retire 3.0.2

package/CHANGELOG.md

@@ -0,0 +1,67 @@
+# Changelog
+
+## [3.0.1]
+
+### Dependency update
+- always output JSON to stdout, to avoid conflict with deprecation warning
+
+## [3.0.1]
+
+### Dependency update
+- glob-parent, lodash and hosted-git-info had vulnerabilities and was updated
+
+## [3.0.0]
+
+### Deprecation notice
+- The node scanner is deprecated: https://github.com/RetireJS/retire.js/wiki/Deprecating-the-node.js-scanner
+
+## [2.2.5]
+
+### Dependency update
+- y18n had a vulnerability and was updated
+
+## [2.2.4]
+
+### Bugfix
+- Fixes [#343](https://github.com/RetireJS/retire.js/pull/343) where symlink to nonexistent file causes it to crash with exception. Now it will log it as warn instead.
+
+## [2.2.3]
+
+### Bugfix
+- Fixes [#337](https://github.com/RetireJS/retire.js/issues/337) where symlinks are not read
+
+
+## [2.2.2]
+
+### Bugfix
+- Fixes [#334](https://github.com/RetireJS/retire.js/issues/334) where detected libraries without vulnerabilities show in output even when verbose is not specified
+
+
+## [2.2.1]
+
+### Bugfix
+- Fixes [#321](https://github.com/RetireJS/retire.js/issues/321) where write output to file did not always work as expected
+
+## [2.2.0] 
+
+### Added
+- Support `--cacert <path>` or `--insecure` when loading the repos (thanks to [adamcohen](https://github.com/adamcohen)) [PR#322](https://github.com/RetireJS/retire.js/pull/322)
+
+
+## [2.1.1] - 2020-03-20
+
+### Bugfix
+- Fix compatibility with node 6
+
+
+## [2.1.1] - 2020-03-16
+
+### Modified
+- Remove `request` as it is deprecated
+
+
+## [2.1.0] - 2020-03-16
+
+### Modified
+- Support ** and * in ignore paths (** = any number of folders)
+

package/README.md

@@ -0,0 +1,80 @@
+Command line scanner looking for use of known vulnerable js files and node modules in web projects and/or node projects.
+
+Install
+-------
+
+    npm install -g retire
+
+
+Usage
+-----
+
+````
+Usage: retire [options]
+
+Options:
+
+  -h, --help               output usage information
+  -V, --version            output the version number
+
+  -p, --package            limit node scan to packages where parent is mentioned in package.json (ignore node_modules)
+  -n, --node               Run node dependency scan only
+  -j, --js                 Run scan of JavaScript files only
+  -v, --verbose            Show identified files (by default only vulnerable files are shown)
+  -x, --dropexternal       Don't include project provided vulnerability repository
+  -c, --nocache            Don't use local cache
+
+  --jspath <path>          Folder to scan for javascript files
+  --nodepath <path>        Folder to scan for node files
+  --path <path>            Folder to scan for both
+  --jsrepo <path|url>      Local or internal version of repo
+  --noderepo <path|url>    Local or internal version of repo
+  --cachedir <path>        Path to use for local cache instead of /tmp/.retire-cache
+  --proxy <url>            Proxy url (http://some.sever:8080)
+  --outputformat <format>  Valid formats: text, json, jsonsimple, depcheck (experimental) and cyclonedx
+  --outputpath <path>      File to which output should be written
+  --ignore <paths>         Comma delimited list of paths to ignore
+  --ignorefile <path>      Custom ignore file, defaults to .retireignore / .retireignore.json
+  --severity <level>       Specify the bug severity level from which the process fails. Allowed levels none, low, medium, high, critical. Default: none
+  --exitwith <code>        Custom exit code (default: 13) when vulnerabilities are found
+  --colors                 Enable color output (console output only)
+  --insecure               Enable fetching remote jsrepo/noderepo files from hosts using an insecure or self-signed SSL (TLS) certificate
+  --cacert <path>          Use the specified certificate file to verify the peer used for fetching remote jsrepo/noderepo files
+````
+
+The `depcheck` output format mimics the output of OWASP Dependency Check, but lacks some information compared to OWASP Dependency Check, because that information is not in the repo.
+The `cyclonedx` output format is based on based on the https://github.com/CycloneDX spec.
+
+.retireignore
+-------------
+````
+@qs                                                             # ignore this module regardless of location
+node_modules/connect/node_modules/body-parser/node_modules/qs   # ignore specific path
+````
+Due to a bug in ignore resolving, please upgrade to >= 1.1.3
+
+.retireignore.json
+------------------
+````
+[
+	{
+		"component": "jquery",
+		"identifiers" : { "issue": "2432"},
+		"justification" : "We dont call external resources with jQuery"
+	},
+	{
+		"component": "jquery",
+		"version" : "2.1.4",
+		"justification" : "We dont call external resources with jQuery"
+	},
+	{
+		"path" : "node_modules",
+		"justification" : "The node modules are only used for building - client side dependencies are using bower"
+	}
+
+]
+````
+
+Source code / Reporting an issue
+--------------------------------
+The source code and issue tracker can be found at [https://github.com/RetireJS/retire.js](https://github.com/RetireJS/retire.js)

