@nodesecure/scanner 3.7.0 → 3.8.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/LICENSE +21 -21
- package/README.md +19 -12
- package/index.d.ts +14 -14
- package/package.json +16 -16
- package/src/class/dependency.class.js +4 -0
- package/src/class/logger.class.js +54 -54
- package/src/constants.js +13 -13
- package/src/depWalker.js +35 -4
- package/src/utils/addMissingVersionFlags.js +24 -24
- package/src/utils/booleanToFlags.js +12 -12
- package/src/utils/dirname.js +9 -9
- package/src/utils/filterDependencyKind.js +44 -44
- package/src/utils/getPackageName.js +21 -21
- package/src/utils/getTarballComposition.js +38 -38
- package/src/utils/isGitDependency.js +1 -10
- package/src/utils/isSensitiveFile.js +17 -17
- package/src/utils/mergeDependencies.js +6 -2
- package/src/utils/semver.js +49 -49
- package/src/utils/warnings.js +36 -36
- package/types/api.d.ts +2 -2
- package/types/logger.d.ts +38 -38
- package/types/scanner.d.ts +9 -4
- package/types/tarball.d.ts +63 -63
- package/types/walker.d.ts +8 -8
package/LICENSE
CHANGED
|
@@ -1,21 +1,21 @@
|
|
|
1
|
-
MIT License
|
|
2
|
-
|
|
3
|
-
Copyright (c) 2021 NodeSecure
|
|
4
|
-
|
|
5
|
-
Permission is hereby granted, free of charge, to any person obtaining a copy
|
|
6
|
-
of this software and associated documentation files (the "Software"), to deal
|
|
7
|
-
in the Software without restriction, including without limitation the rights
|
|
8
|
-
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
9
|
-
copies of the Software, and to permit persons to whom the Software is
|
|
10
|
-
furnished to do so, subject to the following conditions:
|
|
11
|
-
|
|
12
|
-
The above copyright notice and this permission notice shall be included in all
|
|
13
|
-
copies or substantial portions of the Software.
|
|
14
|
-
|
|
15
|
-
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
16
|
-
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
17
|
-
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
|
18
|
-
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
19
|
-
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
20
|
-
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
|
21
|
-
SOFTWARE.
|
|
1
|
+
MIT License
|
|
2
|
+
|
|
3
|
+
Copyright (c) 2021 NodeSecure
|
|
4
|
+
|
|
5
|
+
Permission is hereby granted, free of charge, to any person obtaining a copy
|
|
6
|
+
of this software and associated documentation files (the "Software"), to deal
|
|
7
|
+
in the Software without restriction, including without limitation the rights
|
|
8
|
+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
9
|
+
copies of the Software, and to permit persons to whom the Software is
|
|
10
|
+
furnished to do so, subject to the following conditions:
|
|
11
|
+
|
|
12
|
+
The above copyright notice and this permission notice shall be included in all
|
|
13
|
+
copies or substantial portions of the Software.
|
|
14
|
+
|
|
15
|
+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
16
|
+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
17
|
+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
|
18
|
+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
19
|
+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
20
|
+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
|
21
|
+
SOFTWARE.
|
package/README.md
CHANGED
|
@@ -1,10 +1,10 @@
|
|
|
1
1
|
# NodeSecure Scanner
|
|
2
2
|
|
|
3
3
|
[](https://github.com/NodeSecure/scanner/commit-activity)
|
|
4
|
-
[](https://api.securityscorecards.dev/projects/github.com/NodeSecure/scanner)
|
|
6
6
|
[](https://github.com/NodeSecure/scanner/blob/master/LICENSE)
|
|
7
|
-
|
|
8
8
|
|
|
9
9
|
⚡️ Run a static analysis of your module's dependencies.
|
|
10
10
|
|
|
@@ -71,7 +71,7 @@ interface Options {
|
|
|
71
71
|
## Contributors ✨
|
|
72
72
|
|
|
73
73
|
<!-- ALL-CONTRIBUTORS-BADGE:START - Do not remove or modify this section -->
|
|
74
|
-
[](#contributors-)
|
|
75
75
|
<!-- ALL-CONTRIBUTORS-BADGE:END -->
|
|
76
76
|
|
|
77
77
|
Thanks goes to these wonderful people ([emoji key](https://allcontributors.org/docs/en/emoji-key)):
|
|
@@ -80,14 +80,21 @@ Thanks goes to these wonderful people ([emoji key](https://allcontributors.org/d
|
|
|
80
80
|
<!-- prettier-ignore-start -->
|
|
81
81
|
<!-- markdownlint-disable -->
|
|
82
82
|
<table>
|
|
83
|
-
<
|
|
84
|
-
<
|
|
85
|
-
|
|
86
|
-
|
|
87
|
-
|
|
88
|
-
|
|
89
|
-
|
|
90
|
-
|
|
83
|
+
<tbody>
|
|
84
|
+
<tr>
|
|
85
|
+
<td align="center"><a href="https://www.linkedin.com/in/thomas-gentilhomme/"><img src="https://avatars.githubusercontent.com/u/4438263?v=4?s=100" width="100px;" alt="Gentilhomme"/><br /><sub><b>Gentilhomme</b></sub></a><br /><a href="https://github.com/NodeSecure/scanner/commits?author=fraxken" title="Code">💻</a> <a href="https://github.com/NodeSecure/scanner/commits?author=fraxken" title="Documentation">📖</a> <a href="https://github.com/NodeSecure/scanner/pulls?q=is%3Apr+reviewed-by%3Afraxken" title="Reviewed Pull Requests">👀</a> <a href="#security-fraxken" title="Security">🛡️</a> <a href="https://github.com/NodeSecure/scanner/issues?q=author%3Afraxken" title="Bug reports">🐛</a></td>
|
|
86
|
+
<td align="center"><a href="http://tonygo.dev"><img src="https://avatars.githubusercontent.com/u/22824417?v=4?s=100" width="100px;" alt="Tony Gorez"/><br /><sub><b>Tony Gorez</b></sub></a><br /><a href="https://github.com/NodeSecure/scanner/commits?author=tony-go" title="Code">💻</a> <a href="https://github.com/NodeSecure/scanner/commits?author=tony-go" title="Documentation">📖</a> <a href="https://github.com/NodeSecure/scanner/pulls?q=is%3Apr+reviewed-by%3Atony-go" title="Reviewed Pull Requests">👀</a> <a href="https://github.com/NodeSecure/scanner/issues?q=author%3Atony-go" title="Bug reports">🐛</a></td>
|
|
87
|
+
<td align="center"><a href="https://mickaelcroquet.fr"><img src="https://avatars.githubusercontent.com/u/23740372?v=4?s=100" width="100px;" alt="Haze"/><br /><sub><b>Haze</b></sub></a><br /><a href="https://github.com/NodeSecure/scanner/commits?author=CroquetMickael" title="Code">💻</a></td>
|
|
88
|
+
<td align="center"><a href="https://github.com/mbalabash"><img src="https://avatars.githubusercontent.com/u/16868922?v=4?s=100" width="100px;" alt="Maksim Balabash"/><br /><sub><b>Maksim Balabash</b></sub></a><br /><a href="https://github.com/NodeSecure/scanner/commits?author=mbalabash" title="Code">💻</a></td>
|
|
89
|
+
<td align="center"><a href="https://dev.to/antoinecoulon"><img src="https://avatars.githubusercontent.com/u/43391199?v=4?s=100" width="100px;" alt="Antoine Coulon"/><br /><sub><b>Antoine Coulon</b></sub></a><br /><a href="https://github.com/NodeSecure/scanner/commits?author=antoine-coulon" title="Code">💻</a> <a href="#security-antoine-coulon" title="Security">🛡️</a></td>
|
|
90
|
+
<td align="center"><a href="https://www.linkedin.com/in/nicolas-hallaert/"><img src="https://avatars.githubusercontent.com/u/39910164?v=4?s=100" width="100px;" alt="Nicolas Hallaert"/><br /><sub><b>Nicolas Hallaert</b></sub></a><br /><a href="https://github.com/NodeSecure/scanner/commits?author=Rossb0b" title="Code">💻</a></td>
|
|
91
|
+
<td align="center"><a href="http://sofiand.github.io/portfolio-client/"><img src="https://avatars.githubusercontent.com/u/39944043?v=4?s=100" width="100px;" alt="Yefis"/><br /><sub><b>Yefis</b></sub></a><br /><a href="https://github.com/NodeSecure/scanner/commits?author=SofianD" title="Code">💻</a></td>
|
|
92
|
+
</tr>
|
|
93
|
+
<tr>
|
|
94
|
+
<td align="center"><a href="https://www.linkedin.com/in/franck-hallaert/"><img src="https://avatars.githubusercontent.com/u/110826655?v=4?s=100" width="100px;" alt="Franck Hallaert"/><br /><sub><b>Franck Hallaert</b></sub></a><br /><a href="https://github.com/NodeSecure/scanner/commits?author=Aekk0" title="Code">💻</a></td>
|
|
95
|
+
<td align="center"><a href="https://www.linkedin.com/in/ange-tekeu-a155811b4/"><img src="https://avatars.githubusercontent.com/u/35274201?v=4?s=100" width="100px;" alt="Ange TEKEU"/><br /><sub><b>Ange TEKEU</b></sub></a><br /><a href="https://github.com/NodeSecure/scanner/commits?author=tekeuange23" title="Code">💻</a></td>
|
|
96
|
+
</tr>
|
|
97
|
+
</tbody>
|
|
91
98
|
</table>
|
|
92
99
|
|
|
93
100
|
<!-- markdownlint-restore -->
|
package/index.d.ts
CHANGED
|
@@ -1,14 +1,14 @@
|
|
|
1
|
-
import Scanner from "./types/scanner";
|
|
2
|
-
import { cwd, from, verify, ScannerLoggerEvents } from "./types/api";
|
|
3
|
-
import { depWalker } from "./types/walker";
|
|
4
|
-
import { Logger, LoggerEventData } from "./types/logger";
|
|
5
|
-
import tarball from "./types/tarball";
|
|
6
|
-
|
|
7
|
-
export {
|
|
8
|
-
cwd, from, verify, ScannerLoggerEvents,
|
|
9
|
-
Scanner,
|
|
10
|
-
Logger,
|
|
11
|
-
LoggerEventData,
|
|
12
|
-
tarball,
|
|
13
|
-
depWalker
|
|
14
|
-
}
|
|
1
|
+
import Scanner from "./types/scanner";
|
|
2
|
+
import { cwd, from, verify, ScannerLoggerEvents } from "./types/api";
|
|
3
|
+
import { depWalker } from "./types/walker";
|
|
4
|
+
import { Logger, LoggerEventData } from "./types/logger";
|
|
5
|
+
import tarball from "./types/tarball";
|
|
6
|
+
|
|
7
|
+
export {
|
|
8
|
+
cwd, from, verify, ScannerLoggerEvents,
|
|
9
|
+
Scanner,
|
|
10
|
+
Logger,
|
|
11
|
+
LoggerEventData,
|
|
12
|
+
tarball,
|
|
13
|
+
depWalker
|
|
14
|
+
}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@nodesecure/scanner",
|
|
3
|
-
"version": "3.
