retire 1.5.1 → 1.6.3

package/bin/retire

@@ -48,6 +48,7 @@ program
   .option('--path <path>', 'Folder to scan for both')
   .option('--jsrepo <path|url>', 'Local or internal version of repo')
   .option('--noderepo <path|url>', 'Local or internal version of repo')
+  .option('--cachedir <path>', 'Path to use for local cache instead of /tmp/.retire-cache')
   .option('--proxy <url>', 'Proxy url (http://some.sever:8080)')
   .option('--outputformat <format>', 'Valid formats: text, json')
   .option('--outputpath <path>', 'File to which output should be written')
@@ -61,13 +62,14 @@ program
 var config = utils.extend({ path: '.' }, utils.pick(program, [
   'package', 'node', 'js', 'jspath', 'verbose', 'nodepath', 'path', 'jsrepo', 'noderepo',
   'dropexternal', 'nocache', 'proxy', 'ignore', 'ignorefile', 'outputformat', 'outputpath',
-  'severity', 'exitwith', 'includemeta'
+  'severity', 'exitwith', 'includemeta', 'cachedir'
 ]));
 var scanStart = Date.now();
 
-if (!config.nocache) {
+if (!config.nocache && !config.cachedir) {
   config.cachedir = path.resolve(os.tmpdir(), '.retire-cache/');
 }
+
 config.ignore = config.ignore ? utils.map(config.ignore.split(','), function(e) { return path.resolve(e); }) : [];
 config.ignore = { paths : config.ignore, descriptors: [] };
 
@@ -111,8 +113,8 @@ if(config.ignorefile) {
 
 scanner.on('vulnerable-dependency-found', function(result) {
   vulnsFound = true;
-  var levels = result.results.map(function(r) { return r.vulnerabilities ? r.vulnerabilities.map(function(v) { return severityLevels[v.severity || 'critical'] })  : [] });
-  var severity = utils.flatten(levels).reduce(function(x,y) { return x > y ? x : y});
+  var levels = result.results.map(function(r) { return r.vulnerabilities ? r.vulnerabilities.map(function(v) { return severityLevels[v.severity || 'critical']; })  : []; });
+  var severity = utils.flatten(levels).reduce(function(x,y) { return x > y ? x : y; });
   if(severity >= severityLevels[config.severity]) {
     failProcess = true;
   }

package/lib/repo.js

@@ -46,14 +46,22 @@ function loadFromCache(url, cachedir, options) {
     var cache = fs.existsSync(cacheIndex) ? JSON.parse(fs.readFileSync(cacheIndex)) : {};
     var now = new Date().getTime();
     if (cache[url]) {
-        if (now - cache[url].date < 60*60*1000) {
-            log(options).info("Loading from cache: " + url);
-            return loadJsonFromFile(path.resolve(cachedir, cache[url].file), options);
-        } else {
-            if (fs.existsSync(path.resolve(cachedir, cache[url].date + '.json'))) {
-                fs.unlinkSync(path.resolve(cachedir, cache[url].date + '.json'));
+      if (now - cache[url].date < 60*60*1000) {
+        log(options).info("Loading from cache: " + url);
+        return loadJsonFromFile(path.resolve(cachedir, cache[url].file), options);
+      } else {
+        if (fs.existsSync(path.resolve(cachedir, cache[url].date + '.json'))) {
+          try {
+            fs.unlinkSync(path.resolve(cachedir, cache[url].date + '.json'));
+          } catch (error) {
+            if (error.code !== 'ENOENT') {
+              throw error;
+            } else {
+              console.warn("Could not delete cache. Ignore this error if you are running multiple retire.js in parallel");
             }
+          }
         }
+      }
     }
     var events = new emitter();
     loadJson(url, options).on('done', function(data) {

package/lib/retire.js

@@ -4,7 +4,7 @@
  */
 
 var exports = exports || {};
-exports.version = '1.5.1';
+exports.version = '1.6.3';
 
 function isDefined(o) {
 	return typeof o !== 'undefined';
@@ -28,6 +28,7 @@ function scan(data, extractor, repo, matcher) {
 		for (var i in extractors) {
 			var match = matcher(extractors[i], data);
 			if (match) {
+				match = match.replace(/(\.|-)min$/, "");
 				detected.push({ version: match, component: component, detection: extractor });
 			}
 		}
@@ -52,6 +53,13 @@ function replacementMatch(regex, data) {
 	return null;
 }
 
+function splitAndMatchAll(tokenizer) {
+	return function(regex, data) {
+		var elm = data.split(tokenizer).pop();
+		return simpleMatch('^' + regex + '$', elm);
+	};
+}
+
 
 function scanhash(hash, repo) {
 	for (var component in repo) {
@@ -146,7 +154,7 @@ exports.scanUri = function(uri, repo) {
 };
 
 exports.scanFileName = function(fileName, repo) {
-	var result = scan(fileName, 'filename', repo);
+	var result = scan(fileName, 'filename', repo, splitAndMatchAll('/'));
 	return check(result, repo);
 };
 

package/package.json

@@ -2,7 +2,7 @@
   "author": "Erlend Oftedal <erlend@oftedal.no>",
   "name": "retire",
   "description": "Retire is a tool for detecting use of vulnerable libraries",
-  "version": "1.5.1",
+  "version": "1.6.3",
   "repository": {
     "type": "git",
     "url": "https://github.com/RetireJS/retire.js.git"

package/.npmignore

@@ -1,2 +0,0 @@
-spec
-test