@vyuhlabs/dxkit 2.0.1 → 2.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +131 -0
- package/README.md +21 -15
- package/dist/analyzers/bom/detailed.d.ts +26 -0
- package/dist/analyzers/bom/detailed.d.ts.map +1 -0
- package/dist/analyzers/bom/detailed.js +227 -0
- package/dist/analyzers/bom/detailed.js.map +1 -0
- package/dist/analyzers/bom/gather.d.ts +52 -0
- package/dist/analyzers/bom/gather.d.ts.map +1 -0
- package/dist/analyzers/bom/gather.js +183 -0
- package/dist/analyzers/bom/gather.js.map +1 -0
- package/dist/analyzers/bom/index.d.ts +23 -0
- package/dist/analyzers/bom/index.d.ts.map +1 -0
- package/dist/analyzers/bom/index.js +183 -0
- package/dist/analyzers/bom/index.js.map +1 -0
- package/dist/analyzers/bom/types.d.ts +71 -0
- package/dist/analyzers/bom/types.d.ts.map +1 -0
- package/dist/analyzers/bom/types.js +3 -0
- package/dist/analyzers/bom/types.js.map +1 -0
- package/dist/analyzers/licenses/detailed.d.ts +30 -0
- package/dist/analyzers/licenses/detailed.d.ts.map +1 -0
- package/dist/analyzers/licenses/detailed.js +194 -0
- package/dist/analyzers/licenses/detailed.js.map +1 -0
- package/dist/analyzers/licenses/gather.d.ts +15 -0
- package/dist/analyzers/licenses/gather.d.ts.map +1 -0
- package/dist/analyzers/licenses/gather.js +24 -0
- package/dist/analyzers/licenses/gather.js.map +1 -0
- package/dist/analyzers/licenses/index.d.ts +21 -0
- package/dist/analyzers/licenses/index.d.ts.map +1 -0
- package/dist/analyzers/licenses/index.js +146 -0
- package/dist/analyzers/licenses/index.js.map +1 -0
- package/dist/analyzers/licenses/types.d.ts +30 -0
- package/dist/analyzers/licenses/types.d.ts.map +1 -0
- package/dist/analyzers/licenses/types.js +13 -0
- package/dist/analyzers/licenses/types.js.map +1 -0
- package/dist/analyzers/security/detailed.d.ts +0 -3
- package/dist/analyzers/security/detailed.d.ts.map +1 -1
- package/dist/analyzers/security/detailed.js +37 -6
- package/dist/analyzers/security/detailed.js.map +1 -1
- package/dist/analyzers/security/gather.d.ts.map +1 -1
- package/dist/analyzers/security/gather.js +2 -0
- package/dist/analyzers/security/gather.js.map +1 -1
- package/dist/analyzers/security/index.d.ts.map +1 -1
- package/dist/analyzers/security/index.js +53 -14
- package/dist/analyzers/security/index.js.map +1 -1
- package/dist/analyzers/security/types.d.ts +5 -0
- package/dist/analyzers/security/types.d.ts.map +1 -1
- package/dist/analyzers/security/types.js +0 -3
- package/dist/analyzers/security/types.js.map +1 -1
- package/dist/analyzers/tools/osv.d.ts +49 -5
- package/dist/analyzers/tools/osv.d.ts.map +1 -1
- package/dist/analyzers/tools/osv.js +99 -17
- package/dist/analyzers/tools/osv.js.map +1 -1
- package/dist/analyzers/tools/runner.d.ts +11 -0
- package/dist/analyzers/tools/runner.d.ts.map +1 -1
- package/dist/analyzers/tools/runner.js +54 -0
- package/dist/analyzers/tools/runner.js.map +1 -1
- package/dist/analyzers/tools/tool-registry.d.ts.map +1 -1
- package/dist/analyzers/tools/tool-registry.js +77 -0
- package/dist/analyzers/tools/tool-registry.js.map +1 -1
- package/dist/analyzers/xlsx/bom.d.ts +27 -0
- package/dist/analyzers/xlsx/bom.d.ts.map +1 -0
- package/dist/analyzers/xlsx/bom.js +131 -0
- package/dist/analyzers/xlsx/bom.js.map +1 -0
- package/dist/analyzers/xlsx/index.d.ts +27 -0
- package/dist/analyzers/xlsx/index.d.ts.map +1 -0
- package/dist/analyzers/xlsx/index.js +92 -0
- package/dist/analyzers/xlsx/index.js.map +1 -0
- package/dist/analyzers/xlsx/licenses.d.ts +40 -0
- package/dist/analyzers/xlsx/licenses.d.ts.map +1 -0
- package/dist/analyzers/xlsx/licenses.js +140 -0
- package/dist/analyzers/xlsx/licenses.js.map +1 -0
- package/dist/cli.d.ts.map +1 -1
- package/dist/cli.js +178 -1
- package/dist/cli.js.map +1 -1
- package/dist/languages/capabilities/descriptors.d.ts +4 -1
- package/dist/languages/capabilities/descriptors.d.ts.map +1 -1
- package/dist/languages/capabilities/descriptors.js +20 -1
- package/dist/languages/capabilities/descriptors.js.map +1 -1
- package/dist/languages/capabilities/types.d.ts +59 -3
- package/dist/languages/capabilities/types.d.ts.map +1 -1
- package/dist/languages/csharp.d.ts +13 -0
- package/dist/languages/csharp.d.ts.map +1 -1
- package/dist/languages/csharp.js +228 -33
- package/dist/languages/csharp.js.map +1 -1
- package/dist/languages/go.d.ts.map +1 -1
- package/dist/languages/go.js +211 -26
- package/dist/languages/go.js.map +1 -1
- package/dist/languages/python.d.ts.map +1 -1
- package/dist/languages/python.js +187 -11
- package/dist/languages/python.js.map +1 -1
- package/dist/languages/rust.d.ts +13 -0
- package/dist/languages/rust.d.ts.map +1 -1
- package/dist/languages/rust.js +195 -29
- package/dist/languages/rust.js.map +1 -1
- package/dist/languages/types.d.ts +2 -1
- package/dist/languages/types.d.ts.map +1 -1
- package/dist/languages/typescript.d.ts.map +1 -1
- package/dist/languages/typescript.js +252 -1
- package/dist/languages/typescript.js.map +1 -1
- package/package.json +7 -2
- package/dist/agents/extract.d.ts +0 -25
- package/dist/agents/extract.d.ts.map +0 -1
- package/dist/agents/extract.js +0 -186
- package/dist/agents/extract.js.map +0 -1
- package/dist/agents/schemas.d.ts +0 -106
- package/dist/agents/schemas.d.ts.map +0 -1
- package/dist/agents/schemas.js +0 -86
- package/dist/agents/schemas.js.map +0 -1
- package/dist/agents/session.d.ts +0 -28
- package/dist/agents/session.d.ts.map +0 -1
- package/dist/agents/session.js +0 -223
- package/dist/agents/session.js.map +0 -1
- package/dist/analyzers/index.d.ts +0 -3
- package/dist/analyzers/index.d.ts.map +0 -1
- package/dist/analyzers/index.js +0 -6
- package/dist/analyzers/index.js.map +0 -1
- package/dist/analyzers/security/report.d.ts +0 -6
- package/dist/analyzers/security/report.d.ts.map +0 -1
- package/dist/analyzers/security/report.js +0 -118
- package/dist/analyzers/security/report.js.map +0 -1
- package/dist/analyzers/tools/dotnet.d.ts +0 -8
- package/dist/analyzers/tools/dotnet.d.ts.map +0 -1
- package/dist/analyzers/tools/dotnet.js +0 -81
- package/dist/analyzers/tools/dotnet.js.map +0 -1
- package/dist/analyzers/tools/gather-cache.d.ts +0 -16
- package/dist/analyzers/tools/gather-cache.d.ts.map +0 -1
- package/dist/analyzers/tools/gather-cache.js +0 -126
- package/dist/analyzers/tools/gather-cache.js.map +0 -1
- package/dist/analyzers/tools/go.d.ts +0 -8
- package/dist/analyzers/tools/go.d.ts.map +0 -1
- package/dist/analyzers/tools/go.js +0 -84
- package/dist/analyzers/tools/go.js.map +0 -1
- package/dist/analyzers/tools/node.d.ts +0 -8
- package/dist/analyzers/tools/node.d.ts.map +0 -1
- package/dist/analyzers/tools/node.js +0 -160
- package/dist/analyzers/tools/node.js.map +0 -1
- package/dist/analyzers/tools/python.d.ts +0 -8
- package/dist/analyzers/tools/python.d.ts.map +0 -1
- package/dist/analyzers/tools/python.js +0 -81
- package/dist/analyzers/tools/python.js.map +0 -1
- package/dist/analyzers/tools/rust.d.ts +0 -8
- package/dist/analyzers/tools/rust.d.ts.map +0 -1
- package/dist/analyzers/tools/rust.js +0 -86
- package/dist/analyzers/tools/rust.js.map +0 -1
- package/templates/.ai/templates/session-checkpoint-template.md +0 -97
package/dist/languages/go.js
CHANGED
|
@@ -114,6 +114,19 @@ function tierGolangciIssue(issue) {
|
|
|
114
114
|
/**
|
|
115
115
|
* Single source of truth for the go pack's dep-vuln gathering.
