@nodesecure/scanner 3.2.1 → 3.4.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +6 -4
- package/index.js +63 -63
- package/package.json +86 -86
- package/src/class/dependency.class.js +101 -99
- package/src/depWalker.js +30 -10
- package/src/tarball.js +173 -173
- package/src/utils/warnings.js +36 -36
- package/types/api.d.ts +15 -15
- package/types/scanner.d.ts +7 -0
package/README.md
CHANGED
|
@@ -49,9 +49,9 @@ await Promise.allSettled(promises);
|
|
|
49
49
|
See `types/api.d.ts` for a complete TypeScript definition.
|
|
50
50
|
|
|
51
51
|
```ts
|
|
52
|
-
function cwd(
|
|
53
|
-
function from(packageName: string, options?: Scanner.Options): Promise<Scanner.Payload>;
|
|
54
|
-
function verify(packageName
|
|
52
|
+
function cwd(location: string, options?: Scanner.Options): Promise<Scanner.Payload>;
|
|
53
|
+
function from(packageName: string, options?: Omit<Scanner.Options, "includeDevDeps">): Promise<Scanner.Payload>;
|
|
54
|
+
function verify(packageName?: string | null): Promise<Scanner.VerifyPayload>;
|
|
55
55
|
```
|
|
56
56
|
|
|
57
57
|
`Options` is described with the following TypeScript interface:
|
|
@@ -60,6 +60,7 @@ function verify(packageName: string): Promise<Scanner.VerifyPayload>;
|
|
|
60
60
|
interface Options {
|
|
61
61
|
readonly maxDepth?: number;
|
|
62
62
|
readonly usePackageLock?: boolean;
|
|
63
|
+
readonly includeDevDeps?: boolean;
|
|
63
64
|
readonly vulnerabilityStrategy: Strategy.Kind;
|
|
64
65
|
readonly forceRootAnalysis?: boolean;
|
|
65
66
|
readonly fullLockMode?: boolean;
|
|
@@ -69,7 +70,7 @@ interface Options {
|
|
|
69
70
|
## Contributors ✨
|
|
70
71
|
|
|
71
72
|
<!-- ALL-CONTRIBUTORS-BADGE:START - Do not remove or modify this section -->
|
|
72
|
-
[](#contributors-)
|
|
73
74
|
<!-- ALL-CONTRIBUTORS-BADGE:END -->
|
|
74
75
|
|
|
75
76
|
Thanks goes to these wonderful people ([emoji key](https://allcontributors.org/docs/en/emoji-key)):
|
|
@@ -83,6 +84,7 @@ Thanks goes to these wonderful people ([emoji key](https://allcontributors.org/d
|
|
|
83
84
|
<td align="center"><a href="http://tonygo.dev"><img src="https://avatars.githubusercontent.com/u/22824417?v=4?s=100" width="100px;" alt=""/><br /><sub><b>Tony Gorez</b></sub></a><br /><a href="https://github.com/NodeSecure/scanner/commits?author=tony-go" title="Code">💻</a> <a href="https://github.com/NodeSecure/scanner/commits?author=tony-go" title="Documentation">📖</a> <a href="https://github.com/NodeSecure/scanner/pulls?q=is%3Apr+reviewed-by%3Atony-go" title="Reviewed Pull Requests">👀</a> <a href="https://github.com/NodeSecure/scanner/issues?q=author%3Atony-go" title="Bug reports">🐛</a></td>
|
|
84
85
|
<td align="center"><a href="https://mickaelcroquet.fr"><img src="https://avatars.githubusercontent.com/u/23740372?v=4?s=100" width="100px;" alt=""/><br /><sub><b>Haze</b></sub></a><br /><a href="https://github.com/NodeSecure/scanner/commits?author=CroquetMickael" title="Code">💻</a></td>
|
|
85
86
|
<td align="center"><a href="https://github.com/mbalabash"><img src="https://avatars.githubusercontent.com/u/16868922?v=4?s=100" width="100px;" alt=""/><br /><sub><b>Maksim Balabash</b></sub></a><br /><a href="https://github.com/NodeSecure/scanner/commits?author=mbalabash" title="Code">💻</a></td>
|
|
87
|
+
<td align="center"><a href="https://dev.to/antoinecoulon"><img src="https://avatars.githubusercontent.com/u/43391199?v=4?s=100" width="100px;" alt=""/><br /><sub><b>Antoine Coulon</b></sub></a><br /><a href="https://github.com/NodeSecure/scanner/commits?author=antoine-coulon" title="Code">💻</a> <a href="#security-antoine-coulon" title="Security">🛡️</a></td>
|
|
86
88
|
</tr>
|
|
87
89
|
</table>
|
|
88
90
|
|
package/index.js
CHANGED
|
@@ -1,63 +1,63 @@
|
|
|
1
|
-
// Import Node.js Dependencies
|
|
2
|
-
import path from "path";
|
|
3
|
-
import fs from "fs/promises";
|
|
4
|
-
import timers from "timers/promises";
|
|
5
|
-
import os from "os";
|
|
6
|
-
|
|
7
|
-
// Import Third-party Dependencies
|
|
8
|
-
import pacote from "pacote";
|
|
9
|
-
import { getLocalRegistryURL } from "@nodesecure/npm-registry-sdk";
|
|
10
|
-
|
|
11
|
-
// Import Internal Dependencies
|
|
12
|
-
import { depWalker } from "./src/depWalker.js";
|
|
13
|
-
import { NPM_TOKEN } from "./src/utils/index.js";
|
|
14
|
-
import { ScannerLoggerEvents } from "./src/constants.js";
|
|
15
|
-
import Logger from "./src/class/logger.class.js";
|
|
16
|
-
import * as tarball from "./src/tarball.js";
|
|
17
|
-
|
|
18
|
-
// CONSTANTS
|
|
19
|
-
const kDefaultCwdOptions = { forceRootAnalysis: true, usePackageLock: true };
|
|
20
|
-
|
|
21
|
-
export async function cwd(
|
|
22
|
-
const finalizedOptions = Object.assign({}, kDefaultCwdOptions, options);
|
|
23
|
-
|
|
24
|
-
logger.start(ScannerLoggerEvents.manifest.read);
|
|
25
|
-
const packagePath = path.join(
|
|
26
|
-
const str = await fs.readFile(packagePath, "utf-8");
|
|
27
|
-
logger.end(ScannerLoggerEvents.manifest.read);
|
|
28
|
-
|
|
29
|
-
return depWalker(JSON.parse(str), finalizedOptions, logger);
|
|
30
|
-
}
|
|
31
|
-
|
|
32
|
-
export async function from(packageName, options, logger = new Logger()) {
|
|
33
|
-
logger.start(ScannerLoggerEvents.manifest.fetch);
|
|
34
|
-
const manifest = await pacote.manifest(packageName, {
|
|
35
|
-
...NPM_TOKEN, registry: getLocalRegistryURL(), cache: `${os.homedir()}/.npm`
|
|
36
|
-
});
|
|
37
|
-
logger.end(ScannerLoggerEvents.manifest.fetch);
|
|
38
|
-
|
|
39
|
-
return depWalker(manifest, options, logger);
|
|
40
|
-
}
|
|
41
|
-
|
|
42
|
-
export async function verify(packageName = null) {
|
|
43
|
-
if (typeof packageName === "undefined" || packageName === null) {
|
|
44
|
-
return await tarball.scanPackage(process.cwd());
