@nodesecure/scanner 3.4.0 → 3.6.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +97 -96
- package/package.json +20 -20
- package/src/class/dependency.class.js +5 -1
- package/src/depWalker.js +2 -1
- package/src/manifest.js +63 -57
- package/src/npmRegistry.js +74 -68
- package/src/tarball.js +10 -5
- package/src/utils/analyzeDependencies.js +71 -40
- package/src/utils/warnings.js +36 -36
- package/types/scanner.d.ts +10 -0
package/README.md
CHANGED
|
@@ -1,96 +1,97 @@
|
|
|
1
|
-
# NodeSecure Scanner
|
|
2
|
-
|
|
3
|
-
[](https://github.com/NodeSecure/scanner/commit-activity)
|
|
4
|
-
[](https://github.com/nodejs/security-wg/blob/master/processes/responsible_disclosure_template.md
|
|
5
|
-
)
|
|
6
|
-
[](https://github.com/NodeSecure/scanner/blob/master/LICENSE)
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
⚡️ Run a static analysis of your module's dependencies.
|
|
10
|
-
|
|
11
|
-
## Requirements
|
|
12
|
-
|
|
13
|
-
- [Node.js](https://nodejs.org/en/) version 16 or higher
|
|
14
|
-
|
|
15
|
-
## Getting Started
|
|
16
|
-
|
|
17
|
-
This package is available in the Node Package Repository and can be easily installed with [npm](https://docs.npmjs.com/getting-started/what-is-npm) or [yarn](https://yarnpkg.com).
|
|
18
|
-
|
|
19
|
-
```bash
|
|
20
|
-
$ npm i @nodesecure/scanner
|
|
21
|
-
# or
|
|
22
|
-
$ yarn add @nodesecure/scanner
|
|
23
|
-
```
|
|
24
|
-
|
|
25
|
-
## Usage example
|
|
26
|
-
|
|
27
|
-
```js
|
|
28
|
-
import * as scanner from "@nodesecure/scanner";
|
|
29
|
-
import fs from "fs/promises";
|
|
30
|
-
|
|
31
|
-
// CONSTANTS
|
|
32
|
-
const kPackagesToAnalyze = ["mocha", "cacache", "is-wsl"];
|
|
33
|
-
|
|
34
|
-
const payloads = await Promise.all(
|
|
35
|
-
kPackagesToAnalyze.map((name) => scanner.from(name))
|
|
36
|
-
);
|
|
37
|
-
|
|
38
|
-
const promises = [];
|
|
39
|
-
for (let i = 0; i < kPackagesToAnalyze.length; i++) {
|
|
40
|
-
const data = JSON.stringify(payloads[i], null, 2);
|
|
41
|
-
|
|
42
|
-
promises.push(fs.writeFile(`${kPackagesToAnalyze[i]}.json`, data));
|
|
43
|
-
}
|
|
44
|
-
await Promise.allSettled(promises);
|
|
45
|
-
```
|
|
46
|
-
|
|
47
|
-
## API
|
|
48
|
-
|
|
49
|
-
See `types/api.d.ts` for a complete TypeScript definition.
|
|
50
|
-
|
|
51
|
-
```ts
|
|
52
|
-
function cwd(location: string, options?: Scanner.Options): Promise<Scanner.Payload>;
|
|
53
|
-
function from(packageName: string, options?: Omit<Scanner.Options, "includeDevDeps">): Promise<Scanner.Payload>;
|
|
54
|
-
function verify(packageName?: string | null): Promise<Scanner.VerifyPayload>;
|
|
55
|
-
```
|
|
56
|
-
|
|
57
|
-
`Options` is described with the following TypeScript interface:
|
|
58
|
-
|
|
59
|
-
```ts
|
|
60
|
-
interface Options {
|
|
61
|
-
readonly maxDepth?: number;
|
|
62
|
-
readonly usePackageLock?: boolean;
|
|
63
|
-
readonly includeDevDeps?: boolean;
|
|
64
|
-
readonly vulnerabilityStrategy: Strategy.Kind;
|
|
65
|
-
readonly forceRootAnalysis?: boolean;
|
|
66
|
-
readonly fullLockMode?: boolean;
|
|
67
|
-
}
|
|
68
|
-
```
|
|
69
|
-
|
|
70
|
-
## Contributors ✨
|
|
71
|
-
|
|
72
|
-
<!-- ALL-CONTRIBUTORS-BADGE:START - Do not remove or modify this section -->
|
|
73
|
-
[):
|
|
77
|
-
|
|
78
|
-
<!-- ALL-CONTRIBUTORS-LIST:START - Do not remove or modify this section -->
|
|
79
|
-
<!-- prettier-ignore-start -->
|
|
80
|
-
<!-- markdownlint-disable -->
|
|
81
|
-
<table>
|
|
82
|
-
<tr>
|
|
83
|
-
