@knime/utils 1.12.1 → 2.0.0

package/audit/bulkAudit.js

@@ -1,671 +0,0 @@
-/* eslint-disable no-console, n/no-process-env */
-/**
- * Audits packages from a pnpm-lock.yaml file using the npm bulk advisory API.
- *
- * The legacy npm audit endpoints (/-/npm/v1/security/audits) have been retired
- * (HTTP 410). This module calls the replacement bulk advisory endpoint
- * (/-/npm/v1/security/advisories/bulk) directly.
- *
- * See: https://api-docs.npmjs.com/#tag/Audit
- * See: https://github.com/pnpm/pnpm/issues/11265
- */
-
-import { execSync } from "node:child_process";
-import { existsSync, readFileSync } from "node:fs";
-import { resolve } from "node:path";
-
-const SEVERITY_ORDER = ["low", "moderate", "high", "critical"];
-
-/**
- * Resolve a GitHub API token from GITHUB_TOKEN env var or `gh auth token`.
- * Returns null (with a warning) if neither is available.
- */
-function getGitHubToken() {
-  if (process.env.GITHUB_TOKEN) {
-    return process.env.GITHUB_TOKEN;
-  }
-  try {
-    return execSync("gh auth token", { encoding: "utf-8" }).trim();
-  } catch {
-    // gh CLI not installed or not authenticated
-  }
-  console.warn(
-    "Warning: No GitHub token found (GITHUB_TOKEN env or `gh auth token`).\n" +
-      "GHSA→CVE resolution will use unauthenticated requests (60 req/hour limit).\n",
-  );
-  return null;
-}
-
-/**
- * Extract the GHSA ID from an advisory URL like
- * `https://github.com/advisories/GHSA-r5fr-rjxr-66jc`.
- */
-function extractGhsaId(url) {
-  const match = url.match(/(GHSA-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4})/i);
-  return match ? match[1] : null;
-}
-
-/**
- * Minimally parse a YAML value that is a string array. Handles lines like:
- *   - CVE-2026-4800
- *   - CVE-2026-2950 # comment
- */
-function parseYamlStringArray(lines, startIdx, indent) {
-  const result = [];
-  for (let i = startIdx; i < lines.length; i++) {
-    const line = lines[i];
-    // Skip blank lines and comment-only lines at the expected indentation
-    if (/^\s*$/.test(line) || new RegExp(`^ {${indent}}#`).test(line)) {
-      continue;
-    }
-    // Check if this line is an array item at the expected indentation
-    const itemMatch = line.match(new RegExp(`^ {${indent}}-\\s+(.+)`));
-    if (!itemMatch) {
-      break;
-    }
-    // Strip inline comments
-    const value = itemMatch[1].replace(/#.*$/, "").trim();
-    if (value) {
-      result.push(value);
-    }
-  }
-  return result;
-}
-
-/**
- * Read auditConfig from pnpm-workspace.yaml (top-level `auditConfig` key).
- */
-function readAuditConfigFromWorkspace(workspaceDir) {
-  const config = {};
-  const wsPath = resolve(workspaceDir, "pnpm-workspace.yaml");
-  if (!existsSync(wsPath)) {
-    return config;
-  }
-
-  const content = readFileSync(wsPath, "utf-8");
-  const lines = content.split("\n");
-
-  let inAuditConfig = false;
-  for (let i = 0; i < lines.length; i++) {
-    const line = lines[i];
-
-    if (/^auditConfig:\s*$/.test(line)) {
-      inAuditConfig = true;
-      continue;
-    }
-    // New top-level key ends auditConfig
-    if (inAuditConfig && /^\S/.test(line)) {
-      break;
-    }
-    if (!inAuditConfig) {
-      continue;
-    }
-
-    if (/^ {2}ignoreCves:\s*$/.test(line)) {
-      // eslint-disable-next-line no-magic-numbers
-      config.ignoreCves = parseYamlStringArray(lines, i + 1, 4);
-    }
-    if (/^ {2}ignoreGhsas:\s*$/.test(line)) {
-      // eslint-disable-next-line no-magic-numbers
-      config.ignoreGhsas = parseYamlStringArray(lines, i + 1, 4);
-    }
-  }
-
-  return config;
-}
-
-/**
- * Read auditConfig from package.json (`pnpm.auditConfig` key).
