@ktpartners/dgs-platform 2.9.0 → 3.3.0

package/deliver-great-systems/bin/lib/fixtures/package-scan/gate-parity-runresult.json

@@ -0,0 +1,235 @@
+{
+  "exit_code": 0,
+  "tool_per_target": {
+    "api": "snyk",
+    "worker": "pip-audit",
+    "_product_root": "npm-audit"
+  },
+  "repo_results": [
+    {
+      "repo": "api",
+      "ecosystem": "node",
+      "tool_used": "snyk",
+      "outcome": "ok",
+      "durationMs": 2400,
+      "findings": [
+        {
+          "id": "pkg-001",
+          "tool": "snyk",
+          "ecosystem": "node",
+          "repo": "api",
+          "manifest_path": "packages/api/package.json",
+          "package_name": "lodash",
+          "installed_version": "4.17.15",
+          "vulnerability": {
+            "cve": "CVE-2021-23337",
+            "title": "Command Injection in lodash",
+            "description": "Versions of lodash prior to 4.17.21 are vulnerable to Command Injection.",
+            "reference_url": "https://snyk.io/vuln/SNYK-JS-LODASH-1040724"
+          },
+          "severity": "high",
+          "cvss_score": 7.2,
+          "cvss_vector": null,
+          "direct_or_transitive": "direct",
+          "dependency_chain": [
+            { "name": "api", "version": "1.0.0" },
+            { "name": "lodash", "version": "4.17.15" }
+          ],
+          "chain_available": true,
+          "fix_version": "4.17.21",
+          "remediation": "upgrade to lodash@4.17.21",
+          "licence": null
+        },
+        {
+          "id": "pkg-002",
+          "tool": "snyk",
+          "ecosystem": "node",
+          "repo": "api",
+          "manifest_path": "packages/api/package.json",
+          "package_name": "gpl-licensed-dep",
+          "installed_version": "2.0.0",
+          "vulnerability": {
+            "cve": null,
+            "title": "Prototype Pollution in gpl-licensed-dep",
+            "description": "Multi-line\ndescription with\nembedded newlines.",
+            "reference_url": "https://example.com/advisory"
+          },
+          "severity": "moderate",
+          "cvss_score": null,
+          "cvss_vector": null,
+          "direct_or_transitive": "transitive",
+          "dependency_chain": null,
+          "chain_available": false,
+          "fix_version": null,
+          "remediation": null,
+          "licence": "GPL-3.0"
+        }
+      ]
+    },
+    {
+      "repo": "worker",
+      "ecosystem": "python",
+      "tool_used": "pip-audit",
+      "outcome": "ok",
+      "durationMs": 1800,
+      "findings": [
+        {
+          "id": "pkg-003",
+          "tool": "pip-audit",
+          "ecosystem": "python",
+          "repo": "worker",
+          "manifest_path": null,
+          "package_name": "requests",
+          "installed_version": "2.25.0",
+          "vulnerability": {
+            "cve": "CVE-2023-32681",
+            "title": "Unintended leak of Proxy-Authorization header",
+            "description": "Requests is a HTTP library.",
+            "reference_url": null
+          },
+          "severity": null,
+          "cvss_score": null,
+          "cvss_vector": null,
+          "direct_or_transitive": null,
+          "dependency_chain": null,
+          "chain_available": false,
+          "fix_version": "2.31.0",
+          "remediation": "pip install requests==2.31.0"
+        }
+      ]
+    },
+    {
+      "repo": "_product_root",
+      "ecosystem": "node",
+      "tool_used": "npm-audit",
+      "outcome": "ok",
+      "durationMs": 900,
+      "findings": [
+        {
+          "id": "pkg-004",
+          "tool": "npm-audit",
+          "ecosystem": "node",
+          "repo": "_product_root",
+          "manifest_path": null,
+          "package_name": "express",