|
|
116
116
|
* Consumed by `goDepVulnsProvider` (capability dispatcher).
|
|
117
|
+
*
|
|
118
|
+
* govulncheck only emits `finding` records when call analysis confirms
|
|
119
|
+
* the vulnerable code is reachable from the project's main package, so
|
|
120
|
+
* every emitted DepVulnFinding sets `reachable: true` — Tier-1 output
|
|
121
|
+
* with Tier-4 reachability semantics by virtue of the upstream tool's
|
|
122
|
+
* design.
|
|
123
|
+
*
|
|
124
|
+
* Findings are grouped by (osvId, module, installedVersion). One
|
|
125
|
+
* advisory hitting multiple modules yields multiple findings; multiple
|
|
126
|
+
* call paths through the same (advisory, module, version) collapse to
|
|
127
|
+
* one. govulncheck's per-call-path output (102 raw findings on the
|
|
128
|
+
* Tickit smoke) is intentional internal detail; the bom/render layer
|
|
129
|
+
* wants one row per (vuln × installed package).
|
|
117
130
|
*/
|
|
118
131
|
async function gatherGoDepVulnsResult(cwd) {
|
|
119
132
|
const vuln = (0, tool_registry_1.findTool)(tool_registry_1.TOOL_DEFS.govulncheck, cwd);
|
|
@@ -123,61 +136,135 @@ async function gatherGoDepVulnsResult(cwd) {
|
|
|
123
136
|
if (!raw)
|
|
124
137
|
return { kind: 'no-output' };
|
|
125
138
|
try {
|
|
126
|
-
// govulncheck emits
|
|
139
|
+
// govulncheck -json emits a stream of *pretty-printed* JSON objects
|
|
140
|
+
// (each spanning many lines), not single-line ndjson — so we can't
|
|
141
|
+
// JSON.parse line-by-line. Accumulate lines into a buffer and try to
|
|
142
|
+
// parse after each newline; success resets the buffer for the next
|
|
143
|
+
// record. Three relevant top-level shapes:
|
|
127
144
|
// { "osv": { ...full OSV record... } } — the advisory detail
|
|
128
145
|
// { "finding": { "osv": "GO-YYYY-NNNN", "trace": [...] } } — a call-site hit
|
|
129
|
-
// { "config": ... } / { "progress": ... } — ignored
|
|
130
|
-
const
|
|
146
|
+
// { "config": ... } / { "progress": ... } / { "SBOM": ... } — ignored
|
|
147
|
+
const groupedFindings = new Map();
|
|
131
148
|
const embeddedOsv = new Map();
|
|
132
|
-
for (const
|
|
133
|
-
if (
|
|
134
|
-
|
|
135
|
-
|
|
136
|
-
|
|
137
|
-
|
|
138
|
-
findingIds.add(obj.finding.osv);
|
|
139
|
-
if (obj.osv?.id)
|
|
140
|
-
embeddedOsv.set(obj.osv.id, obj.osv);
|
|
141
|
-
}
|
|
142
|
-
catch {
|
|
143
|
-
/* skip non-JSON lines */
|
|
149
|
+
for (const obj of (0, runner_1.parseJsonStream)(raw)) {
|
|
150
|
+
if (obj.finding?.osv) {
|
|
151
|
+
const trace0 = obj.finding.trace?.[0] ?? {};
|
|
152
|
+
const key = `${obj.finding.osv}|${trace0.module ?? ''}|${trace0.version ?? ''}`;
|
|
153
|
+
if (!groupedFindings.has(key))
|
|
154
|
+
groupedFindings.set(key, obj.finding);
|
|
144
155
|
}
|
|
156
|
+
if (obj.osv?.id)
|
|
157
|
+
embeddedOsv.set(obj.osv.id, obj.osv);
|
|
145
158
|
}
|
|
146
159
|
// Prefer severity from the embedded OSV record (already in the
|
|
147
160
|
// govulncheck output, no extra API call). Fall back to an OSV.dev
|
|
148
161
|
// lookup for IDs without embedded data. Fall back to 'high' (the
|
|
149
162
|
// legacy govulncheck default) for anything still unknown.
|
|
150
|
-
const
|
|
151
|
-
|
|
163
|
+
const uniqueIds = [
|
|
164
|
+
...new Set([...groupedFindings.values()].map((f) => f.osv).filter(Boolean)),
|
|
165
|
+
];
|
|
166
|
+
const needsLookup = uniqueIds.filter((id) => {
|
|
152
167
|
const rec = embeddedOsv.get(id);
|
|
153
168
|
if (!rec)
|
|
154
169
|
return true;
|
|
155
170
|
return (0, osv_1.classifyOsvSeverity)(rec) === 'unknown';
|
|
156
171
|
});
|
|
157
|
-
const lookedUp = needsLookup.length > 0 ? await (0, osv_1.
|
|
172
|
+
const lookedUp = needsLookup.length > 0 ? await (0, osv_1.enrichOsv)(needsLookup) : new Map();
|
|
158
173
|
let critical = 0;
|
|
159
174
|
let high = 0;
|
|
160
175
|
let medium = 0;
|
|
161
176
|
let low = 0;
|
|
162
177
|
let enrichedCount = 0;
|
|
163
|
-
|
|
178
|
+
const severityById = new Map();
|
|
179
|
+
for (const id of uniqueIds) {
|
|
164
180
|
const rec = embeddedOsv.get(id);
|
|
165
181
|
let sev = rec ? (0, osv_1.classifyOsvSeverity)(rec) : 'unknown';
|
|
166
182
|
if (sev === 'unknown')
|
|
167
|
-
sev = lookedUp.get(id) ?? 'unknown';
|
|
183
|
+
sev = lookedUp.get(id)?.severity ?? 'unknown';
|
|
184
|
+
let bucket;
|
|
168
185
|
if (sev !== 'unknown') {
|
|
169
186
|
enrichedCount++;
|
|
170
187
|
if (sev === 'critical')
|
|
171
|
-
critical
|
|
188
|
+
bucket = 'critical';
|
|
172
189
|
else if (sev === 'high')
|
|
173
|
-
high
|
|
190
|
+
bucket = 'high';
|
|
174
191
|
else if (sev === 'medium')
|
|
175
|
-
medium
|
|
192
|
+
bucket = 'medium';
|
|
176
193
|
else
|
|
177
|
-
low
|
|
194
|
+
bucket = 'low';
|
|
178
195
|
}
|
|
179
196
|
else {
|
|
180
|
-
high
|
|
197
|
+
bucket = 'high'; // govulncheck legacy default
|
|
198
|
+
}
|
|
199
|
+
severityById.set(id, bucket);
|
|
200
|
+
if (bucket === 'critical')
|
|
201
|
+
critical++;
|
|
202
|
+
else if (bucket === 'high')
|
|
203
|
+
high++;
|
|
204
|
+
else if (bucket === 'medium')
|
|
205
|
+
medium++;
|
|
206
|
+
else
|
|
207
|
+
low++;
|
|
208
|
+
}
|
|
209
|
+
const findings = [];
|
|
210
|
+
for (const grouped of groupedFindings.values()) {
|
|
211
|
+
if (!grouped.osv)
|
|
212
|
+
continue;
|
|
213
|
+
const trace0 = grouped.trace?.[0] ?? {};
|
|
214
|
+
const osvRec = embeddedOsv.get(grouped.osv);
|
|
215
|
+
// Prefer the trace module (project-specific), fall back to the OSV
|
|
216
|
+
// record's affected package name, then 'unknown' if neither shipped.
|
|
217
|
+
const pkgName = trace0.module ?? osvRec?.affected?.[0]?.package?.name ?? 'unknown';
|
|
218
|
+
const finding = {
|
|
219
|
+
id: grouped.osv,
|
|
220
|
+
package: pkgName,
|
|
221
|
+
installedVersion: trace0.version,
|
|
222
|
+
tool: 'govulncheck',
|
|
223
|
+
severity: severityById.get(grouped.osv) ?? 'high',
|
|
224
|
+
reachable: true,
|
|
225
|
+
};
|
|
226
|
+
if (grouped.fixed_version)
|
|
227
|
+
finding.fixedVersion = grouped.fixed_version;
|
|
228
|
+
// Capture the embedded CVSS (govulncheck bundles severity vectors
|
|
229
|
+
// for many third-party deps but rarely for stdlib). Alias-fallback
|
|
230
|
+
// happens in the batched resolveCvssScores pass after this loop.
|
|
231
|
+
const embeddedScore = osvRec ? (0, osv_1.extractOsvCvssScore)(osvRec) : null;
|
|
232
|
+
if (embeddedScore !== null)
|
|
233
|
+
finding.cvssScore = embeddedScore;
|
|
234
|
+
if (osvRec) {
|
|
235
|
+
const aliases = (osvRec.aliases ?? []).filter((a) => a && a.length > 0);
|
|
236
|
+
if (aliases.length > 0)
|
|
237
|
+
finding.aliases = aliases;
|
|
238
|
+
if (osvRec.summary)
|
|
239
|
+
finding.summary = osvRec.summary;
|
|
240
|
+
else if (osvRec.details)
|
|
241
|
+
finding.summary = osvRec.details;
|
|
242
|
+
const refs = (osvRec.references ?? []).map((r) => r.url).filter(Boolean);
|
|
243
|
+
if (refs.length > 0)
|
|
244
|
+
finding.references = refs;
|
|
245
|
+
}
|
|
246
|
+
// Synthesize an OSV.dev URL when the embedded record lacked references.
