@socketsecurity/cli-with-sentry 0.14.65 → 0.14.67
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/constants.d.ts +2 -2
- package/dist/constants.js +10 -6
- package/dist/constants.js.map +1 -1
- package/dist/instrument-with-sentry.js +2 -2
- package/dist/instrument-with-sentry.js.map +1 -1
- package/dist/module-sync/cli.js +1038 -556
- package/dist/module-sync/cli.js.map +1 -1
- package/dist/module-sync/config.d.ts +19 -0
- package/dist/module-sync/path-resolve.d.ts +2 -2
- package/dist/module-sync/shadow-npm-inject.js +136 -114
- package/dist/module-sync/shadow-npm-inject.js.map +1 -1
- package/dist/module-sync/shadow-npm-paths.js +3 -3
- package/dist/module-sync/shadow-npm-paths.js.map +1 -1
- package/dist/module-sync/socket-package-alert.d.ts +1 -1
- package/dist/require/cli.js +1038 -556
- package/dist/require/cli.js.map +1 -1
- package/package.json +14 -14
- package/dist/module-sync/fs.d.ts +0 -22
- package/dist/module-sync/settings.d.ts +0 -15
|
@@ -0,0 +1,19 @@
|
|
|
1
|
+
import config from '@socketsecurity/config';
|
|
2
|
+
interface LocalConfig {
|
|
3
|
+
apiBaseUrl?: string | null | undefined;
|
|
4
|
+
apiKey?: string | null | undefined;
|
|
5
|
+
apiProxy?: string | null | undefined;
|
|
6
|
+
apiToken?: string | null | undefined;
|
|
7
|
+
defaultOrg?: string;
|
|
8
|
+
enforcedOrgs?: string[] | readonly string[] | null | undefined;
|
|
9
|
+
test?: unknown;
|
|
10
|
+
}
|
|
11
|
+
declare const supportedConfigKeys: Map<keyof LocalConfig, string>;
|
|
12
|
+
declare const sensitiveConfigKeys: Set<keyof LocalConfig>;
|
|
13
|
+
declare function findSocketYmlSync(): {
|
|
14
|
+
path: string;
|
|
15
|
+
parsed: config.SocketYml;
|
|
16
|
+
} | null;
|
|
17
|
+
declare function getConfigValue<Key extends keyof LocalConfig>(key: Key): LocalConfig[Key];
|
|
18
|
+
declare function updateConfigValue<Key extends keyof LocalConfig>(key: keyof LocalConfig, value: LocalConfig[Key]): void;
|
|
19
|
+
export { LocalConfig, supportedConfigKeys, sensitiveConfigKeys, findSocketYmlSync, getConfigValue, updateConfigValue };
|
|
@@ -6,5 +6,5 @@ declare function findBinPathDetailsSync(binName: string): {
|
|
|
6
6
|
shadowed: boolean;
|
|
7
7
|
};
|
|
8
8
|
declare function findNpmPathSync(npmBinPath: string): string | undefined;
|
|
9
|
-
declare function
|
|
10
|
-
export { findBinPathDetailsSync, findNpmPathSync,
|
|
9
|
+
declare function getPackageFilesForScan(cwd: string, inputPaths: string[], supportedFiles: SocketSdkReturnType<'getReportSupportedFiles'>['data'], config?: SocketYml | undefined): Promise<string[]>;
|
|
10
|
+
export { findBinPathDetailsSync, findNpmPathSync, getPackageFilesForScan };
|
|
@@ -26,51 +26,17 @@ var isInteractive = require('@socketregistry/is-interactive/index.cjs');
|
|
|
26
26
|
var registryConstants = require('@socketsecurity/registry/lib/constants');
|
|
27
27
|
var strings = require('@socketsecurity/registry/lib/strings');
|
|
28
28
|
var sdk = require('@socketsecurity/sdk');
|
|
29
|
-
var promises = require('node:timers/promises');
|
|
30
29
|
var fs = require('node:fs');
|
|
31
30
|
var os = require('node:os');
|
|
32
31
|
var path = require('node:path');
|
|
33
32
|
var config = require('@socketsecurity/config');
|
|
33
|
+
var promises = require('node:timers/promises');
|
|
34
34
|
var packages = require('@socketsecurity/registry/lib/packages');
|
|
35
35
|
var sorts = require('@socketsecurity/registry/lib/sorts');
|
|
36
36
|
var terminalLink = _socketInterop(require('terminal-link'));
|
|
37
37
|
var colors = _socketInterop(require('yoctocolors-cjs'));
|
|
38
38
|
var indentString = require('@socketregistry/indent-string/index.cjs');
|
|
39
39
|
|
|
40
|
-
const {
|
|
41
|
-
kInternalsSymbol: kInternalsSymbol$1,
|
|
42
|
-
[kInternalsSymbol$1]: {
|
|
43
|
-
getSentry
|
|
44
|
-
}
|
|
45
|
-
} = constants;
|
|
46
|
-
class AuthError extends Error {}
|
|
47
|
-
class InputError extends Error {
|
|
48
|
-
constructor(message, body) {
|
|
49
|
-
super(message);
|
|
50
|
-
this.body = body;
|
|
51
|
-
}
|
|
52
|
-
}
|
|
53
|
-
async function captureException(exception, hint) {
|
|
54
|
-
const result = captureExceptionSync(exception, hint);
|
|
55
|
-
// "Sleep" for a second, just in case, hopefully enough time to initiate fetch.
