@node-core/utils 6.3.3 → 7.0.0

package/lib/update_security_release.js

@@ -4,11 +4,13 @@ import {
   commitAndPushVulnerabilitiesJSON,
   validateDate,
   pickReport,
+  getAffectedVersionLines,
   getReportSeverity,
   getSummary,
+  confirmSecurityStep,
+  writeSecurityFile,
   SecurityRelease
 } from './security-release/security-release.js';
-import fs from 'node:fs';
 import auth from './auth.js';
 import Request from './request.js';
 import nv from '@pkgjs/nv';
@@ -16,7 +18,7 @@ import semver from 'semver';
 
 export default class UpdateSecurityRelease extends SecurityRelease {
   async sync() {
-    checkRemote(this.cli, this.repository);
+    await checkRemote(this.cli, this.repository);
 
     const content = this.readVulnerabilitiesJSON();
     const credentials = await auth({
@@ -46,10 +48,15 @@ export default class UpdateSecurityRelease extends SecurityRelease {
       };
     }
     const vulnerabilitiesJSONPath = this.getVulnerabilitiesJSONPath();
-    fs.writeFileSync(vulnerabilitiesJSONPath, JSON.stringify(content, null, 2));
+    await writeSecurityFile(
+      this.cli,
+      vulnerabilitiesJSONPath,
+      JSON.stringify(content, null, 2),
+      'This writes synchronized HackerOne report data to vulnerabilities.json.'
+    );
 
     const commitMessage = 'chore: git node security --sync';
-    commitAndPushVulnerabilitiesJSON([vulnerabilitiesJSONPath],
+    await commitAndPushVulnerabilitiesJSON([vulnerabilitiesJSONPath],
       commitMessage, { cli: this.cli, repository: this.repository });
     this.cli.ok('Synced vulnerabilities.json with HackerOne');
   }
@@ -59,19 +66,19 @@ export default class UpdateSecurityRelease extends SecurityRelease {
 
     try {
       validateDate(releaseDate);
-    } catch (error) {
+    } catch {
       cli.error('Invalid date format. Please use the format yyyy/mm/dd.');
       process.exit(1);
     }
 
     // checkout on the next-security-release branch
-    checkoutOnSecurityReleaseBranch(cli, this.repository);
+    await checkoutOnSecurityReleaseBranch(cli, this.repository);
 
     // update the release date in the vulnerabilities.json file
     const updatedVulnerabilitiesFiles = await this.updateJSONReleaseDate(releaseDate, { cli });
 
     const commitMessage = `chore: update the release date to ${releaseDate}`;
-    commitAndPushVulnerabilitiesJSON(updatedVulnerabilitiesFiles,
+    await commitAndPushVulnerabilitiesJSON(updatedVulnerabilitiesFiles,
       commitMessage, { cli, repository: this.repository });
     cli.ok('Done!');
   }
@@ -81,7 +88,12 @@ export default class UpdateSecurityRelease extends SecurityRelease {
     const content = this.readVulnerabilitiesJSON(vulnerabilitiesJSONPath);
     content.releaseDate = releaseDate;
 
-    fs.writeFileSync(vulnerabilitiesJSONPath, JSON.stringify(content, null, 2));
+    await writeSecurityFile(
+      this.cli,
+      vulnerabilitiesJSONPath,
+      JSON.stringify(content, null, 2),
+      `This sets releaseDate to ${releaseDate} in vulnerabilities.json.`
+    );
 
     this.cli.ok(`Updated the release date in vulnerabilities.json: ${releaseDate}`);
     return [vulnerabilitiesJSONPath];
@@ -95,7 +107,7 @@ export default class UpdateSecurityRelease extends SecurityRelease {
 
     const req = new Request(credentials);
     // checkout on the next-security-release branch
-    checkoutOnSecurityReleaseBranch(this.cli, this.repository);
+    await checkoutOnSecurityReleaseBranch(this.cli, this.repository);
 
