@nodesecure/scanner 5.0.1 → 5.2.0

package/README.md

@@ -11,7 +11,7 @@ Scorecard](https://api.securityscorecards.dev/projects/github.com/NodeSecure/sca
 
 ## Requirements
 
-- [Node.js](https://nodejs.org/en/) version 16 or higher
+- [Node.js](https://nodejs.org/en/) version 18 or higher
 
 ## Getting Started
 
@@ -78,7 +78,7 @@ interface Options {
 ## Contributors ✨
 
 <!-- ALL-CONTRIBUTORS-BADGE:START - Do not remove or modify this section -->
-[![All Contributors](https://img.shields.io/badge/all_contributors-11-orange.svg?style=flat-square)](#contributors-)
+[![All Contributors](https://img.shields.io/badge/all_contributors-12-orange.svg?style=flat-square)](#contributors-)
 <!-- ALL-CONTRIBUTORS-BADGE:END -->
 
 Thanks goes to these wonderful people ([emoji key](https://allcontributors.org/docs/en/emoji-key)):
@@ -102,6 +102,7 @@ Thanks goes to these wonderful people ([emoji key](https://allcontributors.org/d
       <td align="center" valign="top" width="14.28%"><a href="https://www.linkedin.com/in/ange-tekeu-a155811b4/"><img src="https://avatars.githubusercontent.com/u/35274201?v=4?s=100" width="100px;" alt="Ange TEKEU"/><br /><sub><b>Ange TEKEU</b></sub></a><br /><a href="https://github.com/NodeSecure/scanner/commits?author=tekeuange23" title="Code">💻</a></td>
       <td align="center" valign="top" width="14.28%"><a href="https://github.com/Kawacrepe"><img src="https://avatars.githubusercontent.com/u/40260517?v=4?s=100" width="100px;" alt="Vincent Dhennin"/><br /><sub><b>Vincent Dhennin</b></sub></a><br /><a href="https://github.com/NodeSecure/scanner/commits?author=Kawacrepe" title="Code">💻</a></td>
       <td align="center" valign="top" width="14.28%"><a href="https://github.com/fabnguess"><img src="https://avatars.githubusercontent.com/u/72697416?v=4?s=100" width="100px;" alt="Kouadio Fabrice Nguessan"/><br /><sub><b>Kouadio Fabrice Nguessan</b></sub></a><br /><a href="#maintenance-fabnguess" title="Maintenance">🚧</a></td>
+      <td align="center" valign="top" width="14.28%"><a href="https://github.com/PierreDemailly"><img src="https://avatars.githubusercontent.com/u/39910767?v=4?s=100" width="100px;" alt="PierreDemailly"/><br /><sub><b>PierreDemailly</b></sub></a><br /><a href="https://github.com/NodeSecure/scanner/commits?author=PierreDemailly" title="Code">💻</a> <a href="https://github.com/NodeSecure/scanner/pulls?q=is%3Apr+reviewed-by%3APierreDemailly" title="Reviewed Pull Requests">👀</a> <a href="https://github.com/NodeSecure/scanner/issues?q=author%3APierreDemailly" title="Bug reports">🐛</a> <a href="https://github.com/NodeSecure/scanner/commits?author=PierreDemailly" title="Tests">⚠️</a></td>
     </tr>
   </tbody>
 </table>

