@coana-tech/cli 13.17.13 → 13.17.15

package/cli.js

@@ -101411,6 +101411,42 @@ var init_vuln_chain_detail_utils = __esm({
   }
 });
 
+// ../utils/src/vulnerable-paths-utils.ts
+var vulnerable_paths_utils_exports = {};
+__export(vulnerable_paths_utils_exports, {
+  addPathToTrie: () => addPathToTrie,
+  isShortestPath: () => isShortestPath,
+  mkTrie: () => mkTrie
+});
+function mkTrie() {
+  return { children: {}, leaf: false };
+}
+function addPathToTrie(root3, vulnPath) {
+  if (!vulnPath.length) return;
+  let curr = root3;
+  let i5 = vulnPath.length - 1;
+  while (i5 >= 0) {
+    curr = curr.children[vulnPath[i5]] ??= { children: {}, leaf: false };
+    --i5;
+  }
+  curr.leaf = true;
+}
+function isShortestPath(root3, vulnPath) {
+  let curr = root3;
+  let i5 = vulnPath.length - 1;
+  while (i5 >= 0) {
+    if (!curr || curr.leaf) return false;
+    curr = curr.children[vulnPath[i5]];
+    --i5;
+  }
+  return curr !== null;
+}
+var init_vulnerable_paths_utils = __esm({
+  "../utils/src/vulnerable-paths-utils.ts"() {
+    "use strict";
+  }
+});
+
 // dist/internal/constants.js
 var require_constants8 = __commonJS({
   "dist/internal/constants.js"(exports2) {
@@ -185166,7 +185202,7 @@ var require_version = __commonJS({
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.version = void 0;
-    exports2.version = "13.17.13";
+    exports2.version = "13.17.15";
   }
 });
 
