fca-rqzax-remake 0.0.1-security → 8.19.2

package/.config/npm/node_global/lib/node_modules/npm/node_modules/@npmcli/arborist/lib/signal-handling.js

@@ -0,0 +1,74 @@
+const signals = require('./signals.js')
+
+// for testing, expose the process being used
+module.exports = Object.assign(fn => setup(fn), { process })
+
+// do all of this in a setup function so that we can call it
+// multiple times for multiple reifies that might be going on.
+// Otherwise, Arborist.reify() is a global action, which is a
+// new constraint we'd be adding with this behavior.
+const setup = fn => {
+  const { process } = module.exports
+
+  const sigListeners = { loaded: false }
+
+  const unload = () => {
+    if (!sigListeners.loaded) {
+      return
+    }
+    for (const sig of signals) {
+      try {
+        process.removeListener(sig, sigListeners[sig])
+      } catch {
+        // ignore errors
+      }
+    }
+    process.removeListener('beforeExit', onBeforeExit)
+    sigListeners.loaded = false
+  }
+
+  const onBeforeExit = () => {
+    // this trick ensures that we exit with the same signal we caught
+    // Ie, if you press ^C and npm gets a SIGINT, we'll do the rollback
+    // and then exit with a SIGINT signal once we've removed the handler.
+    // The timeout is there because signals are asynchronous, so we need
+    // the process to NOT exit on its own, which means we have to have
+    // something keeping the event loop looping.  Hence this hack.
+    unload()
+    process.kill(process.pid, signalReceived)
+    setTimeout(() => {}, 500)
+  }
+
+  let signalReceived = null
+  const listener = (sig, fn) => () => {
+    signalReceived = sig
+
+    // if we exit normally, but caught a signal which would have been fatal,
+    // then re-send it once we're done with whatever cleanup we have to do.
+    unload()
+    if (process.listeners(sig).length < 1) {
+      process.once('beforeExit', onBeforeExit)
+    }
+
+    fn({ signal: sig })
+  }
+
+  // do the actual loading here
+  for (const sig of signals) {
+    sigListeners[sig] = listener(sig, fn)
+    const max = process.getMaxListeners()
+    try {
+      // if we call this a bunch of times, avoid triggering the warning
+      const { length } = process.listeners(sig)
+      if (length >= max) {
+        process.setMaxListeners(length + 1)
+      }
+      process.on(sig, sigListeners[sig])
+    } catch {
+      // ignore errors
+    }
+  }
+  sigListeners.loaded = true
+
+  return unload
+}

package/.config/npm/node_global/lib/node_modules/npm/node_modules/@npmcli/arborist/lib/signals.js

@@ -0,0 +1,58 @@
+// copied from signal-exit
+
+// This is not the set of all possible signals.
+//
+// It IS, however, the set of all signals that trigger
+// an exit on either Linux or BSD systems.  Linux is a
+// superset of the signal names supported on BSD, and
+// the unknown signals just fail to register, so we can
+// catch that easily enough.
+//
+// Don't bother with SIGKILL.  It's uncatchable, which
+// means that we can't fire any callbacks anyway.
+//
+// If a user does happen to register a handler on a non-
+// fatal signal like SIGWINCH or something, and then
+// exit, it'll end up firing `process.emit('exit')`, so
+// the handler will be fired anyway.
+//
+// SIGBUS, SIGFPE, SIGSEGV and SIGILL, when not raised
+// artificially, inherently leave the process in a
+// state from which it is not safe to try and enter JS
+// listeners.
+
+const platform = global.__ARBORIST_FAKE_PLATFORM__ || process.platform
+
+module.exports = [
+  'SIGABRT',
+  'SIGALRM',
+  'SIGHUP',
+  'SIGINT',
+  'SIGTERM',
+]
+
+if (platform !== 'win32') {
+  module.exports.push(
+    'SIGVTALRM',
+    'SIGXCPU',
+    'SIGXFSZ',
+    'SIGUSR2',
+    'SIGTRAP',
+    'SIGSYS',
+    'SIGQUIT',
+    'SIGIOT'
+    // should detect profiler and enable/disable accordingly.
+    // see #21
+    // 'SIGPROF'
+  )
+}
+
+if (platform === 'linux') {
+  module.exports.push(
+    'SIGIO',
+    'SIGPOLL',
+    'SIGPWR',
+    'SIGSTKFLT',
+    'SIGUNUSED'
+  )
+}

package/.config/npm/node_global/lib/node_modules/npm/node_modules/@npmcli/arborist/lib/spec-from-lock.js