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "@nodesecure/scanner",
-  "version": "5.0.1",
+  "version": "5.2.0",
   "description": "A package API to run a static analysis of your module's dependencies.",
   "exports": "./index.js",
   "engines": {
-    "node": ">=16"
+    "node": ">=18"
   },
   "scripts": {
     "lint": "eslint src test",
@@ -50,36 +50,36 @@
   },
   "homepage": "https://github.com/NodeSecure/scanner#readme",
   "devDependencies": {
-    "@nodesecure/eslint-config": "^1.7.0",
+    "@nodesecure/eslint-config": "^1.8.0",
     "@slimio/is": "^2.0.0",
-    "@types/node": "^20.4.5",
-    "c8": "^7.13.0",
-    "dotenv": "^16.0.3",
-    "eslint": "^8.37.0",
+    "@types/node": "^20.10.0",
+    "c8": "^8.0.1",
+    "dotenv": "^16.3.1",
+    "eslint": "8.37.0",
     "get-folder-size": "^4.0.0",
-    "glob": "^10.3.4",
+    "glob": "^10.3.10",
     "pkg-ok": "^3.0.0",
-    "sinon": "^15.0.3",
+    "sinon": "^17.0.1",
     "snap-shot-core": "^10.2.4"
   },
   "dependencies": {
     "@nodesecure/authors": "^1.0.2",
     "@nodesecure/flags": "^2.4.0",
     "@nodesecure/fs-walk": "^1.0.0",
-    "@nodesecure/i18n": "^3.3.0",
-    "@nodesecure/js-x-ray": "^6.0.1",
-    "@nodesecure/npm-registry-sdk": "^1.5.2",
+    "@nodesecure/i18n": "^3.5.0",
+    "@nodesecure/js-x-ray": "^6.3.0",
+    "@nodesecure/npm-registry-sdk": "^2.0.0",
     "@nodesecure/ntlp": "^2.2.1",
     "@nodesecure/vuln": "^1.7.0",
     "@npm/types": "^1.0.2",
-    "@npmcli/arborist": "^6.2.6",
+    "@npmcli/arborist": "^7.2.1",
     "@slimio/lock": "^1.0.0",
     "builtins": "^5.0.1",
-    "combine-async-iterators": "^2.0.1",
-    "itertools": "^2.1.1",
+    "combine-async-iterators": "^2.1.0",
+    "itertools": "^2.1.2",
     "lodash.difference": "^4.5.0",
-    "pacote": "^15.1.1",
-    "semver": "^7.3.8"
+    "pacote": "^17.0.4",
+    "semver": "^7.5.4"
   },
   "type": "module"
 }

package/src/depWalker.js

@@ -19,7 +19,7 @@ import {
   NPM_TOKEN
 } from "./utils/index.js";
 import { scanDirOrArchive } from "./tarball.js";
-import { packageMetadata } from "./npmRegistry.js";
+import { packageMetadata, manifestMetadata } from "./npmRegistry.js";
 import Dependency from "./class/dependency.class.js";
 import Logger from "./class/logger.class.js";
 
@@ -262,12 +262,13 @@ export async function depWalker(manifest, options = {}, logger = new Logger()) {
     const rootDepsOptions = { maxDepth, exclude, usePackageLock, fullLockMode, includeDevDeps, location, registry };
     for await (const currentDep of getRootDependencies(manifest, rootDepsOptions)) {
       const { name, version, dev } = currentDep;
+
       const current = currentDep.exportAsPlainObject(name === manifest.name ? 0 : void 0);
       let proceedDependencyAnalysis = true;
 
       if (dependencies.has(name)) {
-        // TODO: how to handle different metadata ?
         const dep = dependencies.get(name);
+        promisesToWait.push(manifestMetadata(name, version, dep.metadata));
 
         const currVersion = Object.keys(current.versions)[0];
         if (currVersion in dep.versions) {
@@ -292,7 +293,7 @@ export async function depWalker(manifest, options = {}, logger = new Logger()) {
         logger.tick(ScannerLoggerEvents.analysis.tree);
 
         // There is no need to fetch 'N' times the npm metadata for the same package.
-        if (fetchedMetadataPackages.has(name)) {
+        if (fetchedMetadataPackages.has(name) || !current.versions[version].existOnRemoteRegistry) {
           logger.tick(ScannerLoggerEvents.analysis.registry);
         }
         else {
@@ -333,7 +334,27 @@ export async function depWalker(manifest, options = {}, logger = new Logger()) {
 