|
|
247
|
+
if (!finding.references) {
|
|
248
|
+
finding.references = [`https://osv.dev/vulnerability/${grouped.osv}`];
|
|
249
|
+
}
|
|
250
|
+
findings.push(finding);
|
|
251
|
+
}
|
|
252
|
+
// Alias-fallback CVSS pass: stdlib advisories (GO-YYYY-NNNN) often
|
|
253
|
+
// carry no CVSS in either govulncheck's embedded data or OSV.dev's
|
|
254
|
+
// GO-* record, while the corresponding CVE alias does (e.g.
|
|
255
|
+
// GO-2025-3750 → CVE-2025-0913). resolveCvssScores re-queries each
|
|
256
|
+
// alias for findings still missing a score, batched.
|
|
257
|
+
if (findings.length > 0) {
|
|
258
|
+
const cvssInputs = findings.map((f) => ({
|
|
259
|
+
primaryId: f.id,
|
|
260
|
+
embeddedCvss: f.cvssScore ?? null,
|
|
261
|
+
aliases: f.aliases ?? [],
|
|
262
|
+
}));
|
|
263
|
+
const resolved = await (0, osv_1.resolveCvssScores)(cvssInputs);
|
|
264
|
+
for (const f of findings) {
|
|
265
|
+
const score = resolved.get(f.id);
|
|
266
|
+
if (score !== null && score !== undefined)
|
|
267
|
+
f.cvssScore = score;
|
|
181
268
|
}
|
|
182
269
|
}
|
|
183
270
|
const envelope = {
|
|
@@ -187,6 +274,7 @@ async function gatherGoDepVulnsResult(cwd) {
|
|
|
187
274
|
// produced enrichment. Embedded-only severity isn't an OSV call.
|
|
188
275
|
enrichment: enrichedCount > 0 && needsLookup.length > 0 ? 'osv.dev' : null,
|
|
189
276
|
counts: { critical, high, medium, low },
|
|
277
|
+
findings,
|
|
190
278
|
};
|
|
191
279
|
return { kind: 'success', envelope };
|
|
192
280
|
}
|
|
@@ -392,6 +480,102 @@ const goTestFrameworkProvider = {
|
|
|
392
480
|
return gatherGoTestFrameworkResult(cwd);
|
|
393
481
|
},
|
|
394
482
|
};
|
|
483
|
+
/**
|
|
484
|
+
* Parse the NDJSON-ish stream emitted by `go list -m -json all`. The tool
|
|
485
|
+
* outputs concatenated `{...}` objects separated by no delimiter; each
|
|
486
|
+
* object starts with '{' and ends with '}' at column 0. Match each with
|
|
487
|
+
* a multiline regex and JSON.parse individually.
|
|
488
|
+
*/
|
|
489
|
+
function parseGoListModuleStream(raw) {
|
|
490
|
+
const out = [];
|
|
491
|
+
const re = /^\{[\s\S]*?^\}/gm;
|
|
492
|
+
let m;
|
|
493
|
+
while ((m = re.exec(raw)) !== null) {
|
|
494
|
+
try {
|
|
495
|
+
out.push(JSON.parse(m[0]));
|
|
496
|
+
}
|
|
497
|
+
catch {
|
|
498
|
+
/* skip malformed block */
|
|
499
|
+
}
|
|
500
|
+
}
|
|
501
|
+
return out;
|
|
502
|
+
}
|
|
503
|
+
/**
|
|
504
|
+
* Find the module whose path is the longest prefix of a Go package path,
|
|
505
|
+
* returning its version. go-licenses reports at the package level
|
|
506
|
+
* (`github.com/x/y/subpkg`) while `go list -m all` reports at the module
|
|
507
|
+
* level (`github.com/x/y`); longest-prefix match bridges the two.
|
|
508
|
+
*/
|
|
509
|
+
function goVersionForPackage(pkgPath, modules) {
|
|
510
|
+
let best = '';
|
|
511
|
+
for (const mod of modules.keys()) {
|
|
512
|
+
if ((pkgPath === mod || pkgPath.startsWith(mod + '/')) && mod.length > best.length) {
|
|
513
|
+
best = mod;
|
|
514
|
+
}
|
|
515
|
+
}
|
|
516
|
+
return modules.get(best) ?? '';
|
|
517
|
+
}
|
|
518
|
+
/**
|
|
519
|
+
* Single source of truth for the go pack's license gathering. Consumed
|
|
520
|
+
* by `goLicensesProvider` (capability dispatcher).
|
|
521
|
+
*
|
|
522
|
+
* Two-step merge: `go-licenses report .` emits per-package CSV
|
|
523
|
+
* (path,url,license) and `go list -m -json all` emits per-module
|
|
524
|
+
* versions. Modules and packages have different granularity in the
|
|
525
|
+
* Go module system, so we longest-prefix-match the package path
|
|
526
|
+
* against the module list. Returns null cleanly on any Go module
|
|
527
|
+
* without go-licenses installed, without go.mod, or when the tool
|
|
528
|
+
* fails (commonly because `go mod download` hasn't been run).
|
|
529
|
+
*/
|
|
530
|
+
function gatherGoLicensesResult(cwd) {
|
|
531
|
+
if (!(0, runner_1.fileExists)(cwd, 'go.mod'))
|
|
532
|
+
return null;
|
|
533
|
+
const status = (0, tool_registry_1.findTool)(tool_registry_1.TOOL_DEFS['go-licenses'], cwd);
|
|
534
|
+
if (!status.available || !status.path)
|
|
535
|
+
return null;
|
|
536
|
+
const csvRaw = (0, runner_1.run)(`${status.path} report . 2>/dev/null`, cwd, 180000);
|
|
537
|
+
if (!csvRaw)
|
|
538
|
+
return null;
|
|
539
|
+
const listRaw = (0, runner_1.run)('go list -m -json all 2>/dev/null', cwd, 60000);
|
|
540
|
+
const versions = new Map();
|
|
541
|
+
if (listRaw) {
|
|
542
|
+
for (const mod of parseGoListModuleStream(listRaw)) {
|
|
543
|
+
if (mod.Main)
|
|
544
|
+
continue;
|
|
545
|
+
if (mod.Path && mod.Version)
|
|
546
|
+
versions.set(mod.Path, mod.Version);
|
|
547
|
+
}
|
|
548
|
+
}
|
|
549
|
+
const findings = [];
|
|
550
|
+
for (const line of csvRaw.split('\n')) {
|
|
551
|
+
const trimmed = line.trim();
|
|
552
|
+
if (!trimmed)
|
|
553
|
+
continue;
|
|
554
|
+
const parts = trimmed.split(',');
|
|
555
|
+
if (parts.length < 3)
|
|
556
|
+
continue;
|
|
557
|
+
const pkg = parts[0].trim();
|
|
558
|
+
const url = parts[1].trim();
|
|
559
|
+
const license = parts[2].trim();
|
|
560
|
+
findings.push({
|
|
561
|
+
package: pkg,
|
|
562
|
+
version: goVersionForPackage(pkg, versions),
|
|
563
|
+
licenseType: license || 'UNKNOWN',
|
|
564
|
+
sourceUrl: url || undefined,
|
|
565
|
+
});
|
|
566
|
+
}
|
|
567
|
+
return {
|
|
568
|
+
schemaVersion: 1,
|
|
569
|
+
tool: 'go-licenses',
|
|
570
|
+
findings,
|
|
571
|
+
};
|
|
572
|
+
}
|
|
573
|
+
const goLicensesProvider = {
|
|
574
|
+
source: 'go',
|
|
575
|
+
async gather(cwd) {
|
|
576
|
+
return gatherGoLicensesResult(cwd);
|
|
577
|
+
},
|
|
578
|
+
};
|
|
395
579
|
exports.go = {
|
|
396
580
|
id: 'go',
|
|
397
581
|
displayName: 'Go',
|
|
@@ -401,7 +585,7 @@ exports.go = {
|
|
|
401
585
|
detect(cwd) {
|
|
402
586
|
return (0, runner_1.fileExists)(cwd, 'go.mod');
|
|
403
587
|
},
|
|
404
|
-
tools: ['golangci-lint', 'govulncheck'],
|
|
588
|
+
tools: ['golangci-lint', 'govulncheck', 'go-licenses'],
|
|
405
589
|
semgrepRulesets: ['p/gosec'],
|
|
406
590
|
capabilities: {
|
|
407
591
|
depVulns: goDepVulnsProvider,
|
|
@@ -409,6 +593,7 @@ exports.go = {
|
|
|
409
593
|
coverage: goCoverageProvider,
|
|
410
594
|
imports: goImportsProvider,
|
|
411
595
|
testFramework: goTestFrameworkProvider,
|
|
596
|
+
licenses: goLicensesProvider,
|
|
412
597
|
},
|
|
413
598
|
mapLintSeverity: mapGolangciLinterSeverity,
|
|
414
599
|
};
|