|
|
3
|
+
"version": "3.8.1",
|
|
4
4
|
"description": "A package API to run a static analysis of your module's dependencies.",
|
|
5
5
|
"exports": "./index.js",
|
|
6
6
|
"engines": {
|
|
@@ -48,39 +48,39 @@
|
|
|
48
48
|
},
|
|
49
49
|
"homepage": "https://github.com/NodeSecure/scanner#readme",
|
|
50
50
|
"devDependencies": {
|
|
51
|
-
"@nodesecure/eslint-config": "^1.
|
|
51
|
+
"@nodesecure/eslint-config": "^1.6.0",
|
|
52
52
|
"@slimio/is": "^1.5.1",
|
|
53
53
|
"@small-tech/esm-tape-runner": "^2.0.0",
|
|
54
54
|
"@small-tech/tap-monkey": "^1.4.0",
|
|
55
|
-
"@types/node": "^18.
|
|
56
|
-
"c8": "^7.
|
|
55
|
+
"@types/node": "^18.11.18",
|
|
56
|
+
"c8": "^7.12.0",
|
|
57
57
|
"cross-env": "^7.0.3",
|
|
58
|
-
"dotenv": "^16.0.
|
|
59
|
-
"eslint": "^8.
|
|
60
|
-
"get-folder-size": "^
|
|
58
|
+
"dotenv": "^16.0.3",
|
|
59
|
+
"eslint": "^8.31.0",
|
|
60
|
+
"get-folder-size": "^4.0.0",
|
|
61
61
|
"pkg-ok": "^3.0.0",
|
|
62
|
-
"sinon": "^
|
|
62
|
+
"sinon": "^15.0.1",
|
|
63
63
|
"snap-shot-core": "^10.2.4",
|
|
64
|
-
"tape": "^5.
|
|
64
|
+
"tape": "^5.6.1"
|
|
65
65
|
},
|
|
66
66
|
"dependencies": {
|
|
67
67
|
"@nodesecure/flags": "^2.4.0",
|
|
68
68
|
"@nodesecure/fs-walk": "^1.0.0",
|
|
69
|
-
"@nodesecure/i18n": "^2.
|
|
70
|
-
"@nodesecure/js-x-ray": "^5.0
|
|
71
|
-
"@nodesecure/npm-registry-sdk": "^1.4.
|
|
72
|
-
"@nodesecure/ntlp": "^2.
|
|
69
|
+
"@nodesecure/i18n": "^2.1.1",
|
|
70
|
+
"@nodesecure/js-x-ray": "^5.1.0",
|
|
71
|
+
"@nodesecure/npm-registry-sdk": "^1.4.1",
|
|
72
|
+
"@nodesecure/ntlp": "^2.2.0",
|
|
73
73
|
"@nodesecure/utils": "^1.0.0",
|
|
74
74
|
"@nodesecure/vuln": "^1.7.0",
|
|
75
75
|
"@npm/types": "^1.0.2",
|
|
76
|
-
"@npmcli/arborist": "^
|
|
76
|
+
"@npmcli/arborist": "^6.1.5",
|
|
77
77
|
"@slimio/lock": "^1.0.0",
|
|
78
78
|
"builtins": "^5.0.1",
|
|
79
79
|
"combine-async-iterators": "^2.0.1",
|
|
80
80
|
"itertools": "^1.7.1",
|
|
81
81
|
"lodash.difference": "^4.5.0",
|
|
82
|
-
"pacote": "^
|
|
83
|
-
"semver": "^7.3.
|
|
82
|
+
"pacote": "^15.0.8",
|
|
83
|
+
"semver": "^7.3.8"
|
|
84
84
|
},
|
|
85
85
|
"type": "module"
|
|
86
86
|
}
|
|
@@ -9,6 +9,8 @@ export default class Dependency {
|
|
|
9
9
|
this.name = name;
|
|
10
10
|
this.version = version;
|
|
11
11
|
this.dev = false;
|
|
12
|
+
this.existOnRemoteRegistry = true;
|
|
13
|
+
this.alias = {};
|
|
12
14
|
|
|
13
15
|
if (parent !== null) {
|
|
14
16
|
parent.dependencyCount++;
|
|
@@ -62,6 +64,7 @@ export default class Dependency {
|
|
|
62
64
|
id: typeof customId === "number" ? customId : Dependency.currentId++,
|
|
63
65
|
usedBy: this.parent,
|
|
64
66
|
isDevDependency: this.dev,
|
|
67
|
+
existOnRemoteRegistry: this.existOnRemoteRegistry,
|
|
65
68
|
flags: this.flags,
|
|
66
69
|
description: "",
|
|
67
70
|
size: 0,
|
|
@@ -76,6 +79,7 @@ export default class Dependency {
|
|
|
76
79
|
minified: [],
|
|
77
80
|
unused: [],
|
|
78
81
|
missing: [],
|
|
82
|
+
alias: this.alias,
|
|
79
83
|
required_files: [],
|
|
80
84
|
required_nodejs: [],
|
|
81
85
|
required_thirdparty: [],
|
|
@@ -1,54 +1,54 @@
|
|
|
1
|
-
// Import Node.js Dependencies
|
|
2
|
-
import { EventEmitter } from "events";
|
|
3
|
-
import { performance } from "perf_hooks";
|
|
4
|
-
|
|
5
|
-
export default class Logger extends EventEmitter {
|
|
6
|
-
constructor() {
|
|
7
|
-
super();
|
|
8
|
-
|
|
9
|
-
this.events = new Map();
|
|
10
|
-
}
|
|
11
|
-
|
|
12
|
-
start(eventName) {
|
|
13
|
-
if (this.events.has(eventName)) {
|
|
14
|
-
return this;
|
|
15
|
-
}
|
|
16
|
-
|
|
17
|
-
this.events.set(eventName, {
|
|
18
|
-
startedAt: performance.now(),
|
|
19
|
-
count: 0
|
|
20
|
-
});
|
|
21
|
-
this.emit("start", eventName);
|
|
22
|
-
|
|
23
|
-
return this;
|
|
24
|
-
}
|
|
25
|
-
|
|
26
|
-
tick(eventName) {
|
|
27
|
-
if (!this.events.has(eventName)) {
|
|
28
|
-
return this;
|
|
29
|
-
}
|
|
30
|
-
|
|
31
|
-
this.events.get(eventName).count++;
|
|
32
|
-
this.emit("tick", eventName);
|
|
33
|
-
|
|
34
|
-
return this;
|
|
35
|
-
}
|
|
36
|
-
|
|
37
|
-
count(eventName) {
|
|
38
|
-
return this.events.get(eventName)?.count ?? 0;
|
|
39
|
-
}
|
|
40
|
-
|
|
41
|
-
end(eventName) {
|
|
42
|
-
if (!this.events.has(eventName)) {
|
|
43
|
-
return this;
|
|
44
|
-
}
|
|
45
|
-
|
|
46
|
-
const data = this.events.get(eventName);
|
|
47
|
-
this.emit("end", eventName, {
|
|
48
|
-
...data,
|
|
49
|
-
executionTime: performance.now() - data.startedAt
|
|
50
|
-
});
|
|
51
|
-
|
|
52
|
-
return this;
|
|
53
|
-
}
|
|
54
|
-
}
|
|
1
|
+
// Import Node.js Dependencies
|
|
2
|
+
import { EventEmitter } from "events";
|
|
3
|
+
import { performance } from "perf_hooks";
|
|
4
|
+
|
|
5
|
+
export default class Logger extends EventEmitter {
|
|
6
|
+
constructor() {
|
|
7
|
+
super();
|
|
8
|
+
|
|
9
|
+
this.events = new Map();
|
|
10
|
+
}
|
|
11
|
+
|
|
12
|
+
start(eventName) {
|
|
13
|
+
if (this.events.has(eventName)) {
|
|
14
|
+
return this;
|
|
15
|
+
}
|
|
16
|
+
|
|
17
|
+
this.events.set(eventName, {
|
|
18
|
+
startedAt: performance.now(),
|
|
19
|
+
count: 0
|
|
20
|
+
});
|
|
21
|
+
this.emit("start", eventName);
|
|
22
|
+
|
|
23
|
+
return this;
|
|
24
|
+
}
|
|
25
|
+
|
|
26
|
+
tick(eventName) {
|
|
27
|
+
if (!this.events.has(eventName)) {
|
|
28
|
+
return this;
|
|
29
|
+
}
|
|
30
|
+
|
|
31
|
+