@@ -0,0 +1,34 @@
+const npa = require('npm-package-arg')
+
+// extracted from npm v6 lib/install/realize-shrinkwrap-specifier.js
+const specFromLock = (name, lock, where) => {
+  try {
+    if (lock.version) {
+      const spec = npa.resolve(name, lock.version, where)
+      if (lock.integrity || spec.type === 'git') {
+        return spec
+      }
+    }
+    if (lock.from) {
+      // legacy metadata includes "from", but not integrity
+      const spec = npa.resolve(name, lock.from, where)
+      if (spec.registry && lock.version) {
+        return npa.resolve(name, lock.version, where)
+      } else if (!lock.resolved) {
+        return spec
+      }
+    }
+    if (lock.resolved) {
+      return npa.resolve(name, lock.resolved, where)
+    }
+  } catch {
+    // ignore errors
+  }
+  try {
+    return npa.resolve(name, lock.version, where)
+  } catch {
+    return {}
+  }
+}
+
+module.exports = specFromLock

package/.config/npm/node_global/lib/node_modules/npm/node_modules/@npmcli/arborist/lib/tracker.js

@@ -0,0 +1,102 @@
+const _progress = Symbol('_progress')
+const _onError = Symbol('_onError')
+const _setProgress = Symbol('_setProgess')
+const npmlog = require('npmlog')
+
+module.exports = cls => class Tracker extends cls {
+  constructor (options = {}) {
+    super(options)
+    this[_setProgress] = !!options.progress
+    this[_progress] = new Map()
+  }
+
+  addTracker (section, subsection = null, key = null) {
+    if (section === null || section === undefined) {
+      this[_onError](`Tracker can't be null or undefined`)
+    }
+
+    if (key === null) {
+      key = subsection
+    }
+
+    const hasTracker = this[_progress].has(section)
+    const hasSubtracker = this[_progress].has(`${section}:${key}`)
+
+    if (hasTracker && subsection === null) {
+      // 0. existing tracker, no subsection
+      this[_onError](`Tracker "${section}" already exists`)
+    } else if (!hasTracker && subsection === null) {
+      // 1. no existing tracker, no subsection
+      // Create a new tracker from npmlog
+      // starts progress bar
+      if (this[_setProgress] && this[_progress].size === 0) {
+        npmlog.enableProgress()
+      }
+
+      this[_progress].set(section, npmlog.newGroup(section))
+    } else if (!hasTracker && subsection !== null) {
+      // 2. no parent tracker and subsection
+      this[_onError](`Parent tracker "${section}" does not exist`)
+    } else if (!hasTracker || !hasSubtracker) {
+      // 3. existing parent tracker, no subsection tracker
+      // Create a new subtracker in this[_progress] from parent tracker
+      this[_progress].set(`${section}:${key}`,
+        this[_progress].get(section).newGroup(`${section}:${subsection}`)
+      )
+    }
+    // 4. existing parent tracker, existing subsection tracker
+    // skip it
+  }
+
+  finishTracker (section, subsection = null, key = null) {
+    if (section === null || section === undefined) {
+      this[_onError](`Tracker can't be null or undefined`)
+    }
+
+    if (key === null) {
+      key = subsection
+    }
+
+    const hasTracker = this[_progress].has(section)
+    const hasSubtracker = this[_progress].has(`${section}:${key}`)
+
+    // 0. parent tracker exists, no subsection
+    // Finish parent tracker and remove from this[_progress]
+    if (hasTracker && subsection === null) {
+      // check if parent tracker does
+      // not have any remaining children
+      const keys = this[_progress].keys()
+      for (const key of keys) {
+        if (key.match(new RegExp(section + ':'))) {
+          this.finishTracker(section, key)
+        }
+      }
+
+      // remove parent tracker
+      this[_progress].get(section).finish()
+      this[_progress].delete(section)
+
+      // remove progress bar if all
+      // trackers are finished
+      if (this[_setProgress] && this[_progress].size === 0) {
+        npmlog.disableProgress()
+      }
+    } else if (!hasTracker && subsection === null) {
+      // 1. no existing parent tracker, no subsection
+      this[_onError](`Tracker "${section}" does not exist`)
+    } else if (!hasTracker || hasSubtracker) {
+      // 2. subtracker exists
+      // Finish subtracker and remove from this[_progress]
+      this[_progress].get(`${section}:${key}`).finish()
+      this[_progress].delete(`${section}:${key}`)
+    }
+    // 3. existing parent tracker, no subsection
+  }
+
+  [_onError] (msg) {
+    if (this[_setProgress]) {
+      npmlog.disableProgress()
+    }
+    throw new Error(msg)
+  }
+}

package/.config/npm/node_global/lib/node_modules/npm/node_modules/@npmcli/arborist/lib/tree-check.js