     // get h1 report
     const { data: report } = await req.getReport(reportId);
@@ -104,18 +116,23 @@ export default class UpdateSecurityRelease extends SecurityRelease {
     const vulnerabilitiesJSONPath = this.getVulnerabilitiesJSONPath();
     const content = this.readVulnerabilitiesJSON(vulnerabilitiesJSONPath);
     content.reports.push(entry);
-    fs.writeFileSync(vulnerabilitiesJSONPath, JSON.stringify(content, null, 2));
+    await writeSecurityFile(
+      this.cli,
+      vulnerabilitiesJSONPath,
+      JSON.stringify(content, null, 2),
+      `This appends HackerOne report ${entry.id} to vulnerabilities.json.`
+    );
     this.cli.ok(`Updated vulnerabilities.json with the report: ${entry.id}`);
     const commitMessage = `chore: added report ${entry.id} to vulnerabilities.json`;
-    commitAndPushVulnerabilitiesJSON(vulnerabilitiesJSONPath,
+    await commitAndPushVulnerabilitiesJSON(vulnerabilitiesJSONPath,
       commitMessage, { cli: this.cli, repository: this.repository });
     this.cli.ok('Done!');
   }
 
-  removeReport(reportId) {
+  async removeReport(reportId) {
     const { cli } = this;
     // checkout on the next-security-release branch
-    checkoutOnSecurityReleaseBranch(cli, this.repository);
+    await checkoutOnSecurityReleaseBranch(cli, this.repository);
     const vulnerabilitiesJSONPath = this.getVulnerabilitiesJSONPath();
     const content = this.readVulnerabilitiesJSON(vulnerabilitiesJSONPath);
     const found = content.reports.some((report) => report.id === reportId);
@@ -124,11 +141,16 @@ export default class UpdateSecurityRelease extends SecurityRelease {
       process.exit(1);
     }
     content.reports = content.reports.filter((report) => report.id !== reportId);
-    fs.writeFileSync(vulnerabilitiesJSONPath, JSON.stringify(content, null, 2));
+    await writeSecurityFile(
+      this.cli,
+      vulnerabilitiesJSONPath,
+      JSON.stringify(content, null, 2),
+      `This removes HackerOne report ${reportId} from vulnerabilities.json.`
+    );
     this.cli.ok(`Updated vulnerabilities.json with the report: ${reportId}`);
 
     const commitMessage = `chore: remove report ${reportId} from vulnerabilities.json`;
-    commitAndPushVulnerabilitiesJSON(vulnerabilitiesJSONPath,
+    await commitAndPushVulnerabilitiesJSON(vulnerabilitiesJSONPath,
       commitMessage, { cli, repository: this.repository });
     cli.ok('Done!');
   }
@@ -169,6 +191,16 @@ export default class UpdateSecurityRelease extends SecurityRelease {
   }
 
   async updateHackonerReportCve(req, report) {
+    const { id, cveIds } = report;
+    await confirmSecurityStep(
+      this.cli,
+      `update HackerOne report \`${id}\` with CVEs ${cveIds}`,
+      'This writes the assigned CVE IDs back to the HackerOne report.'
+    );
+    return this.updateHackonerReportCveWithoutConfirmation(req, report);
+  }
+
+  async updateHackonerReportCveWithoutConfirmation(req, report) {
     const { id, cveIds } = report;
     this.cli.startSpinner(`Updating report ${id} with CVEs ${cveIds}..`);
     const body = {
@@ -179,90 +211,286 @@ export default class UpdateSecurityRelease extends SecurityRelease {
         }
       }
     };
-    const response = await req.updateReportCVE(id, body);
-    if (response.errors) {
-      this.cli.error(`Error updating report ${id}`);
-      this.cli.error(JSON.stringify(response.errors, null, 2));
+    try {
+      const response = await req.updateReportCVE(id, body);
+      if (response.errors) {
+        this.cli.stopSpinner(
+          `Error updating report ${id}`,
+          this.cli.SPINNER_STATUS.FAILED
+        );
+        this.cli.error(`Error updating report ${id}`);
+        this.cli.error(JSON.stringify(response.errors, null, 2));
+        return false;
+      }
+      this.cli.stopSpinner(`Done updating report ${id} with CVEs ${cveIds}..`);
+      return true;
+    } catch (error) {
+      this.cli.stopSpinner(
+        `Error updating report ${id}`,
+        this.cli.SPINNER_STATUS.FAILED
+      );
+      this.cli.error(error);
+      return false;
     }
-    this.cli.stopSpinner(`Done updating report ${id} with CVEs ${cveIds}..`);
   }
 