- */
-function readAuditConfigFromPackageJson(workspaceDir) {
-  const config = {};
-  const pkgPath = resolve(workspaceDir, "package.json");
-  if (!existsSync(pkgPath)) {
-    return config;
-  }
-
-  try {
-    const pkg = JSON.parse(readFileSync(pkgPath, "utf-8"));
-    const auditConfig = pkg?.pnpm?.auditConfig;
-    if (auditConfig) {
-      if (Array.isArray(auditConfig.ignoreCves)) {
-        config.ignoreCves = auditConfig.ignoreCves;
-      }
-      if (Array.isArray(auditConfig.ignoreGhsas)) {
-        config.ignoreGhsas = auditConfig.ignoreGhsas;
-      }
-    }
-  } catch {
-    // ignore parse errors
-  }
-
-  return config;
-}
-
-/**
- * Merge auditConfig from pnpm-workspace.yaml and package.json.
- * Both sources are combined (union of ignore lists).
- */
-export function readAuditConfig(workspaceDir) {
-  const fromWorkspace = readAuditConfigFromWorkspace(workspaceDir);
-  const fromPkg = readAuditConfigFromPackageJson(workspaceDir);
-
-  return {
-    ignoreCves: [
-      ...(fromWorkspace.ignoreCves ?? []),
-      ...(fromPkg.ignoreCves ?? []),
-    ],
-    ignoreGhsas: [
-      ...(fromWorkspace.ignoreGhsas ?? []),
-      ...(fromPkg.ignoreGhsas ?? []),
-    ],
-  };
-}
-
-/**
- * Resolve GHSA IDs to their associated CVE IDs using the GitHub advisories API.
- * Returns a map from GHSA ID to an array of CVE IDs.
- */
-async function resolveGhsaToCves(ghsaIds) {
-  const map = new Map();
-  if (ghsaIds.length === 0) {
-    return map;
-  }
-
-  const token = getGitHubToken();
-  const headers = { Accept: "application/vnd.github+json" };
-  if (token) {
-    headers.Authorization = `Bearer ${token}`;
-  }
-
-  // Fetch in parallel, but limit concurrency to avoid rate limits
-  const batchSize = 10;
-  for (let i = 0; i < ghsaIds.length; i += batchSize) {
-    const batch = ghsaIds.slice(i, i + batchSize);
-    const results = await Promise.all(
-      batch.map(async (ghsaId) => {
-        try {
-          const resp = await fetch(
-            `https://api.github.com/advisories/${ghsaId}`,
-            { headers },
-          );
-          if (!resp.ok) {
-            console.warn(
-              `Warning: GitHub advisory lookup for ${ghsaId} failed (HTTP ${resp.status}). CVE ignore rules may not apply.`,
-            );
-            return { ghsaId, cves: [] };
-          }
-          const data = await resp.json();
-          const cves = (data.identifiers ?? [])
-            .filter((id) => id.type === "CVE")
-            .map((id) => id.value);
-          return { ghsaId, cves };
-        } catch (err) {
-          console.warn(
-            `Warning: GitHub advisory lookup for ${ghsaId} failed: ${err instanceof Error ? err.message : String(err)}. CVE ignore rules may not apply.`,
-          );
-          return { ghsaId, cves: [] };
-        }
-      }),
-    );
-    for (const { ghsaId, cves } of results) {
-      map.set(ghsaId, cves);
-    }
-  }
-
-  return map;
-}
-
-/**
- * Parse a snapshot key like `lodash-es@4.17.23` or
- * `vite@7.3.1(@types/node@24.10.1)(terser@5.44.1)` and return the
- * base `name@version` (without peer suffixes).
- */
-function snapshotKeyToNameVersion(key) {
-  // Find the version segment: last `@` before any `(`
-  const parenIdx = key.indexOf("(");
-  const base = parenIdx >= 0 ? key.slice(0, parenIdx) : key;
-  return base;
-}
-
-/**
- * Classify every package in the lockfile as "prod" or "dev" by walking the
- * dependency graph starting from each importer's `dependencies`.
- *
- * Returns a Set of `name@version` strings that are reachable from production
- * dependency roots. Any package NOT in this set is dev-only.