|
|
56
|
-
await promises.setTimeout(1000);
|
|
57
|
-
return result;
|
|
58
|
-
}
|
|
59
|
-
function captureExceptionSync(exception, hint) {
|
|
60
|
-
const Sentry = getSentry();
|
|
61
|
-
if (!Sentry) {
|
|
62
|
-
return '';
|
|
63
|
-
}
|
|
64
|
-
debug.debugLog('captureException: Sending exception to Sentry.');
|
|
65
|
-
return Sentry.captureException(exception, hint);
|
|
66
|
-
}
|
|
67
|
-
function isErrnoException(value) {
|
|
68
|
-
if (!(value instanceof Error)) {
|
|
69
|
-
return false;
|
|
70
|
-
}
|
|
71
|
-
return value.code !== undefined;
|
|
72
|
-
}
|
|
73
|
-
|
|
74
40
|
const {
|
|
75
41
|
abortSignal
|
|
76
42
|
} = constants;
|
|
@@ -143,34 +109,36 @@ function safeReadFileSync(filepath, options) {
|
|
|
143
109
|
const LOCALAPPDATA = 'LOCALAPPDATA';
|
|
144
110
|
// Default app data folder env var on Mac/Linux
|
|
145
111
|
const XDG_DATA_HOME = 'XDG_DATA_HOME';
|
|
146
|
-
const SOCKET_APP_DIR = 'socket/settings';
|
|
147
|
-
|
|
148
|
-
|
|
149
|
-
|
|
150
|
-
let
|
|
112
|
+
const SOCKET_APP_DIR = 'socket/settings'; // It used to be settings...
|
|
113
|
+
|
|
114
|
+
const supportedConfigKeys = new Map([['apiBaseUrl', 'Base URL of the API endpoint'], ['apiToken', 'The API token required to access most API endpoints'], ['apiProxy', 'A proxy through which to access the API'], ['enforcedOrgs', 'Orgs in this list have their security policies enforced on this machine']]);
|
|
115
|
+
const sensitiveConfigKeys = new Set(['apiToken']);
|
|
116
|
+
let cachedConfig;
|
|
117
|
+
let configPath;
|
|
118
|
+
let warnedConfigPathWin32Missing = false;
|
|
151
119
|
let pendingSave = false;
|
|
152
|
-
function
|
|
153
|
-
if (
|
|
154
|
-
|
|
155
|
-
const
|
|
156
|
-
if (
|
|
157
|
-
const raw = safeReadFileSync(
|
|
120
|
+
function getConfigValues() {
|
|
121
|
+
if (cachedConfig === undefined) {
|
|
122
|
+
cachedConfig = {};
|
|
123
|
+
const configPath = getConfigPath();
|
|
124
|
+
if (configPath) {
|
|
125
|
+
const raw = safeReadFileSync(configPath);
|
|
158
126
|
if (raw) {
|
|
159
127
|
try {
|
|
160
|
-
Object.assign(
|
|
128
|
+
Object.assign(cachedConfig, JSON.parse(Buffer.from(raw, 'base64').toString()));
|
|
161
129
|
} catch {
|
|
162
|
-
logger.logger.warn(`Failed to parse
|
|
130
|
+
logger.logger.warn(`Failed to parse config at ${configPath}`);
|
|
163
131
|
}
|
|
164
132
|
} else {
|
|
165
|
-
fs.mkdirSync(path.dirname(
|
|
133
|
+
fs.mkdirSync(path.dirname(configPath), {
|
|
166
134
|
recursive: true
|
|
167
135
|
});
|
|
168
136
|
}
|
|
169
137
|
}
|
|
170
138
|
}
|
|
171
|
-
return
|
|
139
|
+
return cachedConfig;
|
|
172
140
|
}
|
|
173
|
-
function
|
|
141
|
+
function getConfigPath() {
|
|
174
142
|
// Get the OS app data folder:
|
|
175
143
|
// - Win: %LOCALAPPDATA% or fail?