+          "installed_version": "",
+          "vulnerability": {
+            "cve": null,
+            "title": "express Critical vulnerability",
+            "description": null,
+            "reference_url": "https://github.com/advisories/GHSA-xxxx"
+          },
+          "severity": "critical",
+          "cvss_score": 9.8,
+          "cvss_vector": null,
+          "direct_or_transitive": "direct",
+          "dependency_chain": null,
+          "chain_available": false,
+          "fix_version": null,
+          "remediation": null
+        }
+      ]
+    }
+  ],
+  "findings": [
+    {
+      "id": "pkg-001",
+      "tool": "snyk",
+      "ecosystem": "node",
+      "repo": "api",
+      "manifest_path": "packages/api/package.json",
+      "package_name": "lodash",
+      "installed_version": "4.17.15",
+      "vulnerability": {
+        "cve": "CVE-2021-23337",
+        "title": "Command Injection in lodash",
+        "description": "Versions of lodash prior to 4.17.21 are vulnerable to Command Injection.",
+        "reference_url": "https://snyk.io/vuln/SNYK-JS-LODASH-1040724"
+      },
+      "severity": "high",
+      "cvss_score": 7.2,
+      "cvss_vector": null,
+      "direct_or_transitive": "direct",
+      "dependency_chain": [
+        { "name": "api", "version": "1.0.0" },
+        { "name": "lodash", "version": "4.17.15" }
+      ],
+      "chain_available": true,
+      "fix_version": "4.17.21",
+      "remediation": "upgrade to lodash@4.17.21",
+      "licence": null
+    },
+    {
+      "id": "pkg-002",
+      "tool": "snyk",
+      "ecosystem": "node",
+      "repo": "api",
+      "manifest_path": "packages/api/package.json",
+      "package_name": "gpl-licensed-dep",
+      "installed_version": "2.0.0",
+      "vulnerability": {
+        "cve": null,
+        "title": "Prototype Pollution in gpl-licensed-dep",
+        "description": "Multi-line\ndescription with\nembedded newlines.",
+        "reference_url": "https://example.com/advisory"
+      },
+      "severity": "moderate",
+      "cvss_score": null,
+      "cvss_vector": null,
+      "direct_or_transitive": "transitive",
+      "dependency_chain": null,
+      "chain_available": false,
+      "fix_version": null,
+      "remediation": null,
+      "licence": "GPL-3.0"
+    },
+    {
+      "id": "pkg-003",
+      "tool": "pip-audit",
+      "ecosystem": "python",
+      "repo": "worker",
+      "manifest_path": null,
+      "package_name": "requests",
+      "installed_version": "2.25.0",
+      "vulnerability": {
+        "cve": "CVE-2023-32681",
+        "title": "Unintended leak of Proxy-Authorization header",
+        "description": "Requests is a HTTP library.",
+        "reference_url": null
+      },
+      "severity": null,
+      "cvss_score": null,
+      "cvss_vector": null,
+      "direct_or_transitive": null,
+      "dependency_chain": null,
+      "chain_available": false,
+      "fix_version": "2.31.0",
+      "remediation": "pip install requests==2.31.0"
+    },
+    {
+      "id": "pkg-004",
+      "tool": "npm-audit",
+      "ecosystem": "node",
+      "repo": "_product_root",
+      "manifest_path": null,
+      "package_name": "express",
+      "installed_version": "",
+      "vulnerability": {
+        "cve": null,
+        "title": "express Critical vulnerability",
+        "description": null,
+        "reference_url": "https://github.com/advisories/GHSA-xxxx"
+      },
+      "severity": "critical",
+      "cvss_score": 9.8,
+      "cvss_vector": null,
+      "direct_or_transitive": "direct",
+      "dependency_chain": null,
+      "chain_available": false,
+      "fix_version": null,
+      "remediation": null
+    }
+  ],
+  "skipped": [],
+  "diagnostics": []
+}