<td align="center"><a href="https://www.linkedin.com/in/thomas-gentilhomme/"><img src="https://avatars.githubusercontent.com/u/4438263?v=4?s=100" width="100px;" alt=""/><br /><sub><b>Gentilhomme</b></sub></a><br /><a href="https://github.com/NodeSecure/scanner/commits?author=fraxken" title="Code">💻</a> <a href="https://github.com/NodeSecure/scanner/commits?author=fraxken" title="Documentation">📖</a> <a href="https://github.com/NodeSecure/scanner/pulls?q=is%3Apr+reviewed-by%3Afraxken" title="Reviewed Pull Requests">👀</a> <a href="#security-fraxken" title="Security">🛡️</a> <a href="https://github.com/NodeSecure/scanner/issues?q=author%3Afraxken" title="Bug reports">🐛</a></td>
|
|
84
|
-
<td align="center"><a href="http://tonygo.dev"><img src="https://avatars.githubusercontent.com/u/22824417?v=4?s=100" width="100px;" alt=""/><br /><sub><b>Tony Gorez</b></sub></a><br /><a href="https://github.com/NodeSecure/scanner/commits?author=tony-go" title="Code">💻</a> <a href="https://github.com/NodeSecure/scanner/commits?author=tony-go" title="Documentation">📖</a> <a href="https://github.com/NodeSecure/scanner/pulls?q=is%3Apr+reviewed-by%3Atony-go" title="Reviewed Pull Requests">👀</a> <a href="https://github.com/NodeSecure/scanner/issues?q=author%3Atony-go" title="Bug reports">🐛</a></td>
|
|
85
|
-
<td align="center"><a href="https://mickaelcroquet.fr"><img src="https://avatars.githubusercontent.com/u/23740372?v=4?s=100" width="100px;" alt=""/><br /><sub><b>Haze</b></sub></a><br /><a href="https://github.com/NodeSecure/scanner/commits?author=CroquetMickael" title="Code">💻</a></td>
|
|
86
|
-
<td align="center"><a href="https://github.com/mbalabash"><img src="https://avatars.githubusercontent.com/u/16868922?v=4?s=100" width="100px;" alt=""/><br /><sub><b>Maksim Balabash</b></sub></a><br /><a href="https://github.com/NodeSecure/scanner/commits?author=mbalabash" title="Code">💻</a></td>
|
|
87
|
-
|
|
88
|
-
</
|
|
89
|
-
|
|
90
|
-
|
|
91
|
-
<!--
|
|
92
|
-
|
|
93
|
-
|
|
94
|
-
|
|
95
|
-
|
|
96
|
-
|
|
1
|
+
# NodeSecure Scanner
|
|
2
|
+
|
|
3
|
+
[](https://github.com/NodeSecure/scanner/commit-activity)
|
|
4
|
+
[](https://github.com/nodejs/security-wg/blob/master/processes/responsible_disclosure_template.md
|
|
5
|
+
)
|
|
6
|
+
[](https://github.com/NodeSecure/scanner/blob/master/LICENSE)
|
|
7
|
+
|
|
8
|
+
|
|
9
|
+
⚡️ Run a static analysis of your module's dependencies.
|
|
10
|
+
|
|
11
|
+
## Requirements
|
|
12
|
+
|
|
13
|
+
- [Node.js](https://nodejs.org/en/) version 16 or higher
|
|
14
|
+
|
|
15
|
+
## Getting Started
|
|
16
|
+
|
|
17
|
+
This package is available in the Node Package Repository and can be easily installed with [npm](https://docs.npmjs.com/getting-started/what-is-npm) or [yarn](https://yarnpkg.com).
|
|
18
|
+
|
|
19
|
+
```bash
|
|
20
|
+
$ npm i @nodesecure/scanner
|
|
21
|
+
# or
|
|
22
|
+
$ yarn add @nodesecure/scanner
|
|
23
|
+
```
|
|
24
|
+
|
|
25
|
+
## Usage example
|
|
26
|
+
|
|
27
|
+
```js
|
|
28
|
+
import * as scanner from "@nodesecure/scanner";
|
|
29
|
+
import fs from "fs/promises";
|
|
30
|
+
|
|
31
|
+
// CONSTANTS
|
|
32
|
+
const kPackagesToAnalyze = ["mocha", "cacache", "is-wsl"];
|
|
33
|
+
|
|
34
|
+
const payloads = await Promise.all(
|
|
35
|
+
kPackagesToAnalyze.map((name) => scanner.from(name))
|
|
36
|
+
);
|
|
37
|
+
|
|
38
|
+
const promises = [];
|
|
39
|
+
for (let i = 0; i < kPackagesToAnalyze.length; i++) {
|
|
40
|
+
const data = JSON.stringify(payloads[i], null, 2);
|
|
41
|
+
|
|
42
|
+
promises.push(fs.writeFile(`${kPackagesToAnalyze[i]}.json`, data));
|
|
43
|
+
}
|
|
44
|
+
await Promise.allSettled(promises);
|
|
45
|
+
```
|
|
46
|
+
|
|
47
|
+
## API
|
|
48
|
+
|
|
49
|
+
See `types/api.d.ts` for a complete TypeScript definition.
