@nodesecure/scanner 3.1.0 → 3.1.1-rc.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +95 -95
- package/package.json +1 -1
- package/src/depWalker.js +2 -2
- package/src/utils/index.js +16 -16
- package/src/utils/isGitDependency.js +20 -20
- package/src/utils/mergeDependencies.js +26 -26
- package/types/scanner.d.ts +1 -1
package/README.md
CHANGED
|
@@ -1,95 +1,95 @@
|
|
|
1
|
-
# NodeSecure Scanner
|
|
2
|
-
|
|
3
|
-
[](https://github.com/NodeSecure/scanner/commit-activity)
|
|
4
|
-
[](https://github.com/nodejs/security-wg/blob/master/processes/responsible_disclosure_template.md
|
|
5
|
-
)
|
|
6
|
-
[](https://github.com/NodeSecure/scanner/blob/master/LICENSE)
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
⚡️ Run a static analysis of your module's dependencies.
|
|
10
|
-
|
|
11
|
-
## Requirements
|
|
12
|
-
|
|
13
|
-
- [Node.js](https://nodejs.org/en/) version 16 or higher
|
|
14
|
-
|
|
15
|
-
## Getting Started
|
|
16
|
-
|
|
17
|
-
This package is available in the Node Package Repository and can be easily installed with [npm](https://docs.npmjs.com/getting-started/what-is-npm) or [yarn](https://yarnpkg.com).
|
|
18
|
-
|
|
19
|
-
```bash
|
|
20
|
-
$ npm i @nodesecure/scanner
|
|
21
|
-
# or
|
|
22
|
-
$ yarn add @nodesecure/scanner
|
|
23
|
-
```
|
|
24
|
-
|
|
25
|
-
## Usage example
|
|
26
|
-
|
|
27
|
-
```js
|
|
28
|
-
import * as scanner from "@nodesecure/scanner";
|
|
29
|
-
import fs from "fs/promises";
|
|
30
|
-
|
|
31
|
-
// CONSTANTS
|
|
32
|
-
const kPackagesToAnalyze = ["mocha", "cacache", "is-wsl"];
|
|
33
|
-
|
|
34
|
-
const payloads = await Promise.all(
|
|
35
|
-
kPackagesToAnalyze.map((name) => scanner.from(name))
|
|
36
|
-
);
|
|
37
|
-
|
|
38
|
-
const promises = [];
|
|
39
|
-
for (let i = 0; i < kPackagesToAnalyze.length; i++) {
|
|
40
|
-
const data = JSON.stringify(payloads[i], null, 2);
|
|
41
|
-
|
|
42
|
-
promises.push(fs.writeFile(`${kPackagesToAnalyze[i]}.json`, data));
|
|
43
|
-
}
|
|
44
|
-
await Promise.allSettled(promises);
|
|
45
|
-
```
|
|
46
|
-
|
|
47
|
-
## API
|
|
48
|
-
|
|
49
|
-
See `types/api.d.ts` for a complete TypeScript definition.