|
|
45
|
-
}
|
|
46
|
-
|
|
47
|
-
const tmpLocation = await fs.mkdtemp(path.join(os.tmpdir(), "/"));
|
|
48
|
-
const dest = path.join(tmpLocation, packageName);
|
|
49
|
-
|
|
50
|
-
try {
|
|
51
|
-
await pacote.extract(packageName, dest, {
|
|
52
|
-
...NPM_TOKEN, registry: getLocalRegistryURL(), cache: `${os.homedir()}/.npm`
|
|
53
|
-
});
|
|
54
|
-
|
|
55
|
-
return await tarball.scanPackage(dest, packageName);
|
|
56
|
-
}
|
|
57
|
-
finally {
|
|
58
|
-
await timers.setImmediate();
|
|
59
|
-
await fs.rm(tmpLocation, { recursive: true, force: true });
|
|
60
|
-
}
|
|
61
|
-
}
|
|
62
|
-
|
|
63
|
-
export { depWalker, tarball, Logger, ScannerLoggerEvents };
|
|
1
|
+
// Import Node.js Dependencies
|
|
2
|
+
import path from "path";
|
|
3
|
+
import fs from "fs/promises";
|
|
4
|
+
import timers from "timers/promises";
|
|
5
|
+
import os from "os";
|
|
6
|
+
|
|
7
|
+
// Import Third-party Dependencies
|
|
8
|
+
import pacote from "pacote";
|
|
9
|
+
import { getLocalRegistryURL } from "@nodesecure/npm-registry-sdk";
|
|
10
|
+
|
|
11
|
+
// Import Internal Dependencies
|
|
12
|
+
import { depWalker } from "./src/depWalker.js";
|
|
13
|
+
import { NPM_TOKEN } from "./src/utils/index.js";
|
|
14
|
+
import { ScannerLoggerEvents } from "./src/constants.js";
|
|
15
|
+
import Logger from "./src/class/logger.class.js";
|
|
16
|
+
import * as tarball from "./src/tarball.js";
|
|
17
|
+
|
|
18
|
+
// CONSTANTS
|
|
19
|
+
const kDefaultCwdOptions = { forceRootAnalysis: true, usePackageLock: true, includeDevDeps: false };
|
|
20
|
+
|
|
21
|
+
export async function cwd(location = process.cwd(), options = {}, logger = new Logger()) {
|
|
22
|
+
const finalizedOptions = Object.assign({ location }, kDefaultCwdOptions, options);
|
|
23
|
+
|
|
24
|
+
logger.start(ScannerLoggerEvents.manifest.read);
|
|
25
|
+
const packagePath = path.join(location, "package.json");
|
|
26
|
+
const str = await fs.readFile(packagePath, "utf-8");
|
|
27
|
+
logger.end(ScannerLoggerEvents.manifest.read);
|
|
28
|
+
|
|
29
|
+
return depWalker(JSON.parse(str), finalizedOptions, logger);
|
|
30
|
+
}
|
|
31
|
+
|
|
32
|
+
export async function from(packageName, options, logger = new Logger()) {
|
|
33
|
+
logger.start(ScannerLoggerEvents.manifest.fetch);
|
|
34
|
+
const manifest = await pacote.manifest(packageName, {
|
|
35
|
+
...NPM_TOKEN, registry: getLocalRegistryURL(), cache: `${os.homedir()}/.npm`
|
|
36
|
+
});
|
|
37
|
+
logger.end(ScannerLoggerEvents.manifest.fetch);
|
|
38
|
+
|
|
39
|
+
return depWalker(manifest, options, logger);
|
|
40
|
+
}
|
|
41
|
+
|
|
42
|
+
export async function verify(packageName = null) {
|
|
43
|
+
if (typeof packageName === "undefined" || packageName === null) {
|
|
44
|
+
return await tarball.scanPackage(process.cwd());
|
|
45
|
+
}
|
|
46
|
+
|
|
47
|
+
const tmpLocation = await fs.mkdtemp(path.join(os.tmpdir(), "/"));
|
|
48
|
+
const dest = path.join(tmpLocation, packageName);
|
|
49
|
+
|
|
50
|
+
try {
|
|
51
|
+
await pacote.extract(packageName, dest, {
|
|
52
|
+
...NPM_TOKEN, registry: getLocalRegistryURL(), cache: `${os.homedir()}/.npm`
|
|
53
|
+
});
|
|
54
|
+
|
|
55
|
+
return await tarball.scanPackage(dest, packageName);
|
|
56
|
+
}
|
|
57
|
+
finally {
|
|
58
|
+
await timers.setImmediate();
|
|
59
|
+
await fs.rm(tmpLocation, { recursive: true, force: true });
|
|
60
|
+
}
|
|
61
|
+
}
|
|
62
|
+
|
|
63
|
+
export { depWalker, tarball, Logger, ScannerLoggerEvents };
|
package/package.json
CHANGED
|
@@ -1,86 +1,86 @@
|
|
|
1
|
-
{
|
|
2
|
-
"name": "@nodesecure/scanner",
|
|
3
|
-
"version": "3.
|
|
4
|
-
"description": "A package API to run a static analysis of your module's dependencies.",
|
|
5
|
-
"exports": "./index.js",
|
|
6
|
-
"engines": {
|
|
7
|
-
"node": ">=16"
|
|
8
|
-
},
|
|
9
|
-
"scripts": {
|
|
10
|
-
"lint": "eslint src test",
|
|
11
|
-
"prepublishOnly": "pkg-ok",
|
|
12
|
-
"test": "npm run lint && npm run test-only",
|
|
13
|
-
"test-only": "cross-env esm-tape-runner 'test/**/*.spec.js' | tap-monkey",
|
|
14
|
-
"coverage": "c8 -r html npm run test-only"
|
|
15
|
-
},
|
|
16
|
-
"files": [
|
|
17
|
-
"src",
|
|
18
|
-
"types",
|
|
19
|
-
"index.js",
|
|
20
|
-
"index.d.ts"
|
|
21
|
-
],
|
|
22
|
-
"repository": {
|
|
23
|
-
"type": "git",
|
|
24
|
-
"url": "git+https://github.com/NodeSecure/scanner.git"
|
|
25
|
-
},
|
|
26
|
-
"keywords": [
|
|
27
|
-
"node",
|
|
28
|
-
"nodejs",
|
|
29
|
-
"security",
|
|
30
|
-
"cli",
|
|
31
|
-
"sast",
|
|
32
|
-
"scanner",
|
|
33
|
-
"static",
|
|
34
|
-
"code",
|
|
35
|
-
"analysis",
|
|
36
|
-
"node_modules",
|
|
37
|
-
"tree",
|
|
38
|
-
"npm",
|
|
39
|
-
"registry",
|
|
40
|
-
"graph",
|
|
41
|
-
"visualization",
|
|
42
|
-
"dependencies"
|
|
43
|
-
],
|
|
44
|
-
"author": "NodeSecure",
|
|
45
|
-
"license": "MIT",
|
|
46
|
-
"bugs": {
|
|
47
|
-
"url": "https://github.com/NodeSecure/scanner/issues"
|
|
48
|
-
},
|
|
49
|
-
"homepage": "https://github.com/NodeSecure/scanner#readme",
|
|
50
|
-
"devDependencies": {
|
|
51
|
-
"@nodesecure/eslint-config": "^1.3.
|
|
52
|
-
"@slimio/is": "^1.5.1",
|
|
53
|
-
"@small-tech/esm-tape-runner": "^1.0.3",
|
|
54
|
-
"@small-tech/tap-monkey": "^1.3.0",
|
|
55
|
-
"@types/node": "^
|
|
56
|
-
"c8": "^7.
|
|
57
|
-
"cross-env": "^7.0.3",
|
|
58
|
-
"dotenv": "^
|
|
59
|
-
"eslint": "^8.
|
|
60
|
-
"get-folder-size": "^3.1.0",
|
|
61
|
-
"pkg-ok": "^2.3.1",
|
|
62
|
-
"sinon": "^
|
|
63
|
-
"snap-shot-core": "^10.2.4",
|
|
64
|
-
"tape": "^5.
|
|
65
|
-
},
|
|
66
|
-
"dependencies": {
|
|
67
|
-
"@nodesecure/flags": "^2.2.0",
|
|
68
|
-
"@nodesecure/fs-walk": "^1.0.0",
|
|
69
|
-
"@nodesecure/i18n": "^1.2.1",
|
|
70
|
-
"@nodesecure/js-x-ray": "^4.2.