   async promptCVECreation(req, reports, programId, content) {
+    const reportsWithoutCVE = reports.filter((report) => !report.cveIds?.length);
+    const requestAll = await this.promptRequestAllCVEs(reportsWithoutCVE);
+
+    if (requestAll) {
+      await confirmSecurityStep(
+        this.cli,
+        `request CVEs for ${reportsWithoutCVE.length} HackerOne reports`,
+        'This submits CVE requests to HackerOne for every report without a CVE.'
+      );
+    }
+
     const supportedVersions = (await nv('supported'));
     const eolVersions = (await nv('eol'));
-    for (const report of reports) {
-      const { id, summary, title, affectedVersions, cveIds, link } = report;
-      // skip if already has a CVE
-      // risky because the CVE associated might be
-      // mentioned in the report and not requested by Node
-      if (cveIds?.length) continue;
+    const versionCache = new Map();
+    const successfulReports = await this.collectSuccessfulCVERequests({
+      req,
+      reports,
+      programId,
+      supportedVersions,
+      eolVersions,
+      versionCache,
+      requestAll
+    });
 
-      let severity = report.severity;
+    if (!successfulReports.length) {
+      this.cli.warn('No CVE requests succeeded.');
+      return;
+    }
 
-      if (!severity.cvss_vector_string || !severity.weakness_id) {
-        try {
-          const h1Report = await req.getReport(id);
-          if (!h1Report.data.relationships.severity?.data.attributes.cvss_vector_string) {
-            throw new Error('No severity found');
-          }
-          severity = {
-            weakness_id: h1Report.data.relationships.weakness?.data.id,
-            cvss_vector_string:
-              h1Report.data.relationships.severity?.data.attributes.cvss_vector_string,
-            rating: h1Report.data.relationships.severity?.data.attributes.rating
-          };
-        } catch (error) {
-          this.cli.error(`Couldnt not retrieve severity from report ${id}, skipping...`);
-          continue;
+    await this.applySuccessfulCVEUpdates(req, content, successfulReports);
+  }
+
+  showCVERequestSummary(reports) {
+    this.cli.info(`Reports selected for CVE requests (${reports.length}):`);
+    for (const { id, severity, title } of reports) {
+      const rating = severity?.rating || 'unknown';
+      this.cli.info(`- ${id} [${rating}] ${title}`);
+    }
+  }
+
+  promptRequestAllCVEs(reportsWithoutCVE) {
+    if (reportsWithoutCVE.length <= 1) return false;
+    this.showCVERequestSummary(reportsWithoutCVE);
+    return this.cli.prompt(
+      'Request CVEs for all reports without prompting for each report?',
+      { defaultAnswer: false }
+    );
+  }
+
+  async collectSuccessfulCVERequests({
+    req,
+    reports,
+    programId,
+    supportedVersions,
+    eolVersions,
+    versionCache,
+    requestAll
+  }) {
+    const successfulReports = [];
+    try {
+      for (const report of reports) {
+        const requested = await this.requestReportCVE({
+          req,
+          report,
+          programId,
+          supportedVersions,
+          eolVersions,
+          versionCache,
+          requestAll
+        });
+        if (requested) successfulReports.push(report);
+      }
+    } catch (error) {
+      if (!this.isPromptInterrupted(error)) throw error;
+      this.cli.warn('CVE request interrupted. Finalizing successful requests.');
+    }
+    return successfulReports;
+  }
+
+  isPromptInterrupted(error) {
+    return error?.name === 'ExitPromptError' ||
+      error?.name === 'AbortPromptError' ||
+      error?.message?.includes('User force closed');
+  }
+
+  async requestReportCVE({
+    req,
+    report,
+    programId,
+    supportedVersions,
+    eolVersions,
+    versionCache,
+    requestAll
+  }) {
+    const { id, summary, title, affectedVersions, cveIds, link } = report;
+    const affectedVersionLines = getAffectedVersionLines(affectedVersions);
+    // skip if already has a CVE
+    // risky because the CVE associated might be
+    // mentioned in the report and not requested by Node
+    if (cveIds?.length) return false;
+
+    let severity = report.severity;
+
+    if (!severity.cvss_vector_string || !severity.weakness_id) {
+      try {
+        const h1Report = await req.getReport(id);
+        if (!h1Report.data.relationships.severity?.data.attributes.cvss_vector_string) {
+          throw new Error('No severity found');
         }
+        severity = {
+          weakness_id: h1Report.data.relationships.weakness?.data.id,
+          cvss_vector_string:
+            h1Report.data.relationships.severity?.data.attributes.cvss_vector_string,
+          rating: h1Report.data.relationships.severity?.data.attributes.rating
+        };
+      } catch {
+        this.cli.error(`Couldnt not retrieve severity from report ${id}, skipping...`);
+        return false;
       }
+    }
 