package/dist/languages/go.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"go.js","sourceRoot":"","sources":["../../src/languages/go.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2QA,kDAmBC;AAQD,gDAqBC;AA3TD,uCAAyB;AACzB,2CAA6B;AAE7B,0DAAkE;AAClE,8DAAoE;AACpE,gDAA6F;AAC7F,sDAA4D;AAC5D,oEAAuE;AAwBvE;;;;;;GAMG;AACH,SAAS,yBAAyB,CAAC,MAA0B;IAC3D,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAE1B,oDAAoD;IACpD,IAAI,MAAM,KAAK,OAAO;QAAE,OAAO,UAAU,CAAC;IAE1C,qEAAqE;IACrE,IACE,MAAM,KAAK,OAAO;QAClB,MAAM,KAAK,aAAa;QACxB,MAAM,KAAK,WAAW;QACtB,MAAM,KAAK,WAAW;QACtB,MAAM,KAAK,aAAa;QACxB,MAAM,KAAK,QAAQ;QACnB,MAAM,KAAK,QAAQ;QACnB,MAAM,KAAK,WAAW;QACtB,MAAM,KAAK,cAAc;QACzB,MAAM,KAAK,eAAe;QAC1B,MAAM,KAAK,OAAO,EAClB,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,+BAA+B;IAC/B,IACE,MAAM,KAAK,UAAU;QACrB,MAAM,KAAK,UAAU;QACrB,MAAM,KAAK,QAAQ;QACnB,MAAM,KAAK,SAAS;QACpB,MAAM,KAAK,SAAS;QACpB,MAAM,KAAK,QAAQ;QACnB,MAAM,KAAK,MAAM;QACjB,MAAM,KAAK,UAAU;QACrB,MAAM,KAAK,WAAW;QACtB,MAAM,KAAK,SAAS;QACpB,MAAM,KAAK,UAAU;QACrB,MAAM,KAAK,UAAU,EACrB,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,qBAAqB;IACrB,IACE,MAAM,KAAK,OAAO;QAClB,MAAM,KAAK,SAAS;QACpB,MAAM,KAAK,WAAW;QACtB,MAAM,KAAK,YAAY;QACvB,MAAM,KAAK,YAAY;QACvB,MAAM,KAAK,UAAU;QACrB,MAAM,KAAK,OAAO;QAClB,MAAM,KAAK,KAAK,EAChB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAoB;IAC7C,MAAM,QAAQ,GAAG,yBAAyB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC7D,qEAAqE;IACrE,2DAA2D;IAC3D,IAAI,QAAQ,KAAK,KAAK,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QAC3C,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QACjD,IAAI,GAAG,KAAK,OAAO;YAAE,OAAO,MAAM,CAAC;QACnC,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,QAAQ,CAAC;IACzC,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,sBAAsB,CAAC,GAAW;IAC/C,MAAM,IAAI,GAAG,IAAA,wBAAQ,EAAC,yBAAS,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;IAClD,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;IAEnE,MAAM,GAAG,GAAG,IAAA,YAAG,EAAC,GAAG,IAAI,CAAC,IAAI,0BAA0B,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IACrE,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAEvC,IAAI,CAAC;QACH,uDAAuD;QACvD,iEAAiE;QACjE,gFAAgF;QAChF,sDAAsD;QACtD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;QACrC,MAAM,WAAW,GAAG,IAAI,GAAG,EAAmB,CAAC;QAC/C,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;gBAAE,SAAS;YAC3B,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAG1B,CAAC;gBACF,IAAI,GAAG,CAAC,OAAO,EAAE,GAAG;oBAAE,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBACtD,IAAI,GAAG,CAAC,GAAG,EAAE,EAAE;oBAAE,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;YACxD,CAAC;YAAC,MAAM,CAAC;gBACP,yBAAyB;YAC3B,CAAC;QACH,CAAC;QAED,+DAA+D;QAC/D,kEAAkE;QAClE,iEAAiE;QACjE,0DAA0D;QAC1D,MAAM,GAAG,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC;QAC5B,MAAM,WAAW,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE;YACpC,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChC,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YACtB,OAAO,IAAA,yBAAmB,EAAC,GAAG,CAAC,KAAK,SAAS,CAAC;QAChD,CAAC,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,IAAA,sBAAgB,EAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC;QAE1F,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,IAAI,GAAG,GAAG,CAAC,CAAC;QACZ,IAAI,aAAa,GAAG,CAAC,CAAC;QACtB,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;YACrB,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChC,IAAI,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,IAAA,yBAAmB,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACrD,IAAI,GAAG,KAAK,SAAS;gBAAE,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,SAAS,CAAC;YAC3D,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,aAAa,EAAE,CAAC;gBAChB,IAAI,GAAG,KAAK,UAAU;oBAAE,QAAQ,EAAE,CAAC;qBAC9B,IAAI,GAAG,KAAK,MAAM;oBAAE,IAAI,EAAE,CAAC;qBAC3B,IAAI,GAAG,KAAK,QAAQ;oBAAE,MAAM,EAAE,CAAC;;oBAC/B,GAAG,EAAE,CAAC;YACb,CAAC;iBAAM,CAAC;gBACN,IAAI,EAAE,CAAC,CAAC,6BAA6B;YACvC,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAkB;YAC9B,aAAa,EAAE,CAAC;YAChB,IAAI,EAAE,aAAa;YACnB,8DAA8D;YAC9D,iEAAiE;YACjE,UAAU,EAAE,aAAa,GAAG,CAAC,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;YAC1E,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE;SACxC,CAAC;QACF,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IACjC,CAAC;AACH,CAAC;AAED,MAAM,kBAAkB,GAAsC;IAC5D,MAAM,EAAE,IAAI;IACZ,KAAK,CAAC,MAAM,CAAC,GAAG;QACd,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAClD,OAAO,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,CAAC;CACF,CAAC;AAEF;;;GAGG;AACH,SAAS,kBAAkB,CAAC,GAAW;IACrC,MAAM,IAAI,GAAG,IAAA,wBAAQ,EAAC,yBAAS,CAAC,eAAe,CAAC,EAAE,GAAG,CAAC,CAAC;IACvD,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAClC,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAC1D,CAAC;IAED,MAAM,GAAG,GAAG,IAAA,YAAG,EAAC,GAAG,IAAI,CAAC,IAAI,0CAA0C,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IACrF,MAAM,MAAM,GAAmB,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;IAC3E,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,2EAA2E;QAC3E,MAAM,QAAQ,GAAe,EAAE,aAAa,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,CAAC;QACjF,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;IACvC,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAmB,CAAC;QAC/C,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;YACtC,MAAM,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACrC,CAAC;QACD,MAAM,QAAQ,GAAe,EAAE,aAAa,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,CAAC;QACjF,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACxD,CAAC;AACH,CAAC;AAED,MAAM,cAAc,GAAmC;IACrD,MAAM,EAAE,IAAI;IACZ,KAAK,CAAC,MAAM,CAAC,GAAG;QACd,MAAM,OAAO,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;QACxC,OAAO,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,CAAC;CACF,CAAC;AAEF;;;GAGG;AACH,SAAS,sBAAsB,CAAC,GAAW;IACzC,KAAK,MAAM,IAAI,IAAI,CAAC,cAAc,EAAE,WAAW,CAAC,EAAE,CAAC;QACjD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACjC,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAA,8BAAmB,EAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YACrD,OAAO,EAAE,aAAa,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,QAAQ,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC;QAC7E,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,kBAAkB,GAAuC;IAC7D,MAAM,EAAE,IAAI;IACZ,KAAK,CAAC,MAAM,CAAC,GAAG;QACd,OAAO,sBAAsB,CAAC,GAAG,CAAC,CAAC;IACrC,CAAC;CACF,CAAC;AAEF;;;;;GAKG;AACH,SAAgB,mBAAmB,CAAC,OAAe;IACjD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,QAAQ,GAAG,8CAA8C,CAAC;IAChE,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC7C,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;IACD,MAAM,OAAO,GAAG,0BAA0B,CAAC;IAC3C,OAAO,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACnB,MAAM,MAAM,GAAG,gCAAgC,CAAC;QAChD,IAAI,EAA0B,CAAC;QAC/B,OAAO,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC1C,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzB,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,SAAgB,kBAAkB,CAAC,SAAiB,EAAE,IAAY,EAAE,GAAW;IAC7E,IAAI,KAAa,CAAC;IAClB,IAAI,CAAC;QACH,KAAK,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACpD,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAC9B,MAAM,UAAU,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAClC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,GAAG,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAChC,IAAI,CAAC;QACH,IAAI,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;YACnC,OAAO,GAAG,CAAC;QACb,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,YAAY;IACd,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,SAAS,qBAAqB,CAAC,GAAW;IACxC,MAAM,QAAQ,GAAG,IAAA,gCAAmB,EAAC,GAAG,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,IAAA,YAAG,EAAC,+BAA+B,QAAQ,cAAc,EAAE,GAAG,CAAC,CAAC;IAC5E,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAEtB,MAAM,SAAS,GAAG,IAAI,GAAG,EAAiC,CAAC;IAC3D,MAAM,KAAK,GAAG,IAAI,GAAG,EAA+B,CAAC;IAErD,