|
|
176
144
|
// - Mac: %XDG_DATA_HOME% or fallback to "~/Library/Application Support/"
|
|
@@ -183,7 +151,7 @@ function getSettingsPath() {
|
|
|
183
151
|
// - Mac: %XDG_DATA_HOME%/socket/settings or "~/Library/Application Support/socket/settings"
|
|
184
152
|
// - Linux: %XDG_DATA_HOME%/socket/settings or "~/.local/share/socket/settings"
|
|
185
153
|
|
|
186
|
-
if (
|
|
154
|
+
if (configPath === undefined) {
|
|
187
155
|
// Lazily access constants.WIN32.
|
|
188
156
|
const {
|
|
189
157
|
WIN32
|
|
@@ -191,22 +159,22 @@ function getSettingsPath() {
|
|
|
191
159
|
let dataHome = WIN32 ? process$1.env[LOCALAPPDATA] : process$1.env[XDG_DATA_HOME];
|
|
192
160
|
if (!dataHome) {
|
|
193
161
|
if (WIN32) {
|
|
194
|
-
if (!
|
|
195
|
-
|
|
162
|
+
if (!warnedConfigPathWin32Missing) {
|
|
163
|
+
warnedConfigPathWin32Missing = true;
|
|
196
164
|
logger.logger.warn(`Missing %${LOCALAPPDATA}%`);
|
|
197
165
|
}
|
|
198
166
|
} else {
|
|
199
167
|
dataHome = path.join(os.homedir(), ...(process$1.platform === 'darwin' ? ['Library', 'Application Support'] : ['.local', 'share']));
|
|
200
168
|
}
|
|
201
169
|
}
|
|
202
|
-
|
|
170
|
+
configPath = dataHome ? path.join(dataHome, SOCKET_APP_DIR) : undefined;
|
|
203
171
|
}
|
|
204
|
-
return
|
|
172
|
+
return configPath;
|
|
205
173
|
}
|
|
206
|
-
function
|
|
174
|
+
function normalizeConfigKey(key) {
|
|
207
175
|
const normalizedKey = key === 'apiToken' ? 'apiKey' : key;
|
|
208
|
-
if (!
|
|
209
|
-
throw new Error(`Invalid
|
|
176
|
+
if (normalizedKey !== 'apiKey' && normalizedKey !== 'test' && !supportedConfigKeys.has(normalizedKey)) {
|
|
177
|
+
throw new Error(`Invalid config key: ${normalizedKey}`);
|
|
210
178
|
}
|
|
211
179
|
return normalizedKey;
|
|
212
180
|
}
|
|
@@ -235,37 +203,72 @@ function findSocketYmlSync() {
|
|
|
235
203
|
}
|
|
236
204
|
return null;
|
|
237
205
|
}
|
|
238
|
-
function
|
|
239
|
-
return
|
|
206
|
+
function getConfigValue(key) {
|
|
207
|
+
return getConfigValues()[normalizeConfigKey(key)];
|
|
240
208
|
}
|
|
241
|
-
function
|
|
242
|
-
const
|
|
243
|
-
|
|
209
|
+
function updateConfigValue(key, value) {
|
|
210
|
+
const localConfig = getConfigValues();
|
|
211
|
+
localConfig[normalizeConfigKey(key)] = value;
|
|
244
212
|
if (!pendingSave) {
|
|
245
213
|
pendingSave = true;
|
|
246
214
|
process$1.nextTick(() => {
|
|
247
215
|
pendingSave = false;
|
|
248
|
-
const
|
|
249
|
-
if (
|
|
250
|
-
fs.writeFileSync(
|
|
216
|
+
const configPath = getConfigPath();
|
|
217
|
+
if (configPath) {
|
|
218
|
+
fs.writeFileSync(configPath, Buffer.from(JSON.stringify(localConfig)).toString('base64'));
|
|
251
219
|
}
|
|
252
220
|
});
|
|
253
221
|
}
|
|
254
222
|
}
|
|
255
223
|
|
|
256
224
|
const {
|
|
257
|
-
|
|
225
|
+
kInternalsSymbol: kInternalsSymbol$1,
|
|
226
|
+
[kInternalsSymbol$1]: {
|
|
227
|
+
getSentry
|
|
228
|
+
}
|
|
229
|
+
} = constants;
|
|
230
|
+
class AuthError extends Error {}
|
|
231
|
+
class InputError extends Error {
|
|
232
|
+
constructor(message, body) {
|
|
233
|
+
super(message);
|
|
234
|
+
this.body = body;
|
|
235
|
+
}
|
|
236
|
+
}
|
|
237
|
+
async function captureException(exception, hint) {
|
|
238
|
+
const result = captureExceptionSync(exception, hint);
|
|
239
|
+
// "Sleep" for a second, just in case, hopefully enough time to initiate fetch.
