([\s\S]*?)<\/div>/g;
+ let m;
+ while ((m = findingRegex.exec(html)) !== null) {
+ findings.push({ title: m[1].trim() });
+ }
+
+ // try to extract a summary JSON blob if present
+ const jsonBlobMatch = html.match(/\{[\s\S]*?\}/);
+ let summary = {};
+ if (jsonBlobMatch) {
+ try { summary = JSON.parse(jsonBlobMatch[0]); } catch (e) { summary = {}; }
+ }
+
+ scanInfo = { status: 'completed', result: { scan_info: summary.scan_info || {}, summary: summary.summary || {}, findings: findings } };
+ }
+ }
+ } catch (e) {
+ // ignore and fall through to 404
+ }
+ }
+ if (!scanInfo) {
+ return res.status(404).json({
+ success: false,
+ error: 'Scan ID not found'
+ });
+ }
+
+ res.json({
+ scan_id: scanId,
+ status: scanInfo.status,
+ progress: scanInfo.progress,
+ message: scanInfo.message
+ });
+});
+
+/**
+ * @swagger
+ * /api/scanner/scan/{scanId}/result:
+ * get:
+ * summary: Get scan result
+ * tags: [Vulnerability Scanner]
+ * parameters:
+ * - in: path
+ * name: scanId
+ * required: true
+ * schema:
+ * type: string
+ * description: Scan ID
+ * responses:
+ * 200:
+ * description: Scan result
+ * content:
+ * application/json:
+ * schema:
+ * $ref: '#/components/schemas/ScanResult'
+ * 202:
+ * description: Scan not completed yet
+ * 404:
+ * description: Scan ID does not exist
+ */
+router.get('/scan/:scanId/result', async (req, res) => {
+ const { scanId } = req.params;
+ const scanInfo = activeScanners.get(scanId);
+
+ if (!scanInfo) {
+ return res.status(404).json({
+ success: false,
+ error: 'Scan ID not found'
+ });
+ }
+
+ if (scanInfo.status !== 'completed') {
+ return res.status(202).json({
+ success: false,
+ error: 'Scan not completed yet',
+ status: scanInfo.status
+ });
+ }
+
+ if (!scanInfo.result) {
+ return res.status(500).json({
+ success: false,
+ error: 'Scan result not available'
+ });
+ }
+
+ // Normalize response: ensure scan_id matches requested scanId and return summary before findings
+ const fullResult = scanInfo.result || {};
+ const summary = fullResult.summary || fullResult.scan_info || {};
+ const findings = fullResult.findings || fullResult.issues || [];
+
+ const responsePayload = {
+ scan_id: scanId,
+ summary: {
+ total_findings: summary.total || summary.total_findings || (Array.isArray(findings) ? findings.length : 0),
+ files_scanned: summary.files_scanned || (summary.stats && summary.stats.files_scanned) || (fullResult.scan_info && fullResult.scan_info.stats && fullResult.scan_info.stats.files_scanned) || null,
+ by_severity: summary.by_severity || summary.severity_summary || fullResult.by_severity || null,
+ by_plugin: summary.by_plugin || fullResult.by_plugin || null
+ },
+ findings: findings
+ };
+
+ res.json(responsePayload);
+});
+
+/**
+ * @swagger
+ * /api/scanner/scan/{scanId}/report:
+ * get:
+ * summary: Download scan report
+ * tags: [Vulnerability Scanner]
+ * parameters:
+ * - in: path
+ * name: scanId
+ * required: true
+ * schema:
+ * type: string
+ * description: Scan ID
+ * - in: query
+ * name: format
+ * schema:
+ * type: string
+ * enum: [html, json]
+ * default: html
+ * description: Report format
+ * responses:
+ * 200:
+ * description: Report file
+ * content:
+ * text/html:
+ * schema:
+ * type: string
+ * application/json:
+ * schema:
+ * type: object
+ * 404:
+ * description: Scan ID does not exist
+ */
+router.get('/scan/:scanId/report', async (req, res) => {
+ const { scanId } = req.params;
+ const { format = 'html' } = req.query;
+ console.log('REPORT request:', { scanId, format, query: req.query });
+ const scanInfo = activeScanners.get(scanId);
+
+ if (!scanInfo) {
+ return res.status(404).json({
+ success: false,
+ error: 'Scan ID not found'
+ });
+ }
+
+ if (scanInfo.status !== 'completed') {
+ return res.status(202).json({
+ success: false,
+ error: 'Scan not completed yet'
+ });
+ }
+
+ if (format === 'html' && scanInfo.result) {
+ // Persist and return HTML report. Prefer the scanner's reports dir for storage.