|
|
71
|
-
"@nodesecure/npm-registry-sdk": "^1.3.0",
|
|
72
|
-
"@nodesecure/ntlp": "^2.1.0",
|
|
73
|
-
"@nodesecure/utils": "^1.0.0",
|
|
74
|
-
"@nodesecure/vuln": "^1.
|
|
75
|
-
"@npm/types": "^1.0.1",
|
|
76
|
-
"@npmcli/arborist": "^
|
|
77
|
-
"@slimio/lock": "^1.0.0",
|
|
78
|
-
"builtins": "^4.0.0",
|
|
79
|
-
"combine-async-iterators": "^2.0.1",
|
|
80
|
-
"itertools": "^1.7.1",
|
|
81
|
-
"lodash.difference": "^4.5.0",
|
|
82
|
-
"pacote": "^
|
|
83
|
-
"semver": "^7.3.4"
|
|
84
|
-
},
|
|
85
|
-
"type": "module"
|
|
86
|
-
}
|
|
1
|
+
{
|
|
2
|
+
"name": "@nodesecure/scanner",
|
|
3
|
+
"version": "3.4.1",
|
|
4
|
+
"description": "A package API to run a static analysis of your module's dependencies.",
|
|
5
|
+
"exports": "./index.js",
|
|
6
|
+
"engines": {
|
|
7
|
+
"node": ">=16"
|
|
8
|
+
},
|
|
9
|
+
"scripts": {
|
|
10
|
+
"lint": "eslint src test",
|
|
11
|
+
"prepublishOnly": "pkg-ok",
|
|
12
|
+
"test": "npm run lint && npm run test-only",
|
|
13
|
+
"test-only": "cross-env esm-tape-runner 'test/**/*.spec.js' | tap-monkey",
|
|
14
|
+
"coverage": "c8 -r html npm run test-only"
|
|
15
|
+
},
|
|
16
|
+
"files": [
|
|
17
|
+
"src",
|
|
18
|
+
"types",
|
|
19
|
+
"index.js",
|
|
20
|
+
"index.d.ts"
|
|
21
|
+
],
|
|
22
|
+
"repository": {
|
|
23
|
+
"type": "git",
|
|
24
|
+
"url": "git+https://github.com/NodeSecure/scanner.git"
|
|
25
|
+
},
|
|
26
|
+
"keywords": [
|
|
27
|
+
"node",
|
|
28
|
+
"nodejs",
|
|
29
|
+
"security",
|
|
30
|
+
"cli",
|
|
31
|
+
"sast",
|
|
32
|
+
"scanner",
|
|
33
|
+
"static",
|
|
34
|
+
"code",
|
|
35
|
+
"analysis",
|
|
36
|
+
"node_modules",
|
|
37
|
+
"tree",
|
|
38
|
+
"npm",
|
|
39
|
+
"registry",
|
|
40
|
+
"graph",
|
|
41
|
+
"visualization",
|
|
42
|
+
"dependencies"
|
|
43
|
+
],
|
|
44
|
+
"author": "NodeSecure",
|
|
45
|
+
"license": "MIT",
|
|
46
|
+
"bugs": {
|
|
47
|
+
"url": "https://github.com/NodeSecure/scanner/issues"
|
|
48
|
+
},
|
|
49
|
+
"homepage": "https://github.com/NodeSecure/scanner#readme",
|
|
50
|
+
"devDependencies": {
|
|
51
|
+
"@nodesecure/eslint-config": "^1.3.1",
|
|
52
|
+
"@slimio/is": "^1.5.1",
|
|
53
|
+
"@small-tech/esm-tape-runner": "^1.0.3",
|
|
54
|
+
"@small-tech/tap-monkey": "^1.3.0",
|
|
55
|
+
"@types/node": "^17.0.21",
|
|
56
|
+
"c8": "^7.11.0",
|
|
57
|
+
"cross-env": "^7.0.3",
|
|
58
|
+
"dotenv": "^16.0.0",
|
|
59
|
+
"eslint": "^8.11.0",
|
|
60
|
+
"get-folder-size": "^3.1.0",
|
|
61
|
+
"pkg-ok": "^2.3.1",
|
|
62
|
+
"sinon": "^13.0.1",
|
|
63
|
+
"snap-shot-core": "^10.2.4",
|
|
64
|
+
"tape": "^5.5.2"
|
|
65
|
+
},
|
|
66
|
+
"dependencies": {
|
|
67
|
+
"@nodesecure/flags": "^2.2.0",
|
|
68
|
+
"@nodesecure/fs-walk": "^1.0.0",
|
|
69
|
+
"@nodesecure/i18n": "^1.2.1",
|
|
70
|
+
"@nodesecure/js-x-ray": "^4.2.1",
|
|
71
|
+
"@nodesecure/npm-registry-sdk": "^1.3.0",
|
|
72
|
+
"@nodesecure/ntlp": "^2.1.0",
|
|
73
|
+
"@nodesecure/utils": "^1.0.0",
|
|
74
|
+
"@nodesecure/vuln": "^1.6.0",
|
|
75
|
+
"@npm/types": "^1.0.1",
|
|
76
|
+
"@npmcli/arborist": "^5.0.3",
|
|
77
|
+
"@slimio/lock": "^1.0.0",
|
|
78
|
+
"builtins": "^4.0.0",
|
|
79
|
+
"combine-async-iterators": "^2.0.1",
|
|
80
|
+
"itertools": "^1.7.1",
|
|
81
|
+
"lodash.difference": "^4.5.0",
|
|
82
|
+
"pacote": "^13.0.5",
|
|
83
|
+
"semver": "^7.3.4"
|
|
84
|
+
},
|
|
85
|
+
"type": "module"
|
|
86
|
+
}
|
|
@@ -1,99 +1,101 @@
|
|
|
1
|
-
export default class Dependency {
|
|
2
|
-
#flags = new Set();
|
|
3
|
-
#parent = null;
|
|
4
|
-
|
|
5
|
-
constructor(name, version, parent = null) {
|
|
6
|
-
this.gitUrl = null;
|
|
7
|
-
this.dependencyCount = 0;
|
|
8
|
-
this.warnings = [];
|
|
9
|
-
this.name = name;
|
|
10
|
-
this.version = version;
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
|
|
49
|
-
|
|
50
|
-
|
|
51
|
-
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
|
|
56
|
-
|
|
57
|
-
|
|
58
|
-
|
|
59
|
-
|
|
60
|
-
|
|
61
|
-
|
|
62
|
-
|
|
63
|
-
|
|
64
|
-
|
|
65
|
-
|
|
66
|
-
|
|
67
|
-
|
|
68
|
-
|
|
69
|
-
|
|
70
|
-
|
|
71
|
-
|
|
72
|
-
|
|
73
|
-
|
|
74
|
-
|
|
75
|
-
|
|
76
|
-
|
|
77
|
-
|
|
78
|
-
|
|
79
|
-
|
|
80
|
-
|
|
81
|
-
|
|
82
|
-
|
|
83
|
-
|
|
84
|
-
|
|
85
|
-
|
|
86
|
-
|
|
87
|
-
|
|
88
|
-
|
|
89
|
-
|
|
90
|
-
|
|
91
|
-
|
|
92
|
-
|
|
93
|
-
|
|
94
|
-
|
|
95
|
-
|
|
96
|
-
|
|
97
|
-
}
|
|
98
|
-
|
|
99
|
-
|
|
1
|
+
export default class Dependency {
|
|
2
|
+
#flags = new Set();
|
|
3
|
+
#parent = null;
|
|
4
|
+
|
|
5
|
+
constructor(name, version, parent = null) {
|
|
6
|
+
this.gitUrl = null;
|
|
7
|
+
this.dependencyCount = 0;
|
|
8
|
+
this.warnings = [];
|
|
9
|
+
this.name = name;
|
|
10
|
+
this.version = version;
|
|
11
|
+
this.dev = false;
|
|
12
|
+
|
|
13
|
+
if (parent !== null) {
|
|
14
|
+
parent.dependencyCount++;
|
|
15
|
+
}
|
|
16
|
+
this.#parent = parent;
|
|
17
|
+
}
|
|
18
|
+
|
|
19
|
+
get fullName() {
|
|
20
|
+
return `${this.name} ${this.version}`;
|
|
21
|
+
}
|
|
22
|
+
|
|
23
|
+
get flags() {
|
|
24
|
+
return [...this.#flags];
|
|
25
|
+
}
|
|
26
|
+
|
|
27
|
+
get parent() {
|
|
28
|
+
return this.#parent === null ? {} : { [this.#parent.name]: this.#parent.version };
|
|
29
|
+
}
|
|
30
|
+
|
|
31
|
+
addFlag(flagName, predicate = true) {
|
|
32
|
+
if (typeof flagName !== "string") {
|
|
33
|
+
throw new TypeError("flagName argument must be typeof string");
|
|
34
|
+
}
|
|
35
|
+
|
|
36
|
+
if (predicate) {
|
|
37
|
+
if (flagName === "hasDependencies" && this.#parent !== null) {
|
|
38
|
+
this.#parent.addFlag("hasIndirectDependencies");
|
|
39
|
+
}
|
|
40
|
+
|
|
41
|
+
this.#flags.add(flagName);
|
|
42
|
+
}
|
|
43
|
+
}
|
|
44
|
+
|
|
45
|
+
isGit(url) {
|
|
46
|
+
this.#flags.add("isGit");
|
|
47
|
+
if (typeof url === "string") {
|
|
48
|
+
this.gitUrl = url;
|
|
49
|
+
}
|
|
50
|
+
|
|
51
|
+
return this;
|
|
52
|
+
}
|
|
53
|
+
|
|
54
|
+
exportAsPlainObject(customId) {
|
|
55
|
+
if (this.warnings.length > 0) {
|
|
56
|
+
this.addFlag("hasWarnings");
|
|
57
|
+
}
|
|
58
|
+
|
|