|
|
240
|
+
await promises.setTimeout(1000);
|
|
241
|
+
return result;
|
|
242
|
+
}
|
|
243
|
+
function captureExceptionSync(exception, hint) {
|
|
244
|
+
const Sentry = getSentry();
|
|
245
|
+
if (!Sentry) {
|
|
246
|
+
return '';
|
|
247
|
+
}
|
|
248
|
+
debug.debugLog('captureException: Sending exception to Sentry.');
|
|
249
|
+
return Sentry.captureException(exception, hint);
|
|
250
|
+
}
|
|
251
|
+
function isErrnoException(value) {
|
|
252
|
+
if (!(value instanceof Error)) {
|
|
253
|
+
return false;
|
|
254
|
+
}
|
|
255
|
+
return value.code !== undefined;
|
|
256
|
+
}
|
|
257
|
+
|
|
258
|
+
const {
|
|
259
|
+
SOCKET_CLI_NO_API_TOKEN,
|
|
260
|
+
SOCKET_SECURITY_API_TOKEN
|
|
258
261
|
} = constants;
|
|
259
262
|
|
|
260
263
|
// The API server that should be used for operations.
|
|
261
264
|
function getDefaultApiBaseUrl() {
|
|
262
|
-
const baseUrl = process$1.env['SOCKET_SECURITY_API_BASE_URL'] ||
|
|
265
|
+
const baseUrl = process$1.env['SOCKET_SECURITY_API_BASE_URL'] || getConfigValue('apiBaseUrl');
|
|
263
266
|
return strings.isNonEmptyString(baseUrl) ? baseUrl : undefined;
|
|
264
267
|
}
|
|
265
268
|
|
|
266
269
|
// The API server that should be used for operations.
|
|
267
270
|
function getDefaultHttpProxy() {
|
|
268
|
-
const apiProxy = process$1.env['SOCKET_SECURITY_API_PROXY'] ||
|
|
271
|
+
const apiProxy = process$1.env['SOCKET_SECURITY_API_PROXY'] || getConfigValue('apiProxy');
|
|
269
272
|
return strings.isNonEmptyString(apiProxy) ? apiProxy : undefined;
|
|
270
273
|
}
|
|
271
274
|
|
|
@@ -276,16 +279,18 @@ function getDefaultToken() {
|
|
|
276
279
|
if (constants.ENV[SOCKET_CLI_NO_API_TOKEN]) {
|
|
277
280
|
_defaultToken = undefined;
|
|
278
281
|
} else {
|
|
279
|
-
const key =
|
|
280
|
-
//
|
|
281
|
-
|
|
282
|
-
process$1.env['SOCKET_SECURITY_API_KEY'] || getSetting('apiToken') || _defaultToken;
|
|
282
|
+
const key =
|
|
283
|
+
// Lazily access constants.ENV[SOCKET_SECURITY_API_TOKEN].
|
|
284
|
+
constants.ENV[SOCKET_SECURITY_API_TOKEN] || getConfigValue('apiToken') || _defaultToken;
|
|
283
285
|
_defaultToken = strings.isNonEmptyString(key) ? key : undefined;
|
|
284
286
|
}
|
|
285
287
|
return _defaultToken;
|
|
286
288
|
}
|
|
287
289
|
function getPublicToken() {
|
|
288
|
-
return (
|
|
290
|
+
return (
|
|
291
|
+
// Lazily access constants.ENV[SOCKET_SECURITY_API_TOKEN].