package/bin/retire

@@ -0,0 +1,240 @@
+#!/usr/bin/env node
+/*jshint esversion: 6 */
+
+var utils     = require('../lib/utils'),
+    program   = require('commander'),
+    retire    = require('../lib/retire'),
+    repo      = require('../lib/repo'),
+    resolve   = require('../lib/resolve'),
+    scanner   = require('../lib/scanner'),
+    reporting = require('../lib/reporting'),
+    forward   = require('../lib/utils').forwardEvent,
+    os        = require('os'),
+    path      = require('path'),
+    fs        = require('fs'),
+    colors    = require('colors/safe'),
+    emitter   = new require('events').EventEmitter;
+
+var events = new emitter();
+var jsRepo = null;
+var bowerRepo = null;
+var nodeRepo = null;
+var vulnsFound = false;
+var failProcess = false;
+var defaultIgnoreFiles = ['.retireignore', '.retireignore.json'];
+var finalResults = [];
+
+var severityLevels = {
+  none: 0,
+  low: 1,
+  medium: 2,
+  high: 3,
+  critical: 4
+};
+
+colors.setTheme({
+  warn: 'red'
+});
+
+
+/*
+ * Parse command line flags.
+ */
+program
+  .version(retire.version)
+  .option('')
+  .option('-p, --package', 'limit node scan to packages where parent is mentioned in package.json (ignore node_modules)')
+  .option('-n, --node',    'Run node dependency scan only')
+  .option('-j, --js',      'Run scan of JavaScript files only')
+  .option('-v, --verbose', 'Show identified files (by default only vulnerable files are shown)')
+  .option('-x, --dropexternal', "Don't include project provided vulnerability repository")
+  .option('-c, --nocache', "Don't use local cache")
+  .option('')
+  .option('--jspath <path>', 'Folder to scan for javascript files')
+  .option('--nodepath <path>', 'Folder to scan for node files')
+  .option('--path <path>', 'Folder to scan for both')
+  .option('--jsrepo <path|url>', 'Local or internal version of repo')
+  .option('--noderepo <path|url>', 'Local or internal version of repo')
+  .option('--cachedir <path>', 'Path to use for local cache instead of /tmp/.retire-cache')
+  .option('--proxy <url>', 'Proxy url (http://some.sever:8080)')
+  .option('--outputformat <format>', 'Valid formats: text, json, jsonsimple, depcheck (experimental) and cyclonedx')
+  .option('--outputpath <path>', 'File to which output should be written')
+  .option('--ignore <paths>', 'Comma delimited list of paths to ignore')
+  .option('--ignorefile <path>', 'Custom ignore file, defaults to .retireignore / .retireignore.json')
+  .option('--severity <level>', 'Specify the bug severity level from which the process fails. Allowed levels none, low, medium, high, critical. Default: none')
+  .option('--exitwith <code>', 'Custom exit code (default: 13) when vulnerabilities are found')
+  .option('--colors', 'Enable color output (console output only)')
+  .option('--insecure', 'Enable fetching remote jsrepo/noderepo files from hosts using an insecure or self-signed SSL (TLS) certificate')
+  .option('--cacert <path>', 'Use the specified certificate file to verify the peer used for fetching remote jsrepo/noderepo files')
+  .parse(process.argv);
+
+var config = utils.extend({ path: '.' }, utils.pick(program, [
+  'package', 'node', 'js', 'jspath', 'verbose', 'nodepath', 'path', 'jsrepo', 'noderepo',
+  'dropexternal', 'nocache', 'proxy', 'ignore', 'ignorefile', 'outputformat', 'outputpath',
+  'severity', 'exitwith', 'colors', 'includemeta', 'cachedir', 'insecure', 'cacert'
+]));
+
+if (!config.nocache && !config.cachedir) {
+  config.cachedir = path.resolve(os.tmpdir(), '.retire-cache/');
+}
+
+config.ignore = config.ignore ? utils.map(config.ignore.split(','), function(e) { return path.resolve(e); }) : [];
+config.ignore = { paths : config.ignore, descriptors: [] };
+config.colorwarn = config.colors ? colors.warn : x => x;
+
+if (!config.ignorefile) {
+  config.ignorefile = defaultIgnoreFiles.filter(function(x){ return fs.existsSync(x); })[0];
+}
+var log = reporting.open(config);
+config.log = log;
+log.info("retire.js v" + retire.version);
+
+function exitWithError(msg) {
+  log.error(config.colorwarn(msg));
+  process.exitCode = 1;
+  log.close();
+}
+
+
+if(!config.severity) {
+  config.severity = 'none';
+} else if (!severityLevels.hasOwnProperty(config.severity)) {
+  exitWithError('Error: Invalid severity level (' + config.severity + '). Valid levels are: ' + Object.keys(severityLevels).join(', '));
+}
+
+if(config.cacert) {
+  if (!fs.existsSync(config.cacert)) {
+    exitWithError('Error: Could not read cacert file: ' + config.cacert);
+  }
