Angular is a development platform for building mobile and desktop web applications using…

#!/usr/bin/env python3
# check_cve_2026_27970.py
# Detects whether a project appears vulnerable to CVE-2026-27970 based on @angular/core version.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import json
import os
import re
import sys
from typing import Optional, Tuple

PKG = '@angular/core'


def normalize(v: str) -> str:
    v = v.strip()
    v = re.sub(r'^[\^~<>= ]+', '', v)
    if v.startswith('v'):
        v = v[1:]
    return v.strip()


def parse_version(v: str) -> Optional[Tuple[int, int, int, str]]:
    v = normalize(v)
    m = re.match(r'^(\d+)\.(\d+)\.(\d+)(?:[-+]([A-Za-z0-9.-]+))?$', v)
    if not m:
        return None
    major = int(m.group(1))
    minor = int(m.group(2))
    patch = int(m.group(3))
    suffix = m.group(4) or ''
    return (major, minor, patch, suffix)


def cmp_ver(a: Tuple[int, int, int, str], b: Tuple[int, int, int, str]) -> int:
    for i in range(3):
        if a[i] < b[i]:
            return -1
        if a[i] > b[i]:
            return 1
    # Stable release is newer than prerelease with same numeric version
    if a[3] == b[3]:
        return 0
    if a[3] == '':
        return 1
    if b[3] == '':
        return -1
    return -1 if a[3] < b[3] else (1 if a[3] > b[3] else 0)


def in_range(vs: str) -> Optional[bool]:
    v = parse_version(vs)
    if not v:
        return None

    # Vulnerable ranges from GHSA/OSV:
    # <=18.2.14
    # >=19.0.0-next.0 <19.2.19
    # >=20.0.0-next.0 <20.3.17
    # >=21.0.0-next.0 <21.1.6
    # >=21.2.0-next.0 <21.2.0

    if v[0] <= 18:
        return cmp_ver(v, parse_version('18.2.14')) <= 0

    if v[0] == 19:
        return cmp_ver(v, parse_version('19.0.0-next.0')) >= 0 and cmp_ver(v, parse_version('19.2.19')) < 0

    if v[0] == 20:
        return cmp_ver(v, parse_version('20.0.0-next.0')) >= 0 and cmp_ver(v, parse_version('20.3.17')) < 0

    if v[0] == 21:
        if cmp_ver(v, parse_version('21.0.0-next.0')) >= 0 and cmp_ver(v, parse_version('21.1.6')) < 0:
            return True
        if cmp_ver(v, parse_version('21.2.0-next.0')) >= 0 and cmp_ver(v, parse_version('21.2.0')) < 0:
            return True
        return False

    return False


def read_json(path: str):
    try:
        with open(path, 'r', encoding='utf-8') as f:
            return json.load(f)
    except Exception:
        return None


def find_version_in_package_json(root: str) -> Optional[str]:
    data = read_json(os.path.join(root, 'package.json'))
    if not data:
        return None
    for section in ('dependencies', 'devDependencies', 'peerDependencies', 'optionalDependencies'):
        deps = data.get(section, {})
        if isinstance(deps, dict) and PKG in deps:
            return str(deps[PKG])
    return None


def find_version_in_package_lock(root: str) -> Optional[str]:
    for name in ('package-lock.json', 'npm-shrinkwrap.json'):
        data = read_json(os.path.join(root, name))
        if not data:
            continue

        packages = data.get('packages')
        if isinstance(packages, dict):
            nm_key = 'node_modules/@angular/core'
            if nm_key in packages and isinstance(packages[nm_key], dict):
                ver = packages[nm_key].get('version')
                if ver:
                    return str(ver)

        deps = data.get('dependencies')
        if isinstance(deps, dict) and PKG in deps and isinstance(deps[PKG], dict):
            ver = deps[PKG].get('version')
            if ver:
                return str(ver)
    return None


def find_version_in_node_modules(root: str) -> Optional[str]:
    pkg_json = os.path.join(root, 'node_modules', '@angular', 'core', 'package.json')
    data = read_json(pkg_json)
    if data and data.get('version'):
        return str(data['version'])
    return None


def main():
    root = sys.argv[1] if len(sys.argv) > 1 else os.getcwd()
    if not os.path.isdir(root):
        print('UNKNOWN: target path does not exist or is not a directory')
        sys.exit(2)

    version = (
        find_version_in_package_lock(root)
        or find_version_in_node_modules(root)
        or find_version_in_package_json(root)
    )

    if not version:
        print('UNKNOWN: could not determine @angular/core version from lockfile, node_modules, or package.json')
        sys.exit(2)

    verdict = in_range(version)
    if verdict is None:
        print(f'UNKNOWN: found @angular/core version {version!r} but could not parse it')
        sys.exit(2)
    elif verdict:
        print(f'VULNERABLE: detected @angular/core {version}')
        sys.exit(1)
    else:
        print(f'PATCHED: detected @angular/core {version}')
        sys.exit(0)


if __name__ == '__main__':
    main()