|
|
50
|
-
|
|
51
|
-
```ts
|
|
52
|
-
function cwd(path: string, options?: Scanner.Options): Promise<Scanner.Payload>;
|
|
53
|
-
function from(packageName: string, options?: Scanner.Options): Promise<Scanner.Payload>;
|
|
54
|
-
function verify(packageName: string): Promise<Scanner.VerifyPayload>;
|
|
55
|
-
```
|
|
56
|
-
|
|
57
|
-
`Options` is described with the following TypeScript interface:
|
|
58
|
-
|
|
59
|
-
```ts
|
|
60
|
-
interface Options {
|
|
61
|
-
readonly maxDepth?: number;
|
|
62
|
-
readonly usePackageLock?: boolean;
|
|
63
|
-
readonly vulnerabilityStrategy: Strategy.Kind;
|
|
64
|
-
readonly forceRootAnalysis?: boolean;
|
|
65
|
-
readonly fullLockMode?: boolean;
|
|
66
|
-
}
|
|
67
|
-
```
|
|
68
|
-
|
|
69
|
-
## Contributors ✨
|
|
70
|
-
|
|
71
|
-
<!-- ALL-CONTRIBUTORS-BADGE:START - Do not remove or modify this section -->
|
|
72
|
-
[](#contributors-)
|
|
73
|
-
<!-- ALL-CONTRIBUTORS-BADGE:END -->
|
|
74
|
-
|
|
75
|
-
Thanks goes to these wonderful people ([emoji key](https://allcontributors.org/docs/en/emoji-key)):
|
|
76
|
-
|
|
77
|
-
<!-- ALL-CONTRIBUTORS-LIST:START - Do not remove or modify this section -->
|
|
78
|
-
<!-- prettier-ignore-start -->
|
|
79
|
-
<!-- markdownlint-disable -->
|
|
80
|
-
<table>
|
|
81
|
-
<tr>
|
|
82
|
-
<td align="center"><a href="https://www.linkedin.com/in/thomas-gentilhomme/"><img src="https://avatars.githubusercontent.com/u/4438263?v=4?s=100" width="100px;" alt=""/><br /><sub><b>Gentilhomme</b></sub></a><br /><a href="https://github.com/NodeSecure/scanner/commits?author=fraxken" title="Code">💻</a> <a href="https://github.com/NodeSecure/scanner/commits?author=fraxken" title="Documentation">📖</a> <a href="https://github.com/NodeSecure/scanner/pulls?q=is%3Apr+reviewed-by%3Afraxken" title="Reviewed Pull Requests">👀</a> <a href="#security-fraxken" title="Security">🛡️</a> <a href="https://github.com/NodeSecure/scanner/issues?q=author%3Afraxken" title="Bug reports">🐛</a></td>
|
|
83
|
-
<td align="center"><a href="http://tonygo.dev"><img src="https://avatars.githubusercontent.com/u/22824417?v=4?s=100" width="100px;" alt=""/><br /><sub><b>Tony Gorez</b></sub></a><br /><a href="https://github.com/NodeSecure/scanner/commits?author=tony-go" title="Code">💻</a> <a href="https://github.com/NodeSecure/scanner/commits?author=tony-go" title="Documentation">📖</a> <a href="https://github.com/NodeSecure/scanner/pulls?q=is%3Apr+reviewed-by%3Atony-go" title="Reviewed Pull Requests">👀</a> <a href="https://github.com/NodeSecure/scanner/issues?q=author%3Atony-go" title="Bug reports">🐛</a></td>
|
|
84
|
-
<td align="center"><a href="https://mickaelcroquet.fr"><img src="https://avatars.githubusercontent.com/u/23740372?v=4?s=100" width="100px;" alt=""/><br /><sub><b>Haze</b></sub></a><br /><a href="https://github.com/NodeSecure/scanner/commits?author=CroquetMickael" title="Code">💻</a></td>
|
|
85
|
-
<td align="center"><a href="https://github.com/mbalabash"><img src="https://avatars.githubusercontent.com/u/16868922?v=4?s=100" width="100px;" alt=""/><br /><sub><b>Maksim Balabash</b></sub></a><br /><a href="https://github.com/NodeSecure/scanner/commits?author=mbalabash" title="Code">💻</a></td>
|
|
86
|
-
</tr>
|
|
87
|
-
</table>
|
|
88
|
-
|
|
89
|
-
<!-- markdownlint-restore -->
|
|
90
|
-
<!-- prettier-ignore-end -->
|
|
91
|
-
|
|
92
|
-
<!-- ALL-CONTRIBUTORS-LIST:END -->
|
|
93
|
-
|
|
94
|
-
## License
|
|
95
|
-
MIT
|
|
1
|
+
# NodeSecure Scanner
|
|
2
|
+
|
|
3
|
+
[](https://github.com/NodeSecure/scanner/commit-activity)
|
|
4
|
+
[](https://github.com/nodejs/security-wg/blob/master/processes/responsible_disclosure_template.md
|
|
5
|
+
)
|
|
6
|
+
[](https://github.com/NodeSecure/scanner/blob/master/LICENSE)
|
|
7
|
+
|
|
8
|
+
|
|
9
|
+
⚡️ Run a static analysis of your module's dependencies.