+ try {
+ const scannerReportsDir = path.join(__dirname, '../Vulnerability_Tool_V2', 'reports');
+ await fs.mkdir(scannerReportsDir, { recursive: true });
+ const htmlPath = path.join(scannerReportsDir, `Vulnerability_Scan_Report_${scanId}.html`);
+
+ // First try to use Python renderer if present
+ const pythonRenderer = path.join(__dirname, '../Vulnerability_Tool_V2/tools/render_from_json.py');
+ const scannerPath = path.join(__dirname, '../Vulnerability_Tool_V2');
+
+ if (await fs.access(pythonRenderer).then(() => true).catch(() => false)) {
+ // write JSON temp file (in scanner reports dir)
+ const tmpJson = path.join(scannerReportsDir, `tmp_${scanId}.json`);
+ await fs.writeFile(tmpJson, JSON.stringify(scanInfo.result, null, 2));
+
+ // Try venv python first, then system python3, then python
+ const pythonCandidates = [
+ path.join(scannerPath, 'venv', 'bin', 'python'),
+ 'python3',
+ 'python'
+ ];
+
+ let spawnRes = null;
+ let usedPython = null;
+ for (const py of pythonCandidates) {
+ try {
+ spawnRes = spawnSync(py, [pythonRenderer, tmpJson, htmlPath], { cwd: scannerPath, encoding: 'utf8' });
+ } catch (e) {
+ spawnRes = { error: e };
+ }
+ if (spawnRes && !spawnRes.error && spawnRes.status === 0) {
+ usedPython = py;
+ break;
+ }
+ }
+
+ // remove tmp
+ try { await fs.unlink(tmpJson); } catch (e) {}
+
+ // If python helper failed or file still missing, fallback to JS renderer
+ const finalHtmlExists = await fs.access(htmlPath).then(() => true).catch(() => false);
+ if (!finalHtmlExists || !usedPython) {
+ const html = generateHTMLReport(scanInfo.result);
+ await fs.writeFile(htmlPath, html);
+ }
+ } else {
+ // No python helper available; use JS renderer
+ const html = generateHTMLReport(scanInfo.result);
+ await fs.writeFile(htmlPath, html);
+ }
+
+ // Prefer scanner reports dir, but as a fallback check project reports dir for any legacy files
+ const projectReportsDir = path.join(__dirname, '../reports');
+
+ // Try to find the actual HTML file which may include an optional tag suffix
+ let finalPath = await findFileWithPrefix(scannerReportsDir, `Vulnerability_Scan_Report_${scanId}`, '.html');
+ if (!finalPath) finalPath = await findFileWithPrefix(projectReportsDir, `Vulnerability_Scan_Report_${scanId}`, '.html');
+ if (!finalPath) finalPath = htmlPath; // fallback to whatever we wrote earlier
+
+ // record chosen path and stream it
+ scanInfo.reportPath = finalPath;
+ const htmlContent = await fs.readFile(finalPath, 'utf-8');
+ res.setHeader('Content-Type', 'text/html');
+ res.setHeader('Content-Disposition', `attachment; filename="${path.basename(finalPath)}"`);
+ res.send(htmlContent);
+ return;
+ } catch (err) {
+ res.status(500).json({ success: false, error: 'Failed to generate HTML report', details: err.message });
+ return;
+ }
+ } else if (format === 'json') {
+ // attempt to find persisted json with optional tag; prefer scanner reports dir
+ const scannerReportsDir = path.join(__dirname, '../Vulnerability_Tool_V2/reports');
+ const projectReportsDir = path.join(__dirname, '../reports');
+ let jsonPath = await findFileWithPrefix(scannerReportsDir, `Vulnerability_Scan_Result_${scanId}`, '.json');
+ if (!jsonPath) jsonPath = await findFileWithPrefix(projectReportsDir, `Vulnerability_Scan_Result_${scanId}`, '.json');
+ if (jsonPath) res.setHeader('Content-Disposition', `attachment; filename="${path.basename(jsonPath)}"`);
