@nodesecure/tarball 3.0.0 → 3.1.0

package/dist/class/DnsResolver.class.d.ts

@@ -0,0 +1,8 @@
+export interface Resolver {
+    isPrivateHost(hostname: string): Promise<boolean>;
+}
+export declare class DnsResolver implements Resolver {
+    #private;
+    isPrivateHost(hostname: string): Promise<boolean>;
+}
+//# sourceMappingURL=DnsResolver.class.d.ts.map

package/dist/class/DnsResolver.class.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"DnsResolver.class.d.ts","sourceRoot":"","sources":["../../src/class/DnsResolver.class.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,QAAQ;IACvB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACnD;AAED,qBAAa,WAAY,YAAW,QAAQ;;IACpC,aAAa,CAAC,QAAQ,EAAE,MAAM;CAqBrC"}

package/dist/class/DnsResolver.class.js

@@ -0,0 +1,24 @@
+// Import Node.js Dependencies
+import { lookup } from "node:dns/promises";
+import {} from "node:dns";
+// Import Third-party Dependencies
+import ipaddress from "ipaddr.js";
+export class DnsResolver {
+    async isPrivateHost(hostname) {
+        const ipAddressListDetails = await lookup(hostname, { all: true });
+        const ipAddressList = ipAddressListDetails.map((ipAddressDetails) => ipAddressDetails.address);
+        return ipAddressList.some(this.#isPrivateIPAddress);
+    }
+    #isPrivateIPAddress(ipAddress) {
+        let ip = ipaddress.parse(ipAddress);
+        if (ip instanceof ipaddress.IPv6 && ip.isIPv4MappedAddress()) {
+            ip = ip.toIPv4Address();
+        }
+        const range = ip.range();
+        if (range !== "unicast") {
+            return true;
+        }
+        return false;
+    }
+}
+//# sourceMappingURL=DnsResolver.class.js.map

package/dist/class/DnsResolver.class.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DnsResolver.class.js","sourceRoot":"","sources":["../../src/class/DnsResolver.class.ts"],"names":[],"mappings":"AAAA,8BAA8B;AAC9B,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAsB,MAAM,UAAU,CAAC;AAE9C,kCAAkC;AAClC,OAAO,SAAS,MAAM,WAAW,CAAC;AAMlC,MAAM,OAAO,WAAW;IACtB,KAAK,CAAC,aAAa,CAAC,QAAgB;QAClC,MAAM,oBAAoB,GAAoB,MAAM,MAAM,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;QACpF,MAAM,aAAa,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC,gBAAgB,EAAE,EAAE,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAE/F,OAAO,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IACtD,CAAC;IAED,mBAAmB,CAAC,SAAiB;QACnC,IAAI,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAEpC,IAAI,EAAE,YAAY,SAAS,CAAC,IAAI,IAAI,EAAE,CAAC,mBAAmB,EAAE,EAAE,CAAC;YAC7D,EAAE,GAAG,EAAE,CAAC,aAAa,EAAE,CAAC;QAC1B,CAAC;QAED,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC;QACzB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}

package/dist/class/NpmTarball.class.d.ts

@@ -3,15 +3,20 @@ import { ManifestManager, type LocatedManifestManager } from "@nodesecure/mama";
 import { type AstAnalyserOptions } from "@nodesecure/js-x-ray";
 import { SourceCodeReport } from "./SourceCodeScanner.class.ts";
 import { type TarballComposition } from "../utils/index.ts";
+import { type Resolver } from "./DnsResolver.class.ts";
 export interface ScannedFilesResult {
     composition: TarballComposition;
     conformance: conformance.SpdxExtractedResult;
     code: SourceCodeReport;
 }
+export type NpmTarballOptions = {
+    resolver?: Resolver;
+};
 export declare class NpmTarball {
+    #private;
     static JS_EXTENSIONS: Set<string>;
     manifest: LocatedManifestManager;
-    constructor(mama: ManifestManager);
+    constructor(mama: ManifestManager, options?: NpmTarballOptions);
     scanFiles(astAnalyserOptions?: AstAnalyserOptions): Promise<ScannedFilesResult>;
 }
 //# sourceMappingURL=NpmTarball.class.d.ts.map

