@sentry/cli 1.74.5 → 1.75.0

package/CHANGELOG.md

@@ -2,6 +2,16 @@
 
 "You know what they say. Fool me once, strike one, but fool me twice... strike three." — Michael Scott
 
+## 1.75.0
+
+- feat(backport): Replace `npmlog` dependency in order to avoid vulnerability (#1445)
+
+## 1.74.6
+
+### Various fixes & improvements
+
+- feat: Replace usage of eval to obfuscate binary path from bundlers (#1375)
+
 ## 1.74.5
 
 ### Various fixes & improvements

package/checksums.txt

@@ -1,9 +1,9 @@
-sentry-cli-Darwin-arm64=850e9b5635462e373d73d7a6f60601da4cf2891b1a6405eebc173dae92841f08
-sentry-cli-Darwin-universal=85d662e19e59a564708bd09a17857b6d7a13d45fde5f7f761365568185679cdd
-sentry-cli-Darwin-x86_64=9012e0ec228dab954e330409bfb2b70f10a4a18d96a3ac858e490db2e5b94035
-sentry-cli-Linux-aarch64=93e8e9ddd46c210900567614622f1b71383aad81814860dff054b38da66e8ed0
-sentry-cli-Linux-armv7=4c2689cc0d27b78e1a72f7370c14cc791cbbae4a1ce0803dc23f8106f3bbf16a
-sentry-cli-Linux-i686=e90923c771968751a82efa17bb0a1b2a2747f8f53b95af016ca99c84b88dc263
-sentry-cli-Linux-x86_64=b22afdbac4258b19896e2f77230b119b14b71944cdd86b4b4904f1d6641af5cd
-sentry-cli-Windows-i686.exe=4b5ab85d99fe29f0b5937f9344944ec77663adc928c85d5887f32cfc655a6116
-sentry-cli-Windows-x86_64.exe=1767f6bdc4a8a5d9542cc000a3cd4041a86809d911a2e172cb77d04a2eee4e3c
+sentry-cli-Darwin-arm64=6b7cc7d3579ba5ff1595517ac665eafd21c749713f4569aad623acd464fc4804
+sentry-cli-Darwin-universal=b64d948db80b4a462e54b869ea9e258c62d1a9facbfaa57c68756695dad9f41c
+sentry-cli-Darwin-x86_64=5f7f8a35d36f96fb5c354a6b0c668cb6707a4ed5d535c155f9dcfb324cc76035
+sentry-cli-Linux-aarch64=c93f55cae48e91495b0f13bc50ae8a057f76452b73c40752ab4aab30f4ef19ce
+sentry-cli-Linux-armv7=c81b622bd11cf01228ece983f538ac2689b2dd49bf3ebb44ff605bf9e254ca32
+sentry-cli-Linux-i686=b1a1ea42ed158935f84d783fe7c8efbb6ebc8615f441e6dd93380d3d4bc93257
+sentry-cli-Linux-x86_64=19b4c6d3bcb65df151a22aa188bae4804c8a7b8dcd4051893125781188b43f5f
+sentry-cli-Windows-i686.exe=2040dc25c0349d7d542a53a2a4d83a249873b07980c6a384ac91c4d265ffbb43
+sentry-cli-Windows-x86_64.exe=691d7e2bf77b1ac097d9f3c31be7478e7ae936383d5e2704cfdc884ffcdaf8d3

package/js/helper.js

@@ -1,21 +1,29 @@
 'use strict';
 
+const path = require('path');
 const childProcess = require('child_process');
 
 /**
- * Absolute path to the sentry-cli binary (platform dependent).
- * @type {string}
+ * This convoluted function resolves the path to the `sentry-cli` binary in a
+ * way that can't be analysed by @vercel/nft.
+ *
+ * Without this, the binary can be detected as an asset and included by bundlers
+ * that use @vercel/nft.
+ * @returns {string} The path to the sentry-cli binary
  */
-let binaryPath = eval(
-  "require('path').resolve(__dirname, require('os').platform() === 'win32' ? '..\\sentry-cli.exe' : '../sentry-cli')"
-);
+function getBinaryPath() {
+  const parts = [];
+  parts.push(__dirname);
+  parts.push('..');
+  parts.push(`sentry-cli${process.platform === 'win32' ? '.exe' : ''}`);
+  return path.resolve(...parts);
+}
 