- */
-// eslint-disable-next-line complexity
-export function classifyProdPackages(lockfilePath) {
-  const content = readFileSync(lockfilePath, "utf-8");
-  const lines = content.split("\n");
-
-  // --- Phase 1: parse all importers into structured data ---
-  const importers = new Map();
-
-  {
-    let section = "none";
-    let currentImporter = null;
-    let currentDepName = null;
-    let inDeps = false;
-
-    for (const line of lines) {
-      if (/^importers:\s*$/.test(line)) {
-        section = "importers";
-        continue;
-      }
-      if (/^(packages|snapshots|catalogs|settings):\s*$/.test(line)) {
-        if (section === "importers") {
-          break;
-        }
-        continue;
-      }
-      if (section !== "importers") {
-        continue;
-      }
-
-      // Importer key (2-space indent)
-      if (
-        /^ {2}\S/.test(line) &&
-        !line.match(
-          /^ {2}(dependencies|devDependencies|peerDependencies|optionalDependencies):/,
-        )
-      ) {
-        currentImporter = line.replace(/^ {2}/, "").replace(/:.*$/, "");
-        importers.set(currentImporter, { prodVersions: [], prodLinks: [] });
-        inDeps = false;
-        continue;
-      }
-
-      if (!currentImporter) {
-        continue;
-      }
-
-      // Sub-section detection
-      if (/^ {4}dependencies:\s*$/.test(line)) {
-        inDeps = true;
-        currentDepName = null;
-        continue;
-      }
-      if (
-        /^ {4}(devDependencies|peerDependencies|optionalDependencies):\s*$/.test(
-          line,
-        )
-      ) {
-        inDeps = false;
-        currentDepName = null;
-        continue;
-      }
-
-      if (inDeps) {
-        const versionMatch = line.match(/^ {8}version:\s+'?(.+?)'?\s*$/);
-        if (versionMatch) {
-          const ver = versionMatch[1];
-          const data = importers.get(currentImporter);
-          if (ver.startsWith("link:")) {
-            // eslint-disable-next-line no-magic-numbers
-            data.prodLinks.push(ver.slice(5)); // strip "link:" prefix
-          } else if (currentDepName) {
-            data.prodVersions.push(`${currentDepName}@${ver}`);
-          }
-        }
-        // Package name key: `      package-name:`
-        const nameMatch = line.match(/^ {6}'?([^':]+)'?:\s*$/);
-        if (nameMatch) {
-          currentDepName = nameMatch[1];
-        }
-      }
-    }
-  }
-
-  // Resolve workspace links to importer IDs.
-  function resolveLink(fromImporter, linkTarget) {
-    if (fromImporter === ".") {
-      return linkTarget.replace(/^\.\//, "");
-    }
-    const parts = fromImporter.split("/");
-    for (const seg of linkTarget.split("/")) {
-      if (seg === "..") {
-        parts.pop();
-      } else if (seg !== ".") {
-        parts.push(seg);
-      }
-    }
-    return parts.join("/");
-  }
-
-  // Collect all prod roots
-  const prodRoots = new Set();
-  const visitedImporters = new Set();
-
-  function collectProdFromImporter(importerId) {
-    if (visitedImporters.has(importerId)) {
-      return;
-    }
-    visitedImporters.add(importerId);
-    const data = importers.get(importerId);
-    if (!data) {
-      return;
-    }
-
-    for (const ver of data.prodVersions) {
-      prodRoots.add(ver);
-    }
-    for (const linkTarget of data.prodLinks) {
-      const linkedImporter = resolveLink(importerId, linkTarget);
-      collectProdFromImporter(linkedImporter);
-    }
-  }
-
-  for (const importerId of importers.keys()) {
-    collectProdFromImporter(importerId);
-  }
-
-  // --- Phase 2: parse snapshots to build adjacency map ---
-  const snapshotDeps = new Map();
-  let inSnapshots = false;
-  let currentSnapshot = null;
-  let inSnapshotDeps = false;
-
-  for (const line of lines) {
-    if (/^snapshots:\s*$/.test(line)) {
-      inSnapshots = true;
-      continue;
-    }
-    if (inSnapshots && /^\S/.test(line) && !line.startsWith("snapshots:")) {
-      break;
-    }
-    if (!inSnapshots) {
-      continue;
-    }
-
-    const snapMatch = line.match(/^ {2}'?([^'\s].*?)'?:\s*(\{\})?$/);
