@socketsecurity/cli 0.14.29 → 0.14.31
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/bin/cli.js +2 -4
- package/bin/npm-cli.js +2 -4
- package/bin/npx-cli.js +2 -4
- package/dist/module-sync/cli.js +137 -112
- package/dist/module-sync/constants.d.ts +8 -2
- package/dist/module-sync/constants.js +34 -16
- package/dist/module-sync/link.js +15 -3
- package/dist/module-sync/npm-cli.js +21 -9
- package/dist/module-sync/npm-injection.js +406 -173
- package/dist/module-sync/npx-cli.js +19 -7
- package/dist/module-sync/path-resolve.js +17 -5
- package/dist/module-sync/sdk.d.ts +1 -2
- package/dist/module-sync/sdk.js +42 -32
- package/dist/module-sync/vendor.js +82 -0
- package/dist/require/cli.js +102 -76
- package/dist/require/constants.d.ts +8 -2
- package/dist/require/constants.js +35 -12
- package/dist/require/link.js +15 -3
- package/dist/require/npm-cli.js +19 -7
- package/dist/require/npm-injection.js +167 -170
- package/dist/require/npx-cli.js +17 -5
- package/dist/require/path-resolve.js +17 -5
- package/dist/require/sdk.d.ts +1 -2
- package/dist/require/sdk.js +36 -26
- package/dist/require/vendor.js +23 -11
- package/package.json +6 -4
- package/translations.json +191 -288
|
@@ -1,24 +1,37 @@
|
|
|
1
1
|
'use strict';
|
|
2
2
|
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
var
|
|
16
|
-
var
|
|
17
|
-
var require$$1$
|
|
18
|
-
var require$$
|
|
19
|
-
var
|
|
20
|
-
var
|
|
21
|
-
var
|
|
3
|
+
function _interop(e) {
|
|
4
|
+
let d
|
|
5
|
+
if (e) {
|
|
6
|
+
let c = 0
|
|
7
|
+
for (const k in e) {
|
|
8
|
+
d = c++ === 0 && k === 'default' ? e[k] : void 0
|
|
9
|
+
if (!d) break
|
|
10
|
+
}
|
|
11
|
+
}
|
|
12
|
+
return d ?? e
|
|
13
|
+
}
|
|
14
|
+
|
|
15
|
+
var vendor = _interop(require('./vendor.js'));
|
|
16
|
+
var constants = _interop(require('./constants.js'));
|
|
17
|
+
var require$$1$4 = _interop(require('node:events'));
|
|
18
|
+
var require$$0 = _interop(require('node:fs'));
|
|
19
|
+
var require$$3$2 = _interop(require('node:https'));
|
|
20
|
+
var require$$1$1 = _interop(require('node:path'));
|
|
21
|
+
var require$$3 = _interop(require('node:readline'));
|
|
22
|
+
var require$$6$2 = _interop(require('node:timers/promises'));
|
|
23
|
+
var require$$1$3 = _interop(require('@inquirer/confirm'));
|
|
24
|
+
var require$$3$1 = _interop(require('@socketregistry/yocto-spinner'));
|
|
25
|
+
var require$$5$1 = _interop(require('npm-package-arg'));
|
|
26
|
+
var require$$4 = _interop(require('semver'));
|
|
27
|
+
var require$$6$1 = _interop(require('@socketsecurity/config'));
|
|
28
|
+
var require$$7 = _interop(require('@socketsecurity/registry/lib/objects'));
|
|
29
|
+
var require$$1$2 = _interop(require('node:net'));
|
|
30
|
+
var require$$1 = _interop(require('node:os'));
|
|
31
|
+
var require$$5 = _interop(require('node:stream'));
|
|
32
|
+
var sdk = _interop(require('./sdk.js'));
|
|
33
|
+
var pathResolve = _interop(require('./path-resolve.js'));
|
|
34
|
+
var link = _interop(require('./link.js'));
|
|
22
35
|
|
|
23
36
|
var npmInjection$2 = {};
|
|
24
37
|
|
|
@@ -29,7 +42,7 @@ var arborist = {};
|
|
|
29
42
|
var ttyServer$1 = {};
|
|
30
43
|
|
|
31
44
|
var name = "@socketsecurity/cli";
|
|
32
|
-
var version = "0.14.