this.events.get(eventName).count++;
|
|
32
|
+
this.emit("tick", eventName);
|
|
33
|
+
|
|
34
|
+
return this;
|
|
35
|
+
}
|
|
36
|
+
|
|
37
|
+
count(eventName) {
|
|
38
|
+
return this.events.get(eventName)?.count ?? 0;
|
|
39
|
+
}
|
|
40
|
+
|
|
41
|
+
end(eventName) {
|
|
42
|
+
if (!this.events.has(eventName)) {
|
|
43
|
+
return this;
|
|
44
|
+
}
|
|
45
|
+
|
|
46
|
+
const data = this.events.get(eventName);
|
|
47
|
+
this.emit("end", eventName, {
|
|
48
|
+
...data,
|
|
49
|
+
executionTime: performance.now() - data.startedAt
|
|
50
|
+
});
|
|
51
|
+
|
|
52
|
+
return this;
|
|
53
|
+
}
|
|
54
|
+
}
|
package/src/constants.js
CHANGED
|
@@ -1,13 +1,13 @@
|
|
|
1
|
-
|
|
2
|
-
export const ScannerLoggerEvents = {
|
|
3
|
-
done: "depWalkerFinished",
|
|
4
|
-
analysis: {
|
|
5
|
-
tree: "walkTree",
|
|
6
|
-
tarball: "tarball",
|
|
7
|
-
registry: "registry"
|
|
8
|
-
},
|
|
9
|
-
manifest: {
|
|
10
|
-
read: "readManifest",
|
|
11
|
-
fetch: "fetchManifest"
|
|
12
|
-
}
|
|
13
|
-
};
|
|
1
|
+
|
|
2
|
+
export const ScannerLoggerEvents = {
|
|
3
|
+
done: "depWalkerFinished",
|
|
4
|
+
analysis: {
|
|
5
|
+
tree: "walkTree",
|
|
6
|
+
tarball: "tarball",
|
|
7
|
+
registry: "registry"
|
|
8
|
+
},
|
|
9
|
+
manifest: {
|
|
10
|
+
read: "readManifest",
|
|
11
|
+
fetch: "fetchManifest"
|
|
12
|
+
}
|
|
13
|
+
};
|
package/src/depWalker.js
CHANGED
|
@@ -37,10 +37,24 @@ export async function* searchDeepDependencies(packageName, gitURL, options) {
|
|
|
37
37
|
registry,
|
|
38
38
|
cache: `${os.homedir()}/.npm`
|
|
39
39
|
});
|
|
40
|
-
const { dependencies, customResolvers } = mergeDependencies(pkg);
|
|
40
|
+
const { dependencies, customResolvers, alias } = mergeDependencies(pkg);
|
|
41
41
|
|
|
42
42
|
const current = new Dependency(name, version, parent);
|
|
43
|
-
|
|
43
|
+
current.alias = Object.fromEntries(alias);
|
|
44
|
+
|
|
45
|
+
if (gitURL !== null) {
|
|
46
|
+
current.isGit(gitURL);
|
|
47
|
+
try {
|
|
48
|
+
await pacote.manifest(`${name}@${version}`, {
|
|
49
|
+
...NPM_TOKEN,
|
|
50
|
+
registry,
|
|
51
|
+
cache: `${os.homedir()}/.npm`
|
|
52
|
+
});
|
|
53
|
+
}
|
|
54
|
+
catch {
|
|
55
|
+
current.existOnRemoteRegistry = false;
|
|
56
|
+
}
|
|
57
|
+
}
|
|
44
58
|
current.addFlag("isDeprecated", deprecated === true);
|
|
45
59
|
current.addFlag("hasCustomResolver", customResolvers.size > 0);
|
|
46
60
|
current.addFlag("hasDependencies", dependencies.size > 0);
|
|
@@ -88,11 +102,16 @@ export async function* deepReadEdges(currentPackageName, options) {
|
|
|
88
102
|
registry,
|
|
89
103
|
cache: `${os.homedir()}/.npm`
|
|
90
104
|
});
|
|
91
|
-
const { customResolvers } = mergeDependencies(pkg);
|
|
105
|
+
const { customResolvers, alias } = mergeDependencies(pkg);
|
|
92
106
|
|
|
107
|
+
current.alias = Object.fromEntries(alias);
|
|
93
108
|
current.addFlag("hasValidIntegrity", _integrity === integrity);
|
|
94
109
|
current.addFlag("isDeprecated");
|
|
95
110
|
current.addFlag("hasCustomResolver", customResolvers.size > 0);
|
|
111
|
+
|
|
112
|
+
if (isGitDependency(to.resolved)) {
|
|
113
|
+
current.isGit(to.resolved);
|
|
114
|
+
}
|
|
96
115
|
}
|
|
97
116
|
current.addFlag("hasDependencies", to.edgesOut.size > 0);
|
|
98
117
|
|
|
@@ -121,8 +140,20 @@ export async function* getRootDependencies(manifest, options) {
|
|
|
121
140
|
registry
|
|
122
141
|
} = options;
|
|
123
142
|
|
|
124
|
-
const { dependencies, customResolvers } = mergeDependencies(manifest, void 0);
|
|
143
|
+
const { dependencies, customResolvers, alias } = mergeDependencies(manifest, void 0);
|
|
125
144
|
const parent = new Dependency(manifest.name, manifest.version);
|
|
145
|
+
parent.alias = Object.fromEntries(alias);
|
|
146
|
+
|
|
147
|
+
try {
|
|
148
|
+
await pacote.manifest(`${manifest.name}@${manifest.version}`, {
|
|
149
|
+
...NPM_TOKEN,
|
|
150
|
+
registry,
|
|
151
|
+
cache: `${os.homedir()}/.npm`
|
|
152
|
+
});
|
|
153
|
+
}
|
|
154
|
+
catch {
|
|
155
|
+
parent.existOnRemoteRegistry = false;
|
|
156
|
+
}
|
|
126
157
|
parent.addFlag("hasCustomResolver", customResolvers.size > 0);
|
|
127
158
|
parent.addFlag("hasDependencies", dependencies.size > 0);
|
|
128
159
|
|
|
@@ -1,24 +1,24 @@
|
|
|
1
|
-
/**
|
|
2
|
-
* @param {Set<string>} flags
|
|
3
|
-
* @param {import("../../types/scanner").Dependency} descriptor
|
|
4
|
-
*/
|
|
5
|
-
export function* addMissingVersionFlags(flags, descriptor) {
|
|
6
|
-
const { metadata, vulnerabilities = [], versions } = descriptor;
|
|
7
|
-
const semverVersions = Object.keys(versions);
|
|
8
|
-
|
|
9
|
-
if (!metadata.hasReceivedUpdateInOneYear && flags.has("hasOutdatedDependency") && !flags.has("isDead")) {
|
|
10
|
-
yield "isDead";
|
|
11
|
-
}
|
|
12
|
-
if (metadata.hasManyPublishers && !flags.has("hasManyPublishers")) {
|
|
13
|
-
yield "hasManyPublishers";
|
|
14
|
-
}
|
|
15
|
-
if (metadata.hasChangedAuthor && !flags.has("hasChangedAuthor")) {
|
|
16
|
-
yield "hasChangedAuthor";
|
|
17
|
-
}
|
|
18
|
-
if (vulnerabilities.length > 0 && !flags.has("hasVulnerabilities")) {
|
|
19
|
-
yield "hasVulnerabilities";
|
|
20
|
-
}
|
|
21
|
-
if (semverVersions.length > 1 && !flags.has("hasDuplicate")) {
|
|
22
|
-
yield "hasDuplicate";
|
|
23
|
-
}
|
|
24
|
-
}
|
|
1
|
+
/**
|
|
2
|
+
* @param {Set<string>} flags
|
|
3
|
+