 /**
- * NOTE: `eval` usage is a workaround for @vercel/nft detecting the binary itself as the hard dependency
- *       and effectively always including it in the bundle, which is not what we want.
- * ref: https://github.com/getsentry/sentry-javascript/issues/3865
- * ref: https://github.com/vercel/nft/issues/203
+ * Absolute path to the sentry-cli binary (platform dependent).
+ * @type {string}
  */
+let binaryPath = getBinaryPath();
 
 /**
  * Overrides the default binary path with a mock value, useful for testing.

package/js/logger.js

@@ -0,0 +1,14 @@
+'use strict';
+
+const format = require('util').format;
+
+module.exports = class Logger {
+  constructor(stream) {
+    this.stream = stream;
+  }
+
+  log() {
+    const message = format(...arguments);
+    this.stream.write(`[sentry-cli] ${message}\n`);
+  }
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sentry/cli",
-  "version": "1.74.5",
+  "version": "1.75.0",
   "description": "A command line utility to work with Sentry. https://docs.sentry.io/hosted/learn/cli/",
   "homepage": "https://docs.sentry.io/hosted/learn/cli/",
   "license": "BSD-3-Clause",
@@ -28,22 +28,23 @@
     "fix": "npm-run-all fix:eslint fix:prettier",
     "fix:eslint": "eslint --fix bin/* scripts/**/*.js js/**/*.js",
     "fix:prettier": "prettier --write bin/* scripts/**/*.js js/**/*.js",
-    "test": "npm-run-all test:jest test:eslint test:prettier",
+    "test": "npm-run-all test:jest test:eslint test:prettier test:vercel-nft",
     "test:jest": "jest",
     "test:watch": "jest --watch --notify",
     "test:eslint": "eslint bin/* scripts/**/*.js js/**/*.js",
-    "test:prettier": "prettier --check  bin/* scripts/**/*.js js/**/*.js"
+    "test:prettier": "prettier --check  bin/* scripts/**/*.js js/**/*.js",
+    "test:vercel-nft": "node scripts/test-vercel-nft.js"
   },
   "dependencies": {
     "https-proxy-agent": "^5.0.0",
     "mkdirp": "^0.5.5",
     "node-fetch": "^2.6.7",
-    "npmlog": "^4.1.2",
     "progress": "^2.0.3",
     "proxy-from-env": "^1.1.0",
     "which": "^2.0.2"
   },
   "devDependencies": {
+    "@vercel/nft": "^0.22.1",
     "eslint": "^6.8.0",
     "eslint-config-airbnb-base": "^14.1.0",
     "eslint-config-prettier": "^6.10.1",
@@ -52,14 +53,15 @@
     "npm-run-all": "^4.1.5",
     "prettier": "^1.19.1"
   },
-  "resolutions": {
-    "npmlog/**/ansi-regex": "^3.0.1"
-  },
   "jest": {
     "collectCoverage": true,
     "testEnvironment": "node",
     "testPathIgnorePatterns": [
       "src/utils"
     ]
+  },
+  "volta": {
+    "node": "10.24.1",
+    "yarn": "1.22.19"
   }
 }

package/scripts/install.js

@@ -17,17 +17,11 @@ const ProgressBar = require('progress');
 const Proxy = require('proxy-from-env');
 // NOTE: Can be dropped in favor of `fs.mkdirSync(path, { recursive: true })` once we stop supporting Node 8.x
 const mkdirp = require('mkdirp');
-const npmLog = require('npmlog');
 const which = require('which');
 
 const helper = require('../js/helper');
 const pkgInfo = require('../package.json');
-
-const CDN_URL =
-  process.env.SENTRYCLI_LOCAL_CDNURL ||
-  process.env.npm_config_sentrycli_cdnurl ||
-  process.env.SENTRYCLI_CDNURL ||
-  'https://downloads.sentry-cdn.com/sentry-cli';
+const Logger = require('../js/logger');
 
 function getLogStream(defaultStream) {
   const logStream = process.env.SENTRYCLI_LOG_STREAM || defaultStream;
@@ -45,6 +39,14 @@ function getLogStream(defaultStream) {
   );
 }
 