|
|
45
|
+
var version = "0.14.31";
|
|
33
46
|
var description = "CLI tool for Socket.dev";
|
|
34
47
|
var homepage = "http://github.com/SocketDev/socket-cli";
|
|
35
48
|
var license = "MIT";
|
|
@@ -105,12 +118,14 @@ var scripts = {
|
|
|
105
118
|
var dependencies = {
|
|
106
119
|
"@apideck/better-ajv-errors": "^0.3.6",
|
|
107
120
|
"@cyclonedx/cdxgen": "^11.0.5",
|
|
108
|
-
"@inquirer/
|
|
121
|
+
"@inquirer/confirm": "^5.0.2",
|
|
122
|
+
"@inquirer/password": "^4.0.3",
|
|
123
|
+
"@inquirer/select": "^4.0.3",
|
|
109
124
|
"@npmcli/promise-spawn": "^8.0.2",
|
|
110
125
|
"@socketregistry/hyrious__bun.lockb": "1.0.5",
|
|
111
126
|
"@socketregistry/yocto-spinner": "^1.0.1",
|
|
112
127
|
"@socketsecurity/config": "^2.1.3",
|
|
113
|
-
"@socketsecurity/registry": "^1.0.
|
|
128
|
+
"@socketsecurity/registry": "^1.0.35",
|
|
114
129
|
"@socketsecurity/sdk": "^1.3.0",
|
|
115
130
|
blessed: "^0.1.81",
|
|
116
131
|
"blessed-contrib": "^4.11.0",
|
|
@@ -275,7 +290,7 @@ var _nodeNet = require$$1$2;
|
|
|
275
290
|
var _nodeOs = require$$1;
|
|
276
291
|
var _nodePath$1 = require$$1$1;
|
|
277
292
|
var _nodeReadline$1 = require$$3;
|
|
278
|
-
var _nodeStream
|
|
293
|
+
var _nodeStream = require$$5;
|
|
279
294
|
var _package = require$$6;
|
|
280
295
|
var _misc$1 = sdk.misc;
|
|
281
296
|
const NEWLINE_CHAR_CODE = 10; /*'\n'*/
|
|
@@ -313,10 +328,10 @@ function createNonStandardTTYServer() {
|
|
|
313
328
|
if (remote_ipc_version !== _package.version) {
|
|
314
329
|
throw new Error('Mismatched STDIO tunnel IPC version, ensure you only have 1 version of socket CLI being called.');
|
|
315
330
|
}
|
|
316
|
-
const input = hasInput ? new _nodeStream
|
|
331
|
+
const input = hasInput ? new _nodeStream.PassThrough() : null;
|
|
317
332
|
input?.pause();
|
|
318
333
|
if (input) conn.pipe(input);
|
|
319
|
-
const output = hasOutput ? new _nodeStream
|
|
334
|
+
const output = hasOutput ? new _nodeStream.PassThrough() : null;
|
|
320
335
|
if (output) {
|
|
321
336
|
output.pipe(conn)
|
|
322
337
|
// Make ora happy
|
|
@@ -470,7 +485,7 @@ var issueRules = {};
|
|
|
470
485
|
Object.defineProperty(issueRules, "__esModule", {
|
|
471
486
|
value: true
|
|
472
487
|
});
|
|
473
|
-
issueRules.
|
|
488
|
+
issueRules.createAlertUXLookup = createAlertUXLookup;
|
|
474
489
|
//#region UX Constants
|
|
475
490
|
|
|
476
491
|
const IGNORE_UX = {
|
|
@@ -537,7 +552,7 @@ function resolveIssueRuleUX(entriesOrderedIssueRules, defaultValue) {
|
|
|
537
552
|
function issueRuleValueDoesNotDefer(issueRule) {
|
|
538
553
|
if (issueRule === undefined) {
|
|
539
554
|
return false;
|
|
540
|
-
} else if (typeof issueRule === 'object'
|
|
555
|
+
} else if (issueRule !== null && typeof issueRule === 'object') {
|
|
541
556
|
const {
|
|
542
557
|
action
|
|
543
558
|
} = issueRule;
|
|
@@ -569,11 +584,13 @@ function uxForDefinedNonDeferValue(issueRuleValue) {
|
|
|
569
584
|
|
|
570
585
|
//#region exports
|
|
571
586
|
|
|
572
|
-
function
|
|
587
|
+
function createAlertUXLookup(settings) {
|
|
573
588
|
const cachedUX = new Map();
|
|
574
589
|
return context => {
|
|
575
|
-
const
|
|
576
|
-
|
|
590
|
+
const {
|
|
591
|
+
type
|
|
592
|
+
} = context.alert;
|
|
593
|
+
let ux = cachedUX.get(type);
|
|
577
594
|
if (ux) {
|
|
578
595
|
return ux;
|
|
579
596
|
}
|
|
@@ -586,7 +603,7 @@ function createIssueUXLookup(settings) {
|
|
|
586
603
|
if (!resolvedTarget) {
|
|
587
604
|
break;
|
|
588
605
|
}
|
|
589
|
-