59
|
+
return {
|
|
60
|
+
versions: {
|
|
61
|
+
[this.version]: {
|
|
62
|
+
id: typeof customId === "number" ? customId : Dependency.currentId++,
|
|
63
|
+
usedBy: this.parent,
|
|
64
|
+
isDevDependency: this.dev,
|
|
65
|
+
flags: this.flags,
|
|
66
|
+
description: "",
|
|
67
|
+
size: 0,
|
|
68
|
+
author: {},
|
|
69
|
+
warnings: this.warnings,
|
|
70
|
+
composition: {
|
|
71
|
+
extensions: [],
|
|
72
|
+
files: [],
|
|
73
|
+
minified: [],
|
|
74
|
+
unused: [],
|
|
75
|
+
missing: [],
|
|
76
|
+
required_files: [],
|
|
77
|
+
required_nodejs: [],
|
|
78
|
+
required_thirdparty: []
|
|
79
|
+
},
|
|
80
|
+
license: "unkown license",
|
|
81
|
+
gitUrl: this.gitUrl
|
|
82
|
+
}
|
|
83
|
+
},
|
|
84
|
+
vulnerabilities: [],
|
|
85
|
+
metadata: {
|
|
86
|
+
dependencyCount: this.dependencyCount,
|
|
87
|
+
publishedCount: 0,
|
|
88
|
+
lastUpdateAt: null,
|
|
89
|
+
lastVersion: null,
|
|
90
|
+
hasManyPublishers: false,
|
|
91
|
+
hasReceivedUpdateInOneYear: true,
|
|
92
|
+
homepage: null,
|
|
93
|
+
author: {},
|
|
94
|
+
publishers: [],
|
|
95
|
+
maintainers: []
|
|
96
|
+
}
|
|
97
|
+
};
|
|
98
|
+
}
|
|
99
|
+
}
|
|
100
|
+
|
|
101
|
+
Dependency.currentId = 1;
|
package/src/depWalker.js
CHANGED
|
@@ -75,13 +75,15 @@ export async function* searchDeepDependencies(packageName, gitURL, options) {
|
|
|
75
75
|
yield current;
|
|
76
76
|
}
|
|
77
77
|
|
|
78
|
-
export async function* deepReadEdges(currentPackageName,
|
|
78
|
+
export async function* deepReadEdges(currentPackageName, options) {
|
|
79
|
+
const { to, parent, exclude, fullLockMode, includeDevDeps } = options;
|
|
79
80
|
const { version, integrity = to.integrity } = to.package;
|
|
80
81
|
|
|
81
82
|
const updatedVersion = version === "*" || typeof version === "undefined" ? "latest" : version;
|
|
82
83
|
const current = new Dependency(currentPackageName, updatedVersion, parent);
|
|
84
|
+
current.dev = to.dev;
|
|
83
85
|
|
|
84
|
-
if (fullLockMode) {
|
|
86
|
+
if (fullLockMode && !includeDevDeps) {
|
|
85
87
|
const { deprecated, _integrity, ...pkg } = await pacote.manifest(`${currentPackageName}@${updatedVersion}`, {
|
|
86
88
|
...NPM_TOKEN,
|
|
87
89
|
registry: getLocalRegistryURL(),
|
|
@@ -96,7 +98,7 @@ export async function* deepReadEdges(currentPackageName, { to, parent, exclude,
|
|
|
96
98
|
current.addFlag("hasDependencies", to.edgesOut.size > 0);
|
|
97
99
|
|
|
98
100
|
for (const [packageName, { to: toNode }] of to.edgesOut) {
|
|
99
|
-
if (toNode === null || toNode.dev) {
|
|
101
|
+
if (toNode === null || (!includeDevDeps && toNode.dev)) {
|
|
100
102
|
continue;
|
|
101
103
|
}
|
|
102
104
|
const cleanName = `${packageName}@${toNode.package.version}`;
|
|
@@ -113,7 +115,11 @@ export async function* deepReadEdges(currentPackageName, { to, parent, exclude,
|
|
|
113
115
|
}
|
|
114
116
|
|
|
115
117
|
export async function* getRootDependencies(manifest, options) {
|
|
116
|
-
const {
|
|
118
|
+
const {
|
|
119
|
+
maxDepth = 4, exclude,
|
|
120
|
+
usePackageLock, fullLockMode, includeDevDeps,
|
|
121
|
+
location
|
|
122
|
+
} = options;
|
|
117
123
|
|
|
118
124
|
const { dependencies, customResolvers } = mergeDependencies(manifest, void 0);
|
|
119
125
|
const parent = new Dependency(manifest.name, manifest.version);
|
|
@@ -124,19 +130,24 @@ export async function* getRootDependencies(manifest, options) {
|
|
|
124
130
|
if (usePackageLock) {
|
|
125
131
|
const arb = new Arborist({
|
|
126
132
|
...NPM_TOKEN,
|
|
133
|
+
path: location,
|
|
127
134
|
registry: getLocalRegistryURL()
|
|
128
135
|
});
|
|
129
136
|
let tree;
|
|
130
137
|
try {
|
|
131
|
-
await fs.access(path.join(
|
|
138
|
+
await fs.access(path.join(location, "node_modules"));
|
|
132
139
|
tree = await arb.loadActual();
|
|
133
140
|
}
|
|
134
141
|
catch {
|
|
135
142
|
tree = await arb.loadVirtual();
|
|
136
143
|
}
|
|
137
144
|
|
|
138
|
-
iterators =
|
|
139
|
-
|
|
145
|
+
iterators = [
|
|
146
|
+
...iter
|
|
147
|
+
.filter(tree.edgesOut.entries(), ([, { to }]) => to !== null && (includeDevDeps ? true : (!to.dev || to.isWorkspace)))
|
|
148
|
+
.map(([packageName, { to }]) => [packageName, to.isWorkspace ? to.target : to])
|
|
149
|
+
.map(([packageName, to]) => deepReadEdges(packageName, { to, parent, fullLockMode, includeDevDeps, exclude }))
|
|
150
|
+
];
|
|
140
151
|
}
|
|
141
152
|
else {
|
|
142
153
|
const configRef = { exclude, maxDepth, parent };
|
|
@@ -174,8 +185,10 @@ export async function depWalker(manifest, options = {}, logger = new Logger()) {
|
|
|
174
185
|
const {
|
|
175
186
|
forceRootAnalysis = false,
|
|
176
187
|
usePackageLock = false,
|
|
188
|
+
includeDevDeps = false,
|
|
177
189
|
fullLockMode = false,
|
|
178
190
|
maxDepth,
|
|
191
|
+
location,
|
|
179
192
|
vulnerabilityStrategy = vuln.strategies.NONE
|
|
180
193
|
} = options;
|
|
181
194
|
|
|
@@ -205,9 +218,9 @@ export async function depWalker(manifest, options = {}, logger = new Logger()) {
|
|
|
205
218
|
const tarballLocker = new Lock({ maxConcurrent: 5 });
|
|
206
219
|
tarballLocker.on("freeOne", () => logger.tick(ScannerLoggerEvents.analysis.tarball));
|
|
207
220
|
|
|
208
|
-
const rootDepsOptions = { maxDepth, exclude, usePackageLock, fullLockMode };
|
|
221
|
+
const rootDepsOptions = { maxDepth, exclude, usePackageLock, fullLockMode, includeDevDeps, location };
|
|
209
222
|
for await (const currentDep of getRootDependencies(manifest, rootDepsOptions)) {
|
|
210
|
-
const { name, version } = currentDep;
|
|
223
|
+
const { name, version, dev } = currentDep;
|
|
211
224
|
const current = currentDep.exportAsPlainObject(name === manifest.name ? 0 : void 0);
|
|
212
225
|
let proceedDependencyAnalysis = true;
|
|
213
226
|
|
|
@@ -229,6 +242,11 @@ export async function depWalker(manifest, options = {}, logger = new Logger()) {
|
|
|
229
242
|
dependencies.set(name, current);
|
|
230
243
|
}
|
|
231
244
|
|
|
245
|
+
// If the dependency is a DevDependencies we ignore it.
