npq 3.10.1 → 3.11.0

package/__tests__/marshalls.snyk.test.js

@@ -1,294 +0,0 @@
-'use strict'
-
-const Marshall = require('../lib/marshalls/snyk.marshall.js')
-const { marshallCategories } = require('../lib/marshalls/constants')
-
-const fs = require('fs')
-const os = require('os')
-
-jest.mock('fs')
-jest.mock('os')
-
-os.homedir.mockReturnValue('/fake/home')
-fs.statSync.mockImplementation(() => {
-  throw new Error('File not found')
-})
-
-// Mock fetch globally
-global.fetch = jest.fn()
-
-const mockPackageRepoUtils = {
-  getLatestVersion: jest.fn().mockResolvedValue('1.0.0')
-}
-
-describe('Snyk Marshall', () => {
-  beforeEach(() => {
-    os.homedir.mockReturnValue('/fake/home')
-    fetch.mockClear()
-    mockPackageRepoUtils.getLatestVersion.mockClear()
-  })
-
-  describe('with Snyk token', () => {
-    const marshall = new Marshall({
-      packageRepoUtils: mockPackageRepoUtils
-    })
-    // Manually set the token for this test suite
-    marshall.snykApiToken = 'fake-snyk-token'
-
-    it('has the right title', () => {
-      expect(marshall.title()).toBe('Checking for known vulnerabilities')
-    })
-
-    it('should throw an error if vulnerabilities are found', async () => {
-      fetch.mockResolvedValueOnce({
-        ok: true,
-        json: () =>
-          Promise.resolve({
-            vulnerabilities: [{ title: 'XSS' }, { title: 'CSRF' }],
-            isMaliciousPackage: false
-          })
-      })
-
-      const pkg = { packageName: 'test-pkg', packageVersion: '1.0.0' }
-      await expect(marshall.validate(pkg)).rejects.toThrow(
-        '2 vulnerable path(s) found: https://snyk.io/vuln/npm:test-pkg'
-      )
-    })
-
-    it('should throw a specific error for malicious packages', async () => {
-      fetch.mockResolvedValueOnce({
-        ok: true,
-        json: () =>
-          Promise.resolve({
-            vulnerabilities: [{ title: 'Malicious Package' }],
-            isMaliciousPackage: true
-          })
-      })
-
-      const pkg = { packageName: 'malicious-pkg', packageVersion: '1.0.0' }
-      await expect(marshall.validate(pkg)).rejects.toThrow(
-        'Malicious package found: https://snyk.io/vuln/npm:malicious-pkg'
-      )
-    })
-
-    it('should pass if no vulnerabilities are found', async () => {
-      fetch.mockResolvedValueOnce({
-        ok: true,
-        json: () =>
-          Promise.resolve({
-            vulnerabilities: [],
-            isMaliciousPackage: false
-          })
-      })
-
-      const pkg = { packageName: 'clean-pkg', packageVersion: '1.0.0' }
-      await expect(marshall.validate(pkg)).resolves.not.toThrow()
-    })
-
-    it('should throw an error if the Snyk API request fails', async () => {
-      fetch.mockResolvedValueOnce({
-        ok: false,
-        status: 500
-      })
-
-      const pkg = { packageName: 'test-pkg', packageVersion: '1.0.0' }
-      await expect(marshall.validate(pkg)).rejects.toThrow(
-        'Snyk API request failed with status 500'
-      )
-    })
-
-    it('should throw an error if Snyk API provides no vulnerability info', async () => {
-      fetch.mockResolvedValueOnce({
-        ok: true,
-        json: () => Promise.resolve({ message: 'no vulns here' }) // No 'vulnerabilities' property
-      })
-
-      const pkg = { packageName: 'test-pkg', packageVersion: '1.0.0' }
-      // This will cause getSnykVulnInfo to return `false`, which makes validate throw
-      await expect(marshall.validate(pkg)).rejects.toThrow(
-        'Unable to query vulnerabilities for packages'
-      )
-    })
-
-    it('should use latest version if packageVersion is not defined', async () => {