|
|
292
|
+
(constants.ENV[SOCKET_SECURITY_API_TOKEN] || getDefaultToken()) ?? registryConstants.SOCKET_PUBLIC_API_TOKEN
|
|
293
|
+
);
|
|
289
294
|
}
|
|
290
295
|
async function setupSdk(apiToken = getDefaultToken(), apiBaseUrl = getDefaultApiBaseUrl(), proxy = getDefaultHttpProxy()) {
|
|
291
296
|
if (typeof apiToken !== 'string' && isInteractive()) {
|
|
@@ -306,7 +311,7 @@ async function setupSdk(apiToken = getDefaultToken(), apiBaseUrl = getDefaultApi
|
|
|
306
311
|
// The '@rollup/plugin-replace' will replace "process.env['INLINED_SOCKET_CLI_NAME']".
|
|
307
312
|
name: "@socketsecurity/cli",
|
|
308
313
|
// The '@rollup/plugin-replace' will replace "process.env['INLINED_SOCKET_CLI_VERSION']".
|
|
309
|
-
version: "0.14.
|
|
314
|
+
version: "0.14.67",
|
|
310
315
|
// The '@rollup/plugin-replace' will replace "process.env['INLINED_SOCKET_CLI_HOMEPAGE']".
|
|
311
316
|
homepage: "https://github.com/SocketDev/socket-cli"
|
|
312
317
|
})
|
|
@@ -1031,6 +1036,12 @@ function isArtifactAlertCve(alert) {
|
|
|
1031
1036
|
return type === ALERT_TYPE_CVE || type === ALERT_TYPE_MEDIUM_CVE || type === ALERT_TYPE_MILD_CVE || type === ALERT_TYPE_CRITICAL_CVE;
|
|
1032
1037
|
}
|
|
1033
1038
|
|
|
1039
|
+
let ALERT_FIX_TYPE = /*#__PURE__*/function (ALERT_FIX_TYPE) {
|
|
1040
|
+
ALERT_FIX_TYPE["cve"] = "cve";
|
|
1041
|
+
ALERT_FIX_TYPE["upgrade"] = "upgrade";
|
|
1042
|
+
return ALERT_FIX_TYPE;
|
|
1043
|
+
}({});
|
|
1044
|
+
|
|
1034
1045
|
const ERROR_UX = {
|
|
1035
1046
|
block: true,
|
|
1036
1047
|
display: true
|
|
@@ -1172,23 +1183,29 @@ async function uxLookup(settings) {
|
|
|
1172
1183
|
const sockSdk = await setupSdk(getPublicToken());
|
|
1173
1184
|
const orgResult = await sockSdk.getOrganizations();
|
|
1174
1185
|
if (!orgResult.success) {
|
|
1175
|
-
|
|
1186
|
+
if (orgResult.status === 429) {
|
|
1187
|
+
throw new Error(`API token quota exceeded: ${orgResult.error}`);
|
|
1188
|
+
}
|
|
1189
|
+
throw new Error(`Failed to fetch Socket organization info: ${orgResult.error}`);
|
|
1176
1190
|
}
|
|
1191
|
+
const {
|
|
1192
|
+
organizations
|
|
1193
|
+
} = orgResult.data;
|
|
1177
1194
|
const orgs = [];
|
|
1178
|
-
for (const org of Object.values(
|
|
1195
|
+
for (const org of Object.values(organizations)) {
|
|
1179
1196
|
if (org) {
|
|
1180
1197
|
orgs.push(org);
|
|
1181
1198
|
}
|
|
1182
1199
|
}
|
|
1183
|
-
const
|
|
1200
|
+
const settingsResult = await sockSdk.postSettings(orgs.map(org => ({
|
|
1184
1201
|
organization: org.id
|
|
1185
1202
|
})));
|
|
1186
|
-
if (!
|
|
1187
|
-
throw new Error(`Failed to fetch API key settings: ${
|
|
1203
|
+
if (!settingsResult.success) {
|
|
1204
|
+
throw new Error(`Failed to fetch API key settings: ${settingsResult.error}`);
|
|
1188
1205
|
}
|
|
1189
1206
|
return {
|
|
1190
1207
|
orgs,
|
|
1191
|
-
settings:
|
|
1208
|
+
settings: settingsResult.data
|
|
1192
1209
|
};
|
|
1193
1210
|
} catch (e) {
|
|
1194
1211
|
const cause = objects.isObject(e) && 'cause' in e ? e['cause'] : undefined;
|
|
@@ -1201,7 +1218,7 @@ async function uxLookup(settings) {
|
|
|
1201
1218
|
}
|
|
1202
1219
|
})();
|
|
1203
1220
|
// Remove any organizations not being enforced.