   // We do this because it "seem" impossible to link all dependencies in the first walk.
   // Because we are dealing with package only one time it may happen sometimes.
+  const globalWarnings = [];
   for (const [packageName, dependency] of dependencies) {
+    const metadataIntegrities = dependency.metadata?.integrity ?? {};
+
+    for (const [version, integrity] of Object.entries(metadataIntegrities)) {
+      const dependencyVer = dependency.versions[version];
+
+      const isEmptyPackage = dependencyVer.warnings
+        .some((warning) => warning.kind === "empty-package");
+      if (isEmptyPackage) {
+        globalWarnings.push(`${packageName}@${version} only contain a package.json file!`);
+      }
+
+      if (!("integrity" in dependencyVer) || dependencyVer.flags.includes("isGit")) {
+        continue;
+      }
+
+      if (dependencyVer.integrity !== integrity) {
+        globalWarnings.push(`${packageName}@${version} manifest & tarball integrity doesn't match!`);
+      }
+    }
     for (const [verStr, verDescriptor] of Object.entries(dependency.versions)) {
       verDescriptor.flags.push(...addMissingVersionFlags(new Set(verDescriptor.flags), dependency));
 
@@ -352,7 +373,7 @@ export async function depWalker(manifest, options = {}, logger = new Logger()) {
 
   try {
     const { warnings, flaggedAuthors } = await getDependenciesWarnings(dependencies);
-    payload.warnings = warnings;
+    payload.warnings = globalWarnings.concat(warnings);
     payload.flaggedAuthors = flaggedAuthors;
     payload.dependencies = Object.fromEntries(dependencies);
 

package/src/manifest.js

@@ -1,6 +1,7 @@
 // Import Node.js Dependencies
 import fs from "node:fs/promises";
 import path from "node:path";
+import crypto from "node:crypto";
 
 // Import Internal Dependencies
 import { parseAuthor } from "./utils/index.js";
@@ -10,6 +11,7 @@ import { parseAuthor } from "./utils/index.js";
 const kNativeNpmPackages = new Set([
   "node-gyp", "node-pre-gyp", "node-gyp-build", "node-addon-api"
 ]);
+const kNodemodulesBinPrefix = "node_modules/.bin/";
 
 /**
  * @see https://www.nerdycode.com/prevent-npm-executing-scripts-security/
@@ -24,7 +26,7 @@ const kUnsafeNpmScripts = new Set([
 
 /**
  * @param {!string} location
- * @returns {import("@npm/types").PackageJson}
+ * @returns {Promise<import("@npm/types").PackageJson>}
  */
 export async function read(location) {
   const packageStr = await fs.readFile(
@@ -37,13 +39,39 @@ export async function read(location) {
 
 export async function readAnalyze(location) {
   const {
-    description = "", author = {}, scripts = {},
-    dependencies = {}, devDependencies = {}, gypfile = false,
+    name,
+    version,
+    description = "",
+    author = {},
+    scripts = {},
+    dependencies = {},
+    devDependencies = {},
+    gypfile = false,
     engines = {},
     repository = {},
-    imports = {}
+    imports = {},
+    license = ""
   } = await read(location);
 
+  for (const [scriptName, scriptValue] of Object.entries(scripts)) {
+    if (scriptValue.startsWith(kNodemodulesBinPrefix)) {
+      scripts[scriptName] = scriptValue.replaceAll(kNodemodulesBinPrefix, "");
+    }
+  }
+
+  const integrityObj = {
+    name,
+    version,
+    dependencies,
+    license,
+    scripts
+  };
+
+  const integrity = crypto
+    .createHash("sha256")
+    .update(JSON.stringify(integrityObj))
+    .digest("hex");
+
   const packageDeps = Object.keys(dependencies);
   const packageDevDeps = Object.keys(devDependencies);
   const hasNativePackage = [...packageDevDeps, ...packageDeps]
@@ -60,6 +88,7 @@ export async function readAnalyze(location) {
     packageDeps,
     packageDevDeps,
     nodejs: { imports },
-    hasNativeElements: hasNativePackage || gypfile
+    hasNativeElements: hasNativePackage || gypfile,
+    integrity
   };
 }

package/src/npmRegistry.js

@@ -1,12 +1,28 @@
+// Import Node.js Dependencies
+import crypto from "node:crypto";
+
 // Import Third-party Dependencies
 import semver from "semver";
-import { packument } from "@nodesecure/npm-registry-sdk";
+import { packument, packumentVersion } from "@nodesecure/npm-registry-sdk";
 