|
|
10
|
+
|
|
11
|
+
## Requirements
|
|
12
|
+
|
|
13
|
+
- [Node.js](https://nodejs.org/en/) version 16 or higher
|
|
14
|
+
|
|
15
|
+
## Getting Started
|
|
16
|
+
|
|
17
|
+
This package is available in the Node Package Repository and can be easily installed with [npm](https://docs.npmjs.com/getting-started/what-is-npm) or [yarn](https://yarnpkg.com).
|
|
18
|
+
|
|
19
|
+
```bash
|
|
20
|
+
$ npm i @nodesecure/scanner
|
|
21
|
+
# or
|
|
22
|
+
$ yarn add @nodesecure/scanner
|
|
23
|
+
```
|
|
24
|
+
|
|
25
|
+
## Usage example
|
|
26
|
+
|
|
27
|
+
```js
|
|
28
|
+
import * as scanner from "@nodesecure/scanner";
|
|
29
|
+
import fs from "fs/promises";
|
|
30
|
+
|
|
31
|
+
// CONSTANTS
|
|
32
|
+
const kPackagesToAnalyze = ["mocha", "cacache", "is-wsl"];
|
|
33
|
+
|
|
34
|
+
const payloads = await Promise.all(
|
|
35
|
+
kPackagesToAnalyze.map((name) => scanner.from(name))
|
|
36
|
+
);
|
|
37
|
+
|
|
38
|
+
const promises = [];
|
|
39
|
+
for (let i = 0; i < kPackagesToAnalyze.length; i++) {
|
|
40
|
+
const data = JSON.stringify(payloads[i], null, 2);
|
|
41
|
+
|
|
42
|
+
promises.push(fs.writeFile(`${kPackagesToAnalyze[i]}.json`, data));
|
|
43
|
+
}
|
|
44
|
+
await Promise.allSettled(promises);
|
|
45
|
+
```
|
|
46
|
+
|
|
47
|
+
## API
|
|
48
|
+
|
|
49
|
+
See `types/api.d.ts` for a complete TypeScript definition.
|
|
50
|
+
|
|
51
|
+
```ts
|
|
52
|
+
function cwd(path: string, options?: Scanner.Options): Promise<Scanner.Payload>;
|
|
53
|
+
function from(packageName: string, options?: Scanner.Options): Promise<Scanner.Payload>;
|
|
54
|
+
function verify(packageName: string): Promise<Scanner.VerifyPayload>;
|
|
55
|
+
```
|
|
56
|
+
|
|
57
|
+
`Options` is described with the following TypeScript interface:
|
|
58
|
+
|
|
59
|
+
```ts
|
|
60
|
+
interface Options {
|
|
61
|
+
readonly maxDepth?: number;
|
|
62
|
+
readonly usePackageLock?: boolean;
|
|
63
|
+
readonly vulnerabilityStrategy: Strategy.Kind;
|
|
64
|
+
readonly forceRootAnalysis?: boolean;
|
|
65
|
+
readonly fullLockMode?: boolean;
|
|
66
|
+
}
|
|
67
|
+
```
|
|
68
|
+
|
|
69
|
+
## Contributors ✨
|
|
70
|
+
|
|
71
|
+
<!-- ALL-CONTRIBUTORS-BADGE:START - Do not remove or modify this section -->
|
|
72
|
+
[](#contributors-)
|
|
73
|
+
<!-- ALL-CONTRIBUTORS-BADGE:END -->
|
|
74
|
+
|
|
75
|
+
Thanks goes to these wonderful people ([emoji key](https://allcontributors.org/docs/en/emoji-key)):
|
|
76
|
+
|
|
77
|
+
<!-- ALL-CONTRIBUTORS-LIST:START - Do not remove or modify this section -->
|
|
78
|
+
<!-- prettier-ignore-start -->
|
|
79
|
+
<!-- markdownlint-disable -->
|
|
80
|
+
<table>
|
|
81
|
+
<tr>
|
|
82
|
+