|
|
246
|
+
if (dev) {
|
|
247
|
+
continue;
|
|
248
|
+
}
|
|
249
|
+
|
|
232
250
|
if (proceedDependencyAnalysis) {
|
|
233
251
|
logger.tick(ScannerLoggerEvents.analysis.tree);
|
|
234
252
|
|
|
@@ -246,6 +264,7 @@ export async function depWalker(manifest, options = {}, logger = new Logger()) {
|
|
|
246
264
|
|
|
247
265
|
promisesToWait.push(scanDirOrArchive(name, version, {
|
|
248
266
|
ref: current.versions[version],
|
|
267
|
+
location,
|
|
249
268
|
tmpLocation: forceRootAnalysis && name === manifest.name ? null : tmpLocation,
|
|
250
269
|
locker: tarballLocker,
|
|
251
270
|
logger
|
|
@@ -264,7 +283,8 @@ export async function depWalker(manifest, options = {}, logger = new Logger()) {
|
|
|
264
283
|
|
|
265
284
|
const { hydratePayloadDependencies, strategy } = await vuln.setStrategy(vulnerabilityStrategy);
|
|
266
285
|
await hydratePayloadDependencies(dependencies, {
|
|
267
|
-
useStandardFormat: true
|
|
286
|
+
useStandardFormat: true,
|
|
287
|
+
path: location
|
|
268
288
|
});
|
|
269
289
|
|
|
270
290
|
payload.vulnerabilityStrategy = strategy;
|
package/src/tarball.js
CHANGED
|
@@ -1,173 +1,173 @@
|
|
|
1
|
-
// Import Node.js Dependencies
|
|
2
|
-
import path from "path";
|
|
3
|
-
import os from "os";
|
|
4
|
-
import timers from "timers/promises";
|
|
5
|
-
|
|
6
|
-
// Import Third-party Dependencies
|
|
7
|
-
import { runASTAnalysisOnFile } from "@nodesecure/js-x-ray";
|
|
8
|
-
import pacote from "pacote";
|
|
9
|
-
import ntlp from "@nodesecure/ntlp";
|
|
10
|
-
|
|
11
|
-
// Import Internal Dependencies
|
|
12
|
-
import {
|
|
13
|
-
getTarballComposition, isSensitiveFile, filterDependencyKind, analyzeDependencies, booleanToFlags,
|
|
14
|
-
NPM_TOKEN
|
|
15
|
-
} from "./utils/index.js";
|
|
16
|
-
import * as manifest from "./manifest.js";
|
|
17
|
-
import { getLocalRegistryURL } from "@nodesecure/npm-registry-sdk";
|
|
18
|
-
|
|
19
|
-
// CONSTANTS
|
|
20
|
-
const kNativeCodeExtensions = new Set([".gyp", ".c", ".cpp", ".node", ".so", ".h"]);
|
|
21
|
-
const kJsExtname = new Set([".js", ".mjs", ".cjs"]);
|
|
22
|
-
|
|
23
|
-
export async function scanJavascriptFile(dest, file, packageName) {
|
|
24
|
-
const result = await runASTAnalysisOnFile(path.join(dest, file), { packageName });
|
|
25
|
-
|
|
26
|
-
const warnings = result.warnings.map((curr) => Object.assign({}, curr, { file }));
|
|
27
|
-
if (!result.ok) {
|
|
28
|
-
return {
|
|
29
|
-
file,
|
|
30
|
-
warnings,
|
|
31
|
-
isMinified: false,
|
|
32
|
-
tryDependencies: [],
|
|
33
|
-
dependencies: [],
|
|
34
|
-
filesDependencies: []
|
|
35
|
-
};
|
|
36
|
-
}
|
|
37
|
-
const { packages, files } = filterDependencyKind(result.dependencies, path.dirname(file));
|
|
38
|
-
|
|
39
|
-
return {
|
|
40
|
-
file,
|
|
41
|
-
warnings,
|
|
42
|
-
isMinified: result.isMinified,
|
|
43
|
-
tryDependencies: [...result.dependencies.getDependenciesInTryStatement()],
|
|
44
|
-
dependencies: packages,
|
|
45
|
-
filesDependencies: files
|
|
46
|
-
};
|
|
47
|
-
}
|
|
48
|
-
|
|
49
|
-
export async function scanDirOrArchive(name, version, options) {
|
|
50
|
-
const { ref, tmpLocation, locker } = options;
|
|
51
|
-
|
|
52
|
-
const isNpmTarball = !(tmpLocation === null);
|
|
53
|
-
const dest = isNpmTarball ? path.join(tmpLocation, `${name}@${version}`) :
|
|
54
|
-
const free = await locker.acquireOne();
|
|
55
|
-
|
|
56
|
-
try {
|
|
57
|
-
// If this is an NPM tarball then we extract it on the disk with pacote.
|
|
58
|
-
if (isNpmTarball) {
|
|
59
|
-
await pacote.extract(ref.flags.includes("isGit") ? ref.gitUrl : `${name}@${version}`, dest, {
|
|
60
|
-
...NPM_TOKEN,
|
|
61
|
-
registry: getLocalRegistryURL(),
|
|
62
|
-
cache: `${os.homedir()}/.npm`
|
|
63
|
-
});
|
|
64
|
-
await timers.setImmediate();
|
|
65
|
-
}
|
|
66
|
-
|
|
67
|
-
// Read the package.json at the root of the directory or archive.