const issueRuleValue = resolvedTarget.issueRules?.[
|
|
606
|
+
const issueRuleValue = resolvedTarget.issueRules?.[type];
|
|
590
607
|
if (typeof issueRuleValue !== 'undefined') {
|
|
591
608
|
orderedIssueRules.push(issueRuleValue);
|
|
592
609
|
}
|
|
@@ -594,7 +611,7 @@ function createIssueUXLookup(settings) {
|
|
|
594
611
|
}
|
|
595
612
|
entriesOrderedIssueRules.push(orderedIssueRules);
|
|
596
613
|
}
|
|
597
|
-
const defaultValue = settings.defaults.issueRules[
|
|
614
|
+
const defaultValue = settings.defaults.issueRules[type];
|
|
598
615
|
let resolvedDefaultValue = {
|
|
599
616
|
action: 'error'
|
|
600
617
|
};
|
|
@@ -608,7 +625,7 @@ function createIssueUXLookup(settings) {
|
|
|
608
625
|
};
|
|
609
626
|
}
|
|
610
627
|
ux = resolveIssueRuleUX(entriesOrderedIssueRules, resolvedDefaultValue);
|
|
611
|
-
cachedUX.set(
|
|
628
|
+
cachedUX.set(type, ux);
|
|
612
629
|
return ux;
|
|
613
630
|
};
|
|
614
631
|
}
|
|
@@ -619,16 +636,16 @@ Object.defineProperty(arborist, "__esModule", {
|
|
|
619
636
|
});
|
|
620
637
|
arborist.SafeArborist = void 0;
|
|
621
638
|
arborist.installSafeArborist = installSafeArborist;
|
|
622
|
-
var _nodeEvents = require$$1$
|
|
639
|
+
var _nodeEvents = require$$1$4;
|
|
623
640
|
var _nodeFs = require$$0;
|
|
624
641
|
var _nodeHttps = require$$3$2;
|
|
625
642
|
var _nodePath = require$$1$1;
|
|
626
643
|
var _nodeReadline = require$$3;
|
|
627
|
-
var
|
|
628
|
-
var
|
|
644
|
+
var _promises = require$$6$2;
|
|
645
|
+
var _confirm = require$$1$3;
|
|
646
|
+
var _yoctoSpinner = require$$3$1;
|
|
629
647
|
var _isInteractive = _interopRequireDefault(vendor.isInteractive);
|
|
630
648
|
var _npmPackageArg = require$$5$1;
|
|
631
|
-
var _yoctoSpinner = require$$3$1;
|
|
632
649
|
var _semver = require$$4;
|
|
633
650
|
var _config = require$$6$1;
|
|
634
651
|
var _objects = require$$7;
|
|
@@ -640,7 +657,7 @@ var _misc = sdk.misc;
|
|
|
640
657
|
var _pathResolve = pathResolve.pathResolve;
|
|
641
658
|
var _sdk = sdk.sdk;
|
|
642
659
|
var _settings = sdk.settings;
|
|
643
|
-
const
|
|
660
|
+
const POTENTIAL_BUG_ERROR_MESSAGE = `This is may be a bug with socket-npm related to changes to the npm CLI.\nPlease report to ${_constants$1.SOCKET_CLI_ISSUES_URL}.`;
|
|
644
661
|
const npmEntrypoint = (0, _nodeFs.realpathSync)(process.argv[1]);
|
|
645
662
|
const npmRootPath = (0, _pathResolve.findRoot)(_nodePath.dirname(npmEntrypoint));
|
|
646
663
|
function tryRequire(...ids) {
|
|
@@ -666,12 +683,9 @@ function tryRequire(...ids) {
|
|
|
666
683
|
return undefined;
|
|
667
684
|
}
|
|
668
685
|
if (npmRootPath === undefined) {
|
|
669
|
-
console.error(`Unable to find npm
|
|
670
|
-
console.error(`Searched parent directories of ${npmEntrypoint}`);
|
|
686
|
+
console.error(`Unable to find npm CLI install directory.\nSearched parent directories of ${npmEntrypoint}.\n\n${POTENTIAL_BUG_ERROR_MESSAGE}`);
|
|
671
687
|
process.exit(127);
|
|
672
688
|
}
|
|
673
|
-
const LOOP_SENTINEL = 1_000_000;
|
|
674
|
-
const NPM_REGISTRY_URL = 'https://registry.npmjs.org';
|
|
675
689
|
const npmNmPath = _nodePath.join(npmRootPath, 'node_modules');
|
|
676
690
|
const arboristPkgPath = _nodePath.join(npmNmPath, '@npmcli/arborist');
|
|
677
691
|
const arboristClassPath = _nodePath.join(arboristPkgPath, 'lib/arborist/index.js');
|
|
@@ -684,7 +698,7 @@ const log = tryRequire([_nodePath.join(npmNmPath, 'proc-log/lib/index.js'),
|
|
|
684
698
|
// is really that of its export log.