+ else res.setHeader('Content-Disposition', `attachment; filename=\"Vulnerability_Scan_Result_${scanId}.json\"`);
+ res.json(scanInfo.result);
+ } else {
+ res.status(400).json({
+ success: false,
+ error: 'Invalid format or report not available'
+ });
+ }
+});
+
+// Debug endpoint: return raw python stdout and JSON candidates for a scan (useful for diagnosing parsing issues)
+router.get('/scan/:scanId/raw', (req, res) => {
+ const { scanId } = req.params;
+ const scanInfo = activeScanners.get(scanId);
+ if (!scanInfo) {
+ return res.status(404).json({ success: false, error: 'Scan ID not found' });
+ }
+
+ const raw = scanInfo.rawOutput || '';
+ const candidates = collectJSONCandidates(raw);
+ res.json({ scan_id: scanId, status: scanInfo.status, progress: scanInfo.progress, raw_preview: raw.slice(0, 4000), candidate_count: candidates.length, candidates: candidates.slice(-3) });
+});
+
+/**
+ * @swagger
+ * /api/scanner/quick-scan:
+ * post:
+ * summary: Quick synchronous scan
+ * tags: [Vulnerability Scanner]
+ * security:
+ * - BearerAuth: []
+ * requestBody:
+ * required: true
+ * content:
+ * application/json:
+ * schema:
+ * $ref: '#/components/schemas/ScanRequest'
+ * responses:
+ * 200:
+ * description: Scan result
+ * content:
+ * application/json:
+ * schema:
+ * $ref: '#/components/schemas/ScanResult'
+ */
+router.post('/quick-scan', async (req, res) => {
+ try {
+ const { target_path, plugins, output_format = 'json' } = req.body;
+
+ if (!target_path) {
+ return res.status(400).json({
+ success: false,
+ error: 'target_path is required'
+ });
+ }
+ // Validate target path exists (same as the async /scan endpoint)
+ const targetExists = await fs.access(target_path).then(() => true).catch(() => false);
+ if (!targetExists) {
+ return res.status(400).json({
+ success: false,
+ error: `Target path does not exist: ${target_path}`
+ });
+ }
+
+ const scanId = generateScanId();
+ const scanTag = 'quick-scan';
+ const scanIdWithTag = formatScanIdWithTag(scanId, scanTag);
+ const result = await runPythonScanSync(target_path, plugins, output_format);
+
+ // persist into activeScanners so subsequent report/status endpoints can find it
+ const scanInfo = {
+ status: 'completed',
+ progress: 100,
+ message: 'Quick scan completed',
+ result: result,
+ tag: scanTag,
+ scan_time: new Date().toISOString()
+ };
+
+ // write report files into the scanner's own reports dir for later retrieval
+ try {
+ const scannerReportsDir = path.join(__dirname, '../Vulnerability_Tool_V2', 'reports');
+ await fs.mkdir(scannerReportsDir, { recursive: true });
+ const jsonPath = path.join(scannerReportsDir, `Vulnerability_Scan_Result_${scanIdWithTag}.json`);
+ await fs.writeFile(jsonPath, JSON.stringify(result, null, 2));
+
+ // also generate HTML report if requested or default format
+ if (output_format === 'html' || output_format === 'json') {
+ // Prefer the scanner's Python renderer for consistent/identical HTML output
+ const pythonRenderer = path.join(__dirname, '../Vulnerability_Tool_V2/tools/render_from_json.py');
+ const htmlPath = path.join(scannerReportsDir, `Vulnerability_Scan_Report_${scanIdWithTag}.html`);
+ const tmpJson = path.join(scannerReportsDir, `tmp_${scanIdWithTag}.json`);
+ await fs.writeFile(tmpJson, JSON.stringify(result, null, 2));
+ let wroteHtml = false;
+ if (await fs.access(pythonRenderer).then(() => true).catch(() => false)) {
+ // try to run python helper (best-effort without blocking server startup)