-      fetch.mockResolvedValueOnce({
-        ok: true,
-        json: () =>
-          Promise.resolve({
-            vulnerabilities: [],
-            isMaliciousPackage: false
-          })
-      })
-
-      const pkg = { packageName: 'test-pkg' }
-      await marshall.validate(pkg)
-
-      expect(mockPackageRepoUtils.getLatestVersion).toHaveBeenCalledWith('test-pkg')
-    })
-  })
-
-  describe('without Snyk token (fallback to OSV)', () => {
-    const marshall = new Marshall({
-      packageRepoUtils: mockPackageRepoUtils
-    })
-    // Ensure no token is set
-    marshall.snykApiToken = null
-
-    it('should throw an error if vulnerabilities are found by OSV', async () => {
-      fetch.mockResolvedValueOnce({
-        ok: true,
-        json: () => Promise.resolve({ vulns: [{ id: 'OSV-1' }, { id: 'OSV-2' }] })
-      })
-
-      const pkg = { packageName: 'test-pkg-osv', packageVersion: '1.0.0' }
-      await expect(marshall.validate(pkg)).rejects.toThrow(
-        '2 vulnerabilities found by OSV for test-pkg-osv'
-      )
-      expect(fetch).toHaveBeenCalledWith('https://api.osv.dev/v1/query', expect.any(Object))
-    })
-
-    it('should pass if no vulnerabilities are found by OSV', async () => {
-      fetch.mockResolvedValueOnce({
-        ok: true,
-        json: () => Promise.resolve({ vulns: [] })
-      })
-
-      const pkg = { packageName: 'clean-pkg-osv', packageVersion: '1.0.0' }
-      await expect(marshall.validate(pkg)).resolves.not.toThrow()
-    })
-
-    it('should handle an empty response from OSV', async () => {
-      fetch.mockResolvedValueOnce({
-        ok: true,
-        json: () => Promise.resolve({})
-      })
-
-      const pkg = { packageName: 'empty-res-pkg', packageVersion: '1.0.0' }
-      await expect(marshall.validate(pkg)).resolves.toEqual({
-        issuesCount: 0,
-        isMaliciousPackage: false
-      })
-    })
-
-    it('should handle OSV API fetch error', async () => {
-      fetch.mockRejectedValueOnce(new Error('Network error'))
-
-      const pkg = { packageName: 'fetch-err-pkg', packageVersion: '1.0.0' }
-      const result = await marshall.validate(pkg)
-
-      expect(result).toEqual({ issuesCount: 0, isMaliciousPackage: false })
-    })
-  })
-
-  describe('run method', () => {
-    const marshall = new Marshall({
-      packageRepoUtils: mockPackageRepoUtils
-    })
-
-    it('should call checkPackage for each package', async () => {
-      const ctx = {
-        pkgs: [
-          { packageName: 'pkg1', packageVersion: '1.0.0' },
-          { packageName: 'pkg2', packageVersion: '2.0.0' }
-        ]
-      }
-      const task = {}
-      marshall.checkPackage = jest.fn()
-
-      await marshall.run(ctx, task)
-
-      expect(marshall.checkPackage).toHaveBeenCalledTimes(2)
-      expect(marshall.checkPackage).toHaveBeenCalledWith(ctx.pkgs[0], ctx, task)
-      expect(marshall.checkPackage).toHaveBeenCalledWith(ctx.pkgs[1], ctx, task)
-    })
-  })
-
-  describe('getSnykToken', () => {
-    it('should return null if config file does not exist', () => {
-      fs.statSync.mockImplementation(() => {
-        throw new Error('ENOENT')
-      })
-
-      const marshall = new Marshall({
-        packageRepoUtils: mockPackageRepoUtils
-      })
-      marshall.snykApiToken = null // ensure no token
-      const token = marshall.getSnykToken()
-      expect(token).toBeNull()
-    })
-
-    it('should return null if config file exists but has no token', () => {
-      fs.statSync.mockReturnValueOnce({ isFile: () => true })
-      jest.doMock('/fake/home/.config/configstore/snyk.json', () => ({}), { virtual: true })
-