* @param {import("../../types/scanner").Dependency} descriptor
|
|
4
|
+
*/
|
|
5
|
+
export function* addMissingVersionFlags(flags, descriptor) {
|
|
6
|
+
const { metadata, vulnerabilities = [], versions } = descriptor;
|
|
7
|
+
const semverVersions = Object.keys(versions);
|
|
8
|
+
|
|
9
|
+
if (!metadata.hasReceivedUpdateInOneYear && flags.has("hasOutdatedDependency") && !flags.has("isDead")) {
|
|
10
|
+
yield "isDead";
|
|
11
|
+
}
|
|
12
|
+
if (metadata.hasManyPublishers && !flags.has("hasManyPublishers")) {
|
|
13
|
+
yield "hasManyPublishers";
|
|
14
|
+
}
|
|
15
|
+
if (metadata.hasChangedAuthor && !flags.has("hasChangedAuthor")) {
|
|
16
|
+
yield "hasChangedAuthor";
|
|
17
|
+
}
|
|
18
|
+
if (vulnerabilities.length > 0 && !flags.has("hasVulnerabilities")) {
|
|
19
|
+
yield "hasVulnerabilities";
|
|
20
|
+
}
|
|
21
|
+
if (semverVersions.length > 1 && !flags.has("hasDuplicate")) {
|
|
22
|
+
yield "hasDuplicate";
|
|
23
|
+
}
|
|
24
|
+
}
|
|
@@ -1,12 +1,12 @@
|
|
|
1
|
-
/**
|
|
2
|
-
* @param {Record<string, boolean>} flagsRecord
|
|
3
|
-
* @example
|
|
4
|
-
* console.log(...booleanToFlags({ hasScript: true })); // "hasScript"
|
|
5
|
-
*/
|
|
6
|
-
export function* booleanToFlags(flagsRecord) {
|
|
7
|
-
for (const [flagName, boolValue] of Object.entries(flagsRecord)) {
|
|
8
|
-
if (boolValue) {
|
|
9
|
-
yield flagName;
|
|
10
|
-
}
|
|
11
|
-
}
|
|
12
|
-
}
|
|
1
|
+
/**
|
|
2
|
+
* @param {Record<string, boolean>} flagsRecord
|
|
3
|
+
* @example
|
|
4
|
+
* console.log(...booleanToFlags({ hasScript: true })); // "hasScript"
|
|
5
|
+
*/
|
|
6
|
+
export function* booleanToFlags(flagsRecord) {
|
|
7
|
+
for (const [flagName, boolValue] of Object.entries(flagsRecord)) {
|
|
8
|
+
if (boolValue) {
|
|
9
|
+
yield flagName;
|
|
10
|
+
}
|
|
11
|
+
}
|
|
12
|
+
}
|
package/src/utils/dirname.js
CHANGED
|
@@ -1,9 +1,9 @@
|
|
|
1
|
-
// Import Node.js Dependencies
|
|
2
|
-
import { fileURLToPath } from "url";
|
|
3
|
-
import { dirname } from "path";
|
|
4
|
-
|
|
5
|
-
export function getDirNameFromUrl(url) {
|
|
6
|
-
const __filename = fileURLToPath(url);
|
|
7
|
-
|
|
8
|
-
return dirname(__filename);
|
|
9
|
-
}
|
|
1
|
+
// Import Node.js Dependencies
|
|
2
|
+
import { fileURLToPath } from "url";
|
|
3
|
+
import { dirname } from "path";
|
|
4
|
+
|
|
5
|
+
export function getDirNameFromUrl(url) {
|
|
6
|
+
const __filename = fileURLToPath(url);
|
|
7
|
+
|
|
8
|
+
return dirname(__filename);
|
|
9
|
+
}
|
|
@@ -1,44 +1,44 @@
|
|
|
1
|
-
// Import Node.js Dependencies
|
|
2
|
-
import path from "path";
|
|
3
|
-
|
|
4
|
-
// CONSTANTS
|
|
5
|
-
const kRelativeImportPath = new Set([".", "..", "./", "../"]);
|
|
6
|
-
|
|
7
|
-
/**
|
|
8
|
-
* @see https://nodejs.org/docs/latest/api/modules.html#file-modules
|
|
9
|
-
*
|
|
10
|
-
* @param {IterableIterator<string>} dependencies
|
|
11
|
-
* @param {!string} relativeFileLocation
|
|
12
|
-
*/
|
|
13
|
-
export function filterDependencyKind(dependencies, relativeFileLocation) {
|
|
14
|
-
const packages = [];
|
|
15
|
-
const files = [];
|
|
16
|
-
|
|
17
|
-
for (const moduleNameOrPath of dependencies) {
|
|
18
|
-
const firstChar = moduleNameOrPath.charAt(0);
|
|
19
|
-
|
|
20
|
-
/**
|
|
21
|
-
* @example
|
|
22
|
-
* require("..");
|
|
23
|
-
* require("/home/marco/foo.js");
|
|
24
|
-
*/
|
|
25
|
-
if (firstChar === "." || firstChar === "/") {
|
|
26
|
-
// Note: condition only possible for CJS
|
|
27
|
-
if (kRelativeImportPath.has(moduleNameOrPath)) {
|
|
28
|
-
files.push(path.join(moduleNameOrPath, "index.js"));
|
|
29
|
-
}
|
|
30
|
-
else {
|
|
31
|
-
// Note: we are speculating that the extension is .js (but it could be .json or .node)
|
|
32
|
-
const fixedFileName = path.extname(moduleNameOrPath) === "" ?
|
|
33
|
-
`${moduleNameOrPath}.js` : moduleNameOrPath;
|
|
34
|
-
|
|
35
|
-
files.push(path.join(relativeFileLocation, fixedFileName));
|
|
36
|
-
}
|
|
37
|
-
}
|
|
38
|
-
else {
|
|
39
|
-
packages.push(moduleNameOrPath);
|
|
40
|
-
}
|
|
41
|
-
}
|
|
42
|
-
|
|
43
|
-
return { packages, files };
|
|
44
|
-
}
|
|
1
|
+
// Import Node.js Dependencies
|
|
2
|
+
import path from "path";
|
|
3
|
+
|
|
4
|
+
// CONSTANTS
|
|
5
|
+
const kRelativeImportPath = new Set([".", "..", "./", "../"]);
|
|
6
|
+
|
|
7
|
+
/**
|
|
8
|
+
* @see https://nodejs.org/docs/latest/api/modules.html#file-modules
|
|
9
|
+
*
|
|
10
|
+
* @param {IterableIterator<string>} dependencies
|
|
11
|
+
* @param {!string} relativeFileLocation
|
|
12
|
+
*/
|
|
13
|
+
export function filterDependencyKind(dependencies, relativeFileLocation) {
|
|
14
|
+
const packages = [];
|
|
15
|
+
const files = [];
|
|
16
|
+
|
|
17
|
+
for (const moduleNameOrPath of dependencies) {
|
|
18
|
+
const firstChar = moduleNameOrPath.charAt(0);
|
|
19
|
+
|
|
20
|
+
/**
|
|
21
|
+
* @example
|
|
22
|
+
* require("..");
|
|
23
|
+
* require("/home/marco/foo.js");
|
|
24
|
+
*/
|
|
25
|
+
if (firstChar === "." || firstChar === "/") {
|
|
26
|
+
// Note: condition only possible for CJS
|
|
27
|
+
if (kRelativeImportPath.has(moduleNameOrPath)) {
|
|
28
|
+
files.push(path.join(moduleNameOrPath, "index.js"));
|
|
29
|
+
}
|
|
30
|
+
else {
|
|
31
|
+
// Note: we are speculating that the extension is .js (but it could be .json or .node)
|
|
32
|
+
const fixedFileName = path.extname(moduleNameOrPath) === "" ?