|
|
685
699
|
mod => mod.log], _nodePath.join(npmNmPath, 'npmlog/lib/log.js'));
|
|
686
700
|
if (log === undefined) {
|
|
687
|
-
console.error(`Unable to integrate with npm
|
|
701
|
+
console.error(`Unable to integrate with npm CLI logging infrastructure.\n\n${POTENTIAL_BUG_ERROR_MESSAGE}.`);
|
|
688
702
|
process.exit(127);
|
|
689
703
|
}
|
|
690
704
|
const pacote = tryRequire(_nodePath.join(npmNmPath, 'pacote'), 'pacote');
|
|
@@ -704,7 +718,7 @@ const OverrideSet = require(arboristOverrideSetClassPatch);
|
|
|
704
718
|
const kCtorArgs = Symbol('ctorArgs');
|
|
705
719
|
const kRiskyReify = Symbol('riskyReify');
|
|
706
720
|
const formatter = new _colorOrMarkdown.ColorOrMarkdown(false);
|
|
707
|
-
const pubToken = (0, _sdk.getDefaultKey)() ??
|
|
721
|
+
const pubToken = (0, _sdk.getDefaultKey)() ?? _constants$1.SOCKET_PUBLIC_API_KEY;
|
|
708
722
|
const ttyServer = (0, _ttyServer.createTTYServer)((0, _isInteractive.default)({
|
|
709
723
|
stream: process.stdin
|
|
710
724
|
}), log);
|
|
@@ -719,31 +733,20 @@ async function uxLookup(settings) {
|
|
|
719
733
|
return _uxLookup(settings);
|
|
720
734
|
}
|
|
721
735
|
async function* batchScan(pkgIds) {
|
|
722
|
-
const
|
|
723
|
-
packages: pkgIds.map(id => {
|
|
724
|
-
const {
|
|
725
|
-
name,
|
|
726
|
-
version
|
|
727
|
-
} = pkgidParts(id);
|
|
728
|
-
return {
|
|
729
|
-
eco: 'npm',
|
|
730
|
-
pkg: name,
|
|
731
|
-
ver: version,
|
|
732
|
-
top: true
|
|
733
|
-
};
|
|
734
|
-
})
|
|
735
|
-
};
|
|
736
|
-
// TODO: Migrate to SDK.
|
|
737
|
-
const pkgDataReq = _nodeHttps.request(`${_constants$1.API_V0_URL}/scan/batch`, {
|
|
736
|
+
const req = _nodeHttps.request(`${_constants$1.API_V0_URL}/purl?alerts=true`, {
|
|
738
737
|
method: 'POST',
|
|
739
738
|
headers: {
|
|
740
739
|
Authorization: `Basic ${Buffer.from(`${pubToken}:`).toString('base64url')}`
|
|
741
740
|
},
|
|
742
741
|
signal: abortSignal
|
|
743
|
-
}).end(JSON.stringify(
|
|
742
|
+
}).end(JSON.stringify({
|
|
743
|
+
components: pkgIds.map(id => ({
|
|
744
|
+
purl: `pkg:npm/${id}`
|
|
745
|
+
}))
|
|
746
|
+
}));
|
|
744
747
|
const {
|
|
745
748
|
0: res
|
|
746
|
-
} = await _nodeEvents.once(
|
|
749
|
+
} = await _nodeEvents.once(req, 'response');
|
|
747
750
|
const ok = res.statusCode >= 200 && res.statusCode <= 299;
|
|
748
751
|
if (!ok) {
|
|
749
752
|
throw new Error(`Socket API Error: ${res.statusCode}`);
|
|
@@ -809,101 +812,118 @@ function findSpecificOverrideSet(first, second) {
|
|
|
809
812
|
log.silly('Conflicting override sets', first, second);
|
|
810
813
|
return undefined;
|
|
811
814
|
}
|
|
815
|
+
function isAlertFixable(alert) {
|
|
816
|
+
const {
|
|
817
|
+
type
|
|
818
|
+
} = alert;
|
|
819
|
+
if (type === 'cve' || type === 'mediumCVE' || type === 'mildCVE' || type === 'criticalCVE') {
|
|
820
|
+
return !!alert.props?.['firstPatchedVersionIdentifier'];
|
|
821
|
+
}
|
|
822
|
+
return type === 'socketUpgradeAvailable';
