Trix is a what-you-see-is-what-you-get rich text editor for everyday writing

#!/usr/bin/env python3
"""
verify_trix_cve_2025_21610.py

Check whether a project uses vulnerable versions of the npm package `trix`
affected by CVE-2025-21610.

Exit codes:
  0 = PATCHED
  1 = VULNERABLE
  2 = UNKNOWN
"""

import json
import os
import re
import sys
from pathlib import Path

FIXED = (2, 1, 12)
PKG = "trix"


def parse_version(v):
    if not v:
        return None
    v = v.strip()
    v = v.lstrip('^~<>=v ')
    m = re.match(r'^(\d+)\.(\d+)\.(\d+)', v)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def is_vulnerable(ver_tuple):
    return ver_tuple is not None and ver_tuple < FIXED


def read_json(path):
    try:
        with open(path, 'r', encoding='utf-8') as f:
            return json.load(f)
    except Exception:
        return None


def check_node_modules(root):
    p = root / 'node_modules' / PKG / 'package.json'
    if not p.exists():
        return None, None
    data = read_json(p)
    if not data:
        return None, None
    ver = parse_version(data.get('version'))
    return str(p), ver


def walk_package_lock_deps(deps, prefix=''):
    found = []
    if not isinstance(deps, dict):
        return found
    for name, meta in deps.items():
        if name == PKG and isinstance(meta, dict):
            ver = parse_version(meta.get('version', ''))
            found.append((prefix + name, ver))
        if isinstance(meta, dict) and 'dependencies' in meta:
            found.extend(walk_package_lock_deps(meta.get('dependencies'), prefix + name + ' > '))
    return found


def check_package_lock(root):
    p = root / 'package-lock.json'
    if not p.exists():
        return []
    data = read_json(p)
    if not data:
        return []
    found = []

    packages = data.get('packages')
    if isinstance(packages, dict):
        for pkg_path, meta in packages.items():
            if pkg_path.endswith(f'node_modules/{PKG}') and isinstance(meta, dict):
                found.append((f'{p}:{pkg_path}', parse_version(meta.get('version', ''))))

    deps = data.get('dependencies')
    found.extend((f'{p}:{path}', ver) for path, ver in walk_package_lock_deps(deps))
    return found


def check_pnpm_lock(root):
    p = root / 'pnpm-lock.yaml'
    if not p.exists():
        return []
    results = []
    try:
        text = p.read_text(encoding='utf-8', errors='ignore')
    except Exception:
        return []

    for m in re.finditer(r'^[ \t]*trix@[^:]*:\s*$(?:\n^[ \t]+.*$)*', text, flags=re.M):
        block = m.group(0)
        vm = re.search(r'^[ \t]*version:\s*([0-9]+\.[0-9]+\.[0-9]+)', block, flags=re.M)
        if vm:
            results.append((f'{p}:trix', parse_version(vm.group(1))))

    if not results:
        for m in re.finditer(r'/trix@([0-9]+\.[0-9]+\.[0-9]+):', text):
            results.append((f'{p}:/trix', parse_version(m.group(1))))

    return results


def check_yarn_lock(root):
    p = root / 'yarn.lock'
    if not p.exists():
        return []
    try:
        text = p.read_text(encoding='utf-8', errors='ignore')
    except Exception:
        return []
    results = []
    blocks = re.split(r'\n(?=(?:"?[^"]+"?:))', text)
    for block in blocks:
        if re.search(r'^(?:"?trix@|trix@)', block):
            vm = re.search(r'\n\s*version\s+"([0-9]+\.[0-9]+\.[0-9]+)"', block)
            if vm:
                results.append((f'{p}:trix', parse_version(vm.group(1))))
    return results


def check_package_json_ranges(root):
    p = root / 'package.json'
    if not p.exists():
        return []
    data = read_json(p)
    if not data:
        return []
    results = []
    for section in ('dependencies', 'devDependencies', 'optionalDependencies', 'peerDependencies'):
        deps = data.get(section, {})
        if isinstance(deps, dict) and PKG in deps:
            results.append((f'{p}:{section}', deps[PKG]))
    return results


def main():
    root = Path(sys.argv[1]).resolve() if len(sys.argv) > 1 else Path.cwd().resolve()
    if not root.exists() or not root.is_dir():
        print('UNKNOWN - target path does not exist or is not a directory')
        sys.exit(2)

    findings = []

    nm_path, nm_ver = check_node_modules(root)
    if nm_path and nm_ver:
        findings.append((nm_path, nm_ver))

    findings.extend(check_package_lock(root))
    findings.extend(check_pnpm_lock(root))
    findings.extend(check_yarn_lock(root))

    dedup = []
    seen = set()
    for loc, ver in findings:
        key = (loc, ver)
        if key not in seen and ver is not None:
            seen.add(key)
            dedup.append((loc, ver))

    vulnerable = [(loc, ver) for loc, ver in dedup if is_vulnerable(ver)]
    patched = [(loc, ver) for loc, ver in dedup if not is_vulnerable(ver)]

    if vulnerable:
        versions = ', '.join(sorted({'.'.join(map(str, v)) for _, v in vulnerable}))
        locations = '; '.join(loc for loc, _ in vulnerable[:5])
        print(f'VULNERABLE - found {PKG} version(s) {versions} at {locations}')
        sys.exit(1)

    if patched:
        versions = ', '.join(sorted({'.'.join(map(str, v)) for _, v in patched}))
        print(f'PATCHED - found {PKG} version(s) {versions}; fixed threshold is 2.1.12')
        sys.exit(0)

    declared = check_package_json_ranges(root)
    if declared:
        refs = '; '.join(f'{loc}={spec}' for loc, spec in declared)
        print(f'UNKNOWN - {PKG} declared in manifest but no installed/locked version resolved: {refs}')
        sys.exit(2)

    print(f'UNKNOWN - no evidence of {PKG} found in node_modules, lockfiles, or package.json under {root}')
    sys.exit(2)


if __name__ == '__main__':
    main()