 // Import Internal Dependencies
-import { parseAuthor } from "./utils/index.js";
+import { parseAuthor, getLinks } from "./utils/index.js";
+
+export async function manifestMetadata(name, version, metadata) {
+  try {
+    const pkgVersion = await packumentVersion(name, version);
+
+    const integrity = getPackumentVersionIntegrity(pkgVersion);
+    metadata.integrity[version] = integrity;
+  }
+  catch {
+    // Ignore
+  }
+}
 
 export async function packageMetadata(name, version, options) {
   const { ref, logger } = options;
+  const packageSpec = `${name}:${version}`;
 
   try {
     const pkg = await packument(name);
@@ -24,18 +40,32 @@ export async function packageMetadata(name, version, options) {
       lastUpdateAt,
       hasReceivedUpdateInOneYear: !(oneYearFromToday > lastUpdateAt),
       maintainers: pkg.maintainers ?? [],
-      publishers: []
+      publishers: [],
+      integrity: {}
     };
 
     const isOutdated = semver.neq(version, lastVersion);
+    const flags = ref.versions[version].flags;
     if (isOutdated) {
-      ref.versions[version].flags.push("isOutdated");
+      flags.push("isOutdated");
     }
 
     const publishers = new Set();
     let searchForMaintainersInVersions = metadata.maintainers.length === 0;
     for (const ver of Object.values(pkg.versions).reverse()) {
+      const versionSpec = `${ver.name}:${ver.version}`;
+      if (packageSpec === versionSpec) {
+        if (ver.deprecated && !flags.includes("isDeprecated")) {
+          flags.push("isDeprecated");
+        }
+
+        metadata.integrity[ver.version] = getPackumentVersionIntegrity(
+          ver
+        );
+      }
+
       const { _npmUser: npmUser, version, maintainers = [] } = ver;
+
       const isNullOrUndefined = typeof npmUser === "undefined" || npmUser === null;
       if (isNullOrUndefined || !("name" in npmUser) || typeof npmUser.name !== "string") {
         continue;
@@ -61,6 +91,7 @@ export async function packageMetadata(name, version, options) {
       }
     }
 
+    Object.assign(ref.versions[version], { links: getLinks(pkg.versions[version]) });
     Object.assign(ref.metadata, metadata);
   }
   catch {
@@ -70,3 +101,25 @@ export async function packageMetadata(name, version, options) {
     logger.tick("registry");
   }
 }
+
+function getPackumentVersionIntegrity(packumentVersion) {
+  const { name, version, dependencies = {}, license = "", scripts = {} } = packumentVersion;
+
+  // See https://github.com/npm/cli/issues/5234
+  if ("install" in dependencies && dependencies.install === "node-gyp rebuild") {
+    delete dependencies.install;
+  }
+
+  const integrityObj = {
+    name,
+    version,
+    dependencies,
+    license,
+    scripts
+  };
+
+  return crypto
+    .createHash("sha256")
+    .update(JSON.stringify(integrityObj))
+    .digest("hex");
+}

package/src/tarball.js

@@ -67,18 +67,42 @@ export async function scanDirOrArchive(name, version, options) {
       });
       await timers.setImmediate();
     }
+    else {
+      // Set links to an empty object because theses are generated only for NPM tarballs
+      Object.assign(ref, { links: {} });
+    }
 
     // Read the package.json at the root of the directory or archive.
     const {
       packageDeps,
       packageDevDeps,
-      author, description, hasScript, hasNativeElements, nodejs,
-      engines, repository, scripts
+      author,
+      description,
+      hasScript,
+      hasNativeElements,
+      nodejs,
+      engines,
+      repository,
+      scripts,
+      integrity
     } = await manifest.readAnalyze(dest);
-    Object.assign(ref, { author, description, engines, repository, scripts });
+    Object.assign(ref, {
+      author, description, engines, repository, scripts, integrity
+    });
 