package/dist/class/NpmTarball.class.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"NpmTarball.class.d.ts","sourceRoot":"","sources":["../../src/class/NpmTarball.class.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,WAAW,MAAM,yBAAyB,CAAC;AACvD,OAAO,EACL,eAAe,EACf,KAAK,sBAAsB,EAC5B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,gBAAgB,EAEjB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,kBAAkB,CAAC;IAChC,WAAW,EAAE,WAAW,CAAC,mBAAmB,CAAC;IAC7C,IAAI,EAAE,gBAAgB,CAAC;CACxB;AAED,qBAAa,UAAU;IACrB,MAAM,CAAC,aAAa,cAIjB;IAEH,QAAQ,EAAE,sBAAsB,CAAC;gBAG/B,IAAI,EAAE,eAAe;IASjB,SAAS,CACb,kBAAkB,CAAC,EAAE,kBAAkB,GACtC,OAAO,CAAC,kBAAkB,CAAC;CA+B/B"}
+{"version":3,"file":"NpmTarball.class.d.ts","sourceRoot":"","sources":["../../src/class/NpmTarball.class.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,WAAW,MAAM,yBAAyB,CAAC;AACvD,OAAO,EACL,eAAe,EACf,KAAK,sBAAsB,EAC5B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAIL,KAAK,kBAAkB,EACxB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,gBAAgB,EAEjB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,KAAK,QAAQ,EAAe,MAAM,wBAAwB,CAAC;AAEpE,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,kBAAkB,CAAC;IAChC,WAAW,EAAE,WAAW,CAAC,mBAAmB,CAAC;IAC7C,IAAI,EAAE,gBAAgB,CAAC;CACxB;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,QAAQ,CAAC,EAAE,QAAQ,CAAC;CACrB,CAAC;AAEF,qBAAa,UAAU;;IACrB,MAAM,CAAC,aAAa,cAIjB;IAEH,QAAQ,EAAE,sBAAsB,CAAC;gBAI/B,IAAI,EAAE,eAAe,EACrB,OAAO,GAAE,iBAAsB;IAU3B,SAAS,CACb,kBAAkB,CAAC,EAAE,kBAAkB,GACtC,OAAO,CAAC,kBAAkB,CAAC;CAgE/B"}

package/dist/class/NpmTarball.class.js

@@ -3,10 +3,11 @@ import path from "node:path";
 // Import Third-party Dependencies
 import * as conformance from "@nodesecure/conformance";
 import { ManifestManager } from "@nodesecure/mama";
-import { AstAnalyser } from "@nodesecure/js-x-ray";
+import { AstAnalyser, CollectableSet, warnings } from "@nodesecure/js-x-ray";
 // Import Internal Dependencies
 import { SourceCodeReport, SourceCodeScanner } from "./SourceCodeScanner.class.js";
 import { getTarballComposition } from "../utils/index.js";
+import { DnsResolver } from "./DnsResolver.class.js";
 export class NpmTarball {
     static JS_EXTENSIONS = new Set([
         ".js", ".mjs", ".cjs",
@@ -14,11 +15,13 @@ export class NpmTarball {
         ".jsx", ".tsx"
     ]);
     manifest;
-    constructor(mama) {
+    #resolver;
+    constructor(mama, options = {}) {
         if (!ManifestManager.isLocated(mama)) {
             throw new Error("ManifestManager must have a location");
         }
         this.manifest = mama;
+        this.#resolver = options?.resolver ?? new DnsResolver();
     }
     async scanFiles(astAnalyserOptions) {
         const location = this.manifest.location;
@@ -31,13 +34,32 @@ export class NpmTarball {
             code = new SourceCodeReport();
         }
         else {
-            const astAnalyser = new AstAnalyser(astAnalyserOptions);
+            const options = this.#optionsWithHostnameSet(astAnalyserOptions ?? {});
+            const hostNameSet = options?.collectables?.find((collectable) => collectable.type === "hostname");
+            const astAnalyser = new AstAnalyser(options);
             code = await new SourceCodeScanner(this.manifest, { astAnalyser }).iterate({
                 manifest: [...this.manifest.getEntryFiles()]
                     .flatMap(filterJavaScriptFiles()),
                 javascript: composition.files
                     .flatMap(filterJavaScriptFiles())
             });
+            const operationQueue = Array.from(hostNameSet)
+                .map(({ value, locations }) => this.#resolver.isPrivateHost(value)
+                .then((isPrivate) => {
+                if (isPrivate) {
+                    locations.forEach(({ file, location }) => {
+                        code.warnings.push({
+                            kind: "shady-link",
+                            ...warnings["shady-link"],
+                            file: file ?? undefined,
+                            location,
+                            value,
+                            source: "Scanner"
+                        });
+                    });
+                }
+            }));
+            await Promise.allSettled(operationQueue);
         }
         return {
             conformance: spdx,
@@ -45,6 +67,13 @@ export class NpmTarball {
             code
         };
     }
+    #optionsWithHostnameSet(options) {
+        const hasHostnameSet = options?.collectables?.some((collectable) => collectable.type === "hostname");
+        if (hasHostnameSet) {
+            return options;
+        }
+        return { ...options, collectables: [...options.collectables ?? [], new CollectableSet("hostname")] };
+    }
 }
 function filterJavaScriptFiles() {
     return (file) => {