+ const { spawnSync } = require('child_process');
+ const scannerPath = path.join(__dirname, '../Vulnerability_Tool_V2');
+ const pythonCandidates = [
+ path.join(scannerPath, 'venv', 'bin', 'python'),
+ 'python3',
+ 'python'
+ ];
+ for (const py of pythonCandidates) {
+ try {
+ const spawnRes = spawnSync(py, [pythonRenderer, tmpJson, htmlPath], { cwd: scannerPath, encoding: 'utf8' });
+ if (!spawnRes.error && spawnRes.status === 0) {
+ wroteHtml = true;
+ break;
+ }
+ } catch (e) {
+ // ignore and try next
+ }
+ }
+ }
+
+ // remove tmp json
+ try { await fs.unlink(tmpJson); } catch (e) {}
+
+ if (!wroteHtml) {
+ // fallback to JS renderer
+ const html = generateHTMLReport(result);
+ await fs.writeFile(htmlPath, html);
+ }
+ scanInfo.reportPath = htmlPath;
+ }
+ } catch (e) {
+ // non-fatal: keep scanInfo in memory but log message
+ scanInfo.message += `; Failed to persist reports: ${e.message}`;
+ }
+
+ activeScanners.set(scanId, scanInfo);
+
+ // Ensure result's own scan_id (if any) doesn't override our generated scanId
+ const responsePayload = Object.assign({}, result || {});
+ responsePayload.scan_id = scanId;
+ responsePayload.target_path = target_path;
+ responsePayload.scan_time = scanInfo.scan_time;
+
+ res.json(responsePayload);
+
+ } catch (error) {
+ res.status(500).json({
+ success: false,
+ error: error.message
+ });
+ }
+});
+
+// Start asynchronous Python scan
+function startPythonScan(scanId, scanTag, targetPath, plugins, outputFormat) {
+ activeScanners.set(scanId, {
+ status: 'running',
+ progress: 0,
+ message: 'Scan initiated',
+ tag: scanTag
+ });
+
+ const scannerPath = path.join(__dirname, '../Vulnerability_Tool_V2');
+ const scriptPath = path.join(scannerPath, 'scanner_v2.py');
+
+ // Resolve a usable python executable: prefer venv, then system python3, then python
+ function resolvePythonExecutableSync(scannerRoot) {
+ const { spawnSync } = require('child_process');
+ const envOverride = process.env.PYTHON_EXECUTABLE && process.env.PYTHON_EXECUTABLE.trim();
+ const candidates = [
+ envOverride,
+ path.join(scannerRoot, 'venv', 'Scripts', 'python.exe'),
+ path.join(scannerRoot, 'venv', 'Scripts', 'python'),
+ path.join(scannerRoot, 'venv', 'bin', 'python'),
+ 'python3',
+ 'python',
+ 'py'
+ ].filter(Boolean);
+ for (const c of candidates) {
+ try {
+ const res = spawnSync(c, ['--version'], { encoding: 'utf8' });
+ if (!res.error && (res.status === 0 || (res.stdout || res.stderr))) {
+ return c;
+ }
+ } catch (e) {
+ // ignore and try next
+ }
+ }
+ return null;
+ }
+
+ const args = ['--target', targetPath, '--format', outputFormat];
+
+ const pythonExec = resolvePythonExecutableSync(scannerPath);
+ if (!pythonExec) {
+ const scanInfo = activeScanners.get(scanId);
+ if (scanInfo) {
+ scanInfo.status = 'failed';
+ scanInfo.progress = 0;
+ scanInfo.message = 'No Python executable found. Expected either Vulnerability_Tool_V2/venv/bin/python or system python3. Please create a venv and install dependencies: `python3 -m venv Vulnerability_Tool_V2/venv && source Vulnerability_Tool_V2/venv/bin/activate && pip install -r Vulnerability_Tool_V2/requirements.txt`';
+ scanInfo.rawOutput = (scanInfo.rawOutput || '') + '\n\nSPAWN_ERROR: No python executable found';
+ }
+ return;
+ }
+
+ let pythonProcess;
+ try {
+ // Enforce UTF-8 so emoji / unicode characters don't break on Windows consoles (keep emoji output intact)