+  config.cacertbuf = fs.readFileSync(config.cacert);
+}
+
+if(config.ignorefile) {
+  if (!fs.existsSync(config.ignorefile)) {
+    exitWithError('Error: Could not read ignore file: ' + config.ignorefile);
+  }
+  if (config.ignorefile.substr(-5) === ".json") {
+    try {
+      var ignored = JSON.parse(fs.readFileSync(config.ignorefile).toString());
+    } catch(e) {
+      exitWithError('Error: Invalid ignore file: ' + config.ignorefile, e);
+    }
+    config.ignore.descriptors = ignored;
+    var ignoredPaths = ignored
+      .map(function(x) { return x.path; })
+      .filter(function(x) { return x; });
+    config.ignore.paths = config.ignore.paths.concat(ignoredPaths);
+  } else {
+    var lines = fs.readFileSync(config.ignorefile).toString().split(/\r\n|\n/g).filter(function(e) { return e !== ''; });
+    ignored = utils.map(lines, function(e) { return e[0] === '@' ? e.slice(1) : path.resolve(e); });
+    config.ignore.paths = config.ignore.paths.concat(ignored);
+  }
+}
+config.ignore.paths = config.ignore.paths
+  .map(p => p.replace(/[.+?^${}()|[\]\\]/g, '\\$&'))
+  .map(p => p.replace(/[*]{1,2}/g, (a) => a.length == 2 ? ".*" : "[^/]*"))
+  .map(s => new RegExp(s)
+);
+
+scanner.on('vulnerable-dependency-found', function(result) {
+  vulnsFound = true;
+  var levels = result.results
+    .map(function(r) {
+      return r.vulnerabilities ? r.vulnerabilities.map(function(v) {
+        return severityLevels[v.severity || 'critical'];
+      }) : []; });
+  var severity = utils.flatten(levels).reduce(function(x,y) { return x > y ? x : y; });
+  if(severity >= severityLevels[config.severity]) {
+    failProcess = true;
+  }
+});
+
+scanner.on('vulnerable-dependency-found', log.logVulnerableDependency);
+scanner.on('dependency-found', log.logDependency);
+
+
+events.on('load-js-repo', function() {
+  (config.jsrepo ?
+    (config.jsrepo.match(/^https?:\/\//) ?
+      repo.loadrepository(config.jsrepo, config)
+      : repo.loadrepositoryFromFile(config.jsrepo, config))
+    : repo.loadrepository('https://raw.githubusercontent.com/RetireJS/retire.js/master/repository/jsrepository.json', config)
+  ).on('stop', forward(events, 'stop'))
+  .on('done', function(repo) {
+      jsRepo = repo;
+      events.emit('js-repo-loaded');
+  });
+});
+
+
+events.on('load-node-repo', function() {
+  (config.noderepo ?
+    (config.noderepo.match(/^https?:\/\//) ?
+      repo.loadrepository(config.noderepo, config)
+      : repo.loadrepositoryFromFile(config.noderepo, config))
+    : repo.loadrepository('https://raw.githubusercontent.com/RetireJS/retire.js/master/repository/npmrepository.json', config)
+  ).on('done', function(repo) {
+      nodeRepo = repo;
+      events.emit('node-repo-loaded');
+  }).on('stop', forward(events, 'stop'));
+});
+
+events.on('js-repo-loaded', function() {
+  events.emit(config.js ? 'scan-js' : 'load-node-repo');
+});
+
+events.on('node-repo-loaded', function() {
+  events.emit(config.node ? 'scan-node' : 'scan-js');
+});
+
+
+events.on('scan-js', function() {
+  resolve.scanJsFiles(config.jspath || config.path, config)
+    .on('jsfile', function(file) {
+      scanner.scanJsFile(file, jsRepo, config);
+    })
+    .on('bowerfile', function(bowerfile) {
+      bowerRepo = bowerRepo || repo.asbowerrepo(jsRepo);
+      scanner.scanBowerFile(bowerfile, bowerRepo, config);
+    })
+    .on('end', function() {
+      events.emit('js-scanned');
+    });
+});
+
+events.on('scan-node', function() {
+  console.warn('DEPRECATION NOTICE: The node scanning is deprecated and will be removed soon. See https://github.com/RetireJS/retire.js/wiki/Deprecating-the-node.js-scanner ')
+  resolve.getNodeDependencies(config.nodepath || config.path, config.package).on('done', function(dependencies) {
+    scanner.scanDependencies(dependencies, nodeRepo, config);
+    events.emit('scan-done');
+  }).on('error', function(err) {
+    console.warn("ERROR: " + err);
+    process.exit(1);
+  });
+});
+
+events.on('js-scanned', function() {
+  events.emit(!config.js ? 'scan-node' : 'scan-done');
+});
+
+events.on('scan-done', function() {
+  process.exitCode = failProcess ? (config.exitwith || 13) : 0;
+  log.close();
+});
+
+
+process.on('uncaughtException', function (err) {
+  console.warn('Exception caught: ', arguments);
+  console.warn(err.stack);
+  process.exit(1);
+});
+
+events.on('stop', function() {
+  exitWithError.apply(null, arguments);
+});
+
+if (config.node) {
+  events.emit('load-node-repo');
+} else {
+  events.emit('load-js-repo');
+}

