@maverick006/scanner-npm-audit 1.0.2 → 1.0.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +12 -6
- package/dist/index.js.map +1 -1
- package/package.json +23 -23
- package/src/index.ts +16 -7
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAQ9D,qBAAa,eAAgB,YAAW,eAAe;IAC9C,IAAI,SAAe;IACnB,OAAO,SAAa;IAErB,IAAI,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC;
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAQ9D,qBAAa,eAAgB,YAAW,eAAe;IAC9C,IAAI,SAAe;IACnB,OAAO,SAAa;IAErB,IAAI,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC;CAgErD"}
|
package/dist/index.js
CHANGED
|
@@ -38,7 +38,7 @@ const child_process_1 = require("child_process");
|
|
|
38
38
|
const util_1 = require("util");
|
|
39
39
|
const parser_1 = require("./parser");
|
|
40
40
|
const path = __importStar(require("path"));
|
|
41
|
-
const
|
|
41
|
+
const execFileAsync = (0, util_1.promisify)(child_process_1.execFile);
|
|
42
42
|
class NpmAuditScanner {
|
|
43
43
|
name = 'npm-audit';
|
|
44
44
|
version = 'unknown';
|
|
@@ -47,11 +47,17 @@ class NpmAuditScanner {
|
|
|
47
47
|
let rawOutput = '';
|
|
48
48
|
try {
|
|
49
49
|
const safePath = path.resolve(input.repositoryPath);
|
|
50
|
-
//
|
|
51
|
-
|
|
52
|
-
const
|
|
53
|
-
|
|
54
|
-
|
|
50
|
+
// Use execFile to prevent command injection
|
|
51
|
+
const npmCmd = process.platform === 'win32' ? 'npm.cmd' : 'npm';
|
|
52
|
+
const fs = require('fs');
|
|
53
|
+
const args = ['audit', '--json', '--prefix', safePath, '--omit=dev'];
|
|
54
|
+
if (fs.existsSync(path.join(safePath, 'package-lock.json'))) {
|
|
55
|
+
args.push('--package-lock-only');
|
|
56
|
+
}
|
|
57
|
+
const { stdout } = await execFileAsync(npmCmd, args, {
|
|
58
|
+
timeout: 60000, // 1 minute max
|
|
59
|
+
maxBuffer: 1024 * 1024 * 50,
|
|
60
|
+
shell: process.platform === 'win32'
|
|
55
61
|
});
|
|
56
62
|
rawOutput = stdout;
|
|
57
63
|
const findings = (0, parser_1.parseNpmAuditOutput)(input.scanId, rawOutput);
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEA,
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEA,iDAAyC;AACzC,+BAAiC;AACjC,qCAA+C;AAC/C,2CAA6B;AAE7B,MAAM,aAAa,GAAG,IAAA,gBAAS,EAAC,wBAAQ,CAAC,CAAC;AAE1C,MAAa,eAAe;IACnB,IAAI,GAAG,WAAW,CAAC;IACnB,OAAO,GAAG,SAAS,CAAC;IAE3B,KAAK,CAAC,IAAI,CAAC,KAAgB;QACzB,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;QAC7B,IAAI,SAAS,GAAG,EAAE,CAAC;QAEnB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;YAEpD,4CAA4C;YAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;YAEhE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;YACzB,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;YAErE,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC,EAAE,CAAC;gBAC5D,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;YACnC,CAAC;YAED,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE;gBACnD,OAAO,EAAE,KAAK,EAAE,eAAe;gBAC/B,SAAS,EAAE,IAAI,GAAG,IAAI,GAAG,EAAE;gBAC3B,KAAK,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO;aACpC,CAAC,CAAC;YAEH,SAAS,GAAG,MAAM,CAAC;YACnB,MAAM,QAAQ,GAAG,IAAA,4BAAmB,EAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YAE9D,OAAO;gBACL,OAAO,EAAE,IAAI,CAAC,IAAI;gBAClB,OAAO,EAAE,IAAI;gBACb,QAAQ;gBACR,SAAS;gBACT,SAAS;gBACT,OAAO,EAAE,IAAI,IAAI,EAAE;aACpB,CAAC;QACJ,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,+DAA+D;YAC/D,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,CAAC;gBACnE,IAAI,CAAC;oBACH,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC;oBACzB,MAAM,QAAQ,GAAG,IAAA,4BAAmB,EAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;oBAC9D,OAAO;wBACL,OAAO,EAAE,IAAI,CAAC,IAAI;wBAClB,OAAO,EAAE,IAAI;wBACb,QAAQ;wBACR,SAAS;wBACT,SAAS;wBACT,OAAO,EAAE,IAAI,IAAI,EAAE;qBACpB,CAAC;gBACJ,CAAC;gBAAC,OAAO,UAAU,EAAE,CAAC;oBACpB,uBAAuB;gBACzB,CAAC;YACH,CAAC;YAED,OAAO;gBACL,OAAO,EAAE,IAAI,CAAC,IAAI;gBAClB,OAAO,EAAE,KAAK;gBACd,QAAQ,EAAE,EAAE;gBACZ,KAAK,EAAE,KAAK,CAAC,OAAO,IAAI,4BAA4B;gBACpD,SAAS,EAAE,KAAK,CAAC,MAAM,IAAI,EAAE;gBAC7B,SAAS;gBACT,OAAO,EAAE,IAAI,IAAI,EAAE;aACpB,CAAC;QACJ,CAAC;IACH,CAAC;CACF;AApED,0CAoEC"}
|
package/package.json
CHANGED
|
@@ -1,23 +1,23 @@
|
|
|
1
|
-
{
|
|
2
|
-
"name": "@maverick006/scanner-npm-audit",
|
|
3
|
-
"version": "1.0.