|
|
50
|
+
|
|
51
|
+
```ts
|
|
52
|
+
function cwd(location: string, options?: Scanner.Options): Promise<Scanner.Payload>;
|
|
53
|
+
function from(packageName: string, options?: Omit<Scanner.Options, "includeDevDeps">): Promise<Scanner.Payload>;
|
|
54
|
+
function verify(packageName?: string | null): Promise<Scanner.VerifyPayload>;
|
|
55
|
+
```
|
|
56
|
+
|
|
57
|
+
`Options` is described with the following TypeScript interface:
|
|
58
|
+
|
|
59
|
+
```ts
|
|
60
|
+
interface Options {
|
|
61
|
+
readonly maxDepth?: number;
|
|
62
|
+
readonly usePackageLock?: boolean;
|
|
63
|
+
readonly includeDevDeps?: boolean;
|
|
64
|
+
readonly vulnerabilityStrategy: Strategy.Kind;
|
|
65
|
+
readonly forceRootAnalysis?: boolean;
|
|
66
|
+
readonly fullLockMode?: boolean;
|
|
67
|
+
}
|
|
68
|
+
```
|
|
69
|
+
|
|
70
|
+
## Contributors ✨
|
|
71
|
+
|
|
72
|
+
<!-- ALL-CONTRIBUTORS-BADGE:START - Do not remove or modify this section -->
|
|
73
|
+
[](#contributors-)
|
|
74
|
+
<!-- ALL-CONTRIBUTORS-BADGE:END -->
|
|
75
|
+
|
|
76
|
+
Thanks goes to these wonderful people ([emoji key](https://allcontributors.org/docs/en/emoji-key)):
|
|
77
|
+
|
|
78
|
+
<!-- ALL-CONTRIBUTORS-LIST:START - Do not remove or modify this section -->
|
|
79
|
+
<!-- prettier-ignore-start -->
|
|
80
|
+
<!-- markdownlint-disable -->
|
|
81
|
+
<table>
|
|
82
|
+
<tr>
|
|
83
|
+
<td align="center"><a href="https://www.linkedin.com/in/thomas-gentilhomme/"><img src="https://avatars.githubusercontent.com/u/4438263?v=4?s=100" width="100px;" alt=""/><br /><sub><b>Gentilhomme</b></sub></a><br /><a href="https://github.com/NodeSecure/scanner/commits?author=fraxken" title="Code">💻</a> <a href="https://github.com/NodeSecure/scanner/commits?author=fraxken" title="Documentation">📖</a> <a href="https://github.com/NodeSecure/scanner/pulls?q=is%3Apr+reviewed-by%3Afraxken" title="Reviewed Pull Requests">👀</a> <a href="#security-fraxken" title="Security">🛡️</a> <a href="https://github.com/NodeSecure/scanner/issues?q=author%3Afraxken" title="Bug reports">🐛</a></td>
|
|
84
|
+
<td align="center"><a href="http://tonygo.dev"><img src="https://avatars.githubusercontent.com/u/22824417?v=4?s=100" width="100px;" alt=""/><br /><sub><b>Tony Gorez</b></sub></a><br /><a href="https://github.com/NodeSecure/scanner/commits?author=tony-go" title="Code">💻</a> <a href="https://github.com/NodeSecure/scanner/commits?author=tony-go" title="Documentation">📖</a> <a href="https://github.com/NodeSecure/scanner/pulls?q=is%3Apr+reviewed-by%3Atony-go" title="Reviewed Pull Requests">👀</a> <a href="https://github.com/NodeSecure/scanner/issues?q=author%3Atony-go" title="Bug reports">🐛</a></td>
|
|
85
|
+
<td align="center"><a href="https://mickaelcroquet.fr"><img src="https://avatars.githubusercontent.com/u/23740372?v=4?s=100" width="100px;" alt=""/><br /><sub><b>Haze</b></sub></a><br /><a href="https://github.com/NodeSecure/scanner/commits?author=CroquetMickael" title="Code">💻</a></td>
|
|
86
|
+
<td align="center"><a href="https://github.com/mbalabash"><img src="https://avatars.githubusercontent.com/u/16868922?v=4?s=100" width="100px;" alt=""/><br /><sub><b>Maksim Balabash</b></sub></a><br /><a href="https://github.com/NodeSecure/scanner/commits?author=mbalabash" title="Code">💻</a></td>
|
|
87
|
+
<td align="center"><a href="https://dev.to/antoinecoulon"><img src="https://avatars.githubusercontent.com/u/43391199?v=4?s=100" width="100px;" alt=""/><br /><sub><b>Antoine Coulon</b></sub></a><br /><a href="https://github.com/NodeSecure/scanner/commits?author=antoine-coulon" title="Code">💻</a> <a href="#security-antoine-coulon" title="Security">🛡️</a></td>
|
|
88
|
+
</tr>
|
|
89
|
+
</table>
|
|
90
|
+
|
|
91
|
+
<!-- markdownlint-restore -->
|
|
92
|
+
<!-- prettier-ignore-end -->
|
|
93
|
+
|
|
94
|
+
<!-- ALL-CONTRIBUTORS-LIST:END -->
|
|
95
|
+
|
|
96
|
+
## License
|
|
97
|
+
MIT
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@nodesecure/scanner",
|
|
3
|
-
"version": "3.
|
|
3
|
+
"version": "3.6.0",
|
|
4
4
|
"description": "A package API to run a static analysis of your module's dependencies.",
|
|
5
5
|
"exports": "./index.js",
|
|
6
6
|
"engines": {
|
|
@@ -48,39 +48,39 @@
|
|
|
48
48
|
},
|
|
49
49
|
"homepage": "https://github.com/NodeSecure/scanner#readme",
|
|
50
50
|
"devDependencies": {
|
|
51
|
-
"@nodesecure/eslint-config": "^1.
|
|
51
|
+
"@nodesecure/eslint-config": "^1.4.0",
|
|
52
52
|
"@slimio/is": "^1.5.1",
|
|
53
|
-
"@small-tech/esm-tape-runner": "^
|
|
54
|
-
"@small-tech/tap-monkey": "^1.
|
|
55
|
-
"@types/node": "^17.0.
|
|
56
|
-
"c8": "^7.11.
|
|
53
|
+
"@small-tech/esm-tape-runner": "^2.0.0",
|
|
54
|
+
"@small-tech/tap-monkey": "^1.4.0",
|
|
55
|
+
"@types/node": "^17.0.39",
|
|
56
|
+
"c8": "^7.11.3",
|
|
57
57
|
"cross-env": "^7.0.3",
|
|
58
|
-
"dotenv": "^16.0.
|
|
59
|
-
"eslint": "^8.
|
|
58
|
+
"dotenv": "^16.0.1",
|
|
59
|
+
"eslint": "^8.17.0",
|
|
60
60
|
"get-folder-size": "^3.1.0",
|
|
61
|
-
"pkg-ok": "^
|
|
62
|
-
"sinon": "^
|
|
61
|
+
"pkg-ok": "^3.0.0",
|
|
62
|
+
"sinon": "^14.0.0",
|
|
63
63
|
"snap-shot-core": "^10.2.4",
|
|
64
|
-
"tape": "^5.5.