|
|
823
|
+
}
|
|
812
824
|
function maybeReadfileSync(filepath) {
|
|
813
825
|
try {
|
|
814
826
|
return (0, _nodeFs.readFileSync)(filepath, 'utf8');
|
|
815
827
|
} catch {}
|
|
816
828
|
return undefined;
|
|
817
829
|
}
|
|
818
|
-
async function
|
|
830
|
+
async function getPackagesAlerts(safeArb, _registry, pkgs, output) {
|
|
819
831
|
const spinner = _yoctoSpinner({
|
|
820
832
|
stream: output
|
|
821
833
|
});
|
|
822
|
-
let result = false;
|
|
823
834
|
let {
|
|
824
835
|
length: remaining
|
|
825
836
|
} = pkgs;
|
|
837
|
+
const packageAlerts = [];
|
|
826
838
|
if (!remaining) {
|
|
827
839
|
spinner.success('No changes detected');
|
|
828
|
-
return
|
|
840
|
+
return packageAlerts;
|
|
829
841
|
}
|
|
830
842
|
const getText = () => `Looking up data for ${remaining} packages`;
|
|
831
843
|
spinner.start(getText());
|
|
832
844
|
try {
|
|
833
|
-
for await (const
|
|
845
|
+
for await (const artifact of batchScan(pkgs.map(p => p.pkgid))) {
|
|
846
|
+
if (!artifact.name || !artifact.version || !artifact.alerts?.length) {
|
|
847
|
+
continue;
|
|
848
|
+
}
|
|
834
849
|
const {
|
|
835
|
-
|
|
836
|
-
|
|
837
|
-
|
|
838
|
-
const id = `${name}@${version}`;
|
|
850
|
+
version
|
|
851
|
+
} = artifact;
|
|
852
|
+
const name = `${artifact.namespace ? `${artifact.namespace}/` : ''}${artifact.name}`;
|
|
853
|
+
const id = `${name}@${artifact.version}`;
|
|
854
|
+
let blocked = false;
|
|
839
855
|
let displayWarning = false;
|
|
840
|
-
let
|
|
841
|
-
|
|
842
|
-
|
|
843
|
-
|
|
844
|
-
|
|
856
|
+
let alerts = [];
|
|
857
|
+
for (const alert of artifact.alerts) {
|
|
858
|
+
// eslint-disable-next-line no-await-in-loop
|
|
859
|
+
const ux = await uxLookup({
|
|
860
|
+
package: {
|
|
861
|
+
name,
|
|
862
|
+
version
|
|
863
|
+
},
|
|
864
|
+
alert: {
|
|
865
|
+
type: alert.type
|
|
866
|
+
}
|
|
845
867
|
});
|
|
846
|
-
|
|
847
|
-
|
|
848
|
-
|
|
849
|
-
|
|
850
|
-
|
|
851
|
-
|
|
852
|
-
|
|
853
|
-
|
|
854
|
-
|
|
855
|
-
|
|
856
|
-
|
|
857
|
-
|
|
868
|
+
if (ux.block) {
|
|
869
|
+
blocked = true;
|
|
870
|
+
}
|
|
871
|
+
if (ux.display) {
|
|
872
|
+
displayWarning = true;
|
|
873
|
+
}
|
|
874
|
+
if (ux.block || ux.display) {
|
|
875
|
+
alerts.push({
|
|
876
|
+
name,
|
|
877
|
+
version,
|
|
878
|
+
type: alert.type,
|
|
879
|
+
block: ux.block,
|
|
880
|
+
raw: alert,
|
|
881
|
+
fixable: isAlertFixable(alert)
|
|
858
882
|
});
|
|
859
|
-
|
|
860
|
-
|
|
861
|
-
|
|
862
|
-
|
|
863
|
-
|
|
864
|
-
//
|
|
865
|
-
|
|
866
|
-
|
|
867
|
-
if (
|
|
868
|
-
|
|
869
|
-
|
|
870
|
-
|
|
871
|
-
|
|
872
|
-
|
|
873
|
-
|
|
874
|
-
}
|
|
875
|
-
}
|
|
876
|
-
if (ux.block) {
|
|
877
|
-
result = true;
|
|
878
|
-
blocked = true;
|
|
879
|
-
}
|
|
880
|
-
if (ux.display) {
|
|
881
|
-
displayWarning = true;
|
|
883
|
+
// Before we ask about problematic issues, check to see if they
|
|
884
|
+
// already existed in the old version if they did, be quiet.