|
|
68
|
-
const { packageDeps, packageDevDeps, author, description, hasScript, hasNativeElements } = await manifest.readAnalyze(dest);
|
|
69
|
-
ref.author = author;
|
|
70
|
-
ref.description = description;
|
|
71
|
-
|
|
72
|
-
// Get the composition of the (extracted) directory
|
|
73
|
-
const { ext, files, size } = await getTarballComposition(dest);
|
|
74
|
-
ref.size = size;
|
|
75
|
-
ref.composition.extensions.push(...ext);
|
|
76
|
-
ref.composition.files.push(...files);
|
|
77
|
-
const hasBannedFile = files.some((path) => isSensitiveFile(path));
|
|
78
|
-
const hasNativeCode = hasNativeElements || files.some((file) => kNativeCodeExtensions.has(path.extname(file)));
|
|
79
|
-
|
|
80
|
-
// Search for minified and runtime dependencies
|
|
81
|
-
// Run a JS-X-Ray analysis on each JavaScript files of the project!
|
|
82
|
-
const fileAnalysisRaw = await Promise.allSettled(
|
|
83
|
-
files
|
|
84
|
-
.filter((name) => kJsExtname.has(path.extname(name)))
|
|
85
|
-
.map((file) => scanJavascriptFile(dest, file, name))
|
|
86
|
-
);
|
|
87
|
-
|
|
88
|
-
const fileAnalysisResults = fileAnalysisRaw
|
|
89
|
-
.filter((promiseSettledResult) => promiseSettledResult.status === "fulfilled")
|
|
90
|
-
.map((promiseSettledResult) => promiseSettledResult.value);
|
|
91
|
-
|
|
92
|
-
ref.warnings.push(...fileAnalysisResults.flatMap((row) => row.warnings));
|
|
93
|
-
|
|
94
|
-
const dependencies = [...new Set(fileAnalysisResults.flatMap((row) => row.dependencies))];
|
|
95
|
-
const filesDependencies = [...new Set(fileAnalysisResults.flatMap((row) => row.filesDependencies))];
|
|
96
|
-
const tryDependencies = new Set(fileAnalysisResults.flatMap((row) => row.tryDependencies));
|
|
97
|
-
const minifiedFiles = fileAnalysisResults.filter((row) => row.isMinified).flatMap((row) => row.file);
|
|
98
|
-
|
|
99
|
-
const {
|
|
100
|
-
nodeDependencies, thirdPartyDependencies, missingDependencies, unusedDependencies, flags
|
|
101
|
-
} = analyzeDependencies(dependencies, { packageDeps, packageDevDeps, tryDependencies });
|
|
102
|
-
|
|
103
|
-
ref.composition.required_thirdparty = thirdPartyDependencies;
|
|
104
|
-
ref.composition.unused.push(...unusedDependencies);
|
|
105
|
-
ref.composition.missing.push(...missingDependencies);
|
|
106
|
-
ref.composition.required_files = filesDependencies;
|
|
107
|
-
ref.composition.required_nodejs = nodeDependencies;
|
|
108
|
-
ref.composition.minified = minifiedFiles;
|
|
109
|
-
|
|
110
|
-
// License
|
|
111
|
-
await timers.setImmediate();
|
|
112
|
-
const licenses = await ntlp(dest);
|
|
113
|
-
const uniqueLicenseIds = Array.isArray(licenses.uniqueLicenseIds) ? licenses.uniqueLicenseIds : [];
|
|
114
|
-
ref.license = licenses;
|
|
115
|
-
ref.license.uniqueLicenseIds = uniqueLicenseIds;
|
|
116
|
-
|
|
117
|
-
ref.flags.push(...booleanToFlags({
|
|
118
|
-
...flags,
|
|
119
|
-
hasNoLicense: uniqueLicenseIds.length === 0,
|
|
120
|
-
hasMultipleLicenses: licenses.hasMultipleLicenses,
|
|
121
|
-
hasMinifiedCode: minifiedFiles.length > 0,
|
|
122
|
-
hasWarnings: ref.warnings.length > 0 && !ref.flags.includes("hasWarnings"),
|
|
123
|
-
hasBannedFile,
|
|
124
|
-
hasNativeCode,
|
|
125
|
-
hasScript
|
|
126
|
-
}));
|
|
127
|
-
}
|
|
128
|
-
catch {
|
|
129
|
-
// Ignore
|
|
130
|
-
}
|
|
131
|
-
finally {
|
|
132
|
-
free();
|
|
133
|
-
}
|
|
134
|
-
}
|
|
135
|
-
|
|
136
|
-
export async function scanPackage(dest, packageName) {
|
|
137
|
-
const { type = "script", name } = await manifest.read(dest);
|
|
138
|
-
|
|
139
|
-
await timers.setImmediate();
|
|
140
|
-
const { ext, files, size } = await getTarballComposition(dest);
|
|
141
|
-
ext.delete("");
|
|
142
|
-
|
|
143
|
-
// Search for runtime dependencies
|
|
144
|
-
const dependencies = Object.create(null);
|
|
145
|
-
const [minified, warnings] = [[], []];
|
|
146
|
-
|
|
147
|
-
const JSFiles = files.filter((name) => kJsExtname.has(path.extname(name)));
|
|
148
|
-
for (const file of JSFiles) {
|
|
149
|
-
const result = await runASTAnalysisOnFile(path.join(dest, file), {
|
|
150
|
-
packageName: packageName ?? name,
|
|
151
|
-
module: type === "module"
|
|
152
|
-
});
|
|
153
|
-
|
|
154
|
-
warnings.push(...result.warnings.map((curr) => Object.assign({}, curr, { file })));
|
|
155
|
-
if (!result.ok) {
|
|
156
|
-
continue;
|
|
157
|
-
}
|
|
158
|
-
|
|
159
|
-
dependencies[file] = result.dependencies.dependencies;
|
|
160
|
-
result.isMinified && minified.push(file);
|
|
161
|
-
}
|
|
162
|
-
|
|
163
|
-
await timers.setImmediate();
|
|
164
|
-
const { uniqueLicenseIds, licenses } = await ntlp(dest);
|
|
165
|
-
|
|
166
|
-
return {
|
|
167
|
-
files: { list: files, extensions: [...ext], minified },
|
|
168
|
-
directorySize: size,
|
|
169
|
-
uniqueLicenseIds,
|
|
170
|
-
licenses,
|
|
171
|
-
ast: { dependencies, warnings }
|
|
172
|
-
};
|
|
173
|
-
}
|
|
1
|
+
// Import Node.js Dependencies
|
|
2
|
+
import path from "path";
|
|
3
|
+
import os from "os";
|
|
4
|
+
import timers from "timers/promises";
|
|
5
|
+
|
|
6
|
+
// Import Third-party Dependencies
|
|
7
|
+
import { runASTAnalysisOnFile } from "@nodesecure/js-x-ray";
|
|
8
|
+
import pacote from "pacote";
|
|
9
|
+
import ntlp from "@nodesecure/ntlp";
|
|
10
|
+
|
|
11
|
+
// Import Internal Dependencies
|
|
12
|
+
import {
|
|
13
|
+
getTarballComposition, isSensitiveFile, filterDependencyKind, analyzeDependencies, booleanToFlags,
|
|
14
|
+
NPM_TOKEN
|
|
15
|
+
} from "./utils/index.js";
|
|
16
|
+
import * as manifest from "./manifest.js";
|
|
17
|
+
import { getLocalRegistryURL } from "@nodesecure/npm-registry-sdk";
|
|
18
|
+
|
|
19
|
+
// CONSTANTS
|
|
20
|
+
const kNativeCodeExtensions = new Set([".gyp", ".c", ".cpp", ".node", ".so", ".h"]);
|
|
21
|
+
const kJsExtname = new Set([".js", ".mjs", ".cjs"]);
|
|
22
|
+
|
|
23
|
+
export async function scanJavascriptFile(dest, file, packageName) {
|
|
24
|
+
const result = await runASTAnalysisOnFile(path.join(dest, file), { packageName });
|
|
25
|
+
|
|
26
|
+
const warnings = result.warnings.map((curr) => Object.assign({}, curr, { file }));
|
|
27
|
+
if (!result.ok) {
|
|
28
|
+
return {
|
|
29
|
+
file,
|
|
30
|
+
warnings,
|
|
31
|
+
isMinified: false,
|
|
32
|
+
tryDependencies: [],
|
|
33
|
+
dependencies: [],
|
|
34
|
+
filesDependencies: []
|
|
35
|
+
};
|
|
36
|
+
}
|
|
37
|
+
const { packages, files } = filterDependencyKind(result.dependencies, path.dirname(file));
|
|
38
|
+
|
|
39
|
+
return {
|
|
40
|
+
file,
|
|
41
|
+
warnings,
|
|
42
|
+
isMinified: result.isMinified,
|
|
43
|
+
tryDependencies: [...result.dependencies.getDependenciesInTryStatement()],
|
|
44
|
+
dependencies: packages,
|
|
45
|
+
filesDependencies: files
|
|
46
|
+
};
|
|
47
|
+
}
|
|
48
|
+
|
|
49
|
+
export async function scanDirOrArchive(name, version, options) {
|
|
50
|
+
const { ref, location = process.cwd(), tmpLocation, locker } = options;
|
|
51
|
+
|
|
52
|
+
const isNpmTarball = !(tmpLocation === null);
|
|
53
|
+
const dest = isNpmTarball ? path.join(tmpLocation, `${name}@${version}`) : location;
|
|
54
|
+
const free = await locker.acquireOne();
|
|
55
|
+
|
|
56
|
+
try {
|
|
57
|
+
// If this is an NPM tarball then we extract it on the disk with pacote.