<td align="center"><a href="https://www.linkedin.com/in/thomas-gentilhomme/"><img src="https://avatars.githubusercontent.com/u/4438263?v=4?s=100" width="100px;" alt=""/><br /><sub><b>Gentilhomme</b></sub></a><br /><a href="https://github.com/NodeSecure/scanner/commits?author=fraxken" title="Code">💻</a> <a href="https://github.com/NodeSecure/scanner/commits?author=fraxken" title="Documentation">📖</a> <a href="https://github.com/NodeSecure/scanner/pulls?q=is%3Apr+reviewed-by%3Afraxken" title="Reviewed Pull Requests">👀</a> <a href="#security-fraxken" title="Security">🛡️</a> <a href="https://github.com/NodeSecure/scanner/issues?q=author%3Afraxken" title="Bug reports">🐛</a></td>
|
|
83
|
+
<td align="center"><a href="http://tonygo.dev"><img src="https://avatars.githubusercontent.com/u/22824417?v=4?s=100" width="100px;" alt=""/><br /><sub><b>Tony Gorez</b></sub></a><br /><a href="https://github.com/NodeSecure/scanner/commits?author=tony-go" title="Code">💻</a> <a href="https://github.com/NodeSecure/scanner/commits?author=tony-go" title="Documentation">📖</a> <a href="https://github.com/NodeSecure/scanner/pulls?q=is%3Apr+reviewed-by%3Atony-go" title="Reviewed Pull Requests">👀</a> <a href="https://github.com/NodeSecure/scanner/issues?q=author%3Atony-go" title="Bug reports">🐛</a></td>
|
|
84
|
+
<td align="center"><a href="https://mickaelcroquet.fr"><img src="https://avatars.githubusercontent.com/u/23740372?v=4?s=100" width="100px;" alt=""/><br /><sub><b>Haze</b></sub></a><br /><a href="https://github.com/NodeSecure/scanner/commits?author=CroquetMickael" title="Code">💻</a></td>
|
|
85
|
+
<td align="center"><a href="https://github.com/mbalabash"><img src="https://avatars.githubusercontent.com/u/16868922?v=4?s=100" width="100px;" alt=""/><br /><sub><b>Maksim Balabash</b></sub></a><br /><a href="https://github.com/NodeSecure/scanner/commits?author=mbalabash" title="Code">💻</a></td>
|
|
86
|
+
</tr>
|
|
87
|
+
</table>
|
|
88
|
+
|
|
89
|
+
<!-- markdownlint-restore -->
|
|
90
|
+
<!-- prettier-ignore-end -->
|
|
91
|
+
|
|
92
|
+
<!-- ALL-CONTRIBUTORS-LIST:END -->
|
|
93
|
+
|
|
94
|
+
## License
|
|
95
|
+
MIT
|
package/package.json
CHANGED
package/src/depWalker.js
CHANGED
|
@@ -184,8 +184,8 @@ export async function depWalker(manifest, options = {}, logger = new Logger()) {
|
|
|
184
184
|
|
|
185
185
|
const payload = {
|
|
186
186
|
id: tmpLocation.slice(-6),
|
|
187
|
-
|
|
188
|
-
|
|
187
|
+
rootDependencyName: manifest.name,
|
|
188
|
+
scannerVersion: packageVersion,
|
|
189
189
|
vulnerabilityStrategy,
|
|
190
190
|
warnings: []
|
|
191
191
|
};
|
package/src/utils/index.js
CHANGED
|
@@ -1,16 +1,16 @@
|
|
|
1
|
-
export * from "./getTarballComposition.js";
|
|
2
|
-
export * from "./isSensitiveFile.js";
|
|
3
|
-
export * from "./isGitDependency.js";
|
|
4
|
-
export * from "./getPackageName.js";
|
|
5
|
-
export * from "./mergeDependencies.js";
|
|
6
|
-
export * from "./semver.js";
|
|
7
|
-
export * from "./dirname.js";
|
|
8
|
-
export * from "./warnings.js";
|
|
9
|
-
export * from "./filterDependencyKind.js";
|
|
10
|
-
export * from "./analyzeDependencies.js";
|
|
11
|
-
export * from "./booleanToFlags.js";
|
|
12
|
-
export * from "./addMissingVersionFlags.js";
|
|
13
|
-
|
|
14
|
-
export const NPM_TOKEN = typeof process.env.NODE_SECURE_TOKEN === "string" ?