|
|
885
|
+
const pkg = pkgs.find(p => p.pkgid === id && p.existing?.startsWith(`${name}@`));
|
|
886
|
+
if (pkg?.existing) {
|
|
887
|
+
const oldArtifact =
|
|
888
|
+
// eslint-disable-next-line no-await-in-loop
|
|
889
|
+
(await batchScan([pkg.existing]).next()).value;
|
|
890
|
+
console.log('oldArtifact', oldArtifact);
|
|
891
|
+
// if (oldArtifact.type === 'success') {
|
|
892
|
+
// issues = issues.filter(
|
|
893
|
+
// ({ type }) =>
|
|
894
|
+
// oldPkgData.value.issues.find(
|
|
895
|
+
// oldIssue => oldIssue.type === type
|
|
896
|
+
// ) === undefined
|
|
897
|
+
// )
|
|
898
|
+
// }
|
|
882
899
|
}
|
|
883
900
|
}
|
|
884
|
-
|
|
885
|
-
|
|
886
|
-
|
|
887
|
-
|
|
888
|
-
|
|
889
|
-
|
|
890
|
-
|
|
891
|
-
|
|
892
|
-
|
|
893
|
-
}
|
|
901
|
+
}
|
|
902
|
+
if (!blocked) {
|
|
903
|
+
const pkg = pkgs.find(p => p.pkgid === id);
|
|
904
|
+
if (pkg) {
|
|
905
|
+
await tarball.stream(id, stream => {
|
|
906
|
+
stream.resume();
|
|
907
|
+
return stream.promise();
|
|
908
|
+
}, {
|
|
909
|
+
...safeArb[kCtorArgs][0]
|
|
910
|
+
});
|
|
894
911
|
}
|
|
895
912
|
}
|
|
896
913
|
if (displayWarning) {
|
|
897
914
|
spinner.stop(`(socket) ${formatter.hyperlink(id, `https://socket.dev/npm/package/${name}/overview/${version}`)} contains risks:`);
|
|
898
|
-
|
|
915
|
+
alerts.sort((a, b) => a.type < b.type ? -1 : 1);
|
|
899
916
|
const lines = new Set();
|
|
900
|
-
for (const
|
|
901
|
-
|
|
902
|
-
|
|
903
|
-
|
|
904
|
-
|
|
905
|
-
|
|
906
|
-
}
|
|
917
|
+
for (const alert of alerts) {
|
|
918
|
+
// Based data from { pageProps: { alertTypes } } of:
|
|
919
|
+
// https://socket.dev/_next/data/94666139314b6437ee4491a0864e72b264547585/en-US.json
|
|
920
|
+
const info = translations.alerts[alert.type];
|
|
921
|
+
const title = info?.title ?? alert.type;
|
|
922
|
+
const attributes = [...(alert.fixable ? ['fixable'] : []), ...(alert.block ? [] : ['non-blocking'])];
|
|
923
|
+
const maybeAttributes = attributes.length ? ` (${attributes.join('; ')})` : '';
|
|
924
|
+
const maybeDesc = info?.description ? ` - ${info.description}` : '';
|
|
925
|
+
// TODO: emoji seems to mis-align terminals sometimes
|
|
926
|
+
lines.add(` ${title}${maybeAttributes}${maybeDesc}\n`);
|
|
907
927
|
}
|
|
908
928
|
for (const line of lines) {
|
|
909
929
|
output?.write(line);
|
|
@@ -912,20 +932,14 @@ async function packagesHaveRiskyIssues(safeArb, _registry, pkgs, output) {
|
|
|
912
932
|
}
|
|
913
933
|
remaining -= 1;
|
|
914
934
|
spinner.text = remaining > 0 ? getText() : '';
|
|
935
|
+
packageAlerts.push(...alerts);
|
|
915
936
|
}
|
|
916
|
-
|
|
937
|
+
} catch (e) {
|
|
938
|
+
console.log('error', e);
|
|
917
939
|
} finally {
|
|
918
940
|
spinner.stop();
|
|
919
941
|
}
|
|
920
|
-
|
|
921
|
-
function pkgidParts(pkgid) {
|
|
922
|
-
const delimiter = pkgid.lastIndexOf('@');
|
|
923
|
-
const name = pkgid.slice(0, delimiter);
|
|
924
|
-
const version = pkgid.slice(delimiter + 1);
|
|
925
|
-
return {
|
|
926
|
-
name,
|
|
927
|
-
version
|
|
928
|
-
};
|
|
942
|
+
return packageAlerts;
|
|
929
943
|
}
|
|
930
944
|
function toRepoUrl(resolved) {
|
|
931
945
|
return resolved.replace(/#[\s\S]*$/, '').replace(/\?[\s\S]*$/, '').replace(/\/[^/]*\/-\/[\s\S]*$/, '');
|
|