|
|
33
|
+
`${moduleNameOrPath}.js` : moduleNameOrPath;
|
|
34
|
+
|
|
35
|
+
files.push(path.join(relativeFileLocation, fixedFileName));
|
|
36
|
+
}
|
|
37
|
+
}
|
|
38
|
+
else {
|
|
39
|
+
packages.push(moduleNameOrPath);
|
|
40
|
+
}
|
|
41
|
+
}
|
|
42
|
+
|
|
43
|
+
return { packages, files };
|
|
44
|
+
}
|
|
@@ -1,21 +1,21 @@
|
|
|
1
|
-
// CONSTANTS
|
|
2
|
-
const kPackageSeparator = "/";
|
|
3
|
-
const kPackageOrgSymbol = "@";
|
|
4
|
-
|
|
5
|
-
/**
|
|
6
|
-
* @see https://github.com/npm/validate-npm-package-name#naming-rules
|
|
7
|
-
*
|
|
8
|
-
* @param {!string} name full package name
|
|
9
|
-
* @returns {string}
|
|
10
|
-
*
|
|
11
|
-
* @example
|
|
12
|
-
* getPackageName("foo"); // foo
|
|
13
|
-
* getPackageName("foo/bar"); // foo
|
|
14
|
-
* getPackageName("@org/bar"); // @org/bar
|
|
15
|
-
*/
|
|
16
|
-
export function getPackageName(name) {
|
|
17
|
-
const parts = name.split(kPackageSeparator);
|
|
18
|
-
|
|
19
|
-
// Note: only scoped package are allowed to start with @
|
|
20
|
-
return name.startsWith(kPackageOrgSymbol) ? `${parts[0]}/${parts[1]}` : parts[0];
|
|
21
|
-
}
|
|
1
|
+
// CONSTANTS
|
|
2
|
+
const kPackageSeparator = "/";
|
|
3
|
+
const kPackageOrgSymbol = "@";
|
|
4
|
+
|
|
5
|
+
/**
|
|
6
|
+
* @see https://github.com/npm/validate-npm-package-name#naming-rules
|
|
7
|
+
*
|
|
8
|
+
* @param {!string} name full package name
|
|
9
|
+
* @returns {string}
|
|
10
|
+
*
|
|
11
|
+
* @example
|
|
12
|
+
* getPackageName("foo"); // foo
|
|
13
|
+
* getPackageName("foo/bar"); // foo
|
|
14
|
+
* getPackageName("@org/bar"); // @org/bar
|
|
15
|
+
*/
|
|
16
|
+
export function getPackageName(name) {
|
|
17
|
+
const parts = name.split(kPackageSeparator);
|
|
18
|
+
|
|
19
|
+
// Note: only scoped package are allowed to start with @
|
|
20
|
+
return name.startsWith(kPackageOrgSymbol) ? `${parts[0]}/${parts[1]}` : parts[0];
|
|
21
|
+
}
|
|
@@ -1,38 +1,38 @@
|
|
|
1
|
-
// Import Node.js Dependencies
|
|
2
|
-
import fs from "fs/promises";
|
|
3
|
-
import path from "path";
|
|
4
|
-
|
|
5
|
-
// Import Third-party Dependencies
|
|
6
|
-
import { walk } from "@nodesecure/fs-walk";
|
|
7
|
-
|
|
8
|
-
export async function getTarballComposition(tarballDir) {
|
|
9
|
-
const ext = new Set();
|
|
10
|
-
const files = [];
|
|
11
|
-
const dirs = [];
|
|
12
|
-
let { size } = await fs.stat(tarballDir);
|
|
13
|
-
|
|
14
|
-
for await (const [dirent, file] of walk(tarballDir)) {
|
|
15
|
-
if (dirent.isFile()) {
|
|
16
|
-
ext.add(path.extname(file));
|
|
17
|
-
files.push(file);
|
|
18
|
-
}
|
|
19
|
-
else if (dirent.isDirectory()) {
|
|
20
|
-
dirs.push(file);
|
|
21
|
-
}
|
|
22
|
-
}
|
|
23
|
-
|
|
24
|
-
const sizeUnfilteredResult = await Promise.allSettled([
|
|
25
|
-
...files.map((file) => fs.stat(file)),
|
|
26
|
-
...dirs.map((file) => fs.stat(file))
|
|
27
|
-
]);
|
|
28
|
-
const sizeAll = sizeUnfilteredResult
|
|
29
|
-
.filter((promiseSettledResult) => promiseSettledResult.status === "fulfilled")
|
|
30
|
-
.map((promiseSettledResult) => promiseSettledResult.value);
|
|
31
|
-
size += sizeAll.reduce((prev, curr) => prev + curr.size, 0);
|
|
32
|
-
|
|
33
|
-
return {
|
|
34
|
-
ext,
|
|
35
|
-
size,
|
|
36
|
-
files: files.map((fileLocation) => path.relative(tarballDir, fileLocation)).sort()
|
|
37
|
-
};
|
|
38
|
-
}
|
|
1
|
+
// Import Node.js Dependencies
|
|
2
|
+
import fs from "fs/promises";
|
|
3
|
+
import path from "path";
|
|
4
|
+
|
|
5
|
+
// Import Third-party Dependencies
|
|
6
|
+
import { walk } from "@nodesecure/fs-walk";
|
|
7
|
+
|
|
8
|
+
export async function getTarballComposition(tarballDir) {
|
|
9
|
+
const ext = new Set();
|
|
10
|
+
const files = [];
|
|
11
|
+
const dirs = [];
|
|
12
|
+
let { size } = await fs.stat(tarballDir);
|
|
13
|
+
|
|
14
|
+
for await (const [dirent, file] of walk(tarballDir)) {
|
|
15
|
+
if (dirent.isFile()) {
|
|
16
|
+
ext.add(path.extname(file));
|
|
17
|
+
files.push(file);
|
|
18
|
+
}
|
|
19
|
+
else if (dirent.isDirectory()) {
|
|
20
|
+
dirs.push(file);
|
|
21
|
+
}
|
|
22
|
+
}
|
|
23
|
+
|
|
24
|
+
const sizeUnfilteredResult = await Promise.allSettled([
|
|
25
|
+
...files.map((file) => fs.stat(file)),
|
|
26
|
+
...dirs.map((file) => fs.stat(file))
|
|
27
|
+
]);
|
|
28
|
+
const sizeAll = sizeUnfilteredResult
|
|
29
|
+
.filter((promiseSettledResult) => promiseSettledResult.status === "fulfilled")
|
|
30
|
+
.map((promiseSettledResult) => promiseSettledResult.value);
|
|
31
|
+
size += sizeAll.reduce((prev, curr) => prev + curr.size, 0);
|
|
32
|
+
|
|
33
|
+
return {
|
|
34
|
+
ext,
|
|
35
|
+
size,
|
|
36
|
+
files: files.map((fileLocation) => path.relative(tarballDir, fileLocation)).sort()
|
|
37
|
+
};
|
|
38
|
+
}
|
|
@@ -1,5 +1,3 @@
|
|
|
1
|
-
const kGitVersionVariants = ["git:", "git+", "github:"];
|
|
2
|
-
|
|
3
1
|
/**
|
|
4
2
|
* @example isGitDependency("github:NodeSecure/scanner") // => true
|
|
5
3
|
* @example isGitDependency("git+ssh://git@github.com:npm/cli#semver:^5.0") // => true
|
|
@@ -9,12 +7,5 @@ const kGitVersionVariants = ["git:", "git+", "github:"];
|
|
|
9
7
|
* @returns {boolean}
|
|
10
8
|
*/
|
|
11
9
|
export function isGitDependency(version) {
|
|
12
|
-
|
|
13
|
-
if (version.startsWith(variant)) {
|
|
14
|
-
return true;
|
|
15
|
-
}
|
|
16
|
-
}
|
|
17
|
-
|
|
18
|
-
return false;
|
|
10
|
+
return /^git(:|\+|hub:)/.test(version);
|
|
19
11
|
}
|
|
20
|
-
|
|
@@ -1,17 +1,17 @@
|
|
|
1
|
-
// Import Node.js Dependencies
|
|
2
|
-
import path from "path";
|
|
3
|
-
|
|
4
|
-
// CONSTANTS
|
|
5
|
-
const kSensitiveFileName = new Set([".npmrc", ".env"]);
|
|
6
|
-
const kSensitiveFileExtension = new Set([".key", ".pem"]);
|
|
7
|
-
|
|
8
|
-
/**
|
|
9
|
-
* @see https://github.com/jandre/safe-commit-hook/blob/master/git-deny-patterns.json
|
|
10
|
-
*
|
|
11
|
-
* @param {!string} fileName
|
|
12
|
-
* @returns {boolean}
|
|
13
|
-
*/
|
|
14
|
-
export function isSensitiveFile(fileName) {
|
|
15
|
-
return kSensitiveFileName.has(path.basename(fileName)) ||
|
|
16
|
-
kSensitiveFileExtension.has(path.extname(fileName));
|
|