+const logger = new Logger(getLogStream('stderr'));
+
+const CDN_URL =
+  process.env.SENTRYCLI_LOCAL_CDNURL ||
+  process.env.npm_config_sentrycli_cdnurl ||
+  process.env.SENTRYCLI_CDNURL ||
+  'https://downloads.sentry-cdn.com/sentry-cli';
+
 function shouldRenderProgressBar() {
   const silentFlag = process.argv.some(v => v === '--silent');
   const silentConfig = process.env.npm_config_loglevel === 'silent';
@@ -165,14 +167,14 @@ function validateChecksum(tempPath, name) {
       }
     }
   } catch (e) {
-    npmLog.info(
+    logger.log(
       'Checksums are generated when the package is published to npm. They are not available directly in the source repository. Skipping validation.'
     );
     return;
   }
 
   if (!storedHash) {
-    npmLog.info(`Checksum for ${name} not found, skipping validation.`);
+    logger.log(`Checksum for ${name} not found, skipping validation.`);
     return;
   }
 
@@ -187,7 +189,7 @@ function validateChecksum(tempPath, name) {
       `Checksum validation for ${name} failed.\nExpected: ${storedHash}\nReceived: ${currentHash}`
     );
   } else {
-    npmLog.info('Checksum validation passed.');
+    logger.log('Checksum validation passed.');
   }
 }
 
@@ -199,7 +201,7 @@ function downloadBinary() {
   if (process.env.SENTRYCLI_USE_LOCAL === '1') {
     try {
       const binPath = which.sync('sentry-cli');
-      npmLog.info('sentry-cli', `Using local binary: ${binPath}`);
+      logger.log(`Using local binary: ${binPath}`);
       fs.copyFileSync(binPath, outputPath);
       return Promise.resolve();
     } catch (e) {
@@ -217,7 +219,7 @@ function downloadBinary() {
 
   const cachedPath = getCachedPath(downloadUrl);
   if (fs.existsSync(cachedPath)) {
-    npmLog.info('sentry-cli', `Using cached binary: ${cachedPath}`);
+    logger.log(`Using cached binary: ${cachedPath}`);
     fs.copyFileSync(cachedPath, outputPath);
     return Promise.resolve();
   }
@@ -225,10 +227,10 @@ function downloadBinary() {
   const proxyUrl = Proxy.getProxyForUrl(downloadUrl);
   const agent = proxyUrl ? new HttpsProxyAgent(proxyUrl) : null;
 
-  npmLog.info('sentry-cli', `Downloading from ${downloadUrl}`);
+  logger.log(`Downloading from ${downloadUrl}`);
 
   if (proxyUrl) {
-    npmLog.info('sentry-cli', `Using proxy URL: ${proxyUrl}`);
+    logger.log(`Using proxy URL: ${proxyUrl}`);
   }
 
   return fetch(downloadUrl, {
@@ -316,10 +318,8 @@ if (process.env.SENTRYCLI_LOCAL_CDNURL) {
   process.on('exit', () => server.close());
 }
 
-npmLog.stream = getLogStream('stderr');
-
 if (process.env.SENTRYCLI_SKIP_DOWNLOAD === '1') {
-  npmLog.info('sentry-cli', `Skipping download because SENTRYCLI_SKIP_DOWNLOAD=1 detected.`);
+  logger.log(`Skipping download because SENTRYCLI_SKIP_DOWNLOAD=1 detected.`);
   process.exit(0);
 }
 

package/scripts/test-vercel-nft.js

@@ -0,0 +1,27 @@
+const major = process.versions.node.split('.')[0];
+
+// @vercel/nft doe not support Node.js v8
+if (major < 10) {
+  process.exit(0);
+}
+
+// eslint-disable-next-line import/no-extraneous-dependencies
+const { nodeFileTrace } = require('@vercel/nft');
+
+const entryPoint = require.resolve('..');
+
+// Trace the module entrypoint
+nodeFileTrace([entryPoint]).then(result => {
+  // eslint-disable-next-line no-console
+  console.log('@vercel/nft traced dependencies:', Array.from(result.fileList));
+
+  // If either binary is picked up, fail the test
+  if (result.fileList.has('sentry-cli') || result.fileList.has('sentry-cli.exe')) {
+    // eslint-disable-next-line no-console
+    console.error('ERROR: The sentry-cli binary should not be found by @vercel/nft');
+    process.exit(-1);
+  } else {
+    // eslint-disable-next-line no-console
+    console.log('The sentry-cli binary was not traced by @vercel/nft');
+  }
+});