@@ -937,7 +951,7 @@ function walk(diff_, needInfoOn = []) {
|
|
|
937
951
|
length: queueLength
|
|
938
952
|
} = queue;
|
|
939
953
|
while (pos < queueLength) {
|
|
940
|
-
if (pos === LOOP_SENTINEL) {
|
|
954
|
+
if (pos === _constants$1.LOOP_SENTINEL) {
|
|
941
955
|
throw new Error('Detected infinite loop while walking Arborist diff');
|
|
942
956
|
}
|
|
943
957
|
const diff = queue[pos++];
|
|
@@ -1509,7 +1523,7 @@ class SafeOverrideSet extends OverrideSet {
|
|
|
1509
1523
|
length: queueLength
|
|
1510
1524
|
} = queue;
|
|
1511
1525
|
while (pos < queueLength) {
|
|
1512
|
-
if (pos === LOOP_SENTINEL) {
|
|
1526
|
+
if (pos === _constants$1.LOOP_SENTINEL) {
|
|
1513
1527
|
throw new Error('Detected infinite loop while comparing override sets');
|
|
1514
1528
|
}
|
|
1515
1529
|
const {
|
|
@@ -1651,43 +1665,26 @@ class SafeArborist extends Arborist {
|
|
|
1651
1665
|
options['save'] = old.save;
|
|
1652
1666
|
options['saveBundle'] = old.saveBundle;
|
|
1653
1667
|
// Nothing to check, mmm already installed or all private?
|
|
1654
|
-
if (diff.findIndex(c => c.repository_url === NPM_REGISTRY_URL) === -1) {
|
|
1668
|
+
if (diff.findIndex(c => c.repository_url === _constants$1.NPM_REGISTRY_URL) === -1) {
|
|
1655
1669
|
return await this[kRiskyReify](...args);
|
|
1656
1670
|
}
|
|
1657
|
-
let proceed = _constants$1.ENV.UPDATE_SOCKET_OVERRIDES_IN_PACKAGE_LOCK_FILE;
|
|
1671
|
+
let proceed = _constants$1.ENV[_constants$1.UPDATE_SOCKET_OVERRIDES_IN_PACKAGE_LOCK_FILE];
|
|
1658
1672
|
if (!proceed) {
|
|
1659
1673
|
proceed = await ttyServer.captureTTY(async (input, output) => {
|
|
1660
1674
|
if (input && output) {
|
|
1661
|
-
const
|
|
1662
|
-
if (!
|
|
1675
|
+
const alerts = await getPackagesAlerts(this, this['registry'], diff, output);
|
|
1676
|
+
if (!alerts.length) {
|
|
1663
1677
|
return true;
|
|
1664
1678
|
}
|
|
1665
|
-
|
|
1666
|
-
|
|
1667
|
-
|
|
1668
|
-
|
|
1669
|
-
|
|
1679
|
+
return await _confirm({
|
|
1680
|
+
message: 'Accept risks of installing these packages?',
|
|
1681
|
+
default: false
|
|
1682
|
+
}, {
|
|
1683
|
+
input,
|
|
1684
|
+
output,
|
|
1685
|
+
signal: abortSignal
|
|
1670
1686
|
});
|
|
1671
|
-
|
|
1672
|
-
try {
|
|
1673
|
-
while (true) {
|
|
1674
|
-
// eslint-disable-next-line no-await-in-loop
|
|
1675
|
-
const answer = await new Promise(resolve => {
|
|
1676
|
-
rli.question('Accept risks of installing these packages (y/N)?\n', {
|
|
1677
|
-
signal: abortSignal
|
|
1678
|
-
}, resolve);
|
|
1679
|
-
});
|
|
1680
|
-
if (/^\s*y(?:es)?\s*$/i.test(answer)) {
|
|
1681
|
-
return true;
|
|
1682
|
-
}
|
|
1683
|
-
if (/^(?:\s*no?\s*|)$/i.test(answer)) {
|
|
1684
|
-
return false;
|
|
1685
|
-
}
|
|
1686
|
-
}
|
|
1687
|
-
} finally {
|
|
1688
|
-
rli.close();
|
|
1689
|
-
}
|
|
1690
|
-
} else if (await packagesHaveRiskyIssues(this, this['registry'], diff, output)) {
|
|
1687
|
+
} else if ((await getPackagesAlerts(this, this['registry'], diff, output)).length > 0) {
|
|
1691
1688
|
throw new Error('Socket npm Unable to prompt to accept risk, need TTY to do so');
|
|
1692
1689
|
}
|
|
1693
1690
|
return true;
|
|
@@ -1788,7 +1785,7 @@ void (async () => {
|
|
|
1788
1785
|
}
|
|
1789
1786
|
});
|
|
1790
1787
|
}
|
|
1791
|
-
_uxLookup = (0, _issueRules.