|
|
58
|
+
if (isNpmTarball) {
|
|
59
|
+
await pacote.extract(ref.flags.includes("isGit") ? ref.gitUrl : `${name}@${version}`, dest, {
|
|
60
|
+
...NPM_TOKEN,
|
|
61
|
+
registry: getLocalRegistryURL(),
|
|
62
|
+
cache: `${os.homedir()}/.npm`
|
|
63
|
+
});
|
|
64
|
+
await timers.setImmediate();
|
|
65
|
+
}
|
|
66
|
+
|
|
67
|
+
// Read the package.json at the root of the directory or archive.
|
|
68
|
+
const { packageDeps, packageDevDeps, author, description, hasScript, hasNativeElements } = await manifest.readAnalyze(dest);
|
|
69
|
+
ref.author = author;
|
|
70
|
+
ref.description = description;
|
|
71
|
+
|
|
72
|
+
// Get the composition of the (extracted) directory
|
|
73
|
+
const { ext, files, size } = await getTarballComposition(dest);
|
|
74
|
+
ref.size = size;
|
|
75
|
+
ref.composition.extensions.push(...ext);
|
|
76
|
+
ref.composition.files.push(...files);
|
|
77
|
+
const hasBannedFile = files.some((path) => isSensitiveFile(path));
|
|
78
|
+
const hasNativeCode = hasNativeElements || files.some((file) => kNativeCodeExtensions.has(path.extname(file)));
|
|
79
|
+
|
|
80
|
+
// Search for minified and runtime dependencies
|
|
81
|
+
// Run a JS-X-Ray analysis on each JavaScript files of the project!
|
|
82
|
+
const fileAnalysisRaw = await Promise.allSettled(
|
|
83
|
+
files
|
|
84
|
+
.filter((name) => kJsExtname.has(path.extname(name)))
|
|
85
|
+
.map((file) => scanJavascriptFile(dest, file, name))
|
|
86
|
+
);
|
|
87
|
+
|
|
88
|
+
const fileAnalysisResults = fileAnalysisRaw
|
|
89
|
+
.filter((promiseSettledResult) => promiseSettledResult.status === "fulfilled")
|
|
90
|
+
.map((promiseSettledResult) => promiseSettledResult.value);
|
|
91
|
+
|
|
92
|
+
ref.warnings.push(...fileAnalysisResults.flatMap((row) => row.warnings));
|
|
93
|
+
|
|
94
|
+
const dependencies = [...new Set(fileAnalysisResults.flatMap((row) => row.dependencies))];
|
|
95
|
+
const filesDependencies = [...new Set(fileAnalysisResults.flatMap((row) => row.filesDependencies))];
|
|
96
|
+
const tryDependencies = new Set(fileAnalysisResults.flatMap((row) => row.tryDependencies));
|
|
97
|
+
const minifiedFiles = fileAnalysisResults.filter((row) => row.isMinified).flatMap((row) => row.file);
|
|
98
|
+
|
|
99
|
+
const {
|
|
100
|
+
nodeDependencies, thirdPartyDependencies, missingDependencies, unusedDependencies, flags
|
|
101
|
+
} = analyzeDependencies(dependencies, { packageDeps, packageDevDeps, tryDependencies });
|
|
102
|
+
|
|
103
|
+
ref.composition.required_thirdparty = thirdPartyDependencies;
|
|
104
|
+
ref.composition.unused.push(...unusedDependencies);
|
|
105
|
+
ref.composition.missing.push(...missingDependencies);
|
|
106
|
+
ref.composition.required_files = filesDependencies;
|
|
107
|
+
ref.composition.required_nodejs = nodeDependencies;
|
|
108
|
+
ref.composition.minified = minifiedFiles;
|
|
109
|
+
|
|
110
|
+
// License
|
|
111
|
+
await timers.setImmediate();
|
|
112
|
+
const licenses = await ntlp(dest);
|
|
113
|
+
const uniqueLicenseIds = Array.isArray(licenses.uniqueLicenseIds) ? licenses.uniqueLicenseIds : [];
|
|
114
|
+
ref.license = licenses;
|
|
115
|
+
ref.license.uniqueLicenseIds = uniqueLicenseIds;
|
|
116
|
+
|
|
117
|
+
ref.flags.push(...booleanToFlags({
|
|
118
|
+
...flags,
|
|
119
|
+
hasNoLicense: uniqueLicenseIds.length === 0,
|
|
120
|
+
hasMultipleLicenses: licenses.hasMultipleLicenses,
|
|
121
|
+
hasMinifiedCode: minifiedFiles.length > 0,
|
|
122
|
+
hasWarnings: ref.warnings.length > 0 && !ref.flags.includes("hasWarnings"),
|
|
123
|
+
hasBannedFile,
|
|
124
|
+
hasNativeCode,
|
|
125
|
+
hasScript
|
|
126
|
+
}));
|
|
127
|
+
}
|
|
128
|
+
catch {
|
|
129
|
+
// Ignore
|
|
130
|
+
}
|
|
131
|
+
finally {
|
|
132
|
+
free();
|
|
133
|
+
}
|
|
134
|
+
}
|
|
135
|
+
|
|
136
|
+
export async function scanPackage(dest, packageName) {
|
|
137
|
+
const { type = "script", name } = await manifest.read(dest);
|
|
138
|
+
|
|
139
|
+
await timers.setImmediate();
|
|
140
|
+
const { ext, files, size } = await getTarballComposition(dest);
|
|
141
|
+
ext.delete("");
|
|
142
|
+
|
|
143
|
+
// Search for runtime dependencies
|
|
144
|
+
const dependencies = Object.create(null);
|
|
145
|
+
const [minified, warnings] = [[], []];
|
|
146
|
+
|
|
147
|
+
const JSFiles = files.filter((name) => kJsExtname.has(path.extname(name)));
|
|
148
|
+
for (const file of JSFiles) {
|
|
149
|
+
const result = await runASTAnalysisOnFile(path.join(dest, file), {
|
|
150
|
+
packageName: packageName ?? name,
|
|
151
|
+
module: type === "module"
|
|
152
|
+
});
|
|
153
|
+
|
|
154
|
+
warnings.push(...result.warnings.map((curr) => Object.assign({}, curr, { file })));
|
|
155
|
+
if (!result.ok) {
|
|
156
|
+
continue;
|
|
157
|
+
}
|
|
158
|
+
|
|
159
|
+
dependencies[file] = result.dependencies.dependencies;
|
|
160
|
+
result.isMinified && minified.push(file);
|
|
161
|
+
}
|
|
162
|
+
|
|
163
|
+
await timers.setImmediate();
|
|
164
|
+
const { uniqueLicenseIds, licenses } = await ntlp(dest);
|
|
165
|
+
|
|
166
|
+
return {
|
|
167
|
+
files: { list: files, extensions: [...ext], minified },
|
|
168
|
+
directorySize: size,
|
|
169
|
+
uniqueLicenseIds,
|
|
170
|
+
licenses,
|
|
171
|
+