-      const { cvss_vector_string, weakness_id } = severity;
+    const { cvss_vector_string, weakness_id } = severity;
 
-      const create = await this.cli.prompt(
-        `Request a CVE for: \n
+    const create = requestAll || await this.cli.prompt(
+      `Request a CVE for: \n
 Title: ${title}\n
 Link: ${link}\n
-Affected versions: ${affectedVersions.join(', ')}\n
+Affected versions: ${affectedVersionLines.join(', ')}\n
 Vector: ${cvss_vector_string}\n
 Summary: ${summary}\n`,
-        { defaultAnswer: true });
-
-      if (!create) continue;
-
-      const { h1AffectedVersions, patchedVersions } =
-        await this.calculateVersions(affectedVersions, supportedVersions, eolVersions);
-      const body = {
-        data: {
-          type: 'cve-request',
-          attributes: {
-            team_handle: 'nodejs-team',
-            versions: h1AffectedVersions,
-            metrics: [
-              {
-                vectorString: cvss_vector_string
-              }
-            ],
-            auto_submit_on_publicly_disclosing_report: true,
-            references: ['https://nodejs.org/en/blog/vulnerability'],
-            report_id: report.id,
-            weakness_id: Number(weakness_id),
-            description: report.summary,
-            vulnerability_discovered_at: new Date().toISOString()
+      { defaultAnswer: true });
+
+    if (!create) return false;
+
+    const { h1AffectedVersions, patchedVersions } =
+      await this.calculateVersions(
+        affectedVersionLines,
+        supportedVersions,
+        eolVersions,
+        versionCache
+      );
+    const body = {
+      data: {
+        type: 'cve-request',
+        attributes: {
+          team_handle: 'nodejs-team',
+          versions: h1AffectedVersions,
+          metrics: [
+            {
+              vectorString: cvss_vector_string
+            }
+          ],
+          auto_submit_on_publicly_disclosing_report: true,
+          references: ['https://nodejs.org/en/blog/vulnerability'],
+          report_id: report.id,
+          weakness_id: Number(weakness_id),
+          description: report.summary,
+          vulnerability_discovered_at: new Date().toISOString()
+        }
+      }
+    };
+    if (!requestAll) {
+      await confirmSecurityStep(
+        this.cli,
+        `request CVE for HackerOne report \`${report.id}\``,
+        'This submits a CVE request to HackerOne for the selected report.'
+      );
+    }
+    this.cli.startSpinner(`Requesting CVE for report ${id}...`);
+    let response;
+    try {
+      response = await req.requestCVE(programId, body);
+    } catch (error) {
+      this.cli.stopSpinner(
+        `Error requesting CVE for report ${id}`,
+        this.cli.SPINNER_STATUS.FAILED
+      );
+      this.cli.error(error);
+      return false;
+    }
+    if (response.errors) {
+      this.cli.stopSpinner(
+        `Error requesting CVE for report ${id}`,
+        this.cli.SPINNER_STATUS.FAILED
+      );
+      this.cli.error(`Error requesting CVE for report ${id}`);