@@ -0,0 +1,155 @@
+const debug = require('./debug.js')
+
+const checkTree = (tree, checkUnreachable = true) => {
+  const log = [['START TREE CHECK', tree.path]]
+
+  // this can only happen in tests where we have a "tree" object
+  // that isn't actually a tree.
+  if (!tree.root || !tree.root.inventory) {
+    return tree
+  }
+
+  const { inventory } = tree.root
+  const seen = new Set()
+  const check = (node, via = tree, viaType = 'self') => {
+    log.push([
+      'CHECK',
+      node && node.location,
+      via && via.location,
+      viaType,
+      'seen=' + seen.has(node),
+      'promise=' + !!(node && node.then),
+      'root=' + !!(node && node.isRoot),
+    ])
+
+    if (!node || seen.has(node) || node.then) {
+      return
+    }
+
+    seen.add(node)
+
+    if (node.isRoot && node !== tree.root) {
+      throw Object.assign(new Error('double root'), {
+        node: node.path,
+        realpath: node.realpath,
+        tree: tree.path,
+        root: tree.root.path,
+        via: via.path,
+        viaType,
+        log,
+      })
+    }
+
+    if (node.root !== tree.root) {
+      throw Object.assign(new Error('node from other root in tree'), {
+        node: node.path,
+        realpath: node.realpath,
+        tree: tree.path,
+        root: tree.root.path,
+        via: via.path,
+        viaType,
+        otherRoot: node.root && node.root.path,
+        log,
+      })
+    }
+
+    if (!node.isRoot && node.inventory.size !== 0) {
+      throw Object.assign(new Error('non-root has non-zero inventory'), {
+        node: node.path,
+        tree: tree.path,
+        root: tree.root.path,
+        via: via.path,
+        viaType,
+        inventory: [...node.inventory.values()].map(node =>
+          [node.path, node.location]),
+        log,
+      })
+    }
+
+    if (!node.isRoot && !inventory.has(node) && !node.dummy) {
+      throw Object.assign(new Error('not in inventory'), {
+        node: node.path,
+        tree: tree.path,
+        root: tree.root.path,
+        via: via.path,
+        viaType,
+        log,
+      })
+    }
+
+    const devEdges = [...node.edgesOut.values()].filter(e => e.dev)
+    if (!node.isTop && devEdges.length) {
+      throw Object.assign(new Error('dev edges on non-top node'), {
+        node: node.path,
+        tree: tree.path,
+        root: tree.root.path,
+        via: via.path,
+        viaType,
+        devEdges: devEdges.map(e => [e.type, e.name, e.spec, e.error]),
+        log,
+      })
+    }
+
+    if (node.path === tree.root.path && node !== tree.root) {
+      throw Object.assign(new Error('node with same path as root'), {
+        node: node.path,
+        tree: tree.path,
+        root: tree.root.path,
+        via: via.path,
+        viaType,
+        log,
+      })
+    }
+
+    if (!node.isLink && node.path !== node.realpath) {
+      throw Object.assign(new Error('non-link with mismatched path/realpath'), {
+        node: node.path,
+        tree: tree.path,
+        realpath: node.realpath,
+        root: tree.root.path,
+        via: via.path,
+        viaType,
+        log,
+      })
+    }
+
+    const { parent, fsParent, target } = node
+    check(parent, node, 'parent')
+    check(fsParent, node, 'fsParent')
+    check(target, node, 'target')
+    log.push(['CHILDREN', node.location, ...node.children.keys()])
+    for (const kid of node.children.values()) {
+      check(kid, node, 'children')
+    }
+    for (const kid of node.fsChildren) {
+      check(kid, node, 'fsChildren')
+    }
+    for (const link of node.linksIn) {
+      check(link, node, 'linksIn')
+    }
+    for (const top of node.tops) {
+      check(top, node, 'tops')
+    }
+    log.push(['DONE', node.location])
+  }
+  check(tree)
+  if (checkUnreachable) {
+    for (const node of inventory.values()) {
+      if (!seen.has(node) && node !== tree.root) {
+        throw Object.assign(new Error('unreachable in inventory'), {
+          node: node.path,
+          realpath: node.realpath,
+          location: node.location,
+          root: tree.root.path,
+          tree: tree.path,
+          log,
+        })
+      }
+    }
+  }
+  return tree
+}
+
+// should only ever run this check in debug mode
+module.exports = tree => tree
+debug(() => module.exports = checkTree)

package/.config/npm/node_global/lib/node_modules/npm/node_modules/@npmcli/arborist/lib/version-from-tgz.js