17
|
-
}
|
|
1
|
+
// Import Node.js Dependencies
|
|
2
|
+
import path from "path";
|
|
3
|
+
|
|
4
|
+
// CONSTANTS
|
|
5
|
+
const kSensitiveFileName = new Set([".npmrc", ".env"]);
|
|
6
|
+
const kSensitiveFileExtension = new Set([".key", ".pem"]);
|
|
7
|
+
|
|
8
|
+
/**
|
|
9
|
+
* @see https://github.com/jandre/safe-commit-hook/blob/master/git-deny-patterns.json
|
|
10
|
+
*
|
|
11
|
+
* @param {!string} fileName
|
|
12
|
+
* @returns {boolean}
|
|
13
|
+
*/
|
|
14
|
+
export function isSensitiveFile(fileName) {
|
|
15
|
+
return kSensitiveFileName.has(path.basename(fileName)) ||
|
|
16
|
+
kSensitiveFileExtension.has(path.extname(fileName));
|
|
17
|
+
}
|
|
@@ -1,6 +1,7 @@
|
|
|
1
1
|
export function mergeDependencies(manifest, types = ["dependencies"]) {
|
|
2
2
|
const dependencies = new Map();
|
|
3
3
|
const customResolvers = new Map();
|
|
4
|
+
const alias = new Map();
|
|
4
5
|
|
|
5
6
|
for (const fieldName of types) {
|
|
6
7
|
if (!Reflect.has(manifest, fieldName)) {
|
|
@@ -15,12 +16,15 @@ export function mergeDependencies(manifest, types = ["dependencies"]) {
|
|
|
15
16
|
*/
|
|
16
17
|
if (/^([a-zA-Z]+:|git\+|\.\\)/.test(version)) {
|
|
17
18
|
customResolvers.set(name, version);
|
|
18
|
-
|
|
19
|
+
if (!version.startsWith("npm:")) {
|
|
20
|
+
continue;
|
|
21
|
+
}
|
|
22
|
+
alias.set(name, version.slice(4));
|
|
19
23
|
}
|
|
20
24
|
|
|
21
25
|
dependencies.set(name, version);
|
|
22
26
|
}
|
|
23
27
|
}
|
|
24
28
|
|
|
25
|
-
return { dependencies, customResolvers };
|
|
29
|
+
return { dependencies, customResolvers, alias };
|
|
26
30
|
}
|
package/src/utils/semver.js
CHANGED
|
@@ -1,49 +1,49 @@
|
|
|
1
|
-
// Import Third-party Dependencies
|
|
2
|
-
import pacote from "pacote";
|
|
3
|
-
import semver from "semver";
|
|
4
|
-
import { getLocalRegistryURL } from "@nodesecure/npm-registry-sdk";
|
|
5
|
-
|
|
6
|
-
// Import Internal Dependencies
|
|
7
|
-
import { NPM_TOKEN } from "./index.js";
|
|
8
|
-
|
|
9
|
-
/**
|
|
10
|
-
* @param {!string} version semver range
|
|
11
|
-
* @returns {string} semver version
|
|
12
|
-
*
|
|
13
|
-
* @example
|
|
14
|
-
* cleanRange(">=1.5.0"); // 1.5.0
|
|
15
|
-
* cleanRange("^2.0.0"); // 2.0.0
|
|
16
|
-
*/
|
|
17
|
-
export function cleanRange(version) {
|
|
18
|
-
// TODO: how do we handle complicated range like pkg-name@1 || 2 or pkg-name@2.1.2 < 3
|
|
19
|
-
const firstChar = version.charAt(0);
|
|
20
|
-
if (firstChar === "^" || firstChar === "<" || firstChar === ">" || firstChar === "=" || firstChar === "~") {
|
|
21
|
-
return version.slice(version.charAt(1) === "=" ? 2 : 1);
|
|
22
|
-
}
|
|
23
|
-
|
|
24
|
-
return version;
|
|
25
|
-
}
|
|
26
|
-
|
|
27
|
-
/**
|
|
28
|
-
* @param {!string} depName dependency name (WITHOUT version/range)
|
|
29
|
-
* @param {!string} range semver range, ex: >=1.5.0
|
|
30
|
-
*/
|
|
31
|
-
export async function getExpectedSemVer(depName, range) {
|
|
32
|
-
try {
|
|
33
|
-
const { versions, "dist-tags": { latest } } = await pacote.packument(depName, {
|
|
34
|
-
...NPM_TOKEN, registry: getLocalRegistryURL()
|
|
35
|
-
});
|
|
36
|
-
const currVersion = semver.maxSatisfying(Object.keys(versions), range);
|
|
37
|
-
|
|
38
|
-
return currVersion === null ? [latest, true] : [currVersion, semver.eq(latest, currVersion)];
|
|
39
|
-
}
|
|
40
|
-
catch (err) {
|
|
41
|
-
return [cleanRange(range), true];
|
|
42
|
-
}
|
|
43
|
-
}
|
|
44
|
-
|
|
45
|
-
export async function getCleanDependencyName([depName, range]) {
|
|
46
|
-
const [depVer, isLatest] = await getExpectedSemVer(depName, range);
|
|
47
|
-
|
|
48
|
-
return [`${depName}@${range}`, `${depName}@${depVer}`, isLatest];
|
|
49
|
-
}
|
|
1
|
+
// Import Third-party Dependencies
|
|
2
|
+
import pacote from "pacote";
|
|
3
|
+
import semver from "semver";
|
|
4
|
+
import { getLocalRegistryURL } from "@nodesecure/npm-registry-sdk";
|
|
5
|
+
|
|
6
|
+
// Import Internal Dependencies
|
|
7
|
+
import { NPM_TOKEN } from "./index.js";
|
|
8
|
+
|
|
9
|
+
/**
|
|
10
|
+
* @param {!string} version semver range
|
|
11
|
+
* @returns {string} semver version
|
|
12
|
+
*
|
|
13
|
+
* @example
|
|
14
|
+
* cleanRange(">=1.5.0"); // 1.5.0
|
|
15
|
+
* cleanRange("^2.0.0"); // 2.0.0
|
|
16
|
+
*/
|
|
17
|
+
export function cleanRange(version) {
|
|
18
|
+
// TODO: how do we handle complicated range like pkg-name@1 || 2 or pkg-name@2.1.2 < 3
|
|
19
|
+
const firstChar = version.charAt(0);
|
|
20
|
+
if (firstChar === "^" || firstChar === "<" || firstChar === ">" || firstChar === "=" || firstChar === "~") {
|
|
21
|
+
return version.slice(version.charAt(1) === "=" ? 2 : 1);
|
|
22
|
+
}
|
|
23
|
+
|
|
24
|
+
return version;
|
|
25
|
+
}
|
|
26
|
+
|
|
27
|
+
/**
|
|
28
|
+
* @param {!string} depName dependency name (WITHOUT version/range)
|
|
29
|
+
* @param {!string} range semver range, ex: >=1.5.0
|
|
30
|
+
*/
|
|
31
|
+
export async function getExpectedSemVer(depName, range) {
|
|
32
|
+
try {
|
|
33
|
+
const { versions, "dist-tags": { latest } } = await pacote.packument(depName, {
|
|
34
|
+
...NPM_TOKEN, registry: getLocalRegistryURL()
|
|
35
|
+
});
|
|
36
|
+
const currVersion = semver.maxSatisfying(Object.keys(versions), range);
|
|
37
|
+
|
|
38
|
+
return currVersion === null ? [latest, true] : [currVersion, semver.eq(latest, currVersion)];
|
|
39
|
+
}
|
|
40
|
+
catch (err) {
|
|
41
|
+
return [cleanRange(range), true];
|
|
42
|
+
}
|
|
43
|
+
}
|
|
44
|
+
|
|
45
|
+
export async function getCleanDependencyName([depName, range]) {
|
|
46
|
+
const [depVer, isLatest] = await getExpectedSemVer(depName, range);
|
|
47
|
+
|
|
48
|
+
return [`${depName}@${range}`, `${depName}@${depVer}`, isLatest];
|
|
49
|
+
}
|
package/src/utils/warnings.js
CHANGED
|
@@ -1,36 +1,36 @@
|
|
|
1
|
-
// Import Third-party Dependencies
|
|
2
|
-
import { getToken, taggedString } from "@nodesecure/i18n";
|
|
3
|
-
|
|
4
|
-
// CONSTANTS
|
|
5
|
-
const kDetectedDep = taggedString`The dependency '${0}' has been detected in the dependency Tree.`;
|
|
6
|
-
const kWarningsMessages = Object.freeze({
|
|
7
|
-