     // Get the composition of the (extracted) directory
     const { ext, files, size } = await getTarballComposition(dest);
+    if (files.length === 1 && files.includes("package.json")) {
+      ref.warnings.push({
+        kind: "empty-package",
+        location: null,
+        i18n: "sast_warnings.emptyPackage",
+        severity: "Critical",
+        source: "Scanner",
+        experimental: false
+      });
+    }
+
     ref.size = size;
     ref.composition.extensions.push(...ext);
     ref.composition.files.push(...files);

package/src/utils/getLinks.js

@@ -0,0 +1,31 @@
+// CONSTANTS
+const kVCSHosts = new Set(["github.com", "gitlab.com"]);
+
+function getVCSRepositoryURL(link) {
+  try {
+    const url = new URL(link);
+    const { hostname, pathname } = url;
+
+    if (kVCSHosts.has(hostname) === false) {
+      return null;
+    }
+
+    const [owner, repo] = pathname.split("/").filter(Boolean).map((curr) => curr.replace(".git", ""));
+
+    return `https://${hostname}/${owner}/${repo}`;
+  }
+  catch {
+    return null;
+  }
+}
+
+export function getLinks(pkg) {
+  const homepage = pkg.homepage || null;
+  const repositoryUrl = pkg.repository?.url || null;
+
+  return {
+    npm: `https://www.npmjs.com/package/${pkg.name}/v/${pkg.version}`,
+    homepage,
+    repository: getVCSRepositoryURL(homepage) ?? getVCSRepositoryURL(repositoryUrl)
+  };
+}

package/src/utils/index.js

@@ -11,6 +11,7 @@ export * from "./analyzeDependencies.js";
 export * from "./booleanToFlags.js";
 export * from "./addMissingVersionFlags.js";
 export * from "./parseManifestAuthor.js";
+export * from "./getLinks.js";
 
 export const NPM_TOKEN = typeof process.env.NODE_SECURE_TOKEN === "string" ?
   { token: process.env.NODE_SECURE_TOKEN } :

package/src/utils/semver.js

@@ -50,12 +50,13 @@ export async function getCleanDependencyName([depName, range]) {
 
 export function getSemVerWarning(value) {
   return {
-    kind: "invalid-semver",
+    kind: "zero-semver",
     file: "package.json",
     value,
     location: null,
-    i18n: "sast_warnings.invalidSemVer",
+    i18n: "sast_warnings.zeroSemVer",
     severity: "Information",
+    source: "Scanner",
     experimental: false
   };
 }

package/src/utils/warnings.js

@@ -8,7 +8,7 @@ import { extractAllAuthors } from "@nodesecure/authors";
 // Import Internal Dependencies
 import { getDirNameFromUrl } from "./dirname.js";
 
-i18n.extendFromSystemPath(
+await i18n.extendFromSystemPath(
   path.join(getDirNameFromUrl(import.meta.url), "..", "..", "i18n")
 );
 

package/types/scanner.d.ts

@@ -40,6 +40,15 @@ declare namespace Scanner {
     at: string;
   }
 
+  export interface DependencyLinks {
+    /** NPM Registry page */
+    npm: string;
+    /** Homepage URL */
+    homepage?: string;
+    /** VCS repository URL */
+    repository?: string;
+  }
+
   export interface DependencyVersion {
     /** Id of the package (useful for usedBy relation) */
     id: number;
@@ -104,6 +113,14 @@ declare namespace Scanner {
      * If the dependency is a GIT repository
      */
     gitUrl: null | string;
+    /**
+     * Version MD5 integrity hash
+     * Generated by the scanner to verify manifest/tarball confusion
+     *
+     * (Not supported on GIT dependency)
+     */
+    integrity?: string;
+    links: DependencyLinks;
   }
 
   export interface Dependency {
@@ -131,6 +148,11 @@ declare namespace Scanner {
        * List of people who published this package
        */
       publishers: Publisher[];
+      /**
+       * Version MD5 integrity hash
+       * Generated by the scanner to verify manifest/tarball confusion
+       */
+      integrity: Record<string, string>;
     }
     /** List of versions of this package available in the dependency tree (In the payload) */
     versions: Record<string, DependencyVersion>;