+      this.cli.error(JSON.stringify(response.errors, null, 2));
+      return false;
+    }
+    this.cli.stopSpinner(`Requested CVE for report ${id}`);
+    const { cve_identifier } = response.data.attributes;
+    report.cveIds = [cve_identifier];
+    report.patchedVersions = patchedVersions;
+    return true;
+  }
+
+  async applySuccessfulCVEUpdates(req, content, successfulReports) {
+    this.cli.info('CVE requests succeeded:');
+    for (const { id, cveIds } of successfulReports) {
+      this.cli.info(`- ${id}: ${cveIds.join(', ')}`);
+    }
+    const updateVulnerabilitiesJSON = await this.cli.prompt(
+      'Update vulnerabilities.json with the successful CVE requests?',
+      { defaultAnswer: true }
+    );
+    if (!updateVulnerabilitiesJSON) {
+      this.cli.warn(
+        'Skipping HackerOne updates because vulnerabilities.json was not updated.'
+      );
+      return;
+    }
+
+    const vulnerabilitiesUpdated = await this.updateVulnerabilitiesJSON(content);
+    if (!vulnerabilitiesUpdated) {
+      this.cli.warn('Skipping HackerOne updates because vulnerabilities.json update failed.');
+      return;
+    }
+
+    const updateHackerOne = await this.cli.prompt(
+      'Update HackerOne reports with the successful CVE IDs?',
+      { defaultAnswer: true }
+    );
+    if (updateHackerOne) {
+      await confirmSecurityStep(
+        this.cli,
+        `update ${successfulReports.length} HackerOne reports with CVE IDs`,
+        'This writes the assigned CVE IDs back to all successful HackerOne reports.'
+      );
+      const h1Succeeded = [];
+      const h1Failed = [];
+      for (const report of successfulReports) {
+        try {
+          const updated = await this.updateHackonerReportCveWithoutConfirmation(req, report);
+          if (updated) {
+            h1Succeeded.push(report);
+          } else {
+            h1Failed.push(report);
           }
+        } catch (error) {
+          this.cli.error(error);
+          h1Failed.push(report);
+        }
+      }
+
+      if (h1Succeeded.length) {
+        this.cli.info('HackerOne reports updated:');
+        for (const { id, cveIds } of h1Succeeded) {
+          this.cli.info(`- ${id}: ${cveIds.join(', ')}`);
+        }
+      }
+      if (h1Failed.length) {
+        this.cli.warn('HackerOne reports not updated:');
+        for (const { id, cveIds } of h1Failed) {
+          this.cli.warn(`- ${id}: ${cveIds.join(', ')}`);
         }
-      };
-      const response = await req.requestCVE(programId, body);
-      if (response.errors) {
-        this.cli.error(`Error requesting CVE for report ${id}`);
-        this.cli.error(JSON.stringify(response.errors, null, 2));
-        continue;
       }
-      const { cve_identifier } = response.data.attributes;
-      report.cveIds = [cve_identifier];
-      report.patchedVersions = patchedVersions;
-      this.updateVulnerabilitiesJSON(content);
-      await this.updateHackonerReportCve(req, report);
     }
   }
 