|
|
1204
|
-
const enforcedOrgs =
|
|
1221
|
+
const enforcedOrgs = getConfigValue('enforcedOrgs') ?? [];
|
|
1205
1222
|
for (const {
|
|
1206
1223
|
0: i,
|
|
1207
1224
|
1: org
|
|
@@ -1255,16 +1272,15 @@ function stringJoinWithSeparateFinalSeparator(list, separator = ' and ') {
|
|
|
1255
1272
|
return `${values.join(', ')}${separator}${finalValue}`;
|
|
1256
1273
|
}
|
|
1257
1274
|
|
|
1258
|
-
let
|
|
1259
|
-
|
|
1260
|
-
|
|
1261
|
-
|
|
1262
|
-
|
|
1263
|
-
return
|
|
1275
|
+
let ALERT_SEVERITY = /*#__PURE__*/function (ALERT_SEVERITY) {
|
|
1276
|
+
ALERT_SEVERITY["critical"] = "critical";
|
|
1277
|
+
ALERT_SEVERITY["high"] = "high";
|
|
1278
|
+
ALERT_SEVERITY["middle"] = "middle";
|
|
1279
|
+
ALERT_SEVERITY["low"] = "low";
|
|
1280
|
+
return ALERT_SEVERITY;
|
|
1264
1281
|
}({});
|
|
1265
|
-
|
|
1266
1282
|
// Ordered from most severe to least.
|
|
1267
|
-
const SEVERITIES_BY_ORDER = ['critical', 'high', 'middle', 'low'];
|
|
1283
|
+
const SEVERITIES_BY_ORDER = Object.freeze(['critical', 'high', 'middle', 'low']);
|
|
1268
1284
|
function getDesiredSeverities(lowestToInclude) {
|
|
1269
1285
|
const result = [];
|
|
1270
1286
|
for (const severity of SEVERITIES_BY_ORDER) {
|
|
@@ -1298,8 +1314,11 @@ function getSeverityCount(issues, lowestToInclude) {
|
|
|
1298
1314
|
if (!value) {
|
|
1299
1315
|
continue;
|
|
1300
1316
|
}
|
|
1301
|
-
|
|
1302
|
-
|
|
1317
|
+
const {
|
|
1318
|
+
severity
|
|
1319
|
+
} = value;
|
|
1320
|
+
if (severityCount[severity] !== undefined) {
|
|
1321
|
+
severityCount[severity] += 1;
|
|
1303
1322
|
}
|
|
1304
1323
|
}
|
|
1305
1324
|
return severityCount;
|
|
@@ -1359,8 +1378,6 @@ function getTranslations() {
|
|
|
1359
1378
|
}
|
|
1360
1379
|
|
|
1361
1380
|
const {
|
|
1362
|
-
ALERT_FIX_TYPE_CVE,
|
|
1363
|
-
ALERT_FIX_TYPE_UPGRADE,
|
|
1364
1381
|
CVE_ALERT_PROPS_FIRST_PATCHED_VERSION_IDENTIFIER,
|
|
1365
1382
|
NPM: NPM$2
|
|
1366
1383
|
} = constants;
|
|
@@ -1368,7 +1385,7 @@ const format = new ColorOrMarkdown(false);
|
|
|
1368
1385
|
async function addArtifactToAlertsMap(artifact, alertsByPkgId, options) {
|
|
1369
1386
|
// Make TypeScript happy.