|
|
64
|
+
"tape": "^5.5.3"
|
|
65
65
|
},
|
|
66
66
|
"dependencies": {
|
|
67
|
-
"@nodesecure/flags": "^2.
|
|
67
|
+
"@nodesecure/flags": "^2.3.0",
|
|
68
68
|
"@nodesecure/fs-walk": "^1.0.0",
|
|
69
|
-
"@nodesecure/i18n": "^1.
|
|
70
|
-
"@nodesecure/js-x-ray": "^4.
|
|
69
|
+
"@nodesecure/i18n": "^1.3.0",
|
|
70
|
+
"@nodesecure/js-x-ray": "^4.5.0",
|
|
71
71
|
"@nodesecure/npm-registry-sdk": "^1.3.0",
|
|
72
72
|
"@nodesecure/ntlp": "^2.1.0",
|
|
73
73
|
"@nodesecure/utils": "^1.0.0",
|
|
74
|
-
"@nodesecure/vuln": "^1.
|
|
75
|
-
"@npm/types": "^1.0.
|
|
76
|
-
"@npmcli/arborist": "^5.
|
|
74
|
+
"@nodesecure/vuln": "^1.7.0",
|
|
75
|
+
"@npm/types": "^1.0.2",
|
|
76
|
+
"@npmcli/arborist": "^5.2.1",
|
|
77
77
|
"@slimio/lock": "^1.0.0",
|
|
78
|
-
"builtins": "^
|
|
78
|
+
"builtins": "^5.0.1",
|
|
79
79
|
"combine-async-iterators": "^2.0.1",
|
|
80
80
|
"itertools": "^1.7.1",
|
|
81
81
|
"lodash.difference": "^4.5.0",
|
|
82
|
-
"pacote": "^13.0
|
|
83
|
-
"semver": "^7.3.
|
|
82
|
+
"pacote": "^13.6.0",
|
|
83
|
+
"semver": "^7.3.7"
|
|
84
84
|
},
|
|
85
85
|
"type": "module"
|
|
86
86
|
}
|
|
@@ -66,6 +66,9 @@ export default class Dependency {
|
|
|
66
66
|
description: "",
|
|
67
67
|
size: 0,
|
|
68
68
|
author: {},
|
|
69
|
+
engines: {},
|
|
70
|
+
repository: {},
|
|
71
|
+
scripts: {},
|
|
69
72
|
warnings: this.warnings,
|
|
70
73
|
composition: {
|
|
71
74
|
extensions: [],
|
|
@@ -75,7 +78,8 @@ export default class Dependency {
|
|
|
75
78
|
missing: [],
|
|
76
79
|
required_files: [],
|
|
77
80
|
required_nodejs: [],
|
|
78
|
-
required_thirdparty: []
|
|
81
|
+
required_thirdparty: [],
|
|
82
|
+
required_subpath: []
|
|
79
83
|
},
|
|
80
84
|
license: "unkown license",
|
|
81
85
|
gitUrl: this.gitUrl
|
package/src/depWalker.js
CHANGED
|
@@ -283,7 +283,8 @@ export async function depWalker(manifest, options = {}, logger = new Logger()) {
|
|
|
283
283
|
|
|
284
284
|
const { hydratePayloadDependencies, strategy } = await vuln.setStrategy(vulnerabilityStrategy);
|
|
285
285
|
await hydratePayloadDependencies(dependencies, {
|
|
286
|
-
useStandardFormat: true
|
|
286
|
+
useStandardFormat: true,
|
|
287
|
+
path: location
|
|
287
288
|
});
|
|
288
289
|
|
|
289
290
|
payload.vulnerabilityStrategy = strategy;
|
package/src/manifest.js
CHANGED
|
@@ -1,57 +1,63 @@
|
|
|
1
|
-
// Import Node.js Dependencies
|
|
2
|
-
import fs from "fs/promises";
|
|
3
|
-
import path from "path";
|
|
4
|
-
|
|
5
|
-
// Import Third-party Dependencies
|
|
6
|
-
import { parseManifestAuthor } from "@nodesecure/utils";
|
|
7
|
-
|
|
8
|
-
// CONSTANTS
|
|
9
|
-
// PR welcome to contribute to this list!
|
|
10
|
-
const kNativeNpmPackages = new Set([
|
|
11
|
-
"node-gyp", "node-pre-gyp", "node-gyp-build", "node-addon-api"
|
|
12
|
-
]);
|
|
13
|
-
|
|
14
|
-
/**
|
|
15
|
-
* @see https://www.nerdycode.com/prevent-npm-executing-scripts-security/
|
|
16
|
-
*/
|
|
17
|
-
const kUnsafeNpmScripts = new Set([
|
|
18
|
-
"install",
|
|
19
|
-
"preinstall", "postinstall",
|
|
20
|
-
"preuninstall", "postuninstall"
|
|
21
|
-
]);
|
|
22
|
-
|
|
23
|
-
/**
|
|
24
|
-
* @param {!string} location
|
|
25
|
-
* @returns {import("@npm/types").PackageJson}
|
|
26
|
-
*/
|
|
27
|
-
export async function read(location) {
|
|
28
|
-
const packageStr = await fs.readFile(
|
|
29
|
-
path.join(location, "package.json"),
|
|
30
|
-
"utf-8"
|
|
31
|
-
);
|
|
32
|
-
|
|
33
|
-
return JSON.parse(packageStr);
|
|
34
|
-
}
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
|
|
44
|
-
|
|
45
|
-
const
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
|
|
49
|
-
|
|
50
|
-
|
|
51
|
-
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
|
|
56
|
-
|
|
57
|
-
|
|
1
|
+
// Import Node.js Dependencies
|
|
2
|
+
import fs from "fs/promises";
|
|
3
|
+
import path from "path";
|
|
4
|
+
|
|
5
|
+
// Import Third-party Dependencies
|
|
6
|
+
import { parseManifestAuthor } from "@nodesecure/utils";
|
|
7
|
+
|
|
8
|
+
// CONSTANTS
|
|
9
|
+
// PR welcome to contribute to this list!