|
|
1788
|
+
_uxLookup = (0, _issueRules.createAlertUXLookup)(settings);
|
|
1792
1789
|
})();
|
|
1793
1790
|
|
|
1794
1791
|
var _constants = constants.constants;
|
package/dist/require/npx-cli.js
CHANGED
|
@@ -1,11 +1,23 @@
|
|
|
1
1
|
#!/usr/bin/env node
|
|
2
2
|
'use strict';
|
|
3
3
|
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
4
|
+
function _interop(e) {
|
|
5
|
+
let d
|
|
6
|
+
if (e) {
|
|
7
|
+
let c = 0
|
|
8
|
+
for (const k in e) {
|
|
9
|
+
d = c++ === 0 && k === 'default' ? e[k] : void 0
|
|
10
|
+
if (!d) break
|
|
11
|
+
}
|
|
12
|
+
}
|
|
13
|
+
return d ?? e
|
|
14
|
+
}
|
|
15
|
+
|
|
16
|
+
var vendor = _interop(require('./vendor.js'));
|
|
17
|
+
var require$$1 = _interop(require('node:path'));
|
|
18
|
+
var require$$1$1 = _interop(require('@npmcli/promise-spawn'));
|
|
19
|
+
var constants = _interop(require('./constants.js'));
|
|
20
|
+
var link = _interop(require('./link.js'));
|
|
9
21
|
|
|
10
22
|
var npxCli$2 = {};
|
|
11
23
|
|
|
@@ -1,10 +1,22 @@
|
|
|
1
1
|
'use strict';
|
|
2
2
|
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
3
|
+
function _interop(e) {
|
|
4
|
+
let d
|
|
5
|
+
if (e) {
|
|
6
|
+
let c = 0
|
|
7
|
+
for (const k in e) {
|
|
8
|
+
d = c++ === 0 && k === 'default' ? e[k] : void 0
|
|
9
|
+
if (!d) break
|
|
10
|
+
}
|
|
11
|
+
}
|
|
12
|
+
return d ?? e
|
|
13
|
+
}
|
|
14
|
+
|
|
15
|
+
var require$$1$1 = _interop(require('node:fs/promises'));
|
|
16
|
+
var require$$1 = _interop(require('node:path'));
|
|
17
|
+
var require$$2 = _interop(require('ignore'));
|
|
18
|
+
var require$$3 = _interop(require('micromatch'));
|
|
19
|
+
var require$$8 = _interop(require('tinyglobby'));
|
|
8
20
|
|
|
9
21
|
var pathResolve = {};
|
|
10
22
|
|
package/dist/require/sdk.d.ts
CHANGED
|
@@ -3,7 +3,6 @@ import { SocketSdk } from '@socketsecurity/sdk';
|
|
|
3
3
|
declare function createDebugLogger(printDebugLogs?: boolean): typeof console.error;
|
|
4
4
|
declare function isErrnoException(value: unknown): value is NodeJS.ErrnoException;
|
|
5
5
|
declare function stringJoinWithSeparateFinalSeparator(list: (string | undefined)[], separator?: string): string;
|
|
6
|
-
declare const FREE_API_KEY = "sktsec_t_--RAN5U4ivauy4w37-6aoKyYPDt5ZbaT5JBVMqiwKo_api";
|
|
7
6
|
declare function getDefaultKey(): string | undefined;
|
|
8
7
|
declare function setupSdk(apiKey?: string | undefined, apiBaseUrl?: string | undefined, proxy?: string | undefined): Promise<SocketSdk>;
|
|
9
|
-
export { createDebugLogger, isErrnoException, stringJoinWithSeparateFinalSeparator,
|
|
8
|
+
export { createDebugLogger, isErrnoException, stringJoinWithSeparateFinalSeparator, getDefaultKey, setupSdk };
|