|
|
1370
1387
|
if (!artifact.name || !artifact.version || !artifact.alerts?.length) {
|
|
1371
|
-
return;
|
|
1388
|
+
return alertsByPkgId;
|
|
1372
1389
|
}
|
|
1373
1390
|
const {
|
|
1374
1391
|
consolidate = false,
|
|
@@ -1405,10 +1422,10 @@ async function addArtifactToAlertsMap(artifact, alertsByPkgId, options) {
|
|
|
1405
1422
|
}
|
|
1406
1423
|
});
|
|
1407
1424
|
const fixType = alert.fix?.type ?? '';
|
|
1408
|
-
const critical = alert.severity ===
|
|
1425
|
+
const critical = alert.severity === ALERT_SEVERITY.critical;
|
|
1409
1426
|
const cve = isArtifactAlertCve(alert);
|
|
1410
|
-
const fixableCve = fixType ===
|
|
1411
|
-
const fixableUpgrade = fixType ===
|
|
1427
|
+
const fixableCve = fixType === ALERT_FIX_TYPE.cve;
|
|
1428
|
+
const fixableUpgrade = fixType === ALERT_FIX_TYPE.upgrade;
|
|
1412
1429
|
const fixable = fixableCve || fixableUpgrade;
|
|
1413
1430
|
const upgrade = fixableUpgrade && !objects.hasOwn(overrides, name);
|
|
1414
1431
|
if (include.cve && cve || include.unfixable && !fixable || include.critical && critical || include.upgrade && upgrade) {
|
|
@@ -1427,7 +1444,7 @@ async function addArtifactToAlertsMap(artifact, alertsByPkgId, options) {
|
|
|
1427
1444
|
}
|
|
1428
1445
|
}
|
|
1429
1446
|
if (!sockPkgAlerts.length) {
|
|
1430
|
-
return;
|
|
1447
|
+
return alertsByPkgId;
|
|
1431
1448
|
}
|
|
1432
1449
|
if (consolidate) {
|
|
1433
1450
|
const highestForCve = new Map();
|
|
@@ -1436,7 +1453,7 @@ async function addArtifactToAlertsMap(artifact, alertsByPkgId, options) {
|
|
|
1436
1453
|
for (const sockPkgAlert of sockPkgAlerts) {
|
|
1437
1454
|
const alert = sockPkgAlert.raw;
|
|
1438
1455
|
const fixType = alert.fix?.type ?? '';
|
|
1439
|
-
if (fixType ===
|
|
1456
|
+
if (fixType === ALERT_FIX_TYPE.cve) {
|
|
1440
1457
|
const patchedVersion = alert.props[CVE_ALERT_PROPS_FIRST_PATCHED_VERSION_IDENTIFIER];
|
|
1441
1458
|
const patchedMajor = semver.major(patchedVersion);
|
|
1442
1459
|
const oldHighest = highestForCve.get(patchedMajor);
|
|
@@ -1447,7 +1464,7 @@ async function addArtifactToAlertsMap(artifact, alertsByPkgId, options) {
|
|
|
1447
1464
|
version: patchedVersion
|
|
1448
1465
|
});
|
|
1449
1466
|
}
|
|
1450
|
-
} else if (fixType ===
|
|
1467
|
+
} else if (fixType === ALERT_FIX_TYPE.upgrade) {
|
|
1451
1468
|
const oldHighest = highestForUpgrade.get(major);
|
|
1452
1469
|
const highest = oldHighest?.version ?? '0.0.0';
|
|
1453
1470
|
if (semver.gt(version, highest)) {
|
|
@@ -1462,11 +1479,11 @@ async function addArtifactToAlertsMap(artifact, alertsByPkgId, options) {
|
|
|
1462
1479
|
}
|
|
1463
1480
|
sockPkgAlerts = [...unfixableAlerts, ...[...highestForCve.values()].map(d => d.alert), ...[...highestForUpgrade.values()].map(d => d.alert)];
|
|
1464
1481
|
}
|
|
1465
|
-
if (
|
|
1466
|
-
|
|
1482
|
+
if (sockPkgAlerts.length) {
|
|
1483
|
+
sockPkgAlerts.sort((a, b) => sorts.naturalCompare(a.type, b.type));
|
|
1484
|
+
alertsByPkgId.set(pkgId, sockPkgAlerts);
|
|
1467
1485
|
}
|
|
1468
|
-
|
|
1469
|
-
alertsByPkgId.set(pkgId, sockPkgAlerts);
|
|
1486
|
+
return alertsByPkgId;
|
|
1470
1487
|
}
|
|
1471
1488
|
function getCveInfoByAlertsMap(alertsMap, options) {
|
|
1472
1489
|
const exclude = {
|
|
@@ -1482,7 +1499,7 @@ function getCveInfoByAlertsMap(alertsMap, options) {
|
|
|
1482
1499
|
const name = packages.resolvePackageName(purlObj);
|
|
1483
1500
|
for (const sockPkgAlert of sockPkgAlerts) {
|
|
1484
1501
|
const alert = sockPkgAlert.raw;
|
|
1485
|
-
if (alert.fix?.type !==
|
|
1502
|
+
if (alert.fix?.type !== ALERT_FIX_TYPE.cve || exclude.upgrade && registry.getManifestData(NPM$2, name)) {
|
|
1486
1503
|
continue;
|
|
1487
1504
|
}
|
|
1488
1505
|
if (!infoByPkg) {
|
|
@@ -1626,7 +1643,10 @@ function getDetailsFromDiff(diff_, options) {
|
|
|
1626
1643
|
}
|
|
1627
1644
|
function getUrlOrigin(input) {
|
|
1628
1645
|
try {
|
|
1629
|
-
|
|
1646
|
+
// TODO: URL.parse is available in Node 22.1.0. We can use it when we drop Node 18.
