dependabot-npm_and_yarn 0.196.3 → 0.198.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7b7522d7728466cae083fc498a0e5c4a7923c46a56a38546f36834de5470fe84
-  data.tar.gz: a55c8659f731d24c8b93a13853d2d05bdc11eb72466873ab002b56b5d8a8ed99
+  metadata.gz: 8b4af608f94aedfc8112da94b62a4691f1c496af6f47d41cc8445171cbd32e5a
+  data.tar.gz: 0d765146b3970caf42148f34d1d849beb0c71d02045330835dc14a4d4179a16b
 SHA512:
-  metadata.gz: f5c67225a4f85b8887d2318f236b078820c201e5daf654cde802633723005f98b7136f3581a9c1edc09d6f2923839454f4340580fc2e3f9e96d478de1de44de4
-  data.tar.gz: 7dd77797d4c581508b60c49adb083e6fab1f2fecdb74456f1b8d9fc2023172f6349cf3b12d2a70f0ab6af5930d73777fa62764dcbb39d2ccde12583e3e2bfec3
+  metadata.gz: 4a9ef601dfaa9aa8afec0658a373e94f34e274ae1da55f45c4468dc7b2e2fe7664ae3936b233124c8a0fb6405043b968477715d16d952a2082101f3bd7c8e593
+  data.tar.gz: 692756d692992aa35ef3fca4a8055ee6f31444df48d42c036f1c7398514bf7a802f307914e9671905c4c924fab155ece1b631655931df3f9d4112fec86182185

data/helpers/lib/npm/vulnerability-auditor.js

@@ -28,7 +28,7 @@
 
 const Arborist = require('@npmcli/arborist')
 const nock = require('nock')
-const { promisify } = require('util');
+const { inspect, promisify } = require('util');
 const exec = promisify(require('child_process').exec)
 
 async function findVulnerableDependencies(directory, advisories) {
@@ -136,7 +136,8 @@ function convertAdvisoriesToRegistryBulkFormat(advisories) {
 }
 
 /* Traverses all effects originating from the named dependency in the
- * audit report and builds an array of all dependency chains,
+ * audit report and returns an array of dependency chains rooted in the named
+ * dependency,
  *   [
  *    {
  *      fixAvailable: true | false | object,
@@ -153,21 +154,56 @@ function convertAdvisoriesToRegistryBulkFormat(advisories) {
  * applies to the first item in the chain (if that item is fixable, then
  * every item after it must be fixable, too).
  */
-function buildDependencyChains(auditReport, name, chain = { items: [] }) {
-  const vuln = auditReport.get(name)
-  const version = [...vuln.nodes][0].version
-  const item = { name, version }
-
-  if (!vuln.effects.size) {
-    // If the current vuln has no effects, we've reached the end of this chain.
-    return [{ fixAvailable: vuln.fixAvailable, items: [item, ...chain.items] }]
+function buildDependencyChains(auditReport, name) {
+  const helper = (name, chain, visited) => {
+    // The vuln for this dependency.
+    const vuln = auditReport.get(name)
+
+    // The current version of this dependency.
+    const version = [...vuln.nodes][0].version
+
+    // The item that will represent this dependency in this chain.
+    const item = { name, version }
+
+    // Array of effects, excluding cycles.
+    const effects = [...vuln.effects]
+
+    if (visited.has(name)) {
+      // We've already visited this dependency in this chain, so we've detected a cycle.
+      // We currently throw when this happens. Ultimately we want to gracefully handle
+      // cycles and still return the recommended fix updates.
+      const source = chain.items[chain.items.length-1]
+      const message = `Cycle detected while traversing effects from ` +
+        `${source.name}@${source.version}: ` +
+        inspect([name, ...visited], {
+          breakLength: Infinity,
+          depth: 1,
+          maxStringLength: 255,
+        })
+      throw new Error(message)
+    }
+
+    if (!effects.length) {
+      // If the current vuln has no effects, we've reached the end of this chain.
+      return [{ fixAvailable: vuln.fixAvailable, items: [item, ...chain.items] }]
+    }
+
+    return effects.reduce((chains, effect) => {
+      return chains.concat(
+        helper(effect.name, { items: [item, ...chain.items] }, new Set([name, ...visited])))
+    }, [])
   }
 
-  return [...vuln.effects].reduce((chains, effect) => {
-    return chains.concat(
-      buildDependencyChains(
-        auditReport, effect.name, { items: [item, ...chain.items] }))
-  }, [])
+  const chains = helper(name, { items: [] }, new Set())
+  const seen = new Set()
+  return chains.filter(chain => {
+    const head = chain.items[0]
+    if (seen.has(head.name)) {
+      return false
+    }
+    seen.add(head.name)
+    return true
+  })
 }
 
 async function loadNpmConfig() {