|
|
10
|
+
const kNativeNpmPackages = new Set([
|
|
11
|
+
"node-gyp", "node-pre-gyp", "node-gyp-build", "node-addon-api"
|
|
12
|
+
]);
|
|
13
|
+
|
|
14
|
+
/**
|
|
15
|
+
* @see https://www.nerdycode.com/prevent-npm-executing-scripts-security/
|
|
16
|
+
*/
|
|
17
|
+
const kUnsafeNpmScripts = new Set([
|
|
18
|
+
"install",
|
|
19
|
+
"preinstall", "postinstall",
|
|
20
|
+
"preuninstall", "postuninstall"
|
|
21
|
+
]);
|
|
22
|
+
|
|
23
|
+
/**
|
|
24
|
+
* @param {!string} location
|
|
25
|
+
* @returns {import("@npm/types").PackageJson}
|
|
26
|
+
*/
|
|
27
|
+
export async function read(location) {
|
|
28
|
+
const packageStr = await fs.readFile(
|
|
29
|
+
path.join(location, "package.json"),
|
|
30
|
+
"utf-8"
|
|
31
|
+
);
|
|
32
|
+
|
|
33
|
+
return JSON.parse(packageStr);
|
|
34
|
+
}
|
|
35
|
+
|
|
36
|
+
export async function readAnalyze(location) {
|
|
37
|
+
const {
|
|
38
|
+
description = "", author = {}, scripts = {},
|
|
39
|
+
dependencies = {}, devDependencies = {}, gypfile = false,
|
|
40
|
+
engines = {},
|
|
41
|
+
repository = {},
|
|
42
|
+
imports = {}
|
|
43
|
+
} = await read(location);
|
|
44
|
+
|
|
45
|
+
const packageDeps = Object.keys(dependencies);
|
|
46
|
+
const packageDevDeps = Object.keys(devDependencies);
|
|
47
|
+
const hasNativePackage = [...packageDevDeps, ...packageDeps]
|
|
48
|
+
.some((pkg) => kNativeNpmPackages.has(pkg));
|
|
49
|
+
|
|
50
|
+
return {
|
|
51
|
+
author: typeof author === "string" ? parseManifestAuthor(author) : author,
|
|
52
|
+
description,
|
|
53
|
+
engines,
|
|
54
|
+
repository,
|
|
55
|
+
scripts,
|
|
56
|
+
hasScript: Object.keys(scripts)
|
|
57
|
+
.some((value) => kUnsafeNpmScripts.has(value.toLowerCase())),
|
|
58
|
+
packageDeps,
|
|
59
|
+
packageDevDeps,
|
|
60
|
+
nodejs: { imports },
|
|
61
|
+
hasNativeElements: hasNativePackage || gypfile
|
|
62
|
+
};
|
|
63
|
+
}
|
package/src/npmRegistry.js
CHANGED
|
@@ -1,68 +1,74 @@
|
|
|
1
|
-
// Import Third-party Dependencies
|
|
2
|
-
import semver from "semver";
|
|
3
|
-
import { parseManifestAuthor } from "@nodesecure/utils";
|
|
4
|
-
import { packument } from "@nodesecure/npm-registry-sdk";
|
|
5
|
-
|
|
6
|
-
export function parseAuthor(author) {
|
|
7
|
-
return typeof author === "string" ? parseManifestAuthor(author) : author;
|
|
8
|
-
}
|
|
9
|
-
|
|
10
|
-
export async function packageMetadata(name, version, options) {
|
|
11
|
-
const { ref, logger } = options;
|
|
12
|
-
|
|
13
|
-
try {
|
|
14
|
-
const pkg = await packument(name);
|
|
15
|
-
|
|
16
|
-
const oneYearFromToday = new Date();
|
|
17
|
-
oneYearFromToday.setFullYear(oneYearFromToday.getFullYear() - 1);
|
|
18
|
-
|
|
19
|
-
const lastVersion = pkg["dist-tags"].latest;
|
|
20
|
-
const lastUpdateAt = new Date(pkg.time[lastVersion]);
|
|
21
|
-
const metadata = {
|
|
22
|
-
author: parseAuthor(pkg.author) ?? {},
|
|
23
|
-
homepage: pkg.homepage || null,
|
|
24
|
-
publishedCount: Object.values(pkg.versions).length,
|
|
25
|
-
lastVersion,
|
|
26
|
-
lastUpdateAt,
|
|
27
|
-
hasReceivedUpdateInOneYear: !(oneYearFromToday > lastUpdateAt),
|
|
28
|
-
maintainers: pkg.maintainers,
|
|
29
|
-
publishers: []
|
|
30
|
-
};
|
|
31
|
-
|
|
32
|
-
const isOutdated = semver.neq(version, lastVersion);
|
|
33
|
-
if (isOutdated) {
|
|
34
|
-
ref.versions[version].flags.push("isOutdated");
|
|
35
|
-
}
|
|
36
|
-
|
|
37
|
-
const publishers = new Set();