|
|
4
|
-
"main": "dist/index.js",
|
|
5
|
-
"types": "dist/index.d.ts",
|
|
6
|
-
"scripts": {
|
|
7
|
-
"build": "tsc",
|
|
8
|
-
"clean": "rm -rf dist",
|
|
9
|
-
"test": "jest",
|
|
10
|
-
"typecheck": "tsc --noEmit"
|
|
11
|
-
},
|
|
12
|
-
"dependencies": {
|
|
13
|
-
"@maverick006/types": "*",
|
|
14
|
-
"@maverick006/security-engine": "*"
|
|
15
|
-
},
|
|
16
|
-
"devDependencies": {
|
|
17
|
-
"typescript": "^5.0.0",
|
|
18
|
-
"jest": "^29.5.0",
|
|
19
|
-
"@types/jest": "^29.5.0",
|
|
20
|
-
"ts-jest": "^29.1.0",
|
|
21
|
-
"@types/node": "^20.0.0"
|
|
22
|
-
}
|
|
23
|
-
}
|
|
1
|
+
{
|
|
2
|
+
"name": "@maverick006/scanner-npm-audit",
|
|
3
|
+
"version": "1.0.3",
|
|
4
|
+
"main": "dist/index.js",
|
|
5
|
+
"types": "dist/index.d.ts",
|
|
6
|
+
"scripts": {
|
|
7
|
+
"build": "tsc",
|
|
8
|
+
"clean": "rm -rf dist",
|
|
9
|
+
"test": "jest",
|
|
10
|
+
"typecheck": "tsc --noEmit"
|
|
11
|
+
},
|
|
12
|
+
"dependencies": {
|
|
13
|
+
"@maverick006/types": "*",
|
|
14
|
+
"@maverick006/security-engine": "*"
|
|
15
|
+
},
|
|
16
|
+
"devDependencies": {
|
|
17
|
+
"typescript": "^5.0.0",
|
|
18
|
+
"jest": "^29.5.0",
|
|
19
|
+
"@types/jest": "^29.5.0",
|
|
20
|
+
"ts-jest": "^29.1.0",
|
|
21
|
+
"@types/node": "^20.0.0"
|
|
22
|
+
}
|
|
23
|
+
}
|
package/src/index.ts
CHANGED
|
@@ -1,11 +1,11 @@
|
|
|
1
1
|
import { SecurityScanner } from '@maverick006/security-engine';
|
|
2
2
|
import { ScanInput, ScannerResult } from '@maverick006/types';
|
|
3
|
-
import {
|
|
3
|
+
import { execFile } from 'child_process';
|
|
4
4
|
import { promisify } from 'util';
|
|
5
5
|
import { parseNpmAuditOutput } from './parser';
|
|
6
6
|
import * as path from 'path';
|
|
7
7
|
|
|
8
|
-
const
|
|
8
|
+
const execFileAsync = promisify(execFile);
|
|
9
9
|
|
|
10
10
|
export class NpmAuditScanner implements SecurityScanner {
|
|
11
11
|
public name = 'npm-audit';
|
|
@@ -18,11 +18,20 @@ export class NpmAuditScanner implements SecurityScanner {
|
|
|
18
18
|
try {
|
|
19
19
|
const safePath = path.resolve(input.repositoryPath);
|
|
20
20
|
|
|
21
|
-
//
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
21
|
+
// Use execFile to prevent command injection
|
|
22
|
+
const npmCmd = process.platform === 'win32' ? 'npm.cmd' : 'npm';
|
|
23
|
+
|
|
24
|
+
const fs = require('fs');
|
|
25
|
+
const args = ['audit', '--json', '--prefix', safePath, '--omit=dev'];
|
|
26
|
+
|
|
27
|
+
if (fs.existsSync(path.join(safePath, 'package-lock.json'))) {
|
|
28
|
+
args.push('--package-lock-only');
|
|
29
|
+
}
|
|
30
|
+
|
|
31
|
+
const { stdout } = await execFileAsync(npmCmd, args, {
|
|
32
|
+
timeout: 60000, // 1 minute max
|
|
33
|
+
maxBuffer: 1024 * 1024 * 50,
|
|
34
|
+
shell: process.platform === 'win32'
|
|
26
35
|
});
|
|
27
36
|
|
|
28
37
|
rawOutput = stdout;
|