package/deliver-great-systems/bin/lib/fixtures/package-scan/govulncheck-import.json

@@ -0,0 +1,3 @@
+{"message":{"type":"osv","osv":{"id":"GO-2023-1878","summary":"Improper input validation in golang.org/x/net","details":"Uncontrolled recursion in golang.org/x/net/html can cause a denial of service.","aliases":["CVE-2023-3978"],"references":[{"type":"WEB","url":"https://pkg.go.dev/vuln/GO-2023-1878"},{"type":"FIX","url":"https://go.dev/cl/514896"}]}}}
+{"message":{"type":"finding","finding":{"osv":"GO-2023-1878","fixed_version":"v0.13.0","trace":[{"module":"example.com/myapp","version":"v0.1.0"},{"module":"golang.org/x/net","version":"v0.12.0","function":"html.Parse"}]}}}
+{"message":{"type":"finding","finding":{"osv":"GO-2023-1878","fixed_version":"v0.13.0","trace":[{"module":"golang.org/x/net","version":"v0.12.0","function":"html.Tokenize"}]}}}

package/deliver-great-systems/bin/lib/fixtures/package-scan/npm-audit-v10.json

@@ -0,0 +1,37 @@
+{
+  "auditReportVersion": 2,
+  "vulnerabilities": {
+    "lodash": {
+      "name": "lodash",
+      "severity": "high",
+      "isDirect": false,
+      "via": [
+        {
+          "source": 1523,
+          "name": "lodash",
+          "dependency": "lodash",
+          "title": "Prototype Pollution in lodash",
+          "url": "https://github.com/advisories/GHSA-p6mc-m468-83gw",
+          "severity": "high",
+          "cwe": ["CWE-1321"],
+          "cvss": {
+            "score": 7.4,
+            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
+          },
+          "range": "<4.17.21"
+        }
+      ],
+      "effects": [],
+      "range": "<4.17.21",
+      "nodes": ["node_modules/lodash"],
+      "fixAvailable": {
+        "name": "lodash",
+        "version": "4.17.21",
+        "isSemVerMajor": false
+      }
+    }
+  },
+  "metadata": {
+    "vulnerabilities": { "info": 0, "low": 0, "moderate": 0, "high": 1, "critical": 0, "total": 1 }
+  }
+}

package/deliver-great-systems/bin/lib/fixtures/package-scan/osv-clean.json

@@ -0,0 +1,3 @@
+{
+  "results": []
+}

package/deliver-great-systems/bin/lib/fixtures/package-scan/osv-vulns.json

@@ -0,0 +1,77 @@
+{
+  "results": [
+    {
+      "source": {
+        "path": "packages/api/package-lock.json",
+        "type": "lockfile"
+      },
+      "packages": [
+        {
+          "package": {
+            "name": "lodash",
+            "version": "4.17.20",
+            "ecosystem": "npm"
+          },
+          "vulnerabilities": [
+            {
+              "id": "GHSA-p6mc-m468-83gw",
+              "summary": "Prototype Pollution in lodash",
+              "details": "Versions of lodash prior to 4.17.21 are vulnerable to prototype pollution.",
+              "aliases": ["CVE-2020-8203"],
+              "severity": [
+                { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }
+              ],
+              "references": [
+                { "type": "WEB", "url": "https://github.com/advisories/GHSA-p6mc-m468-83gw" }
+              ],
+              "affected": [
+                {
+                  "package": { "name": "lodash", "ecosystem": "npm" },
+                  "ranges": [
+                    {
+                      "type": "SEMVER",
+                      "events": [
+                        { "introduced": "0" },
+                        { "fixed": "4.17.21" }
+                      ]
+                    }
+                  ],
+                  "versions": ["4.17.20"]
+                }
+              ]
+            }
+          ]
+        },
+        {
+          "package": {
+            "name": "minimist",
+            "version": "1.2.0",
+            "ecosystem": "npm"
+          },
+          "vulnerabilities": [
+            {
+              "id": "GHSA-vh95-rmgr-6w4m",
+              "summary": "Prototype Pollution in minimist",
+              "details": "minimist before 1.2.3 is vulnerable.",
+              "aliases": ["CVE-2020-7598"],
+              "severity": [
+                { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" }
+              ],
+              "references": [
+                { "type": "WEB", "url": "https://github.com/advisories/GHSA-vh95-rmgr-6w4m" }
+              ],
+              "affected": [
+                {
+                  "package": { "name": "minimist", "ecosystem": "npm" },
+                  "ranges": [
+                    { "type": "SEMVER", "events": [{ "introduced": "0" }, { "fixed": "1.2.3" }] }
+                  ]
+                }
+              ]
+            }
+          ]
+        }
+      ]
+    }
+  ]
+}

package/deliver-great-systems/bin/lib/fixtures/package-scan/pip-audit-requirements.json