-    if (snapMatch && !line.startsWith("    ")) {
-      currentSnapshot = snapMatch[1];
-      if (!snapshotDeps.has(currentSnapshot)) {
-        snapshotDeps.set(currentSnapshot, []);
-      }
-      inSnapshotDeps = false;
-      if (snapMatch[2]) {
-        currentSnapshot = null;
-      }
-      continue;
-    }
-
-    if (!currentSnapshot) {
-      continue;
-    }
-
-    if (/^ {4}(dependencies|optionalDependencies):\s*$/.test(line)) {
-      inSnapshotDeps = true;
-      continue;
-    }
-    if (
-      /^ {4}\S/.test(line) &&
-      !line.match(/^ {4}(dependencies|optionalDependencies):/)
-    ) {
-      inSnapshotDeps = false;
-      continue;
-    }
-
-    if (inSnapshotDeps) {
-      const depMatch = line.match(/^ {6}'?([^':]+)'?:\s+'?(.+?)'?\s*$/);
-      if (depMatch) {
-        const depName = depMatch[1];
-        const depVersion = depMatch[2];
-        snapshotDeps.get(currentSnapshot).push(`${depName}@${depVersion}`);
-      }
-    }
-  }
-
-  // --- Phase 3: BFS from prod roots ---
-  const prodPackages = new Set();
-  const visited = new Set();
-  const queue = [...prodRoots];
-
-  while (queue.length > 0) {
-    const key = queue.pop();
-    if (visited.has(key)) {
-      continue;
-    }
-    visited.add(key);
-
-    const baseKey = snapshotKeyToNameVersion(key);
-    prodPackages.add(baseKey);
-
-    const deps = snapshotDeps.get(key);
-    if (deps) {
-      queue.push(...deps);
-    } else {
-      for (const [snapKey, snapDeps] of snapshotDeps) {
-        if (
-          snapshotKeyToNameVersion(snapKey) === baseKey &&
-          !visited.has(snapKey)
-        ) {
-          visited.add(snapKey);
-          queue.push(...snapDeps);
-        }
-      }
-    }
-  }
-
-  return prodPackages;
-}
-
-/**
- * Minimally parse pnpm-lock.yaml to extract the `packages:` keys.
- */
-export function extractPackagesFromLockfile(lockfilePath) {
-  const content = readFileSync(lockfilePath, "utf-8");
-  const lines = content.split("\n");
-
-  const packages = new Map();
-  let inPackagesSection = false;
-
-  for (const line of lines) {
-    if (/^packages:\s*$/.test(line)) {
-      inPackagesSection = true;
-      continue;
-    }
-
-    if (
-      inPackagesSection &&
-      /^\S/.test(line) &&
-      !line.startsWith("packages:")
-    ) {
-      break;
-    }
-
-    if (!inPackagesSection) {
-      continue;
-    }
-
-    const match = line.match(/^ {2}'?([^':\s][^':]*?)@(\d[^':]*)'?:\s*$/);
-    if (!match) {
-      const unquotedMatch = line.match(
-        /^ {2}([^':\s][^':]*?)@(\d[^':]*?):\s*$/,
-      );
-      if (unquotedMatch) {
-        const name = unquotedMatch[1];
-        const version = unquotedMatch[2].replace(/\(.*$/, "");
-        if (name && version) {
-          // eslint-disable-next-line max-depth
-          if (!packages.has(name)) {
-            packages.set(name, new Set());
-          }
-          packages.get(name).add(version);
-        }
-      }
-      continue;
-    }
-
-    const name = match[1];
-    const version = match[2].replace(/\(.*$/, ""); // strip peer suffixes
-    if (name && version) {
-      if (!packages.has(name)) {
-        packages.set(name, new Set());
-      }
-      packages.get(name).add(version);
-    }
-  }
-
-  return packages;
-}
-
-/**
- * Call the npm bulk advisory endpoint and return the report.
- */
-export async function fetchBulkAdvisories(
-  packages,
-  registry = "https://registry.npmjs.org",
-) {
-  const body = {};
-  for (const [name, versions] of packages) {
-    body[name] = [...versions];
-  }
-
-  const url = `${registry.replace(/\/$/, "")}/-/npm/v1/security/advisories/bulk`;
-
-  const response = await fetch(url, {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify(body),
-  });
-
-  if (!response.ok) {
-    throw new Error(
-      `Bulk advisory endpoint responded with ${response.status}: ${await response.text()}`,
-    );
-  }
-
-  return response.json();
-}
-
-/**
- * Run a full audit: parse lockfile, query the API, return structured results.
- * Respects ignore lists from pnpm-workspace.yaml and package.json.