package/lib/repo.js

@@ -0,0 +1,111 @@
+/* global require, exports */
+/*jshint esversion: 6 */
+var utils   = require('./utils'),
+    fs      = require('fs'),
+    path    = require('path'),
+    forward = require('../lib/utils').forwardEvent,
+    http    = require('http'),
+    https   = require('https'),
+    retire  = require('./retire'),
+    URL     = require('url'),
+    HttpsProxyAgent = require('https-proxy-agent');
+
+var emitter = require('events').EventEmitter;
+
+
+function loadJson(url, options) {
+  var events = new emitter();
+  options.log.info('Downloading ' + url + ' ...');
+  var reqOptions = Object.assign({}, URL.parse(url), { method: 'GET' });
+  if (options.proxy) {
+    reqOptions.agent = new HttpsProxyAgent(options.proxy);
+  }
+  if (options.insecure) {
+    reqOptions.rejectUnauthorized = false;
+  }
+  if (options.cacertbuf) {
+    reqOptions.ca = [ options.cacertbuf ];
+  }
+  var req = (url.startsWith("http:") ? http : https).request(reqOptions, function (res) {
+    if (res.statusCode != 200) return events.emit('stop', 'Error downloading: ' + url + ": HTTP " + res.statusCode + " " + res.statusText);
+    var data = [];
+    res.on('data', c => data.push(c));
+    res.on('end', () => {
+        var d = Buffer.concat(data).toString();
+        d = options.process ? options.process(d) : d;
+        events.emit('done', JSON.parse(d));
+    });
+  });
+  req.on('error', e => events.emit('stop', 'Error downloading: ' + url + ": " + e.toString()));
+  req.end();
+  return events;
+}
+
+function loadJsonFromFile(file, options) {
+  options.log.debug('Reading ' + file + ' ...');
+  var events = new emitter();
+  fs.readFile(file, { encoding : 'utf8'}, function(err, data) {
+    if (err) { return events.emit('stop', err.toString()); }
+    data = options.process ? options.process(data) : data;
+    var obj = JSON.parse(data);
+    events.emit('done', obj);
+  });
+  return events;
+}
+
+function loadFromCache(url, cachedir, options) {
+  var cacheIndex = path.resolve(cachedir, 'index.json');
+  if (!fs.existsSync(cachedir)) fs.mkdirSync(cachedir);
+  var cache = fs.existsSync(cacheIndex) ? JSON.parse(fs.readFileSync(cacheIndex)) : {};
+  var now = new Date().getTime();
+  if (cache[url]) {
+    if (now - cache[url].date < 60*60*1000) {
+      options.log.info('Loading from cache: ' + url);
+      return loadJsonFromFile(path.resolve(cachedir, cache[url].file), options);
+    } else {
+      if (fs.existsSync(path.resolve(cachedir, cache[url].date + '.json'))) {
+        try {
+          fs.unlinkSync(path.resolve(cachedir, cache[url].date + '.json'));
+        } catch (error) {
+          if (error.code !== 'ENOENT') {
+            throw error;
+          } else {
+            console.warn("Could not delete cache. Ignore this error if you are running multiple retire.js in parallel");
+          }
+        }
+      }
+    }
+  }
+  var events = new emitter();
