retire 1.1.2 → 1.1.6

package/README.md

@@ -21,17 +21,29 @@ Options:
 -n, --node              Run node dependency scan only
 -j, --js                Run scan of JavaScript files only
 -v, --verbose           Show identified files (by default only vulnerable files are shown)
+-x, --dropexternal      Don't include project provided vulnerability repository
+-c, --nocache           Don't use local cache
 
 --jspath <path>         Folder to scan for javascript files
 --nodepath <path>       Folder to scan for node files
 --path <path>           Folder to scan for both
---jsrepo <path>         Local version of repo
---noderepo <path>       Local version of repo
+--jsrepo <path|url>     Local or internal version of repo
+--noderepo <path|url>   Local or internal version of repo
 --proxy <url>           Proxy url (http://some.sever:8080)
+--outputformat <format> Valid formats: text, json
+--outputpath <path>     File to which output should be written
 --ignore <paths>        Comma delimited list of paths to ignore
 --ignorefile <path>     Custom .retireignore file, defaults to .retireignore
+--exitwith <code>       Custom exit code (default: 13) when vulnerabilities are found
 ````
 
+.retireignore 
+-------------
+````
+@qs                                                             # ignore this module regardless of location
+node_modules/connect/node_modules/body-parser/node_modules/qs   # ignore specific path
+````
+Due to a bug in ignore resolving, please upgrade to >= 1.1.3
 
 Source code / Reporting an issue
 --------------------------------

package/bin/retire

@@ -41,8 +41,8 @@ program
   .option('--jspath <path>', 'Folder to scan for javascript files')
   .option('--nodepath <path>', 'Folder to scan for node files')
   .option('--path <path>', 'Folder to scan for both')
-  .option('--jsrepo <path>', 'Local version of repo')
-  .option('--noderepo <path>', 'Local version of repo')
+  .option('--jsrepo <path|url>', 'Local or internal version of repo')
+  .option('--noderepo <path|url>', 'Local or internal version of repo')
   .option('--proxy <url>', 'Proxy url (http://some.sever:8080)')
   .option('--outputformat <format>', 'Valid formats: text, json')
   .option('--outputpath <path>', 'File to which output should be written')
@@ -77,7 +77,9 @@ if(config.ignorefile) {
 
 events.on('load-js-repo', function() {
   (config.jsrepo
-    ? repo.loadrepositoryFromFile(config.jsrepo, config)
+    ? (config.jsrepo.match(/^https?:\/\//)
+      ? repo.loadrepository(config.jsrepo, config)
+      : repo.loadrepositoryFromFile(config.jsrepo, config))
     : repo.loadrepository('https://raw.githubusercontent.com/RetireJS/retire.js/master/repository/jsrepository.json', config)
   ).on('done', function(repo) {
       jsRepo = repo;
@@ -88,7 +90,9 @@ events.on('load-js-repo', function() {
 
 events.on('load-node-repo', function() {
   (config.noderepo
-    ? repo.loadrepositoryFromFile(config.noderepo, config)
+    ? (config.noderepo.match(/^https?:\/\//)
+      ? repo.loadrepository(config.noderepo, config)
+      : repo.loadrepositoryFromFile(config.noderepo, config))
     : repo.loadrepository('https://raw.githubusercontent.com/RetireJS/retire.js/master/repository/npmrepository.json', config)
   ).on('done', function(repo) {
       nodeRepo = repo;

package/lib/retire.js

@@ -5,7 +5,7 @@
 
 
 var exports = exports || {};
-exports.version = '1.1.2';
+exports.version = '1.1.6';
 
 function isDefined(o) {
 	return typeof o !== 'undefined';
@@ -120,7 +120,7 @@ exports.check = function(component, version, repo) {
 };
 
 exports.replaceVersion = function(jsRepoJsonAsText) {
-	return jsRepoJsonAsText.replace(/§§version§§/g, '[0-9][0-9.a-z_\\\\-]+');
+	return jsRepoJsonAsText.replace(/§§version§§/g, '[0-9][0-9.a-z_\\\\-]+?');
 };
 
 exports.isVulnerable = function(results) {

package/lib/scanner.js

@@ -1,8 +1,8 @@
 var retire = require('./retire'),
-    _      = require('underscore'),
     fs     = require('fs'),
     crypto = require('crypto'),
     path   = require('path'),
+    _      = require('underscore'),
     log    = require('./utils').log,
     emitter   = new require('events').EventEmitter;
 
@@ -58,13 +58,17 @@ function printVulnerability(component, options) {
   return string;
 }
 
-function shouldIgnore(file, ignores) {
-  return _.detect(ignores, function(i) { return file.indexOf(i) === 0 || file.indexOf(path.resolve(i)) === 0; });
+function shouldIgnore(fileSpecs, ignores) {
+  return _.detect(ignores, function(i) {
+    return _.detect(fileSpecs, function(j) {
+      return j.indexOf(i) === 0 || j.indexOf(path.resolve(i)) === 0 ; 
+    });
+  });
 }
 
 
 function scanJsFile(file, repo, options) {
-  if (options.ignore && shouldIgnore(file, options.ignore)) {
+  if (options.ignore && shouldIgnore([file], options.ignore)) {
     return;
   }
   var results = retire.scanFileName(file, repo);
@@ -81,7 +85,7 @@ function printParent(comp, options) {
 
 function scanDependencies(dependencies, nodeRepo, options) {
   for (var i in dependencies) {
-    if (options.ignore && shouldIgnore(dependencies[i].component, options.ignore)) {
+    if (options.ignore && shouldIgnore([dependencies[i].component, toModulePath(dependencies[i])], options.ignore)) {
       continue;
     }
     results = retire.scanNodeDependency(dependencies[i], nodeRepo);
@@ -98,9 +102,22 @@ function scanDependencies(dependencies, nodeRepo, options) {
   }
 }
 
+function toModulePath(dep) {
+  function f(d) {
+    if (d.parent) return f(d.parent) + "/node_modules/" + d.component;
+    return "";
+  }
+  return path.resolve(f(dep).substring(1));
+}
+
+
+
 function scanBowerFile(file, repo, options) {
+  if (options.ignore && shouldIgnore([file], options.ignore)) {
+    return;
+  }
   try {
-  var bower = JSON.parse(fs.readFileSync(file));
+    var bower = JSON.parse(fs.readFileSync(file));
     if (bower.version) {
       var results = retire.check(bower.name, bower.version, repo);
       printResults(file, results, options);

package/package.json

@@ -2,7 +2,7 @@
   "author": "Erlend Oftedal <erlend@oftedal.no>",
   "name": "retire",
   "description": "Retire is a tool for detecting use of vulnerable libraries",
-  "version": "1.1.2",
+  "version": "1.1.6",
   "repository": {
     "type": "git",
     "url": "https://github.com/RetireJS/retire.js.git"
@@ -12,11 +12,11 @@
   },
   "main": "./lib/retire.js",
   "dependencies": {
-    "underscore"     : "1.7.x - 1.8.x",
-    "commander"	     : "2.5.x",
-    "read-installed" : "3.1.x",
-    "walkdir"        : "0.0.7",
-    "request"        : "~2.x.x"
+    "commander": "2.5.x",
+    "read-installed": "^4.0.3",
+    "request": "~2.x.x",
+    "underscore": "1.7.x - 1.8.x",
+    "walkdir": "0.0.7"
   },
   "devDependencies": {
     "nodeunit": "",