+ const childEnv = Object.assign({}, process.env, {
+ PYTHONUTF8: '1',
+ PYTHONIOENCODING: 'utf-8',
+ SCANNER_PROGRESS: '1' // signal Python side to emit incremental progress lines
+ });
+ pythonProcess = spawn(pythonExec, [scriptPath, ...args], {
+ cwd: scannerPath,
+ env: childEnv
+ });
+ } catch (spawnErr) {
+ const scanInfo = activeScanners.get(scanId);
+ if (scanInfo) {
+ scanInfo.status = 'failed';
+ scanInfo.progress = 0;
+ scanInfo.message = `Failed to start python scanner using '${pythonExec}': ${spawnErr.message || String(spawnErr)}. Tried candidates: venv/bin/python -> python3 -> python`;
+ scanInfo.rawOutput = (scanInfo.rawOutput || '') + '\n\nSPAWN_ERROR:\n' + (spawnErr.stack || String(spawnErr));
+ }
+ return;
+ }
+
+ // handle runtime errors from the child process (e.g., exec failures)
+ pythonProcess.on('error', (err) => {
+ const scanInfo = activeScanners.get(scanId);
+ if (scanInfo) {
+ scanInfo.status = 'failed';
+ scanInfo.progress = 0;
+ scanInfo.message = `Python process error: ${err.message || String(err)}`;
+ scanInfo.rawOutput = (scanInfo.rawOutput || '') + '\n\nPROCESS_ERROR:\n' + (err.stack || String(err));
+ // persist raw output for post-mortem
+ (async () => {
+ try {
+ const reportsDir = path.join(__dirname, '../reports');
+ await fs.mkdir(reportsDir, { recursive: true });
+ const rawPath = path.join(reportsDir, `raw_${scanId}.log`);
+ await fs.writeFile(rawPath, scanInfo.rawOutput || (err.stack || String(err)));
+ scanInfo.rawOutputPath = rawPath;
+ } catch (e) {
+ // nothing else to do
+ }
+ })();
+ }
+ });
+
+ let outputData = '';
+ let errorData = '';
+ let lineBuffer = '';
+ // save raw output for debugging
+
+ pythonProcess.stdout.on('data', (data) => {
+ const chunk = data.toString();
+ outputData += chunk;
+ const scanInfo = activeScanners.get(scanId);
+ lineBuffer += chunk;
+ // Process complete lines for progress markers
+ let lines = lineBuffer.split(/\r?\n/);
+ lineBuffer = lines.pop(); // keep last partial line
+ for (const line of lines) {
+ // Progress sentinel format: PROGRESS|
|
+ const m = line.match(/^PROGRESS\|(\d{1,3})(?:\|(.*))?$/);
+ if (m && scanInfo && scanInfo.status === 'running') {
+ const pct = Math.max(0, Math.min(100, parseInt(m[1], 10)));
+ scanInfo.progress = pct;
+ if (m[2]) {
+ const msg = m[2].trim();
+ // 只在仍处于 running 阶段时更新 message，完成后的成功文案保持原样
+ if (msg) scanInfo.message = msg;
+ }
+ }
+ }
+ });
+
+ pythonProcess.stderr.on('data', (data) => {
+ errorData += data.toString();
+ });
+
+ pythonProcess.on('close', (code) => {
+ console.log('Full Python output:', outputData);
+
+ const scanInfo = activeScanners.get(scanId);
+ if (scanInfo) scanInfo.rawOutput = outputData;
+ if (!scanInfo) return;
+
+ if (code === 0) {
+ try {
+ const result = parseBestJSON(outputData);
+ scanInfo.status = 'completed';
+ scanInfo.progress = 100;
+ scanInfo.message = 'Scan completed successfully';
+ scanInfo.result = result;
+
+ // If there is HTML output, save it as well
+ if (outputFormat === 'html') {
+ scanInfo.htmlReport = generateHTMLReport(result);
+ // persist into project reports dir for easy discovery (async IIFE)
+ (async () => {
+ try {
+ const reportsDir = path.join(__dirname, '../reports');
+ await fs.mkdir(reportsDir, { recursive: true });
+ const idWithTag = formatScanIdWithTag(scanId, scanTag);
+ const htmlPath = path.join(reportsDir, `Vulnerability_Scan_Report_${idWithTag}.html`);