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
const
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
|
|
49
|
-
|
|
50
|
-
|
|
51
|
-
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
|
|
56
|
-
|
|
57
|
-
|
|
58
|
-
|
|
59
|
-
|
|
60
|
-
|
|
61
|
-
|
|
62
|
-
|
|
63
|
-
|
|
64
|
-
|
|
65
|
-
|
|
66
|
-
|
|
67
|
-
}
|
|
68
|
-
|
|
1
|
+
// Import Third-party Dependencies
|
|
2
|
+
import semver from "semver";
|
|
3
|
+
import { parseManifestAuthor } from "@nodesecure/utils";
|
|
4
|
+
import { packument } from "@nodesecure/npm-registry-sdk";
|
|
5
|
+
|
|
6
|
+
export function parseAuthor(author) {
|
|
7
|
+
return typeof author === "string" ? parseManifestAuthor(author) : author;
|
|
8
|
+
}
|
|
9
|
+
|
|
10
|
+
export async function packageMetadata(name, version, options) {
|
|
11
|
+
const { ref, logger } = options;
|
|
12
|
+
|
|
13
|
+
try {
|
|
14
|
+
const pkg = await packument(name);
|
|
15
|
+
|
|
16
|
+
const oneYearFromToday = new Date();
|
|
17
|
+
oneYearFromToday.setFullYear(oneYearFromToday.getFullYear() - 1);
|
|
18
|
+
|
|
19
|
+
const lastVersion = pkg["dist-tags"].latest;
|
|
20
|
+
const lastUpdateAt = new Date(pkg.time[lastVersion]);
|
|
21
|
+
const metadata = {
|
|
22
|
+
author: parseAuthor(pkg.author) ?? {},
|
|
23
|
+
homepage: pkg.homepage || null,
|
|
24
|
+
publishedCount: Object.values(pkg.versions).length,
|
|
25
|
+
lastVersion,
|
|
26
|
+
lastUpdateAt,
|
|
27
|
+
hasReceivedUpdateInOneYear: !(oneYearFromToday > lastUpdateAt),
|
|
28
|
+
maintainers: pkg.maintainers ?? [],
|
|
29
|
+
publishers: []
|
|
30
|
+
};
|
|
31
|
+
|
|
32
|
+
const isOutdated = semver.neq(version, lastVersion);
|
|
33
|
+
if (isOutdated) {
|
|
34
|
+
ref.versions[version].flags.push("isOutdated");
|
|
35
|
+
}
|
|
36
|
+
|
|
37
|
+
const publishers = new Set();
|
|
38
|
+
let searchForMaintainersInVersions = metadata.maintainers.length === 0;
|
|
39
|
+
for (const ver of Object.values(pkg.versions).reverse()) {
|
|
40
|
+
const { _npmUser: npmUser, version, maintainers = [] } = ver;
|
|
41
|
+
const isNullOrUndefined = typeof npmUser === "undefined" || npmUser === null;
|
|
42
|
+
if (isNullOrUndefined || !("name" in npmUser) || typeof npmUser.name !== "string") {
|
|
43
|
+
continue;
|
|
44
|
+
}
|
|
45
|
+
|
|
46
|
+
const authorName = metadata.author?.name ?? null;
|
|
47
|
+
if (authorName === null) {
|
|
48
|
+
metadata.author = npmUser;
|
|
49
|
+
}
|
|
50
|
+
else if (npmUser.name !== metadata.author.name) {
|
|
51
|
+
metadata.hasManyPublishers = true;
|
|
52
|
+
}
|
|
53
|
+
|
|
54
|
+
// TODO: add npmUser.email
|
|
55
|
+
if (!publishers.has(npmUser.name)) {
|
|
56
|
+
publishers.add(npmUser.name);
|
|
57
|
+
metadata.publishers.push({ ...npmUser, version, at: new Date(pkg.time[version]) });
|
|
58
|
+
}
|
|
59
|
+
|
|
60
|
+
if (searchForMaintainersInVersions) {
|
|
61
|
+
metadata.maintainers.push(...maintainers);
|
|
62
|
+
searchForMaintainersInVersions = false;
|
|
63
|
+
}
|
|
64
|
+
}
|
|
65
|
+
|
|
66
|
+
Object.assign(ref.metadata, metadata);
|
|
67
|
+
}
|
|
68
|
+
catch {
|
|
69
|
+
// ignore
|
|
70
|
+
}
|
|
71
|
+
finally {
|
|
72
|
+
logger.tick("registry");
|
|
73
|
+
}
|
|
74
|
+
}
|
package/src/tarball.js
CHANGED
|
@@ -65,9 +65,13 @@ export async function scanDirOrArchive(name, version, options) {
|
|
|
65
65
|
}
|
|
66
66
|
|
|
67
67
|
// Read the package.json at the root of the directory or archive.
