@sudoplatform/sudo-common 8.8.6 → 8.9.1

package/bin/suppress-audit.sh

@@ -2,14 +2,83 @@
 #
 # Insert a audit identifier to suppress in verification proccess.
 #
+# Suppressions are objects added to the auditSuppresions element of package.json
+# and are of the form:
+#
+# "auditSuppressions": {
+#   "<numeric-vulnerability-id>": {
+#     "until": <numeric-expiry-in-seconds-since-epoch>,
+#     "untilISO": "<expiry-time-in-ISO8601-format>",
+#     "reason": "<string-text-for-recording-reason-for-suppression>"
+#   }
+# }
+#
 
-auditid=$1
-PACKAGE_JSON="package.json"
+usage() {
+  echo 1>&2 "Usage: $cmd [-d <days-to-suppress>] audit-id reasonwords as remaining args"
+  echo 1>&2
+  echo 1>&2 "       -d Number of days to suppress vulnerability for. Default: 30."
+  echo 1>&2
+  echo 1>&2 "       Example:"
+  echo 1>&2 "          suppress-audit.sh 12345 suppressing for a while"
+  echo 1>&2
+  echo 1>&2 "          Suppresses vulnerability 12345 for default 30 days recording"
+  echo 1>&2 "          'suppressing for a while' as the reason."
+  echo 1>&2
+}
+
+DAYS_TO_SUPPRESS=30
+
+cmd=$(basename "$0")
+# shellcheck disable=SC2048,SC2086
+if ! args=$(getopt d: $*); then
+  usage
+  exit 1
+fi
+
+# shellcheck disable=SC2086
+set -- $args
 
-if [ -z $auditid ]; then
-  echo "Usage: yarn suppress-audit <audit id>"
+while [ "$#" -gt 0 ] && [ "$1" != "--" ]; do
+  case "$1" in
+    -d) if ! expr "$2" : '[0-9][0-9]*$' >/dev/null || [ "$(($2 > 0))" -eq 0 ]; then
+          echo 1>&2 "ERROR: suppression days must be positive integer"
+          echo 1>&2
+          usage
+          exit 1
+        fi
+        DAYS_TO_SUPPRESS=$2
+        shift
+        shift
+        ;;
+  esac
+done
+if [ "$1" = "--" ]; then
+  shift
+fi
+auditid="$1"
+shift
+reason="${*}"
+
+if [ -z "$auditid" ]; then
+  echo 1>&2 "ERROR: No audit-id specified"
+  echo 1>&2
+  usage
+  exit 1
+fi
+
+if [ -z "$reason" ]; then
+  echo 1>&2 "ERROR: No suppression reason specified"
+  echo 1>&2
+  usage
   exit 1
 fi
+
+SECONDS_TO_SUPPRESS=$((DAYS_TO_SUPPRESS * 3600 * 24))
+PACKAGE_JSON="package.json"
+
+set -e
 cp $PACKAGE_JSON $PACKAGE_JSON.old
-cat $PACKAGE_JSON | jq ".auditSuppressions.\"$auditid\" = (now | floor | . + 1209600)" > $PACKAGE_JSON.staging
+cat $PACKAGE_JSON | jq '(now | floor | . + '$SECONDS_TO_SUPPRESS') as $expiry | .auditSuppressions."'"$auditid"'" = {"until": $expiry,"untilISO":($expiry | strftime("%FT%TZ") ),"reason":"'"${reason}"'"}' > $PACKAGE_JSON.staging
 mv $PACKAGE_JSON.staging $PACKAGE_JSON
+set +e

package/bin/yarn-audit-with-suppression.sh

@@ -1,16 +1,43 @@
 #!/bin/sh
 
-yarn audit --json --groups "dependencies devDependencies" | jq -s -c 'map(select(.type == "auditAdvisory").data.advisory) | unique_by(.id) | .[] | {id, title, module_name, vulnerable_versions, patched_versions, severity, findings}' | (new=""; while read advisory ; do
+# Run yarn audit reading any suppressions from the auditSuppressions element
+# of package.json.
+#
+# Suppressions are added by yarn suppress-audit and are of the form:
+#
+# "auditSuppressions": {
+#   "<numeric-vulnerability-id>": {
+#     "until": <numeric-expiry-in-seconds-since-epoch>,
+#     "untilISO": "<expiry-time-in-ISO8601-format>",
+#     "reason": "<string-text-for-recording-reason-for-suppression>"
+#   }
+# }
+#
+# Previously, the value of the audit suppression was jsut the expiry timestamp
+# this old format is still recognized by this script.
+#
+yarn audit --json --groups "dependencies devDependencies" | \
+  jq -M -s -c 'map(select(.type == "auditAdvisory").data.advisory) | unique_by(.id) | .[] | {id, title, module_name, vulnerable_versions, patched_versions, severity, findings}' | \
+  (new=""; while read -r advisory ; do
   id=$(echo "${advisory}" | jq '.id')
   suppression=$(jq ".auditSuppressions[\"$id\"] | select (. != null)" package.json)
   if [ -z "$suppression" ]; then
     echo "New advisory ${id}:"
     echo "${advisory}" | jq .
     new=1
-  elif [ $(date '+%s') -gt "$suppression" ]; then
-    echo "Suppression for advisory ${id} has expired. Please revisit:"
-    echo "${advisory}" | jq .
-    new=1
+  else
+    if expr "$suppression" : '[0-9][0-9]*$' >/dev/null ; then
+      # Old style suppression that was just the expiry timestamp
+      expiry="$suppression"
+    else
+      # New style suppression is a JSON object
+      expiry=$(echo "$suppression" | jq -M -c ".until // 0")
+    fi
+    if [ "$(date '+%s')" -gt "$expiry" ]; then
+      echo "Suppression for advisory ${id} has expired. Please revisit:"
+      echo "${advisory}" | jq .
+      new=1
+    fi
   fi
 done
 if [ -n "${new}" ]; then

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sudoplatform/sudo-common",
-  "version": "8.8.6",
+  "version": "8.9.1",
   "author": "Anonyome Labs, Inc.",
   "repository": {
     "type": "git",
@@ -52,13 +52,13 @@
     "**/apollo-client": "^2.6.10"
   },
   "dependencies": {
-    "@aws-sdk/client-s3": "^3.490.0",
+    "@aws-sdk/client-s3": "^3.588.0",
     "apollo-client": "^2.6.10",
     "asn1js": "^3.0.5",
     "browser-bunyan": "^1.8.0",
     "fflate": "^0.8.2",
     "graphql": "^15.8.0",
-    "pkijs": "^3.0.16",
+    "pkijs": "^3.1.0",
     "tslib": "^2.6.2"
   },
   "peerDependencies": {
@@ -84,12 +84,12 @@
     "jest": "^27.5.1",
     "monocle-ts": "^2.3.13",
     "newtype-ts": "^0.3.5",
-    "prettier": "^3.2.5",
+    "prettier": "^3.3.0",
     "rimraf": "^5.0.7",
     "ts-jest": "^27.1.5",
     "ts-mockito": "^2.6.1",
     "ts-node": "^10.9.2",
     "typedoc": "^0.25.13",
-    "typescript": "^5.4.5"
+    "typescript": "~5.4.x"
   }
 }