-      const marshall = new Marshall({
-        packageRepoUtils: mockPackageRepoUtils
-      })
-      marshall.snykApiToken = null // ensure no token
-      const token = marshall.getSnykToken()
-      expect(token).toBeNull()
-    })
-
-    it('should return the token if the config file exists and has a token', () => {
-      fs.statSync.mockImplementation(() => ({ isFile: () => true }))
-      fs.readFileSync.mockReturnValue(JSON.stringify({ api: 'a-real-token' }))
-
-      const marshall = new Marshall({
-        packageRepoUtils: mockPackageRepoUtils
-      })
-      marshall.snykApiToken = null // ensure no token
-      const token = marshall.getSnykToken()
-      expect(token).toBe('a-real-token')
-
-      // Reset mock to avoid affecting other tests
-      fs.statSync.mockImplementation(() => {
-        throw new Error('File not found')
-      })
-    })
-
-    it('should return null if config file is malformed', () => {
-      fs.statSync.mockImplementation(() => ({ isFile: () => true }))
-      fs.readFileSync.mockReturnValue('not a valid json')
-
-      const marshall = new Marshall({
-        packageRepoUtils: mockPackageRepoUtils
-      })
-      marshall.snykApiToken = null // ensure no token
-      const token = marshall.getSnykToken()
-      expect(token).toBeNull()
-    })
-
-    it('should return null if statSync returns falsy', () => {
-      fs.statSync.mockReturnValue(false)
-
-      const marshall = new Marshall({
-        packageRepoUtils: mockPackageRepoUtils
-      })
-      marshall.snykApiToken = null // ensure no token
-      const token = marshall.getSnykToken()
-      expect(token).toBeNull()
-    })
-  })
-
-  describe('getSnykToken with env var', () => {
-    const OLD_ENV = process.env
-
-    beforeEach(() => {
-      jest.resetModules() // Most important - it clears the cache
-      process.env = { ...OLD_ENV } // Make a copy
-    })
-
-    afterAll(() => {
-      process.env = OLD_ENV // Restore old environment
-    })
-
-    it('should return token from SNYK_TOKEN environment variable', () => {
-      process.env.SNYK_TOKEN = 'token-from-env'
-      const MarshallWithEnv = require('../lib/marshalls/snyk.marshall.js')
-      const marshall = new MarshallWithEnv({
-        packageRepoUtils: mockPackageRepoUtils
-      })
-      expect(marshall.getSnykToken()).toBe('token-from-env')
-    })
-  })
-})

package/__tests__/marshalls.tasks.test.js

@@ -1,130 +0,0 @@
-const path = require('path')
-const marshalls = require('../lib/marshalls')
-
-const PackageRepoUtilsMock = class Fake {
-  getPackageInfo() {
-    return Promise.resolve(true)
-  }
-}
-
-test('running marshall tasks succeeds', async () => {
-  marshalls.collectMarshalls = jest.fn(() => {
-    return Promise.resolve([path.join(process.cwd(), '__tests__/__fixtures__/test.marshall.js')])
-  })
-
-  const config = {
-    pkgs: [{ packageName: 'express' }, { packageName: 'semver' }],
-    packageRepoUtils: new PackageRepoUtilsMock()
-  }
-
-  const results = await marshalls.tasks(config)
-
-  expect(results[0]['test.marshall']).toEqual({
-    status: null,
-    errors: [],
-    warnings: [],
-    data: { express: 'mock data check', semver: 'mock data check' },
-    marshall: 'test.marshall',
-    categoryId: 'PackageHealth'
-  })
-})
-
-test('running marshall tasks fails', async () => {
-  marshalls.collectMarshalls = jest.fn(() => {
-    return Promise.resolve([path.join(process.cwd(), '__tests__/__fixtures__/test.marshall.js')])
-  })
-
-  const config = {
-    pkgs: [{ packageName: 'express' }, { packageName: 'dockly' }],
-    packageRepoUtils: new PackageRepoUtilsMock()
-  }
-
-  const mockedResults = [