+ await fs.writeFile(htmlPath, scanInfo.htmlReport);
+ scanInfo.reportPath = htmlPath;
+ } catch (e) {
+ // if writing to project reports fails, leave as-is and record message
+ scanInfo.message = (scanInfo.message || '') + `; Failed to persist html report: ${e.message}`;
+ }
+ })();
+ }
+ } catch (error) {
+ // Persist raw output to disk for post-mortem analysis
+ (async () => {
+ try {
+ const reportsDir = path.join(__dirname, '../reports');
+ await fs.mkdir(reportsDir, { recursive: true });
+ const rawPath = path.join(reportsDir, `raw_${scanId}.log`);
+ await fs.writeFile(rawPath, outputData);
+ scanInfo.rawOutputPath = rawPath;
+ scanInfo.status = 'failed';
+ scanInfo.message = `Failed to parse scan result: ${error.message}. Raw output saved to: ${rawPath}`;
+ } catch (fsErr) {
+ scanInfo.status = 'failed';
+ scanInfo.message = `Failed to parse scan result: ${error.message}. Also failed to write raw output: ${fsErr.message}`;
+ }
+ })();
+ }
+ } else {
+ // Try to salvage a result if the python process printed JSON despite non-zero exit
+ try {
+ const maybeResult = parseBestJSON(outputData);
+ scanInfo.status = 'completed';
+ scanInfo.progress = 100;
+ // Keep user-facing message consistent with successful scans
+ const detailMsg = `Non-zero exit code ${code} but output parsed successfully`;
+ scanInfo.message = 'Scan completed successfully';
+ // Preserve diagnostic detail separately (not exposed unless you add to response)
+ scanInfo.diagnostic = detailMsg;
+ scanInfo.result = maybeResult;
+ } catch (parseErr) {
+ // Save raw output for non-zero exit as well
+ (async () => {
+ try {
+ const reportsDir = path.join(__dirname, '../reports');
+ await fs.mkdir(reportsDir, { recursive: true });
+ const rawPath = path.join(reportsDir, `raw_${scanId}.log`);
+ await fs.writeFile(rawPath, outputData + '\n\nSTDERR:\n' + errorData);
+ scanInfo.rawOutputPath = rawPath;
+ scanInfo.status = 'failed';
+ scanInfo.message = `Scan failed with code ${code}. Raw output saved to: ${rawPath}`;
+ } catch (fsErr) {
+ scanInfo.status = 'failed';
+ scanInfo.message = `Scan failed with code ${code}: ${errorData}. Also failed to write raw output: ${fsErr.message}`;
+ }
+ })();
+ }
+ }
+ });
+}
+
+// Run Python scan synchronously
+function runPythonScanSync(targetPath, plugins, outputFormat) {
+ return new Promise((resolve, reject) => {
+ const scannerPath = path.join(__dirname, '../Vulnerability_Tool_V2');
+ const scriptPath = path.join(scannerPath, 'scanner_v2.py');
+
+ // Use the requested output format (was hard-coded to 'json')
+ const args = ['--target', targetPath, '--format', outputFormat || 'json'];
+ (async () => {
+ const pythonExec = await resolvePythonExecutable(scannerPath);
+ if (!pythonExec) {
+ return reject(new Error('No usable Python executable found. Please create Vulnerability_Tool_V2/venv or ensure python3 is available and scanner dependencies are installed.'));
+ }
+
+ const childEnv = Object.assign({}, process.env, {
+ PYTHONUTF8: '1',
+ PYTHONIOENCODING: 'utf-8'
+ });
+ const pythonProcess = spawn(pythonExec, [scriptPath, ...args], {
+ cwd: scannerPath,
+ env: childEnv
+ });
+
+ let outputData = '';
+ let errorData = '';
+
+ pythonProcess.stdout.on('data', (data) => {
+ outputData += data.toString();
+ });
+
+ pythonProcess.stderr.on('data', (data) => {
+ errorData += data.toString();
+ });
+
+ pythonProcess.on('close', (code) => {
+ const attemptParse = () => {