ast: { dependencies, warnings }
|
|
172
|
+
};
|
|
173
|
+
}
|
package/src/utils/warnings.js
CHANGED
|
@@ -1,36 +1,36 @@
|
|
|
1
|
-
// Import Third-party Dependencies
|
|
2
|
-
import { getToken, taggedString } from "@nodesecure/i18n";
|
|
3
|
-
|
|
4
|
-
// CONSTANTS
|
|
5
|
-
const kDetectedDep = taggedString`The dependency '${0}' has been detected in the dependency Tree.`;
|
|
6
|
-
const kWarningsMessages = Object.freeze({
|
|
7
|
-
"@scarf/scarf": getToken("warnings.disable_scarf"),
|
|
8
|
-
iohook: getToken("warnings.keylogging")
|
|
9
|
-
});
|
|
10
|
-
const kPackages = new Set(Object.keys(kWarningsMessages));
|
|
11
|
-
const kAuthors = new Set(["marak", "marak.squires@gmail.com"]);
|
|
12
|
-
|
|
13
|
-
function getWarning(depName) {
|
|
14
|
-
return `${kDetectedDep(depName)} ${kWarningsMessages[depName]}`;
|
|
15
|
-
}
|
|
16
|
-
|
|
17
|
-
export function getDependenciesWarnings(dependencies) {
|
|
18
|
-
const warnings = [];
|
|
19
|
-
for (const depName of kPackages) {
|
|
20
|
-
if (dependencies.has(depName)) {
|
|
21
|
-
warnings.push(getWarning(depName));
|
|
22
|
-
}
|
|
23
|
-
}
|
|
24
|
-
|
|
25
|
-
// TODO: optimize with @nodesecure/author later
|
|
26
|
-
for (const [packageName, dependency] of dependencies) {
|
|
27
|
-
for (const { name, email } of dependency.metadata.maintainers) {
|
|
28
|
-
if (kAuthors.has(name) || kAuthors.has(email)) {
|
|
29
|
-
warnings.push(`'Marak Squires' package '${packageName}' has been detected in the dependency tree`);
|
|
30
|
-
}
|
|
31
|
-
}
|
|
32
|
-
}
|
|
33
|
-
|
|
34
|
-
return warnings;
|
|
35
|
-
}
|
|
36
|
-
|
|
1
|
+
// Import Third-party Dependencies
|
|
2
|
+
import { getToken, taggedString } from "@nodesecure/i18n";
|
|
3
|
+
|
|
4
|
+
// CONSTANTS
|
|
5
|
+
const kDetectedDep = taggedString`The dependency '${0}' has been detected in the dependency Tree.`;
|
|
6
|
+
const kWarningsMessages = Object.freeze({
|
|
7
|
+
"@scarf/scarf": getToken("warnings.disable_scarf"),
|
|
8
|
+
iohook: getToken("warnings.keylogging")
|
|
9
|
+
});
|
|
10
|
+
const kPackages = new Set(Object.keys(kWarningsMessages));
|
|
11
|
+
const kAuthors = new Set(["marak", "marak.squires@gmail.com"]);
|
|
12
|
+
|
|
13
|
+
function getWarning(depName) {
|
|
14
|
+
return `${kDetectedDep(depName)} ${kWarningsMessages[depName]}`;
|
|
15
|
+
}
|
|
16
|
+
|
|
17
|
+
export function getDependenciesWarnings(dependencies) {
|
|
18
|
+
const warnings = [];
|
|
19
|
+
for (const depName of kPackages) {
|
|
20
|
+
if (dependencies.has(depName)) {
|
|
21
|
+
warnings.push(getWarning(depName));
|
|
22
|
+
}
|
|
23
|
+
}
|
|
24
|
+
|
|
25
|
+
// TODO: optimize with @nodesecure/author later
|
|
26
|
+
for (const [packageName, dependency] of dependencies) {
|
|
27
|
+
for (const { name, email } of dependency.metadata.maintainers) {
|
|
28
|
+
if (kAuthors.has(name) || kAuthors.has(email)) {
|
|
29
|
+
warnings.push(`'Marak Squires' package '${packageName}' has been detected in the dependency tree`);
|
|
30
|
+
}
|
|
31
|
+
}
|
|
32
|
+
}
|
|
33
|
+
|
|
34
|
+
return warnings;
|
|
35
|
+
}
|
|
36
|
+
|
package/types/api.d.ts
CHANGED
|
@@ -1,15 +1,15 @@
|
|
|
1
|
-
import Scanner from "./scanner";
|
|
2
|
-
import { Logger, LoggerEvents } from "./logger";
|
|
3
|
-
|
|
4
|
-
export {
|
|
5
|
-
cwd,
|
|
6
|
-
from,
|
|
7
|
-
verify,
|
|
8
|
-
ScannerLoggerEvents
|
|
9
|
-
}
|
|
10
|
-
|
|
11
|
-
declare const ScannerLoggerEvents: LoggerEvents;
|
|
12
|
-
|
|
13
|
-
declare function cwd(
|
|
14
|
-
declare function from(packageName: string, options?: Scanner.Options, logger?: Logger): Promise<Scanner.Payload>;
|
|
15
|
-
declare function verify(packageName
|
|
1
|
+
import Scanner from "./scanner";
|
|
2
|
+
import { Logger, LoggerEvents } from "./logger";
|
|
3
|
+
|
|
4
|
+
export {
|
|
5
|
+
cwd,
|
|
6
|
+
from,
|
|
7
|
+
verify,
|
|
8
|
+
ScannerLoggerEvents
|
|
9
|
+
}
|
|
10
|
+
|
|
11
|
+
declare const ScannerLoggerEvents: LoggerEvents;
|
|
12
|
+
|
|
13
|
+
declare function cwd(location: string, options?: Scanner.Options, logger?: Logger): Promise<Scanner.Payload>;
|
|
14
|
+
declare function from(packageName: string, options?: Omit<Scanner.Options, "includeDevDeps">, logger?: Logger): Promise<Scanner.Payload>;
|
|
15
|
+
declare function verify(packageName?: string | null): Promise<Scanner.VerifyPayload>;
|
package/types/scanner.d.ts
CHANGED
|
@@ -33,6 +33,7 @@ declare namespace Scanner {
|
|
|
33
33
|
export interface DependencyVersion {
|
|
34
34
|
/** Id of the package (useful for usedBy relation) */
|
|
35
35
|
id: number;
|
|
36
|
+
isDevDependency: boolean;
|
|
36
37
|
/** By whom (id) is used the package */
|
|
37
38
|
usedBy: Record<string, string>;
|
|
38
39
|
/** Size on disk of the extracted tarball (in bytes) */
|
|
@@ -162,6 +163,12 @@ declare namespace Scanner {
|
|
|
162
163
|
* @default true for cwd() API
|
|
163
164
|
*/
|
|
164
165
|
readonly usePackageLock?: boolean;
|
|
166
|
+
/**
|
|
167
|
+
* Include project devDependencies (only available for cwd command)
|
|
168
|
+
*
|
|
169
|
+
* @default false
|
|
170
|
+
*/
|
|
171
|
+
readonly includeDevDeps?: boolean;
|
|
165
172
|
/**
|
|
166
173
|
* Vulnerability strategy name (npm, snyk, node)
|
|
167
174
|
*
|