Proxy server in Graph Explorer before 3

#!/usr/bin/env bash
# check_graph_explorer_cve_2026_10584.sh
# Exit codes:
#   0 = PATCHED / not affected
#   1 = VULNERABLE
#   2 = UNKNOWN / unable to determine

set -u

TARGET_TYPE=""
TARGET_VALUE=""
URL=""
VERSION=""
LIVE_NOTE=""

usage() {
  echo "Usage: $0 (--container <name> | --path <dir>) [--url <https://host/explorer>]"
}

log() {
  printf '%s\n' "$*" >&2
}

version_lt() {
  # returns 0 if $1 < $2
  [ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | head -n1)" != "$2" ] && return 1
  [ "$1" = "$2" ] && return 1
  return 0
}

version_ge() {
  [ "$1" = "$2" ] && return 0
  ! version_lt "$1" "$2"
}

extract_version_from_json() {
  local file="$1"
  grep -Eo '"version"[[:space:]]*:[[:space:]]*"[0-9]+\.[0-9]+\.[0-9]+"' "$file" 2>/dev/null | head -n1 | grep -Eo '[0-9]+\.[0-9]+\.[0-9]+'
}

extract_version_from_container() {
  local c="$1"
  local img v p

  img=$(docker inspect --format '{{.Config.Image}}' "$c" 2>/dev/null)
  if [ -n "$img" ]; then
    v=$(printf '%s' "$img" | sed -n 's/.*:\([0-9][0-9.]*\)$/\1/p' | head -n1)
    if printf '%s' "$v" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+$'; then
      printf '%s' "$v"
      return 0
    fi
  fi

  for p in /app/package.json /usr/src/app/package.json /workspace/package.json /graph-explorer/package.json; do
    v=$(docker exec "$c" sh -c "test -f '$p' && cat '$p'" 2>/dev/null | grep -Eo '"version"[[:space:]]*:[[:space:]]*"[0-9]+\.[0-9]+\.[0-9]+"' | head -n1 | grep -Eo '[0-9]+\.[0-9]+\.[0-9]+')
    if [ -n "$v" ]; then
      printf '%s' "$v"
      return 0
    fi
  done

  return 1
}

extract_version_from_path() {
  local d="$1"
  local p v
  for p in "$d/package.json" "$d/app/package.json" "$d/graph-explorer/package.json"; do
    if [ -f "$p" ]; then
      v=$(extract_version_from_json "$p")
      if [ -n "$v" ]; then
        printf '%s' "$v"
        return 0
      fi
    fi
  done
  return 1
}

probe_url() {
  local raw="$1" scheme hostpath host http_code https_code http_url https_url
  scheme=$(printf '%s' "$raw" | sed -n 's#^\(https\?\)://.*#\1#p')
  hostpath=$(printf '%s' "$raw" | sed -n 's#^https\?://##p')
  host=$(printf '%s' "$hostpath" | cut -d/ -f1)

  if [ -z "$host" ]; then
    LIVE_NOTE="live_check=invalid_url"
    return
  fi

  http_url="http://$host/"
  https_url="https://$host/"

  http_code=$(curl -m 5 -ksS -o /dev/null -w '%{http_code}' "$http_url" 2>/dev/null || true)
  https_code=$(curl -m 5 -ksS -o /dev/null -w '%{http_code}' "$https_url" 2>/dev/null || true)

  if [ "$http_code" != "000" ] && [ "$https_code" = "000" ]; then
    LIVE_NOTE="live_check=http_responds_https_fails"
  elif [ "$http_code" != "000" ] && [ "$https_code" != "000" ]; then
    LIVE_NOTE="live_check=http_and_https_respond"
  elif [ "$http_code" = "000" ] && [ "$https_code" != "000" ]; then
    LIVE_NOTE="live_check=https_only"
  else
    LIVE_NOTE="live_check=unreachable"
  fi
}

while [ $# -gt 0 ]; do
  case "$1" in
    --container)
      TARGET_TYPE="container"
      TARGET_VALUE="${2:-}"
      shift 2
      ;;
    --path)
      TARGET_TYPE="path"
      TARGET_VALUE="${2:-}"
      shift 2
      ;;
    --url)
      URL="${2:-}"
      shift 2
      ;;
    -h|--help)
      usage
      exit 2
      ;;
    *)
      log "Unknown argument: $1"
      usage
      exit 2
      ;;
  esac
done

if [ -z "$TARGET_TYPE" ] || [ -z "$TARGET_VALUE" ]; then
  usage
  exit 2
fi

if [ "$TARGET_TYPE" = "container" ]; then
  if ! command -v docker >/dev/null 2>&1; then
    echo "UNKNOWN: docker not found"
    exit 2
  fi
  VERSION=$(extract_version_from_container "$TARGET_VALUE" || true)
else
  VERSION=$(extract_version_from_path "$TARGET_VALUE" || true)
fi

if [ -n "$URL" ]; then
  probe_url "$URL"
fi

if [ -n "$VERSION" ]; then
  if version_ge "$VERSION" "3.0.1"; then
    echo "PATCHED: Graph Explorer version $VERSION ${LIVE_NOTE:+($LIVE_NOTE)}"
    exit 0
  fi
  if version_ge "$VERSION" "1.1.0" && version_lt "$VERSION" "3.0.1"; then
    echo "VULNERABLE: Graph Explorer version $VERSION is within affected range >=1.1.0,<3.0.1 ${LIVE_NOTE:+($LIVE_NOTE)}"
    exit 1
  fi
  echo "PATCHED: Graph Explorer version $VERSION is outside the affected range ${LIVE_NOTE:+($LIVE_NOTE)}"
  exit 0
fi

if [ "$LIVE_NOTE" = "live_check=http_responds_https_fails" ]; then
  echo "UNKNOWN: could not determine version, but service appears to respond on HTTP while HTTPS fails ($LIVE_NOTE)"
  exit 2
fi

echo "UNKNOWN: unable to determine Graph Explorer version ${LIVE_NOTE:+($LIVE_NOTE)}"
exit 2