-    {
-      'test.marshall': {
-        status: null,
-        errors: [{ pkg: 'dockly', message: 'simulating mock error' }],
-        warnings: [],
-        data: { express: 'mock data check' }
-      }
-    }
-  ]
-
-  await expect(marshalls.tasks(config)).resolves.toMatchObject(mockedResults)
-})
-
-test('running marshall tasks includes an error when single package is not found', async () => {
-  const PackageRepoUtilsNotFoundMock = class Fake {
-    getPackageInfo() {
-      return Promise.resolve({ error: 'Not found' })
-    }
-  }
-
-  marshalls.collectMarshalls = jest.fn(() => {
-    return Promise.resolve([path.join(process.cwd(), '__tests__/__fixtures__/test.marshall.js')])
-  })
-
-  const config = {
-    pkgs: [{ packageName: 'nonexistent-package' }],
-    packageRepoUtils: new PackageRepoUtilsNotFoundMock()
-  }
-
-  const mockedResults = [
-    {
-      not_found: {
-        status: null,
-        errors: [{ pkg: 'nonexistent-package', message: 'Package not found' }],
-        warnings: [],
-        data: {},
-        marshall: 'not_found',
-        categoryId: 'PackageHealth'
-      }
-    }
-  ]
-
-  await expect(marshalls.tasks(config)).resolves.toMatchObject(mockedResults)
-})
-
-test('running marshall tasks filters out not found packages when multiple packages provided', async () => {
-  const PackageRepoUtilsMixedMock = class Fake {
-    getPackageInfo(packageName) {
-      if (packageName === 'nonexistent-package') {
-        return Promise.resolve({ error: 'Not found' })
-      }
-      return Promise.resolve(true)
-    }
-  }
-
-  marshalls.collectMarshalls = jest.fn(() => {
-    return Promise.resolve([path.join(process.cwd(), '__tests__/__fixtures__/test.marshall.js')])
-  })
-
-  const config = {
-    pkgs: [
-      { packageName: 'express' },
-      { packageName: 'nonexistent-package' },
-      { packageName: 'semver' }
-    ],
-    packageRepoUtils: new PackageRepoUtilsMixedMock()
-  }
-
-  const result = await marshalls.tasks(config)
-
-  expect(result[0]['not_found']).toEqual({
-    status: null,
-    errors: [{ pkg: 'nonexistent-package', message: 'Package not found' }],
-    warnings: [],
-    data: {},
-    marshall: 'not_found',
-    categoryId: 'PackageHealth'
-  })
-
-  expect(result[1]['test.marshall']).toEqual({
-    status: null,
-    errors: [],
-    warnings: [],
-    data: { express: 'mock data check', semver: 'mock data check' },
-    marshall: 'test.marshall',
-    categoryId: 'PackageHealth'
-  })
-})

package/__tests__/marshalls.typosquatting.test.js

@@ -1,76 +0,0 @@
-const TyposquattingMarshall = require('../lib/marshalls/typosquatting.marshall')
-
-describe('Typosquatting Marshall', () => {
-  test('should remove duplicate entries from similar packages', async () => {
-    const typosquattingMarshall = new TyposquattingMarshall({
-      packageRepoUtils: {
-        isPackageInAllowList: jest.fn(() => {
-          return false // Simulate that the package is not in the allow list
-        })
-      }
-    })
-
-    // Create a test package that would match multiple similar packages
-    const pkg = {
-      packageName: 'ghtml' // This should match 'html' which appears multiple times in the data
-    }
-
-    try {
-      await typosquattingMarshall.validate(pkg)
-      // If no error is thrown, the test should fail
-      expect(true).toBe(false)
-    } catch (error) {
-      // Check that the error message doesn't contain duplicate entries
-      const errorMessage = error.message
-      expect(errorMessage).toContain('Potential typosquatting with popular package(s):')
-
-      // Extract the package names from the error message
