@cupel-sh/cli 0.9.0 → 0.11.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +22 -16
- package/bundle/cli.js +2576 -75
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -10,17 +10,20 @@ npx @cupel-sh/cli scan .
|
|
|
10
10
|
|
|
11
11
|
## Verdicts
|
|
12
12
|
|
|
13
|
-
cupel answers with one of
|
|
13
|
+
cupel answers with one of three verdicts: **reachable**, **potentially
|
|
14
|
+
reachable** and **not reachable**. Each is reported in its own tiers:
|
|
14
15
|
|
|
15
|
-
| Verdict
|
|
16
|
-
| ------------------------------------- |
|
|
17
|
-
| `
|
|
18
|
-
| `not-
|
|
19
|
-
|
|
|
20
|
-
| `
|
|
16
|
+
| Verdict | Tier | Meaning |
|
|
17
|
+
| --------------------- | ------------------------------------- | ---------------------------------------------------------------------------------------------------- |
|
|
18
|
+
| reachable | `reachable-low` / `-medium` / `-high` | a call path exists; confidence rises with the evidence |
|
|
19
|
+
| potentially reachable | `potentially-reachable-not-ruled-out` | a path could not be ruled out: a dynamic call, a dynamic load, or a dependency cupel cannot see into |
|
|
20
|
+
| potentially reachable | `potentially-reachable-not-analysed` | cupel did not analyse this finding, and says why |
|
|
21
|
+
| not reachable | `not-reachable` | no call path from your code reaches the vulnerable symbol |
|
|
22
|
+
| not reachable | `not-affected` | the advisory does not apply to this version |
|
|
21
23
|
|
|
22
|
-
|
|
23
|
-
better. Every
|
|
24
|
+
Potentially reachable is never folded into the other verdicts to make a number
|
|
25
|
+
look better. Every potentially reachable finding carries a named reason and an
|
|
26
|
+
owner.
|
|
24
27
|
|
|
25
28
|
**An empty result is not a clean bill of health.** It is the set of advisories
|
|
26
29
|
cupel could enumerate for the packages it could see.
|
|
@@ -29,15 +32,18 @@ cupel could enumerate for the packages it could see.
|
|
|
29
32
|
|
|
30
33
|
```
|
|
31
34
|
cupel scan <dir> [--shard <npm.sqlite>] [--sarif <file>]
|
|
32
|
-
[--fail-on-reachable] [--fail-on-
|
|
35
|
+
[--fail-on-reachable] [--fail-on-potentially-reachable]
|
|
33
36
|
```
|
|
34
37
|
|
|
35
|
-
| Flag
|
|
36
|
-
|
|
|
37
|
-
| `--shard`
|
|
38
|
-
| `--sarif`
|
|
39
|
-
| `--fail-on-reachable`
|
|
40
|
-
| `--fail-on-
|
|
38
|
+
| Flag | Effect |
|
|
39
|
+
| --------------------------------- | -------------------------------------------------------- |
|
|
40
|
+
| `--shard` | path to the npm symbol shard (or set `CUPEL_SHARD_NPM`) |
|
|
41
|
+
| `--sarif` | also write a SARIF 2.1.0 report |
|
|
42
|
+
| `--fail-on-reachable` | exit 2 when any reachable finding is present |
|
|
43
|
+
| `--fail-on-potentially-reachable` | exit 2 when any potentially reachable finding is present |
|
|
44
|
+
|
|
45
|
+
`--fail-on-unknown`, the old name of `--fail-on-potentially-reachable`, still
|
|
46
|
+
works and prints a warning. It will be removed in the next major version.
|
|
41
47
|
|
|
42
48
|
Requires Node 22 or newer.
|
|
43
49
|
|