|
|
15
|
-
{ token: process.env.NODE_SECURE_TOKEN } :
|
|
16
|
-
{};
|
|
1
|
+
export * from "./getTarballComposition.js";
|
|
2
|
+
export * from "./isSensitiveFile.js";
|
|
3
|
+
export * from "./isGitDependency.js";
|
|
4
|
+
export * from "./getPackageName.js";
|
|
5
|
+
export * from "./mergeDependencies.js";
|
|
6
|
+
export * from "./semver.js";
|
|
7
|
+
export * from "./dirname.js";
|
|
8
|
+
export * from "./warnings.js";
|
|
9
|
+
export * from "./filterDependencyKind.js";
|
|
10
|
+
export * from "./analyzeDependencies.js";
|
|
11
|
+
export * from "./booleanToFlags.js";
|
|
12
|
+
export * from "./addMissingVersionFlags.js";
|
|
13
|
+
|
|
14
|
+
export const NPM_TOKEN = typeof process.env.NODE_SECURE_TOKEN === "string" ?
|
|
15
|
+
{ token: process.env.NODE_SECURE_TOKEN } :
|
|
16
|
+
{};
|
|
@@ -1,20 +1,20 @@
|
|
|
1
|
-
const kGitVersionVariants = ["git:", "git+", "github:"];
|
|
2
|
-
|
|
3
|
-
/**
|
|
4
|
-
* @example isGitDependency("github:NodeSecure/scanner") // => true
|
|
5
|
-
* @example isGitDependency("git+ssh://git@github.com:npm/cli#semver:^5.0") // => true
|
|
6
|
-
* @example isGitDependency(">=1.0.2 <2.1.2") // => false
|
|
7
|
-
* @example isGitDependency("http://asdf.com/asdf.tar.gz") // => false
|
|
8
|
-
* @param {string} version
|
|
9
|
-
* @returns {boolean}
|
|
10
|
-
*/
|
|
11
|
-
export function isGitDependency(version) {
|
|
12
|
-
for (const variant of kGitVersionVariants) {
|
|
13
|
-
if (version.startsWith(variant)) {
|
|
14
|
-
return true;
|
|
15
|
-
}
|
|
16
|
-
}
|
|
17
|
-
|
|
18
|
-
return false;
|
|
19
|
-
}
|
|
20
|
-
|
|
1
|
+
const kGitVersionVariants = ["git:", "git+", "github:"];
|
|
2
|
+
|
|
3
|
+
/**
|
|
4
|
+
* @example isGitDependency("github:NodeSecure/scanner") // => true
|
|
5
|
+
* @example isGitDependency("git+ssh://git@github.com:npm/cli#semver:^5.0") // => true
|
|
6
|
+
* @example isGitDependency(">=1.0.2 <2.1.2") // => false
|
|
7
|
+
* @example isGitDependency("http://asdf.com/asdf.tar.gz") // => false
|
|
8
|
+
* @param {string} version
|
|
9
|
+
* @returns {boolean}
|
|
10
|
+
*/
|
|
11
|
+
export function isGitDependency(version) {
|
|
12
|
+
for (const variant of kGitVersionVariants) {
|
|
13
|
+
if (version.startsWith(variant)) {
|
|
14
|
+
return true;
|
|
15
|
+
}
|
|
16
|
+
}
|
|
17
|
+
|
|
18
|
+