package/dist/class/NpmTarball.class.js.map

@@ -1 +1 @@
-{"version":3,"file":"NpmTarball.class.js","sourceRoot":"","sources":["../../src/class/NpmTarball.class.ts"],"names":[],"mappings":"AAAA,8BAA8B;AAC9B,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,kCAAkC;AAClC,OAAO,KAAK,WAAW,MAAM,yBAAyB,CAAC;AACvD,OAAO,EACL,eAAe,EAEhB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,WAAW,EAEZ,MAAM,sBAAsB,CAAC;AAE9B,+BAA+B;AAC/B,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EAClB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,qBAAqB,EAEtB,MAAM,mBAAmB,CAAC;AAQ3B,MAAM,OAAO,UAAU;IACrB,MAAM,CAAC,aAAa,GAAG,IAAI,GAAG,CAAC;QAC7B,KAAK,EAAE,MAAM,EAAE,MAAM;QACrB,KAAK,EAAE,MAAM,EAAE,MAAM;QACrB,MAAM,EAAE,MAAM;KACf,CAAC,CAAC;IAEH,QAAQ,CAAyB;IAEjC,YACE,IAAqB;QAErB,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;QAED,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,SAAS,CACb,kBAAuC;QAEvC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACxC,MAAM,CACJ,WAAW,EACX,IAAI,CACL,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACpB,qBAAqB,CAAC,QAAQ,CAAC;YAC/B,WAAW,CAAC,eAAe,CAAC,QAAQ,CAAC;SACtC,CAAC,CAAC;QAEH,IAAI,IAAsB,CAAC;QAC3B,IAAI,WAAW,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YACjF,IAAI,GAAG,IAAI,gBAAgB,EAAE,CAAC;QAChC,CAAC;aACI,CAAC;YACJ,MAAM,WAAW,GAAG,IAAI,WAAW,CAAC,kBAAkB,CAAC,CAAC;YAExD,IAAI,GAAG,MAAM,IAAI,iBAAiB,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC;gBACzE,QAAQ,EAAE,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;qBACzC,OAAO,CAAC,qBAAqB,EAAE,CAAC;gBACnC,UAAU,EAAE,WAAW,CAAC,KAAK;qBAC1B,OAAO,CAAC,qBAAqB,EAAE,CAAC;aACpC,CAAC,CAAC;QACL,CAAC;QAED,OAAO;YACL,WAAW,EAAE,IAAI;YACjB,WAAW;YACX,IAAI;SACL,CAAC;IACJ,CAAC;;AAGH,SAAS,qBAAqB;IAC5B,OAAO,CAAC,IAAY,EAAE,EAAE;QACtB,IAAI,UAAU,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACrD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,EAAE,CAAC;IACZ,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"NpmTarball.class.js","sourceRoot":"","sources":["../../src/class/NpmTarball.class.ts"],"names":[],"mappings":"AAAA,8BAA8B;AAC9B,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,kCAAkC;AAClC,OAAO,KAAK,WAAW,MAAM,yBAAyB,CAAC;AACvD,OAAO,EACL,eAAe,EAEhB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,WAAW,EACX,cAAc,EACd,QAAQ,EAET,MAAM,sBAAsB,CAAC;AAE9B,+BAA+B;AAC/B,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EAClB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,qBAAqB,EAEtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAiB,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAYpE,MAAM,OAAO,UAAU;IACrB,MAAM,CAAC,aAAa,GAAG,IAAI,GAAG,CAAC;QAC7B,KAAK,EAAE,MAAM,EAAE,MAAM;QACrB,KAAK,EAAE,MAAM,EAAE,MAAM;QACrB,MAAM,EAAE,MAAM;KACf,CAAC,CAAC;IAEH,QAAQ,CAAyB;IACjC,SAAS,CAAW;IAEpB,YACE,IAAqB,EACrB,UAA6B,EAAE;QAE/B,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;QAED,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC,SAAS,GAAG,OAAO,EAAE,QAAQ,IAAI,IAAI,WAAW,EAAE,CAAC;IAC1D,CAAC;IAED,KAAK,CAAC,SAAS,CACb,kBAAuC;QAEvC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACxC,MAAM,CACJ,WAAW,EACX,IAAI,CACL,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACpB,qBAAqB,CAAC,QAAQ,CAAC;YAC/B,WAAW,CAAC,eAAe,CAAC,QAAQ,CAAC;SACtC,CAAC,CAAC;QAEH,IAAI,IAAsB,CAAC;QAC3B,IAAI,WAAW,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YACjF,IAAI,GAAG,IAAI,gBAAgB,EAAE,CAAC;QAChC,CAAC;aACI,CAAC;YACJ,MAAM,OAAO,GAAG,IAAI,CAAC,uBAAuB,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC;YAEvE,MAAM,WAAW,GAAG,OAAO,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,KAAK,UAAU,CAAE,CAAC;YAEnG,MAAM,WAAW,GAAG,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC;YAE7C,IAAI,GAAG,MAAM,IAAI,iBAAiB,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC;gBACzE,QAAQ,EAAE,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;qBACzC,OAAO,CAAC,qBAAqB,EAAE,CAAC;gBACnC,UAAU,EAAE,WAAW,CAAC,KAAK;qBAC1B,OAAO,CAAC,qBAAqB,EAAE,CAAC;aACpC,CAAC,CAAC;YAEH,MAAM,cAAc,GAClB,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC;iBACpB,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC;iBAC/D,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE;gBAClB,IAAI,SAAS,EAAE,CAAC;oBACd,SAAS,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE;wBACvC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;4BACjB,IAAI,EAAE,YAAY;4BAClB,GAAG,QAAQ,CAAC,YAAY,CAAC;4BACzB,IAAI,EAAE,IAAI,IAAI,SAAS;4BACvB,QAAQ;4BACR,KAAK;4BACL,MAAM,EAAE,SAAS;yBAClB,CAAC,CAAC;oBACL,CAAC,CAAC,CAAC;gBACL,CAAC;YACH,CAAC,CAAC,CACH,CAAC;YACN,MAAM,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;QAC3C,CAAC;QAED,OAAO;YACL,WAAW,EAAE,IAAI;YACjB,WAAW;YACX,IAAI;SACL,CAAC;IACJ,CAAC;IAED,uBAAuB,CAAC,OAA2B;QACjD,MAAM,cAAc,GAAG,OAAO,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC;QACrG,IAAI,cAAc,EAAE,CAAC;YACnB,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,OAAO,EAAE,GAAG,OAAO,EAAE,YAAY,EAAE,CAAC,GAAG,OAAO,CAAC,YAAY,IAAI,EAAE,EAAE,IAAI,cAAc,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;IACvG,CAAC;;AAGH,SAAS,qBAAqB;IAC5B,OAAO,CAAC,IAAY,EAAE,EAAE;QACtB,IAAI,UAAU,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACrD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,EAAE,CAAC;IACZ,CAAC,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nodesecure/tarball",
-  "version": "3.0.0",
+  "version": "3.1.0",
   "description": "NodeSecure tarball scanner",
   "type": "module",
   "exports": {
@@ -47,10 +47,11 @@
   "dependencies": {
     "@nodesecure/conformance": "^1.2.1",
     "@nodesecure/fs-walk": "^2.0.0",
-    "@nodesecure/js-x-ray": "11.1.0",
-    "@nodesecure/mama": "^2.1.0",
+    "@nodesecure/js-x-ray": "11.3.0",
+    "@nodesecure/mama": "^2.1.1",
     "@nodesecure/npm-types": "^1.2.0",
     "@nodesecure/utils": "^2.3.0",
+    "ipaddr.js": "2.3.0",
     "pacote": "^21.0.0"
   },
   "devDependencies": {