-      const packagesList = errorMessage.split('popular package(s): ')[1]
-      const packages = packagesList.split(', ')
-
-      // Check that there are no duplicates
-      const uniquePackages = [...new Set(packages)]
-      expect(packages.length).toBe(uniquePackages.length)
-
-      // Verify that 'html' appears only once even though it exists multiple times in the data
-      const htmlCount = packages.filter((pkg) => pkg === 'html').length
-      expect(htmlCount).toBe(1)
-    }
-  })
-
-  test('should not report typosquatting for packages in top packages list', async () => {
-    const typosquattingMarshall = new TyposquattingMarshall({
-      packageRepoUtils: {
-        isPackageInAllowList: jest.fn(() => {
-          return true
-        })
-      }
-    })
-
-    // Test with a package that exists in the top packages list
-    const pkg = {
-      packageName: 'express' // This should be in the top packages list
-    }
-
-    const result = await typosquattingMarshall.validate(pkg)
-    expect(result).toEqual([])
-  })
-
-  test('should not report typosquatting for packages with no similar matches', async () => {
-    const typosquattingMarshall = new TyposquattingMarshall({
-      packageRepoUtils: {
-        isPackageInAllowList: jest.fn(() => {
-          return false // Simulate that the package is not in the allow list
-        })
-      }
-    })
-
-    // Test with a package that has no similar matches
-    const pkg = {
-      packageName: 'verylonganduniquenamethatdoesnotmatchanything'
-    }
-
-    const result = await typosquattingMarshall.validate(pkg)
-    expect(result).toEqual([])
-  })
-})

package/__tests__/marshalls.version-maturity.test.js

@@ -1,194 +0,0 @@
-'use strict'
-
-const Marshall = require('../lib/marshalls/version-maturity.marshall')
-
-describe('Version Maturity Marshall', () => {
-  test('should have the correct title', () => {
-    const testMarshall = new Marshall({
-      packageRepoUtils: null
-    })
-
-    expect(testMarshall.title()).toEqual('Checking version maturity')
-  })
-
-  test('should throw error for recently published version (same day)', async () => {
-    const now = new Date()
-    const hoursAgo = new Date(now.getTime() - 2 * 60 * 60 * 1000) // 2 hours ago
-
-    const testMarshall = new Marshall({
-      packageRepoUtils: {
-        getPackageInfo: () => {
-          return Promise.resolve({
-            time: {
-              '1.0.0': hoursAgo.toISOString()
-            }
-          })
-        },
-        getSemVer: () => Promise.resolve('1.0.0')
-      }
-    })
-
-    await expect(
-      testMarshall.validate({
-        packageName: 'test-package',
-        packageVersion: '1.0.0'
-      })
-    ).rejects.toThrow(
-      'Detected a recently published version (published 2 hours ago) - consider waiting for community review'
-    )
-  })
-
-  test('should throw error for recently published version (within threshold)', async () => {
-    const now = new Date()
-    const daysAgo = new Date(now.getTime() - 3 * 24 * 60 * 60 * 1000) // 3 days ago
-
-    const testMarshall = new Marshall({
-      packageRepoUtils: {
-        getPackageInfo: () => {
-          return Promise.resolve({
-            time: {
-              '1.0.0': daysAgo.toISOString()
-            }
-          })
-        },
-        getSemVer: () => Promise.resolve('1.0.0')
-      }
-    })
-
-    await expect(
-      testMarshall.validate({
-        packageName: 'test-package',
-        packageVersion: '1.0.0'
-      })
-    ).rejects.toThrow(
-      'Detected a recently published version (published 3 days ago) - consider waiting for community review'