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,MAAM,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACnC,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAC3C,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC1B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAClC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YACpD,IAAI,QAAQ;gBAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACtC,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,GAAG,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAChD,CAAC;IAED,IAAI,SAAS,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO;QACL,aAAa,EAAE,CAAC;QAChB,IAAI,EAAE,YAAY;QAClB,gBAAgB,EAAE,CAAC,KAAK,CAAC;QACzB,SAAS;QACT,KAAK;KACN,CAAC;AACJ,CAAC;AAED,MAAM,iBAAiB,GAAsC;IAC3D,MAAM,EAAE,IAAI;IACZ,KAAK,CAAC,MAAM,CAAC,GAAG;QACd,OAAO,qBAAqB,CAAC,GAAG,CAAC,CAAC;IACpC,CAAC;CACF,CAAC;AAEF;;;;GAIG;AACH,SAAS,2BAA2B,CAAC,GAAW;IAC9C,IAAI,CAAC,IAAA,mBAAU,EAAC,GAAG,EAAE,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,OAAO,EAAE,aAAa,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AAC3D,CAAC;AAED,MAAM,uBAAuB,GAA4C;IACvE,MAAM,EAAE,IAAI;IACZ,KAAK,CAAC,MAAM,CAAC,GAAG;QACd,OAAO,2BAA2B,CAAC,GAAG,CAAC,CAAC;IAC1C,CAAC;CACF,CAAC;AAEW,QAAA,EAAE,GAAoB;IACjC,EAAE,EAAE,IAAI;IACR,WAAW,EAAE,IAAI;IACjB,gBAAgB,EAAE,CAAC,KAAK,CAAC;IACzB,gBAAgB,EAAE,CAAC,WAAW,CAAC;IAC/B,aAAa,EAAE,CAAC,QAAQ,CAAC;IAEzB,MAAM,CAAC,GAAG;QACR,OAAO,IAAA,mBAAU,EAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACnC,CAAC;IAED,KAAK,EAAE,CAAC,eAAe,EAAE,aAAa,CAAC;IACvC,eAAe,EAAE,CAAC,SAAS,CAAC;IAE5B,YAAY,EAAE;QACZ,QAAQ,EAAE,kBAAkB;QAC5B,IAAI,EAAE,cAAc;QACpB,QAAQ,EAAE,kBAAkB;QAC5B,OAAO,EAAE,iBAAiB;QAC1B,aAAa,EAAE,uBAAuB;KACvC;IAED,eAAe,EAAE,yBAAyB;CAC3C,CAAC"}
|
|
1
|
+
{"version":3,"file":"go.js","sourceRoot":"","sources":["../../src/languages/go.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4WA,kDAmBC;AAQD,gDAqBC;AA5ZD,uCAAyB;AACzB,2CAA6B;AAE7B,0DAAkE;AAClE,8DAAoE;AACpE,gDAMgC;AAChC,sDAA6E;AAC7E,oEAAuE;AA2BvE;;;;;;GAMG;AACH,SAAS,yBAAyB,CAAC,MAA0B;IAC3D,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAE1B,oDAAoD;IACpD,IAAI,MAAM,KAAK,OAAO;QAAE,OAAO,UAAU,CAAC;IAE1C,qEAAqE;IACrE,IACE,MAAM,KAAK,OAAO;QAClB,MAAM,KAAK,aAAa;QACxB,MAAM,KAAK,WAAW;QACtB,MAAM,KAAK,WAAW;QACtB,MAAM,KAAK,aAAa;QACxB,MAAM,KAAK,QAAQ;QACnB,MAAM,KAAK,QAAQ;QACnB,MAAM,KAAK,WAAW;QACtB,MAAM,KAAK,cAAc;QACzB,MAAM,KAAK,eAAe;QAC1B,MAAM,KAAK,OAAO,EAClB,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,+BAA+B;IAC/B,IACE,MAAM,KAAK,UAAU;QACrB,MAAM,KAAK,UAAU;QACrB,MAAM,KAAK,QAAQ;QACnB,MAAM,KAAK,SAAS;QACpB,MAAM,KAAK,SAAS;QACpB,MAAM,KAAK,QAAQ;QACnB,MAAM,KAAK,MAAM;QACjB,MAAM,KAAK,UAAU;QACrB,MAAM,KAAK,WAAW;QACtB,MAAM,KAAK,SAAS;QACpB,MAAM,KAAK,UAAU;QACrB,MAAM,KAAK,UAAU,EACrB,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,qBAAqB;IACrB,IACE,MAAM,KAAK,OAAO;QAClB,MAAM,KAAK,SAAS;QACpB,MAAM,KAAK,WAAW;QACtB,MAAM,KAAK,YAAY;QACvB,MAAM,KAAK,YAAY;QACvB,MAAM,KAAK,UAAU;QACrB,MAAM,KAAK,OAAO;QAClB,MAAM,KAAK,KAAK,EAChB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAoB;IAC7C,MAAM,QAAQ,GAAG,yBAAyB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC7D,qEAAqE;IACrE,2DAA2D;IAC3D,IAAI,QAAQ,KAAK,KAAK,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QAC3C,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QACjD,IAAI,GAAG,KAAK,OAAO;YAAE,OAAO,MAAM,CAAC;QACnC,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,QAAQ,CAAC;IACzC,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAQD;;;;;;;;;;;;;;;;GAgBG;AACH,KAAK,UAAU,sBAAsB,CAAC,GAAW;IAC/C,MAAM,IAAI,GAAG,IAAA,wBAAQ,EAAC,yBAAS,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;IAClD,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;IAEnE,MAAM,GAAG,GAAG,IAAA,YAAG,EAAC,GAAG,IAAI,CAAC,IAAI,0BAA0B,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IACrE,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAEvC,IAAI,CAAC;QACH,oEAAoE;QACpE,mEAAmE;QACnE,qEAAqE;QACrE,mEAAmE;QACnE,2CAA2C;QAC3C,iEAAiE;QACjE,gFAAgF;QAChF,wEAAwE;QACxE,MAAM,eAAe,GAAG,IAAI,GAAG,EAAyB,CAAC;QACzD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAmB,CAAC;QAC/C,KAAK,MAAM,GAAG,IAAI,IAAA,wBAAe,EAAC,GAAG,CAGnC,EAAE,CAAC;YACH,IAAI,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC;gBACrB,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC5C,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,MAAM,CAAC,MAAM,IAAI,EAAE,IAAI,MAAM,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;gBAChF,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YACvE,CAAC;YACD,IAAI,GAAG,CAAC,GAAG,EAAE,EAAE;gBAAE,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QACxD,CAAC;QAED,+DAA+D;QAC/D,kEAAkE;QAClE,iEAAiE;QACjE,0DAA0D;QAC1D,MAAM,SAAS,GAAG;YAChB,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,eAAe,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAa,CAAC;SACxF,CAAC;QACF,MAAM,WAAW,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE;YAC1C,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChC,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YACtB,OAAO,IAAA,yBAAmB,EAAC,GAAG,CAAC,KAAK,SAAS,CAAC;QAChD,CAAC,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,IAAA,eAAS,EAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC;QAEnF,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,IAAI,GAAG,GAAG,CAAC,CAAC;QACZ,IAAI,aAAa,GAAG,CAAC,CAAC;QACtB,MAAM,YAAY,GAAG,IAAI,GAAG,EAAgC,CAAC;QAC7D,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;YAC3B,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChC,IAAI,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,IAAA,yBAAmB,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACrD,IAAI,GAAG,KAAK,SAAS;gBAAE,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,QAAQ,IAAI,SAAS,CAAC;YACrE,IAAI,MAA4B,CAAC;YACjC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,aAAa,EAAE,CAAC;gBAChB,IAAI,GAAG,KAAK,UAAU;oBAAE,MAAM,GAAG,UAAU,CAAC;qBACvC,IAAI,GAAG,KAAK,MAAM;oBAAE,MAAM,GAAG,MAAM,CAAC;qBACpC,IAAI,GAAG,KAAK,QAAQ;oBAAE,MAAM,GAAG,QAAQ,CAAC;;oBACxC,MAAM,GAAG,KAAK,CAAC;YACtB,CAAC;iBAAM,CAAC;gBACN,MAAM,GAAG,MAAM,CAAC,CAAC,6BAA6B;YAChD,CAAC;YACD,YAAY,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAC7B,IAAI,MAAM,KAAK,UAAU;gBAAE,QAAQ,EAAE,CAAC;iBACjC,IAAI,MAAM,KAAK,MAAM;gBAAE,IAAI,EAAE,CAAC;iBAC9B,IAAI,MAAM,KAAK,QAAQ;gBAAE,MAAM,EAAE,CAAC;;gBAClC,GAAG,EAAE,CAAC;QACb,CAAC;QAED,MAAM,QAAQ,GAAqB,EAAE,CAAC;QACtC,KAAK,MAAM,OAAO,IAAI,eAAe,CAAC,MAAM,EAAE,EAAE,CAAC;YAC/C,IAAI,CAAC,OAAO,CAAC,GAAG;gBAAE,SAAS;YAC3B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACxC,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAE7B,CAAC;YACd,mEAAmE;YACnE,qEAAqE;YACrE,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,IAAI,SAAS,CAAC;YACnF,MAAM,OAAO,GAAmB;gBAC9B,EAAE,EAAE,OAAO,CAAC,GAAG;gBACf,OAAO,EAAE,OAAO;gBAChB,gBAAgB,EAAE,MAAM,CAAC,OAAO;gBAChC,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,MAAM;gBACjD,SAAS,EAAE,IAAI;aAChB,CAAC;YACF,IAAI,OAAO,CAAC,aAAa;gBAAE,OAAO,CAAC,YAAY,GAAG,OAAO,CAAC,aAAa,CAAC;YACxE,kEAAkE;YAClE,mEAAmE;YACnE,iEAAiE;YACjE,MAAM,aAAa,GAAG,MAAM,CAAC,CAAC,CAAC,IAAA,yBAAmB,EAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAClE,IAAI,aAAa,KAAK,IAAI;gBAAE,OAAO,CAAC,SAAS,GAAG,aAAa,CAAC;YAC9D,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;gBACxE