+  loadJson(url, options).on('done', function(data) {
+    cache[url] = { date : now, file : now + '.json' };
+    fs.writeFileSync(path.resolve(cachedir, cache[url].file), JSON.stringify(data), { encoding : 'utf8' });
+    fs.writeFileSync(cacheIndex, JSON.stringify(cache), { encoding : 'utf8' });
+    events.emit('done', data);
+  }).on('stop', forward(events, 'stop'));
+  return events;
+}
+
+exports.asbowerrepo = function(jsRepo) {
+  var result = {};
+  Object.keys(jsRepo).map(function(k) {
+    (jsRepo[k].bowername || [k]).map(function(b) {
+      result[b] = result[b] || { vulnerabilities: [] };
+      result[b].vulnerabilities = result[b].vulnerabilities.concat(jsRepo[k].vulnerabilities);
+    });
+  });
+  return result;
+};
+
+exports.loadrepository = function(repoUrl, options) {
+  options = utils.extend(options, { process : retire.replaceVersion });
+  if (options.nocache) {
+    return loadJson(repoUrl, options);
+  }
+  return loadFromCache(repoUrl, options.cachedir, options);
+};
+
+exports.loadrepositoryFromFile = function(filepath, options) {
+  options = utils.extend(options, { process : retire.replaceVersion });
+  return loadJsonFromFile(filepath, options);
+};

package/lib/reporters/console.js

@@ -0,0 +1,43 @@
+var retire = require('../retire');
+var utils = require('../utils');
+
+
+function printResults(logger, finding, config) {
+  if (finding.results && finding.results.length > 0) {
+    var logFunc = retire.isVulnerable(finding.results) ? logger.warn : logger.info;
+    var printed = {};
+    finding.results.forEach(function(elm) {
+      if (!config.verbose && !retire.isVulnerable([elm])) return;
+      var key = elm.component + ' ' + elm.version;
+      logFunc(finding.file);
+      logFunc(' ' + String.fromCharCode(8627) + ' ' + key);
+      if (printed[key]) return;
+      if (retire.isVulnerable([elm])) {
+        logFunc(key + ' has known vulnerabilities:' + printVulnerability(logger, elm, config));
+      }
+      printed[key] = true;
+    });
+  }
+}
+
+function printVulnerability(logger, component, config) {
+  var string = '';
+  component.vulnerabilities.forEach(function(vulnerability){
+    string += config.outputformat === 'clean' ? '\n   ' : ' ';
+    if (vulnerability.severity) {
+      string += 'severity: ' + vulnerability.severity + '; ';
+    }
+    if (vulnerability.identifiers) {
+      string += utils.map(vulnerability.identifiers, function(id, name) {
+        return name + ': ' + utils.flatten([id]).join(' ');
+      }).join(', ') + '; ';
+    }
+    string += vulnerability.info.join(config.outputformat === 'clean' ? '\n' : ' ');
+  });
+  return string;
+}
+
+exports.configure = function(logger, writer, config, hash) {
+    logger.logDependency = function(finding) { if (config.verbose) printResults(logger, finding, config); };
+    logger.logVulnerableDependency = function(component) { printResults(logger, component, config); };
+};