-    )
-  })
-
-  test('should throw error for version published exactly 1 day ago', async () => {
-    const now = new Date()
-    const oneDayAgo = new Date(now.getTime() - 24 * 60 * 60 * 1000) // 1 day ago
-
-    const testMarshall = new Marshall({
-      packageRepoUtils: {
-        getPackageInfo: () => {
-          return Promise.resolve({
-            time: {
-              '1.0.0': oneDayAgo.toISOString()
-            }
-          })
-        },
-        getSemVer: () => Promise.resolve('1.0.0')
-      }
-    })
-
-    await expect(
-      testMarshall.validate({
-        packageName: 'test-package',
-        packageVersion: '1.0.0'
-      })
-    ).rejects.toThrow(
-      'Detected a recently published version (published 1 day ago) - consider waiting for community review'
-    )
-  })
-
-  test('should pass for version published beyond threshold', async () => {
-    const now = new Date()
-    const weekAgo = new Date(now.getTime() - 8 * 24 * 60 * 60 * 1000) // 8 days ago
-
-    const testMarshall = new Marshall({
-      packageRepoUtils: {
-        getPackageInfo: () => {
-          return Promise.resolve({
-            time: {
-              '1.0.0': weekAgo.toISOString()
-            }
-          })
-        },
-        getSemVer: () => Promise.resolve('1.0.0')
-      }
-    })
-
-    const result = await testMarshall.validate({
-      packageName: 'test-package',
-      packageVersion: '1.0.0'
-    })
-
-    expect(result).toEqual({
-      packageName: 'test-package',
-      packageVersion: '1.0.0'
-    })
-  })
-
-  test('should throw error when package time information is missing', async () => {
-    const testMarshall = new Marshall({
-      packageRepoUtils: {
-        getPackageInfo: () => {
-          return Promise.resolve({})
-        },
-        getSemVer: () => Promise.resolve('1.0.0')
-      }
-    })
-
-    await expect(
-      testMarshall.validate({
-        packageName: 'test-package',
-        packageVersion: '1.0.0'
-      })
-    ).rejects.toThrow('Could not determine package version information')
-  })
-
-  test('should throw error when version release date is missing', async () => {
-    const testMarshall = new Marshall({
-      packageRepoUtils: {
-        getPackageInfo: () => {
-          return Promise.resolve({
-            time: {
-              '2.0.0': new Date().toISOString()
-            }
-          })
-        },
-        getSemVer: () => Promise.resolve('1.0.0')
-      }
-    })
-
-    await expect(
-      testMarshall.validate({
-        packageName: 'test-package',
-        packageVersion: '1.0.0'
-      })
-    ).rejects.toThrow('Could not determine release date for version 1.0.0')
-  })
-
-  test('should handle version aliases correctly', async () => {
-    const now = new Date()
-    const daysAgo = new Date(now.getTime() - 2 * 24 * 60 * 60 * 1000) // 2 days ago
-
-    const testMarshall = new Marshall({
-      packageRepoUtils: {
-        getPackageInfo: () => {
-          return Promise.resolve({
-            time: {
-              '1.2.3': daysAgo.toISOString()
-            }
-          })
-        },
-        getSemVer: (packageName, packageVersion) => {
-          if (packageVersion === 'latest') {
-            return Promise.resolve('1.2.3')
-          }
-          return Promise.resolve(packageVersion)
-        }
-      }
-    })
-
-    await expect(
-      testMarshall.validate({
-        packageName: 'test-package',
-        packageVersion: 'latest'
-      })
-    ).rejects.toThrow(
-      'Detected a recently published version (published 2 days ago) - consider waiting for community review'
-    )
-  })
-})