"@scarf/scarf": getToken("warnings.disable_scarf"),
|
|
8
|
-
iohook: getToken("warnings.keylogging")
|
|
9
|
-
});
|
|
10
|
-
const kPackages = new Set(Object.keys(kWarningsMessages));
|
|
11
|
-
const kAuthors = new Set(["marak", "marak.squires@gmail.com"]);
|
|
12
|
-
|
|
13
|
-
function getWarning(depName) {
|
|
14
|
-
return `${kDetectedDep(depName)} ${kWarningsMessages[depName]}`;
|
|
15
|
-
}
|
|
16
|
-
|
|
17
|
-
export function getDependenciesWarnings(dependencies) {
|
|
18
|
-
const warnings = [];
|
|
19
|
-
for (const depName of kPackages) {
|
|
20
|
-
if (dependencies.has(depName)) {
|
|
21
|
-
warnings.push(getWarning(depName));
|
|
22
|
-
}
|
|
23
|
-
}
|
|
24
|
-
|
|
25
|
-
// TODO: optimize with @nodesecure/author later
|
|
26
|
-
for (const [packageName, dependency] of dependencies) {
|
|
27
|
-
for (const { name, email } of dependency.metadata.maintainers) {
|
|
28
|
-
if (kAuthors.has(name) || kAuthors.has(email)) {
|
|
29
|
-
warnings.push(`'Marak Squires' package '${packageName}' has been detected in the dependency tree`);
|
|
30
|
-
}
|
|
31
|
-
}
|
|
32
|
-
}
|
|
33
|
-
|
|
34
|
-
return warnings;
|
|
35
|
-
}
|
|
36
|
-
|
|
1
|
+
// Import Third-party Dependencies
|
|
2
|
+
import { getToken, taggedString } from "@nodesecure/i18n";
|
|
3
|
+
|
|
4
|
+
// CONSTANTS
|
|
5
|
+
const kDetectedDep = taggedString`The dependency '${0}' has been detected in the dependency Tree.`;
|
|
6
|
+
const kWarningsMessages = Object.freeze({
|
|
7
|
+
"@scarf/scarf": getToken("warnings.disable_scarf"),
|
|
8
|
+
iohook: getToken("warnings.keylogging")
|
|
9
|
+
});
|
|
10
|
+
const kPackages = new Set(Object.keys(kWarningsMessages));
|
|
11
|
+
const kAuthors = new Set(["marak", "marak.squires@gmail.com"]);
|
|
12
|
+
|
|
13
|
+
function getWarning(depName) {
|
|
14
|
+
return `${kDetectedDep(depName)} ${kWarningsMessages[depName]}`;
|
|
15
|
+
}
|
|
16
|
+
|
|
17
|
+
export function getDependenciesWarnings(dependencies) {
|
|
18
|
+
const warnings = [];
|
|
19
|
+
for (const depName of kPackages) {
|
|
20
|
+
if (dependencies.has(depName)) {
|
|
21
|
+
warnings.push(getWarning(depName));
|
|
22
|
+
}
|
|
23
|
+
}
|
|
24
|
+
|
|
25
|
+
// TODO: optimize with @nodesecure/author later
|
|
26
|
+
for (const [packageName, dependency] of dependencies) {
|
|
27
|
+
for (const { name, email } of dependency.metadata.maintainers) {
|
|
28
|
+
if (kAuthors.has(name) || kAuthors.has(email)) {
|
|
29
|
+
warnings.push(`'Marak Squires' package '${packageName}' has been detected in the dependency tree`);
|
|
30
|
+
}
|
|
31
|
+
}
|
|
32
|
+
}
|
|
33
|
+
|
|
34
|
+
return warnings;
|
|
35
|
+
}
|
|
36
|
+
|
package/types/api.d.ts
CHANGED
package/types/logger.d.ts
CHANGED
|
@@ -1,38 +1,38 @@
|
|
|
1
|
-
import { EventEmitter } from "events";
|
|
2
|
-
|
|
3
|
-
export {
|
|
4
|
-
Logger,
|
|
5
|
-
LoggerEventData,
|
|
6
|
-
LoggerEvents
|
|
7
|
-
}
|
|
8
|
-
|
|
9
|
-
interface LoggerEvents {
|
|
10
|
-
readonly done: "depWalkerFinished";
|
|
11
|
-
readonly analysis: {
|
|
12
|
-
readonly tree: "walkTree";
|
|
13
|
-
readonly tarball: "tarball";
|
|
14
|
-
readonly registry: "registry";
|
|
15
|
-
};
|
|
16
|
-
readonly manifest: {
|
|
17
|
-
readonly read: "readManifest";
|
|
18
|
-
readonly fetch: "fetchManifest";
|
|
19
|
-
};
|
|
20
|
-
}
|
|
21
|
-
|
|
22
|
-
interface LoggerEventData {
|
|
23
|
-
/** UNIX Timestamp */
|
|
24
|
-
startedAt: number;
|
|
25
|
-
/** Count of triggered event */
|
|
26
|
-
count: number;
|
|
27
|
-
}
|
|
28
|
-
|
|
29
|
-
declare class Logger extends EventEmitter {
|
|
30
|
-
public events: Map<string, LoggerEventData>;
|
|
31
|
-
|
|
32
|
-
constructor();
|
|
33
|
-
|
|
34
|
-
start(eventName: string): Logger;
|
|
35
|
-
end(eventName: string): Logger;
|
|
36
|
-
tick(eventName: string): Logger;
|
|
37
|
-
count(eventName: string): number;
|
|
38
|
-
}
|
|
1
|
+
import { EventEmitter } from "events";
|
|
2
|
+
|
|
3
|
+
export {
|
|
4
|
+
Logger,
|
|
5
|
+
LoggerEventData,
|
|
6
|
+
LoggerEvents
|
|
7
|
+
}
|
|
8
|
+
|
|
9
|
+
interface LoggerEvents {
|
|
10
|
+
readonly done: "depWalkerFinished";
|
|
11
|
+
readonly analysis: {
|
|
12
|
+
readonly tree: "walkTree";
|
|
13
|
+
readonly tarball: "tarball";
|
|
14
|
+
readonly registry: "registry";
|
|
15
|
+
};
|
|
16
|
+
readonly manifest: {
|
|
17
|
+
readonly read: "readManifest";
|
|
18
|
+
readonly fetch: "fetchManifest";
|
|
19
|
+
};
|
|
20
|
+
}
|
|
21
|
+
|
|
22
|
+
interface LoggerEventData {
|
|
23
|
+
/** UNIX Timestamp */
|
|
24
|
+
startedAt: number;
|
|
25
|
+
/** Count of triggered event */
|
|
26
|
+
count: number;
|
|
27
|
+
}
|
|
28
|
+
|
|
29
|
+
declare class Logger extends EventEmitter {
|
|
30
|
+
public events: Map<string, LoggerEventData>;
|
|
31
|
+
|
|
32
|
+
constructor();
|
|
33
|
+
|
|
34
|
+
start(eventName: string): Logger;
|
|
35
|
+
end(eventName: string): Logger;
|
|
36
|
+
tick(eventName: string): Logger;
|
|
37
|
+
count(eventName: string): number;
|
|
38
|
+
}
|
package/types/scanner.d.ts
CHANGED
|
@@ -2,7 +2,6 @@
|
|
|
2
2
|
import * as JSXRay from "@nodesecure/js-x-ray";
|
|
3
3
|
import { license as License } from "@nodesecure/ntlp";
|
|
4
4
|
import * as Vuln from "@nodesecure/vuln";
|
|
5
|
-
import { Flags } from "@nodesecure/flags";
|
|
6
5
|
|
|
7
6
|
// Import Third-party Dependencies
|
|
8
7
|
import { Maintainer } from "@npm/types";
|
|
@@ -34,6 +33,11 @@ declare namespace Scanner {
|
|
|
34
33
|
/** Id of the package (useful for usedBy relation) */
|
|
35
34
|
id: number;
|
|
36
35
|
isDevDependency: boolean;
|
|
36
|
+
/**
|
|
37
|
+
* Tell if the given package exist on the configured remote registry (npm by default)
|
|
38
|
+
* @default true
|
|
39
|
+
*/
|
|
40
|
+
existOnRemoteRegistry: boolean;
|
|
37
41
|
/** By whom (id) is used the package */
|
|
38
42
|
usedBy: Record<string, string>;
|
|
39
43
|
/** Size on disk of the extracted tarball (in bytes) */
|
|
@@ -56,7 +60,7 @@ declare namespace Scanner {
|
|
|
56
60
|
*
|
|
57
61
|
* @see https://github.com/NodeSecure/js-x-ray/blob/master/WARNINGS.md
|
|
58
62
|
*/
|
|
59
|
-
warnings: JSXRay.Warning<JSXRay.