@@ -0,0 +1,48 @@
+/* eslint node/no-deprecated-api: "off" */
+const semver = require('semver')
+const { basename } = require('path')
+const { parse } = require('url')
+module.exports = (name, tgz) => {
+  const base = basename(tgz)
+  if (!base.endsWith('.tgz')) {
+    return null
+  }
+
+  const u = parse(tgz)
+  if (/^https?:/.test(u.protocol)) {
+    // registry url?  check for most likely pattern.
+    // either /@foo/bar/-/bar-1.2.3.tgz or
+    // /foo/-/foo-1.2.3.tgz, and fall through to
+    // basename checking.  Note that registries can
+    // be mounted below the root url, so /a/b/-/x/y/foo/-/foo-1.2.3.tgz
+    // is a potential option.
+    const tfsplit = u.path.slice(1).split('/-/')
+    if (tfsplit.length > 1) {
+      const afterTF = tfsplit.pop()
+      if (afterTF === base) {
+        const pre = tfsplit.pop()
+        const preSplit = pre.split(/\/|%2f/i)
+        const project = preSplit.pop()
+        const scope = preSplit.pop()
+        return versionFromBaseScopeName(base, scope, project)
+      }
+    }
+  }
+
+  const split = name.split(/\/|%2f/i)
+  const project = split.pop()
+  const scope = split.pop()
+  return versionFromBaseScopeName(base, scope, project)
+}
+
+const versionFromBaseScopeName = (base, scope, name) => {
+  if (!base.startsWith(name + '-')) {
+    return null
+  }
+
+  const parsed = semver.parse(base.substring(name.length + 1, base.length - 4))
+  return parsed ? {
+    name: scope && scope.charAt(0) === '@' ? `${scope}/${name}` : name,
+    version: parsed.version,
+  } : null
+}

package/.config/npm/node_global/lib/node_modules/npm/node_modules/@npmcli/arborist/lib/vuln.js