|
|
68
|
-
const {
|
|
69
|
-
|
|
70
|
-
|
|
68
|
+
const {
|
|
69
|
+
packageDeps,
|
|
70
|
+
packageDevDeps,
|
|
71
|
+
author, description, hasScript, hasNativeElements, nodejs,
|
|
72
|
+
engines, repository, scripts
|
|
73
|
+
} = await manifest.readAnalyze(dest);
|
|
74
|
+
Object.assign(ref, { author, description, engines, repository, scripts });
|
|
71
75
|
|
|
72
76
|
// Get the composition of the (extracted) directory
|
|
73
77
|
const { ext, files, size } = await getTarballComposition(dest);
|
|
@@ -97,10 +101,11 @@ export async function scanDirOrArchive(name, version, options) {
|
|
|
97
101
|
const minifiedFiles = fileAnalysisResults.filter((row) => row.isMinified).flatMap((row) => row.file);
|
|
98
102
|
|
|
99
103
|
const {
|
|
100
|
-
nodeDependencies, thirdPartyDependencies, missingDependencies, unusedDependencies, flags
|
|
101
|
-
} = analyzeDependencies(dependencies, { packageDeps, packageDevDeps, tryDependencies });
|
|
104
|
+
nodeDependencies, thirdPartyDependencies, subpathImportsDependencies, missingDependencies, unusedDependencies, flags
|
|
105
|
+
} = analyzeDependencies(dependencies, { packageDeps, packageDevDeps, tryDependencies, nodeImports: nodejs.imports });
|
|
102
106
|
|
|
103
107
|
ref.composition.required_thirdparty = thirdPartyDependencies;
|
|
108
|
+
ref.composition.required_subpath = Object.fromEntries(subpathImportsDependencies);
|
|
104
109
|
ref.composition.unused.push(...unusedDependencies);
|
|
105
110
|
ref.composition.missing.push(...missingDependencies);
|
|
106
111
|
ref.composition.required_files = filesDependencies;
|
|
@@ -1,40 +1,71 @@
|
|
|
1
|
-
// Import Third-party Dependencies
|
|
2
|
-
import difference from "lodash.difference";
|
|
3
|
-
import builtins from "builtins";
|
|
4
|
-
|
|
5
|
-
// Import Internal Dependencies
|
|
6
|
-
import { getPackageName } from "./getPackageName.js";
|
|
7
|
-
|
|
8
|
-
// CONSTANTS
|
|
9
|
-
const kNodeModules = new Set(builtins({ experimental: true }));
|
|
10
|
-
const kExternalModules = new Set(["http", "https", "net", "http2", "dgram", "child_process"]);
|
|
11
|
-
|
|
12
|
-
export function analyzeDependencies(dependencies, deps = {}) {
|
|
13
|
-
const { packageDeps, packageDevDeps, tryDependencies } = deps;
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
.filter((name) =>
|
|
18
|
-
.
|
|
19
|
-
|
|
20
|
-
.filter((name) => !
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
|
|
1
|
+
// Import Third-party Dependencies
|
|
2
|
+
import difference from "lodash.difference";
|
|
3
|
+
import builtins from "builtins";
|
|
4
|
+
|
|
5
|
+
// Import Internal Dependencies
|
|
6
|
+
import { getPackageName } from "./getPackageName.js";
|
|
7
|
+
|
|
8
|
+
// CONSTANTS
|
|
9
|
+
const kNodeModules = new Set(builtins({ experimental: true }));
|
|
10
|
+
const kExternalModules = new Set(["http", "https", "net", "http2", "dgram", "child_process"]);
|
|
11
|
+
|
|
12
|
+
export function analyzeDependencies(dependencies, deps = {}) {
|
|
13
|
+
const { packageDeps, packageDevDeps, tryDependencies, nodeImports = {} } = deps;
|
|
14
|
+
|
|
15
|
+
// See: https://nodejs.org/api/packages.html#subpath-imports
|
|
16
|
+
const subpathImportsDependencies = dependencies
|
|
17
|
+
.filter((name) => isAliasDependency(name) && name in nodeImports)
|
|
18
|
+
.map((name) => buildSubpathDependency(name, nodeImports));
|
|
19
|
+
const thirdPartyDependenciesAliased = new Set(
|
|
20
|
+
subpathImportsDependencies.flat().filter((name) => !isAliasDependency(name))
|
|
21
|
+
);
|
|
22
|
+
|
|
23
|
+
const thirdPartyDependencies = dependencies
|
|
24
|
+
.map((name) => (packageDeps.includes(name) ? name : getPackageName(name)))
|
|
25
|
+
.filter((name) => !name.startsWith("."))
|
|
26
|
+
.filter((name) => !isNodeCoreModule(name))
|
|
27
|
+
.filter((name) => !packageDevDeps.includes(name))
|
|
28
|
+
.filter((name) => !tryDependencies.has(name));
|
|
29
|
+
|
|
30
|
+
const unusedDependencies = difference(
|
|
31
|
+
packageDeps.filter((name) => !name.startsWith("@types")),
|
|
32
|
+
[...thirdPartyDependencies, ...thirdPartyDependenciesAliased]
|
|
33
|
+
);
|
|
34
|
+
const missingDependencies = [...new Set(difference(thirdPartyDependencies, packageDeps))]
|
|
35
|
+
.filter((name) => !(name in nodeImports));
|
|
36
|
+
const nodeDependencies = dependencies.filter((name) => isNodeCoreModule(name));
|
|
37
|
+
|
|
38
|
+
return {
|
|
39
|
+
nodeDependencies,
|
|
40
|
+
thirdPartyDependencies: [...new Set(thirdPartyDependencies)],
|
|
41
|
+
subpathImportsDependencies,
|
|
42
|
+
unusedDependencies,
|
|
43
|
+
missingDependencies,
|
|
44
|
+
|
|
45
|
+
flags: {
|
|
46
|
+
hasExternalCapacity: nodeDependencies.some((depName) => kExternalModules.has(depName)),
|
|
47
|
+
hasMissingOrUnusedDependency: unusedDependencies.length > 0 || missingDependencies.length > 0
|
|
48
|
+
}
|
|
49
|
+
};
|
|
50
|
+
}
|
|
51
|
+
|
|
52
|
+
/**
|
|
53
|
+
* @param {!string} moduleName
|
|
54
|
+
* @returns {boolean}
|
|
55
|
+
*/
|
|
56
|
+
function isNodeCoreModule(moduleName) {
|
|
57
|
+
const cleanModuleName = moduleName.startsWith("node:") ? moduleName.slice(5) : moduleName;
|
|
58
|
+
|
|
59
|
+
// Note: We need to also check moduleName because builtins package only return true for 'node:test'.