|
|
1647
|
+
// https://nodejs.org/docs/latest-v22.x/api/url.html#urlparseinput-base
|
|
1648
|
+
// return URL.parse(input)?.origin ?? ''
|
|
1649
|
+
return new URL(input).origin ?? '';
|
|
1630
1650
|
} catch {}
|
|
1631
1651
|
return '';
|
|
1632
1652
|
}
|
|
@@ -1707,12 +1727,12 @@ async function getAlertsMapFromArborist(arb, options) {
|
|
|
1707
1727
|
return [key, overrideSet.value];
|
|
1708
1728
|
}));
|
|
1709
1729
|
}
|
|
1710
|
-
const
|
|
1730
|
+
const sockSdk = await setupSdk(getPublicToken());
|
|
1711
1731
|
const toAlertsMapOptions = {
|
|
1712
1732
|
overrides,
|
|
1713
1733
|
...options
|
|
1714
1734
|
};
|
|
1715
|
-
for await (const batchPackageFetchResult of
|
|
1735
|
+
for await (const batchPackageFetchResult of sockSdk.batchPackageStream({
|
|
1716
1736
|
alerts: 'true',
|
|
1717
1737
|
compact: 'true',
|
|
1718
1738
|
fixable: include.unfixable ? 'false' : 'true'
|
|
@@ -1910,12 +1930,12 @@ function installSafeArborist() {
|
|
|
1910
1930
|
|
|
1911
1931
|
installSafeArborist();
|
|
1912
1932
|
|
|
1933
|
+
exports.ALERT_SEVERITY = ALERT_SEVERITY;
|
|
1913
1934
|
exports.Arborist = Arborist;
|
|
1914
1935
|
exports.AuthError = AuthError;
|
|
1915
1936
|
exports.ColorOrMarkdown = ColorOrMarkdown;
|
|
1916
1937
|
exports.InputError = InputError;
|
|
1917
1938
|
exports.SAFE_ARBORIST_REIFY_OPTIONS_OVERRIDES = SAFE_ARBORIST_REIFY_OPTIONS_OVERRIDES;
|
|
1918
|
-
exports.SEVERITY = SEVERITY;
|
|
1919
1939
|
exports.SafeArborist = SafeArborist;
|
|
1920
1940
|
exports.addArtifactToAlertsMap = addArtifactToAlertsMap;
|
|
1921
1941
|
exports.captureException = captureException;
|
|
@@ -1924,18 +1944,20 @@ exports.findPackageNodes = findPackageNodes;
|
|
|
1924
1944
|
exports.findUp = findUp;
|
|
1925
1945
|
exports.formatSeverityCount = formatSeverityCount;
|
|
1926
1946
|
exports.getAlertsMapFromArborist = getAlertsMapFromArborist;
|
|
1947
|
+
exports.getConfigValue = getConfigValue;
|
|
1927
1948
|
exports.getCveInfoByAlertsMap = getCveInfoByAlertsMap;
|
|
1928
1949
|
exports.getDefaultToken = getDefaultToken;
|
|
1929
1950
|
exports.getPublicToken = getPublicToken;
|
|
1930
|
-
exports.getSetting = getSetting;
|
|
1931
1951
|
exports.getSeverityCount = getSeverityCount;
|
|
1932
1952
|
exports.getSocketDevAlertUrl = getSocketDevAlertUrl;
|
|
1933
1953
|
exports.getSocketDevPackageOverviewUrl = getSocketDevPackageOverviewUrl;
|
|
1934
1954
|
exports.readFileBinary = readFileBinary;
|
|
1935
1955
|
exports.readFileUtf8 = readFileUtf8;
|
|
1936
1956
|
exports.safeReadFile = safeReadFile;
|
|
1957
|
+
exports.sensitiveConfigKeys = sensitiveConfigKeys;
|
|
1937
1958
|
exports.setupSdk = setupSdk;
|
|
1959
|
+
exports.supportedConfigKeys = supportedConfigKeys;
|
|
1960
|
+
exports.updateConfigValue = updateConfigValue;
|
|
1938
1961
|
exports.updateNode = updateNode;
|
|
1939
|
-
|
|
1940
|
-
//# debugId=10ac7b59-9e2e-4a6a-88ed-ed401e2c65fd
|
|
1962
|
+
//# debugId=be8eae0e-badd-401f-9719-bf4c7157004d
|
|
1941
1963
|
//# sourceMappingURL=shadow-npm-inject.js.map
|