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;oBAAE,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC;gBAClD,IAAI,MAAM,CAAC,OAAO;oBAAE,OAAO,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;qBAChD,IAAI,MAAM,CAAC,OAAO;oBAAE,OAAO,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;gBAC1D,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBACzE,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;oBAAE,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;YACjD,CAAC;YACD,wEAAwE;YACxE,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;gBACxB,OAAO,CAAC,UAAU,GAAG,CAAC,iCAAiC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzB,CAAC;QAED,mEAAmE;QACnE,mEAAmE;QACnE,4DAA4D;QAC5D,mEAAmE;QACnE,qDAAqD;QACrD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,UAAU,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACtC,SAAS,EAAE,CAAC,CAAC,EAAE;gBACf,YAAY,EAAE,CAAC,CAAC,SAAS,IAAI,IAAI;gBACjC,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,EAAE;aACzB,CAAC,CAAC,CAAC;YACJ,MAAM,QAAQ,GAAG,MAAM,IAAA,uBAAiB,EAAC,UAAU,CAAC,CAAC;YACrD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;gBACzB,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACjC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;oBAAE,CAAC,CAAC,SAAS,GAAG,KAAK,CAAC;YACjE,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAkB;YAC9B,aAAa,EAAE,CAAC;YAChB,IAAI,EAAE,aAAa;YACnB,8DAA8D;YAC9D,iEAAiE;YACjE,UAAU,EAAE,aAAa,GAAG,CAAC,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;YAC1E,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE;YACvC,QAAQ;SACT,CAAC;QACF,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IACjC,CAAC;AACH,CAAC;AAED,MAAM,kBAAkB,GAAsC;IAC5D,MAAM,EAAE,IAAI;IACZ,KAAK,CAAC,MAAM,CAAC,GAAG;QACd,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAClD,OAAO,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,CAAC;CACF,CAAC;AAEF;;;GAGG;AACH,SAAS,kBAAkB,CAAC,GAAW;IACrC,MAAM,IAAI,GAAG,IAAA,wBAAQ,EAAC,yBAAS,CAAC,eAAe,CAAC,EAAE,GAAG,CAAC,CAAC;IACvD,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAClC,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAC1D,CAAC;IAED,MAAM,GAAG,GAAG,IAAA,YAAG,EAAC,GAAG,IAAI,CAAC,IAAI,0CAA0C,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IACrF,MAAM,MAAM,GAAmB,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;IAC3E,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,2EAA2E;QAC3E,MAAM,QAAQ,GAAe,EAAE,aAAa,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,CAAC;QACjF,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;IACvC,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAmB,CAAC;QAC/C,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;YACtC,MAAM,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACrC,CAAC;QACD,MAAM,QAAQ,GAAe,EAAE,aAAa,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,CAAC;QACjF,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACxD,CAAC;AACH,CAAC;AAED,MAAM,cAAc,GAAmC;IACrD,MAAM,EAAE,IAAI;IACZ,KAAK,CAAC,MAAM,CAAC,GAAG;QACd,MAAM,OAAO,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;QACxC,OAAO,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,CAAC;CACF,CAAC;AAEF;;;GAGG;AACH,SAAS,sBAAsB,CAAC,GAAW;IACzC,KAAK,MAAM,IAAI,IAAI,CAAC,cAAc,EAAE,WAAW,CAAC,EAAE,CAAC;QACjD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACjC,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAA,8BAAmB,EAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YACrD,OAAO,EAAE,aAAa,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,QAAQ,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC;QAC7E,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,kBAAkB,GAAuC;IAC7D,MAAM,EAAE,IAAI;IACZ,KAAK,CAAC,MAAM,CAAC,GAAG;QACd,OAAO,sBAAsB,CAAC,GAAG,CAAC,CAAC;IACrC,CAAC;CACF,CAAC;AAEF;;;;;GAKG;AACH,SAAgB,mBAAmB,CAAC,OAAe;IACjD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,QAAQ,GAAG,8CAA8C,CAAC;IAChE,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC7C,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;IACD,MAAM,OAAO,GAAG,0BAA0B,CAAC;IAC3C,OAAO,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACnB,MAAM,MAAM,GAAG,gCAAgC,CAAC;QAChD,IAAI,EAA0B,CAAC;QAC/B,OAAO,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC1C,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzB,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,SAAgB,kBAAkB,CAAC,SAAiB,EAAE,IAAY,EAAE,GAAW;IAC7E,IAAI,KAAa,CAAC;IAClB,IAAI,CAAC;QACH,KAAK,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACpD,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAC9B,MAAM,UAAU,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAClC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,GAAG,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAChC,IAAI,CAAC;QACH,IAAI,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;YACnC,OAAO,GAAG,CAAC;QACb,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,YAAY;IACd,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,SAAS,qBAAqB,CAAC,GAAW;IACxC,MAAM,QAAQ,GAAG,IAAA,gCAAmB,EAAC,GAAG,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,IAAA,YAAG,EAAC,+BAA+B,QAAQ,cAAc,EAAE,GAAG,CAAC,CAAC;IAC5E,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAEtB,MAAM,SAAS,GAAG,IAAI,GAAG,EAAiC,CAAC;IAC3D,MAAM,KAAK,GAAG,IAAI,GAAG,EAA+B,CAAC;IAErD,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,MAAM,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACnC,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAC3C,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC1B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAClC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YACpD,IAAI,QAAQ;gBAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACtC,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,GAAG,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAChD,CAAC;IAED,IAAI,SAAS,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO;QACL,aAAa,EAAE,CAAC;QAChB,IAAI,EAAE,YAAY;QAClB,gBAAgB,EAAE,CAAC,KAAK,CAAC;QACzB,SAAS;QACT,KAAK;KACN,CAAC;AACJ,CAAC;AAED,MAAM,iBAAiB,GAAsC;IAC3D,MAAM,EAAE,IAAI;IACZ,KAAK,CAAC,MAAM,CAAC,GAAG;QACd,OAAO,qBAAqB,CAAC,GAAG,CAAC,CAAC;IACpC,CAAC;CACF,CAAC;AAEF;;;;GAIG;AACH,SAAS,2BAA2B,CAAC,GAAW;IAC9C,IAAI,CAAC,IAAA,mBAAU,EAAC,GAAG,EAAE,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,OAAO,EAAE,aAAa,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AAC3D,CAAC;AAED,MAAM,uBAAuB,GAA4C;IACvE,MAAM,EAAE,IAAI;IACZ,KAAK,CAAC,MAAM,CAAC,GAAG;QACd,OAAO,2BAA2B,CAAC,GAAG,CAAC,CAAC;IAC1C,CAAC;CACF,CAAC;AASF;;;;;GAKG;AACH,SAAS,uBAAuB,CAAC,GAAW;IAC1C,MAAM,GAAG,GAAmB,EAAE,CAAC;IAC/B,MAAM,EAAE,GAAG,kBAAkB,CAAC;IAC9B,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC;YACH,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAiB,CAAC,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,0BAA0B;QAC5B,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,SAAS,mBAAmB,CAAC,OAAe,EAAE,OAA4B;IACxE,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QACjC,IAAI,CAAC,OAAO,KAAK,GAAG,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YACnF,IAAI,GAAG,GAAG,CAAC;QACb,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,sBAAsB,CAAC,GAAW;IACzC,IAAI,CAAC,IAAA,mBAAU,EAAC,GAAG,EAAE,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAE5C,MAAM,MAAM,