|
|
63
|
+
warnings: JSXRay.Warning<JSXRay.WarningDefault>[];
|
|
60
64
|
/** Tarball composition (files and dependencies) */
|
|
61
65
|
composition: {
|
|
62
66
|
/** Files extensions (.js, .md, .exe etc..) */
|
|
@@ -64,6 +68,7 @@ declare namespace Scanner {
|
|
|
64
68
|
files: string[];
|
|
65
69
|
/** Minified files (foo.min.js etc..) */
|
|
66
70
|
minified: string[];
|
|
71
|
+
alias: Record<string, string>;
|
|
67
72
|
required_files: string[];
|
|
68
73
|
required_thirdparty: string[];
|
|
69
74
|
required_nodejs: string[];
|
|
@@ -83,7 +88,7 @@ declare namespace Scanner {
|
|
|
83
88
|
*
|
|
84
89
|
* @see https://github.com/NodeSecure/flags/blob/main/FLAGS.md
|
|
85
90
|
*/
|
|
86
|
-
flags:
|
|
91
|
+
flags: string[];
|
|
87
92
|
/**
|
|
88
93
|
* If the dependency is a GIT repository
|
|
89
94
|
*/
|
|
@@ -155,7 +160,7 @@ declare namespace Scanner {
|
|
|
155
160
|
licenses: License[];
|
|
156
161
|
ast: {
|
|
157
162
|
dependencies: Record<string, JSXRay.Dependency>;
|
|
158
|
-
warnings: JSXRay.Warning<JSXRay.
|
|
163
|
+
warnings: JSXRay.Warning<JSXRay.WarningDefault>[];
|
|
159
164
|
};
|
|
160
165
|
}
|
|
161
166
|
|
package/types/tarball.d.ts
CHANGED
|
@@ -1,63 +1,63 @@
|
|
|
1
|
-
import ntlp from "@nodesecure/ntlp";
|
|
2
|
-
import Locker from "@slimio/lock";
|
|
3
|
-
import Logger from "
|
|
4
|
-
|
|
5
|
-
export = tarball;
|
|
6
|
-
|
|
7
|
-
declare namespace tarball {
|
|
8
|
-
export interface ManifestData {
|
|
9
|
-
/** Dependencies in package.json */
|
|
10
|
-
packageDeps: string[];
|
|
11
|
-
/** DevDependencies in package.json */
|
|
12
|
-
packageDevDeps: string[];
|
|
13
|
-
/** Does package.json contain a 'gypfile' property ? */
|
|
14
|
-
packageGyp: boolean;
|
|
15
|
-
}
|
|
16
|
-
|
|
17
|
-
export interface ScannedFileResult {
|
|
18
|
-
/** Dependencies in try/catch block (probably optional dependencies) */
|
|
19
|
-
inTryDeps: string[];
|
|
20
|
-
/** Dependencies required or imported */
|
|
21
|
-
dependencies: string[];
|
|
22
|
-
/** Required or imported javascript files */
|
|
23
|
-
filesDependencies: string[];
|
|
24
|
-
}
|
|
25
|
-
|
|
26
|
-
export interface ScannedPackageResult {
|
|
27
|
-
files: {
|
|
28
|
-
/** Complete list of files for the given package */
|
|
29
|
-
list: string[];
|
|
30
|
-
/** Complete list of extensions (.js, .md etc.) */
|
|
31
|
-
extensions: string[];
|
|
32
|
-
/** List of minified javascript files */
|
|
33
|
-
minified: string[];
|
|
34
|
-
};
|
|
35
|
-
/** Size of the directory in bytes */
|
|
36
|
-
directorySize: number;
|
|
37
|
-
/** Unique license contained in the tarball (MIT, ISC ..) */
|
|
38
|
-
uniqueLicenseIds: string[];
|
|
39
|
-
/** All licenses with their SPDX */
|
|
40
|
-
licenses: ntlp.license[];
|
|
41
|
-
ast: {
|
|
42
|
-
dependencies: any;
|
|
43
|
-
warnings: any[];
|
|
44
|
-
};
|
|
45
|
-
}
|
|
46
|
-
|
|
47
|
-
export interface ScanDirOrArchiveOptions {
|
|
48
|
-
ref: any;
|
|
49
|
-
locker: Locker;
|
|
50
|
-
tmpLocation: string;
|
|
51
|
-
logger: Logger;
|
|
52
|
-
}
|
|
53
|
-
|
|
54
|
-
export interface ScanFileOptions {
|
|
55
|
-
name: string;
|
|
56
|
-
ref: any;
|
|
57
|
-
}
|
|
58
|
-
|
|
59
|
-
export function readManifest(dest: string, ref: any): Promise<ManifestData>;
|
|
60
|
-
export function scanFile(dest: string, file: string, options: ScanFileOptions): Promise<ScannedFileResult | null>;
|
|
61
|
-
export function scanPackage(dest: string, packageName
|
|
62
|
-
export function scanDirOrArchive(name: string, version: string, options: ScanDirOrArchiveOptions): Promise<void>;
|
|
63
|
-
}
|
|
1
|
+
import ntlp from "@nodesecure/ntlp";
|
|
2
|
+
import Locker from "@slimio/lock";
|
|
3
|
+
import { Logger } from "./logger.js";
|
|
4
|
+
|
|
5
|
+
export = tarball;
|
|
6
|
+
|
|
7
|
+
declare namespace tarball {
|
|
8
|
+
export interface ManifestData {
|
|
9
|
+
/** Dependencies in package.json */
|
|
10
|
+
packageDeps: string[];
|
|
11
|
+
/** DevDependencies in package.json */
|
|
12
|
+
packageDevDeps: string[];
|
|
13
|
+
/** Does package.json contain a 'gypfile' property ? */
|
|
14
|
+
packageGyp: boolean;
|
|
15
|
+
}
|
|
16
|
+
|
|
17
|
+
export interface ScannedFileResult {
|
|
18
|
+
/** Dependencies in try/catch block (probably optional dependencies) */
|
|
19
|
+
inTryDeps: string[];
|
|
20
|
+
/** Dependencies required or imported */
|
|
21
|
+
dependencies: string[];
|
|
22
|
+
/** Required or imported javascript files */
|
|
23
|
+
filesDependencies: string[];
|
|
24
|
+
}
|
|
25
|
+
|
|
26
|
+
export interface ScannedPackageResult {
|
|
27
|
+
files: {
|
|
28
|
+
/** Complete list of files for the given package */
|
|
29
|
+
list: string[];
|
|
30
|
+
/** Complete list of extensions (.js, .md etc.) */
|
|
31
|
+
extensions: string[];
|
|
32
|
+
/** List of minified javascript files */
|
|
33
|
+
minified: string[];
|
|
34
|
+
};
|
|
35
|
+
/** Size of the directory in bytes */
|
|
36
|
+
directorySize: number;
|
|
37
|
+
/** Unique license contained in the tarball (MIT, ISC ..) */
|
|
38
|
+
uniqueLicenseIds: string[];
|
|
39
|
+
/** All licenses with their SPDX */
|
|
40
|
+
licenses: ntlp.license[];
|
|
41
|
+
ast: {
|
|
42
|
+
dependencies: any;
|
|
43
|
+
warnings: any[];
|
|
44
|
+
};
|
|
45
|
+
}
|
|
46
|
+
|
|
47
|
+
export interface ScanDirOrArchiveOptions {
|
|
48
|
+
ref: any;
|
|
49
|
+
locker: Locker;
|
|
50
|
+
tmpLocation: string;
|
|
51
|
+
logger: Logger;
|
|
52
|
+
}
|
|
53
|
+
|
|
54
|
+
export interface ScanFileOptions {
|
|
55
|
+
name: string;
|
|
56
|
+
ref: any;
|
|
57
|
+
}
|
|
58
|
+
|
|
59
|
+
export function readManifest(dest: string, ref: any): Promise<ManifestData>;
|
|
60
|
+
export function scanFile(dest: string, file: string, options: ScanFileOptions): Promise<ScannedFileResult | null>;
|
|
61
|
+
export function scanPackage(dest: string, packageName?: string): Promise<ScannedPackageResult>;
|
|
62
|
+
export function scanDirOrArchive(name: string, version: string, options: ScanDirOrArchiveOptions): Promise<void>;
|
|
63
|
+
}
|
package/types/walker.d.ts
CHANGED
|
@@ -1,8 +1,8 @@
|
|
|
1
|
-
import { Manifest } from "@npm/types";
|
|
2
|
-
import Scanner from "./scanner";
|
|
3
|
-
|
|
4
|
-
export {
|
|
5
|
-
depWalker
|
|
6
|
-
}
|
|
7
|
-
|
|
8
|
-
declare function depWalker(manifest: Manifest, options?: Scanner.Options);
|
|
1
|
+
import { Manifest } from "@npm/types";
|
|
2
|
+
import Scanner from "./scanner.js";
|
|
3
|
+
|
|
4
|
+
export {
|
|
5
|
+
depWalker
|
|
6
|
+
}
|
|
7
|
+
|
|
8
|
+
declare function depWalker(manifest: Manifest, options?: Scanner.Options);
|