- */
-export async function audit(opts) {
-  const lockfilePath = resolve(opts.lockfilePath);
-  const packages = extractPackagesFromLockfile(lockfilePath);
-  const advisories = await fetchBulkAdvisories(packages, opts.registry);
-
-  // Classify prod vs dev
-  const prodPackages = classifyProdPackages(lockfilePath);
-
-  // Collect ignore sets
-  const ignoredGhsas = new Set(opts.auditConfig?.ignoreGhsas ?? []);
-  const ignoredCves = new Set(opts.auditConfig?.ignoreCves ?? []);
-  const needCveResolution = ignoredCves.size > 0;
-
-  // If we have CVEs to ignore, resolve GHSA→CVE mappings
-  let ghsaToCves = new Map();
-  if (needCveResolution) {
-    const allGhsaIds = new Set();
-    for (const advList of Object.values(advisories)) {
-      for (const a of advList) {
-        const ghsaId = extractGhsaId(a.url);
-        if (ghsaId) {
-          allGhsaIds.add(ghsaId);
-        }
-      }
-    }
-    ghsaToCves = await resolveGhsaToCves([...allGhsaIds]);
-  }
-
-  const minIdx = SEVERITY_ORDER.indexOf(opts.minSeverity ?? "low");
-  const severityCounts = {};
-  let totalVulnerabilities = 0;
-  let prodVulnerabilities = 0;
-  let devVulnerabilities = 0;
-  const filteredAdvisories = {};
-
-  for (const [pkg, advList] of Object.entries(advisories)) {
-    const versions = packages.get(pkg);
-    const isProd = versions
-      ? [...versions].some((v) => prodPackages.has(`${pkg}@${v}`))
-      : false;
-    const depType = isProd ? "prod" : "dev";
-
-    if (opts.prod && !isProd) {
-      continue;
-    }
-
-    const filtered = advList.filter((a) => {
-      const idx = SEVERITY_ORDER.indexOf(a.severity);
-      if (idx < minIdx) {
-        return false;
-      }
-
-      const ghsaId = extractGhsaId(a.url);
-      if (ghsaId && ignoredGhsas.has(ghsaId)) {
-        return false;
-      }
-
-      if (ghsaId && needCveResolution) {
-        const cves = ghsaToCves.get(ghsaId) ?? [];
-        if (cves.some((cve) => ignoredCves.has(cve))) {
-          return false;
-        }
-      }
-
-      return true;
-    });
-    if (filtered.length > 0) {
-      filteredAdvisories[pkg] = filtered.map((a) => ({ ...a, depType }));
-      for (const a of filtered) {
-        severityCounts[a.severity] = (severityCounts[a.severity] ?? 0) + 1;
-        totalVulnerabilities++;
-        if (isProd) {
-          prodVulnerabilities++;
-        } else {
-          devVulnerabilities++;
-        }
-      }
-    }
-  }
-
-  return {
-    advisories: filteredAdvisories,
-    totalVulnerabilities,
-    severityCounts,
-    prodVulnerabilities,
-    devVulnerabilities,
-  };
-}
-
-/**
- * Format an audit result for human-readable console output.
- */
-export function formatAuditReport(result) {
-  if (result.totalVulnerabilities === 0) {
-    return "No vulnerabilities found.";
-  }
-
-  const lines = [];
-  lines.push(
-    `Found ${result.totalVulnerabilities} vulnerabilit${result.totalVulnerabilities === 1 ? "y" : "ies"} (${result.prodVulnerabilities} prod, ${result.devVulnerabilities} dev):\n`,
-  );
-
-  for (const severity of SEVERITY_ORDER) {
-    const count = result.severityCounts[severity];
-    if (count) {
-      lines.push(`  ${severity}: ${count}`);
-    }
-  }
-  lines.push("");
-
-  for (const [pkg, advList] of Object.entries(result.advisories)) {
-    for (const adv of advList) {
-      const tag = adv.depType === "prod" ? "prod" : "dev";
-      // eslint-disable-next-line no-magic-numbers
-      lines.push(`  ${adv.severity.toUpperCase().padEnd(9)} ${pkg} [${tag}]`);
-      lines.push(`    ${adv.title}`);
-      lines.push(`    Vulnerable: ${adv.vulnerable_versions}`);
-      lines.push(`    ${adv.url}`);
-      lines.push("");
-    }
-  }
-
-  return lines.join("\n");
-}