GAAG,IAAA,wBAAQ,EAAC,yBAAS,CAAC,aAAa,CAAC,EAAE,GAAG,CAAC,CAAC;IACvD,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEnD,MAAM,MAAM,GAAG,IAAA,YAAG,EAAC,GAAG,MAAM,CAAC,IAAI,uBAAuB,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IACvE,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,MAAM,OAAO,GAAG,IAAA,YAAG,EAAC,kCAAkC,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IACpE,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC3C,IAAI,OAAO,EAAE,CAAC;QACZ,KAAK,MAAM,GAAG,IAAI,uBAAuB,CAAC,OAAO,CAAC,EAAE,CAAC;YACnD,IAAI,GAAG,CAAC,IAAI;gBAAE,SAAS;YACvB,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO;gBAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAqB,EAAE,CAAC;IACtC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,SAAS;QAC/B,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAChC,QAAQ,CAAC,IAAI,CAAC;YACZ,OAAO,EAAE,GAAG;YACZ,OAAO,EAAE,mBAAmB,CAAC,GAAG,EAAE,QAAQ,CAAC;YAC3C,WAAW,EAAE,OAAO,IAAI,SAAS;YACjC,SAAS,EAAE,GAAG,IAAI,SAAS;SAC5B,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,aAAa,EAAE,CAAC;QAChB,IAAI,EAAE,aAAa;QACnB,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,MAAM,kBAAkB,GAAuC;IAC7D,MAAM,EAAE,IAAI;IACZ,KAAK,CAAC,MAAM,CAAC,GAAG;QACd,OAAO,sBAAsB,CAAC,GAAG,CAAC,CAAC;IACrC,CAAC;CACF,CAAC;AAEW,QAAA,EAAE,GAAoB;IACjC,EAAE,EAAE,IAAI;IACR,WAAW,EAAE,IAAI;IACjB,gBAAgB,EAAE,CAAC,KAAK,CAAC;IACzB,gBAAgB,EAAE,CAAC,WAAW,CAAC;IAC/B,aAAa,EAAE,CAAC,QAAQ,CAAC;IAEzB,MAAM,CAAC,GAAG;QACR,OAAO,IAAA,mBAAU,EAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACnC,CAAC;IAED,KAAK,EAAE,CAAC,eAAe,EAAE,aAAa,EAAE,aAAa,CAAC;IACtD,eAAe,EAAE,CAAC,SAAS,CAAC;IAE5B,YAAY,EAAE;QACZ,QAAQ,EAAE,kBAAkB;QAC5B,IAAI,EAAE,cAAc;QACpB,QAAQ,EAAE,kBAAkB;QAC5B,OAAO,EAAE,iBAAiB;QAC1B,aAAa,EAAE,uBAAuB;QACtC,QAAQ,EAAE,kBAAkB;KAC7B;IAED,eAAe,EAAE,yBAAyB;CAC3C,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"python.d.ts","sourceRoot":"","sources":["../../src/languages/python.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"python.d.ts","sourceRoot":"","sources":["../../src/languages/python.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,eAAe,EAAgB,MAAM,SAAS,CAAC;AAoS7D;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAqB7D;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAqB7F;AA4LD,eAAO,MAAM,MAAM,EAAE,eA8BpB,CAAC"}
|
package/dist/languages/python.js
CHANGED
|
@@ -82,6 +82,29 @@ function hasPyFileWithinDepth(cwd, maxDepth = 2) {
|
|
|
82
82
|
}
|
|
83
83
|
return search(cwd, 0);
|
|
84
84
|
}
|
|
85
|
+
/**
|
|
86
|
+
* Build the pip-audit invocation for the project at `cwd`. Returns null
|
|
87
|
+
* when no supported manifest is present — without one, pip-audit would
|
|
88
|
+
* silently fall back to scanning its own python environment (the
|
|
89
|
+
* dxkit-installed graphify-venv), reporting irrelevant vulnerabilities
|
|
90
|
+
* against tools rather than against the project's declared dependencies.
|
|
91
|
+
*
|
|
92
|
+
* Manifest precedence:
|
|
93
|
+
* - pyproject.toml / setup.py → `pip-audit .` (project mode reads the
|
|
94
|
+
* declared dependencies)
|
|
95
|
+
* - requirements.txt → `pip-audit -r requirements.txt`
|
|
96
|
+
* - Pipfile → unsupported by pip-audit natively; we
|
|
97
|
+
* return null rather than scan the wrong environment.
|
|
98
|
+
*/
|
|
99
|
+
function buildPipAuditCommand(cwd, pipAuditPath) {
|
|
100
|
+
if ((0, runner_1.fileExists)(cwd, 'pyproject.toml') || (0, runner_1.fileExists)(cwd, 'setup.py')) {
|
|
101
|
+
return `${pipAuditPath} . --format json 2>/dev/null`;
|
|
102
|
+
}
|
|
103
|
+
if ((0, runner_1.fileExists)(cwd, 'requirements.txt')) {
|
|
104
|
+
return `${pipAuditPath} -r requirements.txt --format json 2>/dev/null`;
|
|
105
|
+
}
|
|
106
|
+
return null;
|
|
107
|
+
}
|
|
85
108
|
/**
|
|
86
109
|
* Single source of truth for the python pack's dep-vuln gathering.
|
|
87
110
|
* Consumed by `pyDepVulnsProvider` (capability dispatcher).
|
|
@@ -90,7 +113,10 @@ async function gatherPyDepVulnsResult(cwd) {
|
|
|
90
113
|
const pipAudit = (0, tool_registry_1.findTool)(tool_registry_1.TOOL_DEFS['pip-audit'], cwd);
|
|
91
114
|
if (!pipAudit.available || !pipAudit.path)
|
|
92
115
|
return { kind: 'tool-missing' };
|
|
93
|
-
const
|
|
116
|
+
const cmd = buildPipAuditCommand(cwd, pipAudit.path);
|
|
117
|
+
if (!cmd)
|
|
118
|
+
return { kind: 'tool-missing' };
|
|
119
|
+
const raw = (0, runner_1.run)(cmd, cwd, 120000);
|
|
94
120
|
if (!raw)
|
|
95
121
|
return { kind: 'no-output' };
|
|
96
122
|
try {
|
|
@@ -102,29 +128,89 @@ async function gatherPyDepVulnsResult(cwd) {
|
|
|
102
128
|
vulnIds.push(v.id);
|
|
103
129
|
}
|
|
104
130
|
}
|
|
105
|
-
// pip-audit doesn't carry severity per vuln — look up via
|
|
106
|
-
// Unknown/unreachable IDs fall back to medium (pip-audit's
|
|
107
|
-
|
|
131
|
+
// pip-audit doesn't carry severity or CVSS per vuln — look up via
|
|
132
|
+
// OSV.dev. Unknown/unreachable IDs fall back to medium (pip-audit's
|
|
133
|
+
// legacy default). cvssScore is attached to findings when available.
|
|
134
|
+
const enriched = await (0, osv_1.enrichOsv)(vulnIds);
|
|
108
135
|
let critical = 0;
|
|
109
136
|
let high = 0;
|
|
110
137
|
let medium = 0;
|
|
111
138
|
let low = 0;
|
|
112
139
|
let enrichedCount = 0;
|
|
113
|
-
|
|
114
|
-
const
|
|
140
|
+
const resolveSeverity = (id) => {
|
|
141
|
+
const detail = enriched.get(id);
|
|
142
|
+
const sev = detail?.severity;
|
|
115
143
|
if (sev && sev !== 'unknown') {
|
|
116
144
|
enrichedCount++;
|
|
117
145
|
if (sev === 'critical')
|
|
146
|
+
return 'critical';
|
|
147
|
+
if (sev === 'high')
|
|
148
|
+
return 'high';
|
|
149
|
+
if (sev === 'medium')
|
|
150
|
+
return 'medium';
|
|
151
|
+
return 'low';
|
|
152
|
+
}
|
|
153
|
+
return 'medium';
|
|
154
|
+
};
|
|
155
|
+
const findings = [];
|
|
156
|
+
for (const dep of data.dependencies || []) {
|
|
157
|
+
for (const v of dep.vulns || []) {
|
|
158
|
+
if (!v.id)
|
|
159
|
+
continue;
|
|
160
|
+
const severity = resolveSeverity(v.id);
|
|
161
|
+
if (severity === 'critical')
|
|
118
162
|
critical++;
|
|
119
|
-
else if (
|
|
163
|
+
else if (severity === 'high')
|
|
120
164
|
high++;
|
|
121
|
-
else if (
|
|
165
|
+
else if (severity === 'medium')
|
|
122
166
|
medium++;
|
|
123
167
|
else
|
|
124
168
|
low++;
|
|
169
|
+
const finding = {
|
|
170
|
+
id: v.id,
|
|
171
|
+
package: dep.name ?? 'unknown',
|
|
172
|
+
installedVersion: dep.version,
|
|
173
|
+
tool: 'pip-audit',
|
|
174
|
+
severity,
|
|
175
|
+
};
|
|
176
|
+
// Embedded score from the primary enrichment pass; alias-fallback
|
|
177
|
+
// happens in the batched resolveCvssScores call after this loop.
|
|
178
|
+
const primaryCvss = enriched.get(v.id)?.cvssScore;
|
|
179
|
+
if (primaryCvss !== null && primaryCvss !== undefined)
|
|
180
|
+
finding.cvssScore = primaryCvss;
|
|
181
|
+
// pip-audit returns sorted fix versions ascending; the first is the
|
|
182
|
+
// minimal upgrade that resolves the issue.
|
|
183
|
+
if (v.fix_versions && v.fix_versions.length > 0) {
|
|
184
|
+
finding.fixedVersion = v.fix_versions[0];
|
|
185
|
+
}
|
|
186
|
+
// Filter empty alias entries — ECHO advisories occasionally emit [].