@@ -185196,6 +185232,7 @@ var require_cli_core = __commonJS({
     var vuln_chain_detail_utils_1 = (init_vuln_chain_detail_utils(), __toCommonJS(vuln_chain_detail_utils_exports));
     var vulnerability_reachability_1 = (init_vulnerability_reachability(), __toCommonJS(vulnerability_reachability_exports));
     var other_modules_communicator_1 = (init_other_modules_communicator(), __toCommonJS(other_modules_communicator_exports));
+    var vulnerable_paths_utils_1 = (init_vulnerable_paths_utils(), __toCommonJS(vulnerable_paths_utils_exports));
     var constants_1 = require_constants8();
     var dashboard_integration_1 = (init_dashboard_integration(), __toCommonJS(dashboard_integration_exports));
     var vulnerability_scanning_1 = require_vulnerability_scanning();
@@ -185433,7 +185470,50 @@ var require_cli_core = __commonJS({
       async runOnSubproject(otherModulesCommunicator, subProjAndWsPath, reachabilitySupported) {
         const { packageManagerName, subprojectPath, workspacePaths } = subProjAndWsPath;
         this.sendProgress("RUN_ON_SUBPROJECT", true, subprojectPath);
+        const rootWorkingDirectory = this.rootWorkingDirectory;
+        const ecosystem = subProjAndWsPath.ecosystem;
         try {
+          let pruneVulnerablePathsToShortestPathsOnly = function(ecosystem2, workspaceToAugmentedVulnerabilities2) {
+            const vulnerabilityToWorkspaceToCodeAwareScanSuccess = {};
+            for (const [workspacePath, augmentedVulnerabilities] of Object.entries(workspaceToAugmentedVulnerabilities2)) {
+              augmentedVulnerabilities.forEach((augmentedVulnerability) => {
+                const url2 = augmentedVulnerability.url;
+                const results = augmentedVulnerability.results;
+                if (results.type === "success") {
+                  (vulnerabilityToWorkspaceToCodeAwareScanSuccess[url2] ??= {})[workspacePath] = results;
+                }
+              });
+            }
+            const serialize3 = (t3) => `${t3.package}#${t3.class}`.toLowerCase();
+            for (const workspaceToCodeAwareScanSuccess of Object.values(vulnerabilityToWorkspaceToCodeAwareScanSuccess)) {
+              const trie = (0, vulnerable_paths_utils_1.mkTrie)();
+              for (const codeAwareScanSuccess of Object.values(workspaceToCodeAwareScanSuccess)) {
+                codeAwareScanSuccess.detectedOccurrences.forEach((detectedOccurence) => {
+                  detectedOccurence.affectedAppCodePoints.forEach((affectedAppCodePoint) => {
+                    (0, vulnerable_paths_utils_1.addPathToTrie)(trie, affectedAppCodePoint.map(serialize3));
+                  });
+                });
+              }
+              for (const codeAwareScanSuccess of Object.values(workspaceToCodeAwareScanSuccess)) {
+                codeAwareScanSuccess.detectedOccurrences = codeAwareScanSuccess.detectedOccurrences.filter((detectedOccurence) => {
+                  detectedOccurence.affectedAppCodePoints = detectedOccurence.affectedAppCodePoints.filter((affectedAppCodePoint) => {
+                    return (0, vulnerable_paths_utils_1.isShortestPath)(trie, affectedAppCodePoint.map(serialize3));
+                  });
+                  if (ecosystem2 === "MAVEN") {
+                    detectedOccurence.affectedAppCodePoints = detectedOccurence.affectedAppCodePoints.map((path2) => {
+                      if (path2.length < 2)
+                        throw new Error("The path should always have length at least two.");
+                      return {
+                        appClass: path2[0].class,
+                        reference: path2[1]
+                      };
+                    });
+                  }
+                  return detectedOccurence.affectedAppCodePoints.length > 0;
+                });
+              }
+            }
+          };
           this.sendProgress("PREPARE_PROJECT_AND_GET_PROJECT_DATA", true, subprojectPath);
           const projectInfo = await otherModulesCommunicator.prepareProjectAndGetProjectData(packageManagerName, subprojectPath, workspacePaths, this.options.providerProject ? await this.runOnProvider(this.options.providerProject) : void 0);
           this.sendProgress("PREPARE_PROJECT_AND_GET_PROJECT_DATA", false, subprojectPath);
@@ -185454,9 +185534,12 @@ var require_cli_core = __commonJS({
               this.sendProgress("SCAN_FOR_VULNERABILITIES", false, subprojectPath, workspacePath);
             }
           })));
-          return await (0, async_1.asyncMap)(workspacePaths, async (workspacePath) => {
+          const workspaceToDependencyTree = Object.fromEntries(workspacePaths.map((workspacePath) => [
+            workspacePath,
+            projectInfo[workspacePath].dataForAnalysis.dependencyTree
+          ]));
+          const workspaceToAugmentedVulnerabilities = Object.fromEntries(await (0, async_1.asyncMap)(workspacePaths, async (workspacePath) => {
             const dataForAnalysis = projectInfo[workspacePath].dataForAnalysis;
-            const ecosystem = dataForAnalysis.type ?? "NPM";
             const vulnerabilities = workspaceToVulnerabilities[workspacePath];
             const augmentedVulnerabilities = reachabilitySupported ? await this.runReachabilityAnalysis(otherModulesCommunicator, subprojectPath, workspacePath, dataForAnalysis, vulnerabilities) : vulnerabilities.map((v) => ({
               ...v,
@@ -185465,14 +185548,20 @@ var require_cli_core = __commonJS({
                 message: `Reachability analysis for languages using ${ecosystem} not supported yet`
               }
             }));
+            return [workspacePath, augmentedVulnerabilities];
+          }));
+          if (ecosystem === "MAVEN" || ecosystem === "NUGET") {
+            pruneVulnerablePathsToShortestPathsOnly(ecosystem, workspaceToAugmentedVulnerabilities);
+          }
+          return workspacePaths.map((workspacePath) => {
             const codeAwareScanResultsForAllPackages = [];
-            codeAwareScanResultsForAllPackages.push(...transformToReportVulnerabilities(augmentedVulnerabilities, projectInfo[workspacePath].directDependenciesMap ?? {}, subprojectPath, workspacePath, this.rootWorkingDirectory));
+            codeAwareScanResultsForAllPackages.push(...transformToReportVulnerabilities(workspaceToAugmentedVulnerabilities[workspacePath], projectInfo[workspacePath].directDependenciesMap ?? {}, subprojectPath, workspacePath, rootWorkingDirectory));
             return {
-              subprojectPath: (0, path_1.relative)(this.rootWorkingDirectory, subprojectPath) || ".",
+              subprojectPath: (0, path_1.relative)(rootWorkingDirectory, subprojectPath) || ".",
               workspacePath,
               directDependencies: projectInfo[workspacePath].directDependenciesMap ?? {},
               vulnerabilities: codeAwareScanResultsForAllPackages,
-              dependencyTree: dataForAnalysis.dependencyTree
+              dependencyTree: workspaceToDependencyTree[workspacePath]
             };
           });
         } finally {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coana-tech/cli",
-  "version": "13.17.13",
+  "version": "13.17.15",
   "description": "Coana CLI",
   "bin": {
     "@coana-tech/cli": "./cli.js"