+ try { return parseBestJSON(outputData); } catch (e) { return null; }
+ };
+ const resultObj = attemptParse();
+ if (resultObj) {
+ // 任何情况下（包括非零退出）只要成功解析就返回结果
+ resolve(resultObj);
+ return;
+ }
+ // 若第一次解析失败，再尝试剪掉 stderr 附加的尾部（常见编码错误行）
+ let trimmed = outputData.replace(/Unexpected error:[\s\S]*$/i, '').trim();
+ if (!resultObj && trimmed !== outputData) {
+ try {
+ const salvage = parseBestJSON(trimmed);
+ return resolve(salvage);
+ } catch (_) {}
+ }
+ // 仍失败，写 raw 输出
+ (async () => {
+ try {
+ const reportsDir = path.join(__dirname, '../reports');
+ await fs.mkdir(reportsDir, { recursive: true });
+ const rawPath = path.join(reportsDir, `raw_sync_${Date.now()}.log`);
+ await fs.writeFile(rawPath, outputData + '\n\nSTDERR:\n' + errorData);
+ reject(new Error(`Scan failed with code ${code}. Raw output saved to: ${rawPath}`));
+ } catch (fsErr) {
+ reject(new Error(`Scan failed with code ${code}: ${errorData}. Also failed to write raw output: ${fsErr.message}`));
+ }
+ })();
+ });
+ })();
+ });
+}
+
+// Collect JSON candidates from text by tracking balanced braces/brackets
+function collectJSONCandidates(text) {
+ if (!text || typeof text !== 'string') return [];
+
+ const candidates = [];
+ const len = text.length;
+ let inString = false;
+ let escape = false;
+ let depth = 0;
+ let start = -1;
+
+ for (let i = 0; i < len; i++) {
+ const ch = text[i];
+ if (inString) {
+ if (escape) { escape = false; }
+ else if (ch === '\\') { escape = true; }
+ else if (ch === '"') { inString = false; }
+ continue;
+ }
+ if (ch === '"') { inString = true; continue; }
+
+ if ((ch === '{' || ch === '[') && start === -1) {
+ start = i;
+ depth = 1;
+ continue;
+ }
+
+ if (start !== -1) {
+ if (ch === '{' || ch === '[') depth++;
+ else if (ch === '}' || ch === ']') {
+ depth--;
+ if (depth === 0) {
+ candidates.push(text.substring(start, i + 1).trim());
+ start = -1;
+ }
+ }
+ }
+ }
+ return candidates;
+}
+
+// Attempt to parse the best JSON candidate from text, with progressive trimming if needed
+function parseBestJSON(text) {
+ const candidates = collectJSONCandidates(text);
+ if (!candidates || candidates.length === 0) throw new Error('No JSON object or array found in output');
+
+ const maxTrimAttempts = 200; // bounded attempts to trim tail
+ for (let ci = candidates.length - 1; ci >= 0; ci--) {
+ let cand = candidates[ci];
+ // try direct parse
+ try {
+ return JSON.parse(cand);
+ } catch (err) {
+ // if parse failed, try trimming tail progressively (but bounded)
+ for (let t = 0; t < maxTrimAttempts && cand.length > 2; t++) {
+ // remove up to t+1 chars from end
+ const newLen = Math.max(0, cand.length - (t + 1));
+ const substr = cand.substring(0, newLen).trim();
+ try {
+ return JSON.parse(substr);
+ } catch (e2) {
+ // continue trimming
+ }
+ }
+ }
+ }
+
+ throw new Error('Failed to parse any JSON candidate from output');
+}
+
+// Generate HTML report
+function generateHTMLReport(scanResult) {
+ const { summary, findings } = scanResult;
+
+ return `
+
+
+
+ NutriHelp Vulnerability Scan Report
+
+
+
+
+
+
+
+
${summary.files_scanned}
+
Files Scanned
+
+
+
${findings.length}
+
Total Issues
+
+
+
${summary.by_severity.CRITICAL || 0}
+
Critical
+
+
+
${summary.by_severity.HIGH || 0}
+
High
+
+
📋 Detailed Findings
+ ${findings.map(finding => `
+
+
${finding.title} (${finding.severity})
+
File: ${finding.file_path}
+
Description: ${finding.description}
+
Plugin: ${finding.plugin_name}
+