|
|
187
|
+
const aliases = (v.aliases ?? []).filter((a) => a && a.length > 0);
|
|
188
|
+
if (aliases.length > 0)
|
|
189
|
+
finding.aliases = aliases;
|
|
190
|
+
if (v.description)
|
|
191
|
+
finding.summary = v.description;
|
|
192
|
+
// pip-audit doesn't carry advisory URLs; OSV.dev hosts a canonical
|
|
193
|
+
// page per vulnerability id, so synthesize the reference. Render
|
|
194
|
+
// layer can override if a tool-supplied URL becomes available later.
|
|
195
|
+
finding.references = [`https://osv.dev/vulnerability/${v.id}`];
|
|
196
|
+
findings.push(finding);
|
|
125
197
|
}
|
|
126
|
-
|
|
127
|
-
|
|
198
|
+
}
|
|
199
|
+
// Alias-fallback CVSS pass: PYSEC-* records on OSV.dev frequently
|
|
200
|
+
// lack CVSS vectors that the corresponding CVE alias carries (the
|
|
201
|
+
// pip ecosystem assigns PYSEC ids before CVEs land). When primary
|
|
202
|
+
// lookup misses, we re-query each alias to fill the score.
|
|
203
|
+
if (findings.length > 0) {
|
|
204
|
+
const cvssInputs = findings.map((f) => ({
|
|
205
|
+
primaryId: f.id,
|
|
206
|
+
embeddedCvss: f.cvssScore ?? null,
|
|
207
|
+
aliases: f.aliases ?? [],
|
|
208
|
+
}));
|
|
209
|
+
const resolved = await (0, osv_1.resolveCvssScores)(cvssInputs);
|
|
210
|
+
for (const f of findings) {
|
|
211
|
+
const score = resolved.get(f.id);
|
|
212
|
+
if (score !== null && score !== undefined)
|
|
213
|
+
f.cvssScore = score;
|
|
128
214
|
}
|
|
129
215
|
}
|
|
130
216
|
const envelope = {
|
|
@@ -132,6 +218,7 @@ async function gatherPyDepVulnsResult(cwd) {
|
|
|
132
218
|
tool: 'pip-audit',
|
|
133
219
|
enrichment: enrichedCount > 0 ? 'osv.dev' : null,
|
|
134
220
|
counts: { critical, high, medium, low },
|
|
221
|
+
findings,
|
|
135
222
|
};
|
|
136
223
|
return { kind: 'success', envelope };
|
|
137
224
|
}
|
|
@@ -364,6 +451,94 @@ const pyTestFrameworkProvider = {
|
|
|
364
451
|
return gatherPyTestFrameworkResult(cwd);
|
|
365
452
|
},
|
|
366
453
|
};
|
|
454
|
+
/**
|
|
455
|
+
* Locate the project's own Python interpreter. Conventional venv locations
|
|
456
|
+
* are `.venv/bin/python[3]` or `venv/bin/python[3]`; we check in that
|
|
457
|
+
* order. Returns null if no venv is found — the provider then skips
|
|
458
|
+
* cleanly rather than falling through to pip-licenses's install env
|
|
459
|
+
* (which would report dxkit's own packages, not the project's).
|
|
460
|
+
*/
|
|
461
|
+
function findPyProjectVenvPython(cwd) {
|
|
462
|
+
const candidates = [
|
|
463
|
+
path.join(cwd, '.venv', 'bin', 'python'),
|
|
464
|
+
path.join(cwd, '.venv', 'bin', 'python3'),
|
|
465
|
+
path.join(cwd, 'venv', 'bin', 'python'),
|
|
466
|
+
path.join(cwd, 'venv', 'bin', 'python3'),
|
|
467
|
+
];
|
|
468
|
+
for (const c of candidates) {
|
|
469
|
+
try {
|
|
470
|
+
if (fs.statSync(c).isFile())
|
|
471
|
+
return c;
|
|
472
|
+
}
|
|
473
|
+
catch {
|
|
474
|
+
/* not this one */
|
|
475
|
+
}
|
|
476
|
+
}
|
|
477
|
+
return null;
|
|
478
|
+
}
|
|
479
|
+
/**
|
|
480
|
+
* Single source of truth for the python pack's license gathering.
|
|
481
|
+
* Consumed by `pyLicensesProvider` (capability dispatcher).
|
|
482
|
+
*
|
|
483
|
+
* Gating is strict — both a Python manifest AND a project venv are
|
|
484
|
+
* required. Reason: pip-licenses operates on the active Python
|
|
485
|
+
* environment, so invoking it without `--python <project-venv>` would
|
|
486
|
+
* report whatever packages are installed in dxkit's graphify-venv
|
|
487
|
+
* (i.e. garbage). Returns null when either prerequisite is missing so
|
|
488
|
+
* the dispatcher drops the pack cleanly.
|
|
489
|
+
*/
|
|
490
|
+
function gatherPyLicensesResult(cwd) {
|
|
491
|
+
const hasManifest = (0, runner_1.fileExists)(cwd, 'pyproject.toml') ||
|
|
492
|
+
(0, runner_1.fileExists)(cwd, 'setup.py') ||
|
|
493
|
+
(0, runner_1.fileExists)(cwd, 'requirements.txt') ||
|
|
494
|
+
(0, runner_1.fileExists)(cwd, 'Pipfile');
|
|
495
|
+
if (!hasManifest)
|
|
496
|
+
return null;
|
|
497
|
+
const venvPython = findPyProjectVenvPython(cwd);
|
|
498
|
+
if (!venvPython)
|
|
499
|
+
return null;
|
|
500
|
+
const status = (0, tool_registry_1.findTool)(tool_registry_1.TOOL_DEFS['pip-licenses'], cwd);
|
|
501
|
+
if (!status.available || !status.path)
|
|
502
|
+
return null;
|
|
503
|
+
const raw = (0, runner_1.run)(`${status.path} --python ${venvPython} --format=json --with-license-file --no-license-path --with-description --with-urls --with-authors 2>/dev/null`, cwd, 120000);
|
|
504
|
+
if (!raw)
|
|
505
|
+
return null;
|
|
506
|
+
let data;
|
|
507
|
+
try {
|
|
508
|
+
data = JSON.parse(raw);
|
|
509
|
+
}
|
|
510
|
+
catch {
|
|
511
|
+
return null;
|
|
512
|
+
}
|
|
513
|
+
if (!Array.isArray(data))
|
|
514
|
+
return null;
|
|
515
|
+
const findings = [];
|
|
516
|
+
for (const entry of data) {
|
|
517
|
+
if (!entry.Name || !entry.Version)
|
|
518
|
+
continue;
|
|
519
|
+
const licenseType = entry.License && entry.License !== 'UNKNOWN' ? entry.License : 'UNKNOWN';
|
|
520
|
+
findings.push({
|
|
521
|
+
package: entry.Name,
|
|
522
|
+
version: entry.Version,
|
|
523
|
+
licenseType,
|
|
524
|
+
licenseText: entry.LicenseText && entry.LicenseText !== 'UNKNOWN' ? entry.LicenseText : undefined,
|
|
525
|
+
sourceUrl: entry.URL && entry.URL !== 'UNKNOWN' ? entry.URL : undefined,
|
|
526
|
+
description: entry.Description && entry.Description !== 'UNKNOWN' ? entry.Description : undefined,
|
|
527
|
+
supplier: entry.Author && entry.Author !== 'UNKNOWN' ? entry.Author : undefined,
|
|
528
|
+
});
|
|
529
|
+
}
|
|
530
|
+
return {
|
|
531
|
+
schemaVersion: 1,
|
|
532
|
+
tool: 'pip-licenses',
|
|
533
|
+
findings,
|
|
534
|
+
};
|
|
535
|
+
}
|
|
536
|
+
const pyLicensesProvider = {
|
|
537
|
+
source: 'python',
|
|
538
|
+
async gather(cwd) {
|
|
539
|
+
return gatherPyLicensesResult(cwd);
|
|
540
|
+
},
|
|
541
|
+
};
|
|
367
542
|
exports.python = {
|
|
368
543
|
id: 'python',
|
|
369
544
|
displayName: 'Python',
|
|
@@ -377,7 +552,7 @@ exports.python = {
|
|
|
377
552
|
(0, runner_1.fileExists)(cwd, 'Pipfile') ||
|
|
378
553
|
hasPyFileWithinDepth(cwd, 2));
|
|
379
554
|
},
|
|
380
|
-
tools: ['ruff', 'pip-audit', 'coverage-py'],
|
|
555
|
+
tools: ['ruff', 'pip-audit', 'coverage-py', 'pip-licenses'],
|
|
381
556
|
semgrepRulesets: ['p/python'],
|
|
382
557
|
capabilities: {
|
|
383
558
|
depVulns: pyDepVulnsProvider,
|
|
@@ -385,6 +560,7 @@ exports.python = {
|
|
|
385
560
|
coverage: pyCoverageProvider,
|
|
386
561
|
imports: pyImportsProvider,
|
|
387
562
|
testFramework: pyTestFrameworkProvider,
|
|
563
|
+
licenses: pyLicensesProvider,
|
|
388
564
|
},
|
|
389
565
|
mapLintSeverity: mapRuffSeverity,
|
|
390
566
|
};
|