|
|
60
|
+
return kNodeModules.has(cleanModuleName) || kNodeModules.has(moduleName);
|
|
61
|
+
}
|
|
62
|
+
|
|
63
|
+
function isAliasDependency(moduleName) {
|
|
64
|
+
return moduleName.charAt(0) === "#";
|
|
65
|
+
}
|
|
66
|
+
|
|
67
|
+
function buildSubpathDependency(alias, nodeImports) {
|
|
68
|
+
const importedDependency = nodeImports[alias].node ?? nodeImports[alias].default;
|
|
69
|
+
|
|
70
|
+
return [alias, importedDependency];
|
|
71
|
+
}
|
package/src/utils/warnings.js
CHANGED
|
@@ -1,36 +1,36 @@
|
|
|
1
|
-
// Import Third-party Dependencies
|
|
2
|
-
import { getToken, taggedString } from "@nodesecure/i18n";
|
|
3
|
-
|
|
4
|
-
// CONSTANTS
|
|
5
|
-
const kDetectedDep = taggedString`The dependency '${0}' has been detected in the dependency Tree.`;
|
|
6
|
-
const kWarningsMessages = Object.freeze({
|
|
7
|
-
"@scarf/scarf": getToken("warnings.disable_scarf"),
|
|
8
|
-
iohook: getToken("warnings.keylogging")
|
|
9
|
-
});
|
|
10
|
-
const kPackages = new Set(Object.keys(kWarningsMessages));
|
|
11
|
-
const kAuthors = new Set(["marak", "marak.squires@gmail.com"]);
|
|
12
|
-
|
|
13
|
-
function getWarning(depName) {
|
|
14
|
-
return `${kDetectedDep(depName)} ${kWarningsMessages[depName]}`;
|
|
15
|
-
}
|
|
16
|
-
|
|
17
|
-
export function getDependenciesWarnings(dependencies) {
|
|
18
|
-
const warnings = [];
|
|
19
|
-
for (const depName of kPackages) {
|
|
20
|
-
if (dependencies.has(depName)) {
|
|
21
|
-
warnings.push(getWarning(depName));
|
|
22
|
-
}
|
|
23
|
-
}
|
|
24
|
-
|
|
25
|
-
// TODO: optimize with @nodesecure/author later
|
|
26
|
-
for (const [packageName, dependency] of dependencies) {
|
|
27
|
-
for (const { name, email } of dependency.metadata.maintainers) {
|
|
28
|
-
if (kAuthors.has(name) || kAuthors.has(email)) {
|
|
29
|
-
warnings.push(`'Marak Squires' package '${packageName}' has been detected in the dependency tree`);
|
|
30
|
-
}
|
|
31
|
-
}
|
|
32
|
-
}
|
|
33
|
-
|
|
34
|
-
return warnings;
|
|
35
|
-
}
|
|
36
|
-
|
|
1
|
+
// Import Third-party Dependencies
|
|
2
|
+
import { getToken, taggedString } from "@nodesecure/i18n";
|
|
3
|
+
|
|
4
|
+
// CONSTANTS
|
|
5
|
+
const kDetectedDep = taggedString`The dependency '${0}' has been detected in the dependency Tree.`;
|
|
6
|
+
const kWarningsMessages = Object.freeze({
|
|
7
|
+
"@scarf/scarf": getToken("warnings.disable_scarf"),
|
|
8
|
+
iohook: getToken("warnings.keylogging")
|
|
9
|
+
});
|
|
10
|
+
const kPackages = new Set(Object.keys(kWarningsMessages));
|
|
11
|
+
const kAuthors = new Set(["marak", "marak.squires@gmail.com"]);
|
|
12
|
+
|
|
13
|
+
function getWarning(depName) {
|
|
14
|
+
return `${kDetectedDep(depName)} ${kWarningsMessages[depName]}`;
|
|
15
|
+
}
|
|
16
|
+
|
|
17
|
+
export function getDependenciesWarnings(dependencies) {
|
|
18
|
+
const warnings = [];
|
|
19
|
+
for (const depName of kPackages) {
|
|
20
|
+
if (dependencies.has(depName)) {
|
|
21
|
+
warnings.push(getWarning(depName));
|
|
22
|
+
}
|
|
23
|
+
}
|
|
24
|
+
|
|
25
|
+
// TODO: optimize with @nodesecure/author later
|
|
26
|
+
for (const [packageName, dependency] of dependencies) {
|
|
27
|
+
for (const { name, email } of dependency.metadata.maintainers) {
|
|
28
|
+
if (kAuthors.has(name) || kAuthors.has(email)) {
|
|
29
|
+
warnings.push(`'Marak Squires' package '${packageName}' has been detected in the dependency tree`);
|
|
30
|
+
}
|
|
31
|
+
}
|
|
32
|
+
}
|
|
33
|
+
|
|
34
|
+
return warnings;
|
|
35
|
+
}
|
|
36
|
+
|
package/types/scanner.d.ts
CHANGED
|
@@ -42,6 +42,15 @@ declare namespace Scanner {
|
|
|
42
42
|
description: string;
|
|
43
43
|
/** Author of the package. This information is not trustable and can be empty. */
|
|
44
44
|
author: Maintainer;
|
|
45
|
+
engines: {
|
|
46
|
+
node?: string;
|
|
47
|
+
npm?: string;
|
|
48
|
+
};
|
|
49
|
+
repository: {
|
|
50
|
+
type: string;
|
|
51
|
+
url: string;
|
|
52
|
+
};
|
|
53
|
+
scripts: Record<string, string>;
|
|
45
54
|
/**
|
|
46
55
|
* JS-X-Ray warnings
|
|
47
56
|
*
|
|
@@ -58,6 +67,7 @@ declare namespace Scanner {
|
|
|
58
67
|
required_files: string[];
|
|
59
68
|
required_thirdparty: string[];
|
|
60
69
|
required_nodejs: string[];
|
|
70
|
+
required_subpath: string[];
|
|
61
71
|
unused: string[];
|
|
62
72
|
missing: string[];
|
|
63
73
|
};
|