@@ -0,0 +1,28 @@
+{
+  "dependencies": [
+    {
+      "name": "requests",
+      "version": "2.20.0",
+      "vulns": [
+        {
+          "id": "GHSA-x84v-xcm2-53pg",
+          "fix_versions": ["2.20.1", "2.21.0"],
+          "description": "Requests before 2.20.0 sends an HTTP Authorization header to an http URI upon redirect.",
+          "aliases": ["CVE-2018-18074"]
+        }
+      ]
+    },
+    {
+      "name": "urllib3",
+      "version": "1.24.1",
+      "vulns": [
+        {
+          "id": "PYSEC-2019-132",
+          "fix_versions": ["1.24.2"],
+          "description": "urllib3 before 1.24.2 does not remove the Authorization header on cross-origin redirects.",
+          "aliases": ["CVE-2019-11324"]
+        }
+      ]
+    }
+  ]
+}

package/deliver-great-systems/bin/lib/fixtures/package-scan/snyk-lodash.json

@@ -0,0 +1,30 @@
+{
+  "ok": false,
+  "targetFile": "package.json",
+  "projectName": "your-app",
+  "displayTargetFile": "package.json",
+  "foundProjectCount": 1,
+  "vulnerabilities": [
+    {
+      "id": "SNYK-JS-LODASH-590103",
+      "title": "Prototype Pollution",
+      "description": "lodash is vulnerable to prototype pollution via zipObjectDeep.",
+      "packageName": "lodash",
+      "version": "4.17.20",
+      "severity": "critical",
+      "cvssScore": 9.8,
+      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+      "identifiers": {
+        "CVE": ["CVE-2020-8203"],
+        "CWE": ["CWE-1321"]
+      },
+      "from": ["your-app@1.0.0", "auth-lib@2.3.1", "lodash@4.17.20"],
+      "upgradePath": [false, "auth-lib@2.3.2", "lodash@4.17.21"],
+      "fixedIn": ["4.17.21"],
+      "isUpgradable": true,
+      "isPatchable": false,
+      "url": "https://snyk.io/vuln/SNYK-JS-LODASH-590103",
+      "license": "MIT"
+    }
+  ]
+}

package/deliver-great-systems/bin/lib/fixtures/package-scan/snyk-workspaces.json

@@ -0,0 +1,55 @@
+{
+  "ok": false,
+  "projects": [
+    {
+      "targetFile": "packages/api/package.json",
+      "projectName": "api",
+      "vulnerabilities": [
+        {
+          "id": "SNYK-JS-LODASH-590103",
+          "title": "Prototype Pollution",
+          "packageName": "lodash",
+          "version": "4.17.20",
+          "severity": "critical",
+          "cvssScore": 9.8,
+          "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+          "identifiers": { "CVE": ["CVE-2020-8203"] },
+          "from": ["api@1.0.0", "lodash@4.17.20"],
+          "upgradePath": [false, "lodash@4.17.21"],
+          "fixedIn": ["4.17.21"],
+          "isUpgradable": true
+        },
+        {
+          "id": "SNYK-JS-MINIMIST-559764",
+          "title": "Prototype Pollution",
+          "packageName": "minimist",
+          "version": "1.2.0",
+          "severity": "medium",
+          "cvssScore": 5.6,
+          "identifiers": { "CVE": ["CVE-2020-7598"] },
+          "from": ["api@1.0.0", "mkdirp@0.5.1", "minimist@1.2.0"],
+          "fixedIn": ["1.2.3"],
+          "isUpgradable": true
+        }
+      ]
+    },
+    {
+      "targetFile": "packages/web/package.json",
+      "projectName": "web",
+      "vulnerabilities": [
+        {
+          "id": "SNYK-JS-AXIOS-1038255",
+          "title": "Server-Side Request Forgery",
+          "packageName": "axios",
+          "version": "0.21.0",
+          "severity": "high",
+          "cvssScore": 7.5,
+          "identifiers": { "CVE": ["CVE-2020-28168"] },
+          "from": ["web@1.0.0", "axios@0.21.0"],
+          "fixedIn": ["0.21.1"],
+          "isUpgradable": true
+        }
+      ]
+    }
+  ]
+}