@@ -277,39 +505,53 @@ Summary: ${summary}\n`,
     }
   }
 
-  async calculateVersions(affectedVersions, supportedVersions, eolVersions) {
+  async calculateVersions(
+    affectedVersions,
+    supportedVersions,
+    eolVersions,
+    versionCache = new Map()
+  ) {
+    affectedVersions = getAffectedVersionLines(affectedVersions);
     const h1AffectedVersions = [];
     const patchedVersions = [];
     let isPatchRelease = true;
     for (const affectedVersion of affectedVersions) {
-      const affectedMajor = affectedVersion.split('.')[0];
-      const latest = supportedVersions.find((v) => v.major === Number(affectedMajor)).version;
-      const version = await this.cli.prompt(
-        `What is the affected version (<=) for release line ${affectedVersion}?`,
-        { questionType: 'input', defaultAnswer: latest });
-
-      const nextPatchVersion = semver.inc(version, 'patch');
-      const nextMinorVersion = semver.inc(version, 'minor');
-      const patchedVersion = await this.cli.prompt(
-        `What is the patched version (>=) for release line ${affectedVersion}?`,
-        {
-          questionType: 'input',
-          defaultAnswer: isPatchRelease ? nextPatchVersion : nextMinorVersion
-        });
+      if (!versionCache.has(affectedVersion)) {
+        const affectedMajor = affectedVersion.split('.')[0];
+        const latest = supportedVersions.find((v) => v.major === Number(affectedMajor)).version;
+        const version = await this.cli.prompt(
+          `What is the affected version (<=) for release line ${affectedVersion}?`,
+          { questionType: 'input', defaultAnswer: latest });
+
+        const nextPatchVersion = semver.inc(version, 'patch');
+        const nextMinorVersion = semver.inc(version, 'minor');
+        const patchedVersion = await this.cli.promptRadio(
+          `What is the patched version (>=) for release line ${affectedVersion}?`,
+          [nextPatchVersion, nextMinorVersion],
+          {
+            defaultAnswer: isPatchRelease ? nextPatchVersion : nextMinorVersion
+          });
+
+        if (patchedVersion !== nextPatchVersion) {
+          isPatchRelease = false; // is a minor release
+        }
 
-      if (patchedVersion !== nextPatchVersion) {
-        isPatchRelease = false; // is a minor release
+        versionCache.set(affectedVersion, {
+          patchedVersion,
+          h1AffectedVersion: {
+            vendor: 'nodejs',
+            product: 'node',
+            func: '<=',
+            version,
+            versionType: 'semver',
+            affected: true
+          }
+        });
       }
 
+      const { h1AffectedVersion, patchedVersion } = versionCache.get(affectedVersion);
       patchedVersions.push(patchedVersion);
-      h1AffectedVersions.push({
-        vendor: 'nodejs',
-        product: 'node',
-        func: '<=',
-        version,
-        versionType: 'semver',
-        affected: true
-      });
+      h1AffectedVersions.push(h1AffectedVersion);
     }
 
     // All EOL versions are affected since they no longer receive security patches

package/lib/utils.js

@@ -6,12 +6,12 @@ import { forceRunAsync } from './run.js';
 export function ascending(a, b) {
   if (a === b) return 0;
   return a < b ? -1 : 1;
-};
+}
 
 export function descending(a, b) {
   if (a === b) return 0;
   return a > b ? -1 : 1;
-};
+}
 
 export function flatten(arr) {
   let result = [];
@@ -27,7 +27,7 @@ export function flatten(arr) {
 
 export function shortSha(sha) {
   return sha.slice(0, 12);
-};
+}
 
 let isGhAvailableCache;
 export function isGhAvailable() {
@@ -35,7 +35,7 @@ export function isGhAvailable() {
     isGhAvailableCache = which.sync('gh', { nothrow: true }) !== null;
   }
   return isGhAvailableCache;
-};
+}
 
 /**
  * Returns the user's preferred text editor command.
@@ -65,4 +65,4 @@ export async function getEditor(options = {}) {
 
   return process.env.VISUAL || process.env.EDITOR ||
           (platform() === 'win32' ? 'notepad.exe' : 'vi');
-};
+}

package/lib/verbosity.js

@@ -11,7 +11,7 @@ export let verbosity = VERBOSITY.NONE;
 
 export function isDebugVerbosity() {
   return verbosity === VERBOSITY.DEBUG;
-};
+}
 
 export function setVerbosityFromEnv() {
   const env = (process.env.NCU_VERBOSITY || '').toUpperCase();
@@ -21,9 +21,9 @@ export function setVerbosityFromEnv() {
   if (!isDebugVerbosity()) {
     Error.stackTraceLimit = 0;
   }
-};
+}
 
 export function debuglog(...args) {
   // Prepend a line break in case it's logged while the spinner is running
   console.error(chalk.green(util.format('\n[DEBUG]', ...args)));
-};
+}