return false;
|
|
19
|
+
}
|
|
20
|
+
|
|
@@ -1,26 +1,26 @@
|
|
|
1
|
-
export function mergeDependencies(manifest, types = ["dependencies"]) {
|
|
2
|
-
const dependencies = new Map();
|
|
3
|
-
const customResolvers = new Map();
|
|
4
|
-
|
|
5
|
-
for (const fieldName of types) {
|
|
6
|
-
if (!Reflect.has(manifest, fieldName)) {
|
|
7
|
-
continue;
|
|
8
|
-
}
|
|
9
|
-
const dep = manifest[fieldName];
|
|
10
|
-
|
|
11
|
-
for (const [name, version] of Object.entries(dep)) {
|
|
12
|
-
/**
|
|
13
|
-
* Version can be file:, github:, git:, git+, ./...
|
|
14
|
-
* @see https://docs.npmjs.com/cli/v7/configuring-npm/package-json#dependencies
|
|
15
|
-
*/
|
|
16
|
-
if (/^([a-zA-Z]+:|git\+|\.\\)/.test(version)) {
|
|
17
|
-
customResolvers.set(name, version);
|
|
18
|
-
continue;
|
|
19
|
-
}
|
|
20
|
-
|
|
21
|
-
dependencies.set(name, version);
|
|
22
|
-
}
|
|
23
|
-
}
|
|
24
|
-
|
|
25
|
-
return { dependencies, customResolvers };
|
|
26
|
-
}
|
|
1
|
+
export function mergeDependencies(manifest, types = ["dependencies"]) {
|
|
2
|
+
const dependencies = new Map();
|
|
3
|
+
const customResolvers = new Map();
|
|
4
|
+
|
|
5
|
+
for (const fieldName of types) {
|
|
6
|
+
if (!Reflect.has(manifest, fieldName)) {
|
|
7
|
+
continue;
|
|
8
|
+
}
|
|
9
|
+
const dep = manifest[fieldName];
|
|
10
|
+
|
|
11
|
+
for (const [name, version] of Object.entries(dep)) {
|
|
12
|
+
/**
|
|
13
|
+
* Version can be file:, github:, git:, git+, ./...
|
|
14
|
+
* @see https://docs.npmjs.com/cli/v7/configuring-npm/package-json#dependencies
|
|
15
|
+
*/
|
|
16
|
+
if (/^([a-zA-Z]+:|git\+|\.\\)/.test(version)) {
|
|
17
|
+
customResolvers.set(name, version);
|
|
18
|
+
continue;
|
|
19
|
+
}
|
|
20
|
+
|
|
21
|
+
dependencies.set(name, version);
|
|
22
|
+
}
|
|
23
|
+
}
|
|
24
|
+
|
|
25
|
+
return { dependencies, customResolvers };
|
|
26
|
+
}
|
package/types/scanner.d.ts
CHANGED
|
@@ -128,7 +128,7 @@ declare namespace Scanner {
|
|
|
128
128
|
/** All the dependencies of the package (flattened) */
|
|
129
129
|
dependencies: Dependencies;
|
|
130
130
|
/** Version of the scanner used to generate the result */
|
|
131
|
-
|
|
131
|
+
scannerVersion: string;
|
|
132
132
|
/** Vulnerability strategy name (npm, snyk, node) */
|
|
133
133
|
vulnerabilityStrategy: Vuln.Strategy.Kind;
|
|
134
134
|
}
|