@@ -0,0 +1,217 @@
+// An object representing a vulnerability either as the result of an
+// advisory or due to the package in question depending exclusively on
+// vulnerable versions of a dep.
+//
+// - name: package name
+// - range: Set of vulnerable versions
+// - nodes: Set of nodes affected
+// - effects: Set of vulns triggered by this one
+// - advisories: Set of advisories (including metavulns) causing this vuln.
+//   All of the entries in via are vulnerability objects returned by
+//   @npmcli/metavuln-calculator
+// - via: dependency vulns which cause this one
+
+const { satisfies, simplifyRange } = require('semver')
+const semverOpt = { loose: true, includePrerelease: true }
+
+const localeCompare = require('@isaacs/string-locale-compare')('en')
+const npa = require('npm-package-arg')
+const _range = Symbol('_range')
+const _simpleRange = Symbol('_simpleRange')
+const _fixAvailable = Symbol('_fixAvailable')
+
+const severities = new Map([
+  ['info', 0],
+  ['low', 1],
+  ['moderate', 2],
+  ['high', 3],
+  ['critical', 4],
+  [null, -1],
+])
+
+for (const [name, val] of severities.entries()) {
+  severities.set(val, name)
+}
+
+class Vuln {
+  constructor ({ name, advisory }) {
+    this.name = name
+    this.via = new Set()
+    this.advisories = new Set()
+    this.severity = null
+    this.effects = new Set()
+    this.topNodes = new Set()
+    this[_range] = null
+    this[_simpleRange] = null
+    this.nodes = new Set()
+    // assume a fix is available unless it hits a top node
+    // that locks it in place, setting this false or {isSemVerMajor, version}.
+    this[_fixAvailable] = true
+    this.addAdvisory(advisory)
+    this.packument = advisory.packument
+    this.versions = advisory.versions
+  }
+
+  get fixAvailable () {
+    return this[_fixAvailable]
+  }
+
+  set fixAvailable (f) {
+    this[_fixAvailable] = f
+    // if there's a fix available for this at the top level, it means that
+    // it will also fix the vulns that led to it being there.  to get there,
+    // we set the vias to the most "strict" of fix availables.
+    // - false: no fix is available
+    // - {name, version, isSemVerMajor} fix requires -f, is semver major
+    // - {name, version} fix requires -f, not semver major
+    // - true: fix does not require -f
+    // TODO: duped entries may require different fixes but the current
+    // structure does not support this, so the case were a top level fix
+    // corrects a duped entry may mean you have to run fix more than once
+    for (const v of this.via) {
+      // don't blow up on loops
+      if (v.fixAvailable === f) {
+        continue
+      }
+
+      if (f === false) {
+        v.fixAvailable = f
+      } else if (v.fixAvailable === true) {
+        v.fixAvailable = f
+      } else if (typeof f === 'object' && (
+        typeof v.fixAvailable !== 'object' || !v.fixAvailable.isSemVerMajor)) {
+        v.fixAvailable = f
+      }
+    }
+  }
+
+  get isDirect () {
+    for (const node of this.nodes.values()) {
+      for (const edge of node.edgesIn) {
+        if (edge.from.isProjectRoot || edge.from.isWorkspace) {
+          return true
+        }
+      }
+    }
+    return false
+  }
+
+  testSpec (spec) {
+    const specObj = npa(spec)
+    if (!specObj.registry) {
+      return true
+    }
+
+    if (specObj.subSpec) {
+      spec = specObj.subSpec.rawSpec
+    }
+
+    for (const v of this.versions) {
+      if (satisfies(v, spec) && !satisfies(v, this.range, semverOpt)) {
+        return false
+      }
+    }
+    return true
+  }
+
+  toJSON () {
+    return {
+      name: this.name,
+      severity: this.severity,
+      isDirect: this.isDirect,
+      // just loop over the advisories, since via is only Vuln objects,
+      // and calculated advisories have all the info we need
+      via: [...this.advisories].map(v => v.type === 'metavuln' ? v.dependency : {
+        ...v,
+        versions: undefined,
+        vulnerableVersions: undefined,
+        id: undefined,
+      }).sort((a, b) =>
+        localeCompare(String(a.source || a), String(b.source || b))),
+      effects: [...this.effects].map(v => v.name).sort(localeCompare),
+      range: this.simpleRange,
+      nodes: [...this.nodes].map(n => n.location).sort(localeCompare),
+      fixAvailable: this[_fixAvailable],
+    }
+  }
+
+  addVia (v) {
+    this.via.add(v)
+    v.effects.add(this)
+    // call the setter since we might add vias _after_ setting fixAvailable
+    this.fixAvailable = this.fixAvailable
+  }
+
+  deleteVia (v) {
+    this.via.delete(v)
+    v.effects.delete(this)
+  }
+
+  deleteAdvisory (advisory) {
+    this.advisories.delete(advisory)
+    // make sure we have the max severity of all the vulns causing this one
+    this.severity = null
+    this[_range] = null
+    this[_simpleRange] = null
+    // refresh severity
+    for (const advisory of this.advisories) {
+      this.addAdvisory(advisory)
+    }
+
+    // remove any effects that are no longer relevant
+    const vias = new Set([...this.advisories].map(a => a.dependency))
+    for (const via of this.via) {
+      if (!vias.has(via.name)) {
+        this.deleteVia(via)
+      }
+    }
+  }
+
+  addAdvisory (advisory) {
+    this.advisories.add(advisory)
+    const sev = severities.get(advisory.severity)
+    this[_range] = null
+    this[_simpleRange] = null
+    if (sev > severities.get(this.severity)) {
+      this.severity = advisory.severity
+    }
+  }
+
+  get range () {
+    return this[_range] ||
+      (this[_range] = [...this.advisories].map(v => v.range).join(' || '))
+  }
+
+  get simpleRange () {
+    if (this[_simpleRange] && this[_simpleRange] === this[_range]) {
+      return this[_simpleRange]
+    }
+
+    const versions = [...this.advisories][0].versions
+    const range = this.range
+    const simple = simplifyRange(versions, range, semverOpt)
+    return this[_simpleRange] = this[_range] = simple
+  }
+
+  isVulnerable (node) {
+    if (this.nodes.has(node)) {
+      return true
+    }
+
+    const { version } = node.package
+    if (!version) {
+      return false
+    }
+
+    for (const v of this.advisories) {
+      if (v.testVersion(version)) {
+        this.nodes.add(node)
+        return true
+      }
+    }
+
+    return false
+  }
+}
+
+module.exports = Vuln