package/lib/reporters/cyclonedx.js

@@ -0,0 +1,59 @@
+/*jshint esversion: 6 */
+
+var retire = require('../retire');
+var fs = require('fs');
+
+
+function configureCycloneDXLogger(logger, writer, config, hash) {
+	var vulnsFound = false;
+	var finalResults = { version: retire.version, start: new Date(), data: [], messages: [], errors: [] };
+	logger.info = finalResults.messages.push;
+	logger.debug = config.verbose ? finalResults.messages.push : function() {};
+	logger.warn = logger.error = finalResults.errors.push;
+	logger.logVulnerableDependency = function(finding) {
+		vulnsFound = true;
+		finalResults.data.push(finding);
+	};
+	logger.logDependency = function(finding) {
+		if (finding.results.length > 0) {
+		  finalResults.data.push(finding); 
+		}
+	};
+
+	logger.close = function(callback) {
+		var write = vulnsFound ? writer.err : writer.out;
+		finalResults.start = finalResults.start.toISOString().replace("Z", "+0000");
+		var seen = {};
+		var components = finalResults.data.filter(d => d.results).map(r => r.results.map(dep => {
+			dep.version = (dep.version.split(".").length >= 3 ? dep.version : dep.version + ".0").replace(/-/g, ".");
+			var filepath = r.file || dep.file;
+			var filename = filepath.split("/").slice(-1);
+			var file = fs.readFileSync(filepath);
+			var purl = `pkg:npm/${dep.component}@${dep.version}`;
+			if (seen[purl]) return '';
+			seen[purl] = true;
+			return `
+    <component type="library">
+      <name>${dep.component}</name>
+      <version>${dep.version}</version>
+      <hashes>
+        <hash alg="MD5">${hash.md5(file)}</hash>
+        <hash alg="SHA-1">${hash.sha1(file)}</hash>
+        <hash alg="SHA-256">${hash.sha256(file)}</hash>
+        <hash alg="SHA-512">${hash.sha512(file)}</hash>
+      </hashes>
+      <licenses><license></license></licenses>
+      <purl>${purl}</purl>
+      <modified>false</modified>
+    </component>`;
+    }).join("")).join("");
+		write(`<?xml version="1.0"?>
+<bom xmlns="http://cyclonedx.org/schema/bom/1.0" version="1">
+  <components>${components}
+  </components>
+</bom>`);
+		writer.close(callback); 
+	};
+}
+
+exports.configure = configureCycloneDXLogger;

package/lib/reporters/depcheck.js

@@ -0,0 +1,113 @@
+/*jshint esversion: 6 */
+
+var retire = require('../retire');
+var fs = require('fs');
+
+
+function configureDepCheckLogger(logger, writer, config, hash) {
+	var vulnsFound = false;
+	var finalResults = { version: retire.version, start: new Date(), data: [], messages: [], errors: [] };
+	logger.info = finalResults.messages.push;
+	logger.debug = config.verbose ? finalResults.messages.push : function() {};
+	logger.warn = logger.error = finalResults.errors.push;
+	logger.logVulnerableDependency = function(finding) {
+		vulnsFound = true;
+		finalResults.data.push(finding);
+	};
+	logger.logDependency = function(finding) { 
+		if (config.verbose && finding.results.length > 0) { 
+			finalResults.data.push(finding); 
+		} 
+	};
+
+	logger.close = function(callback) {
+		var write = vulnsFound ? writer.err : writer.out;
+		finalResults.start = finalResults.start.toISOString().replace("Z", "+0000");
+		write(`<?xml version="1.0"?>
+<analysis xmlns="https://jeremylong.github.io/DependencyCheck/dependency-check.2.3.xsd">
+  <scanInfo>
+    <engineVersion>${retire.version}</engineVersion>
+    <dataSource><name>${config.jsRepo || "Retire.js github js repo"}</name><timestamp>${finalResults.start}</timestamp></dataSource>
+    <dataSource><name>${config.nodeRepo || "Retire.js github node repo"}</name><timestamp>${finalResults.start}</timestamp></dataSource>
+   </scanInfo>
+   <projectInfo>
+   	<name>${config.path}</name>
+    <reportDate>${finalResults.start}</reportDate>
+    <credits>retire.js</credits>
+   </projectInfo>
+   <dependencies>`);
+		write(finalResults.data.filter(d => d.results).map(r => r.results.map((dep, i) => {
+			var filepath = r.file || dep.file;
+			var filename = filepath.split("/").slice(-1);
+			var file = fs.readFileSync(filepath);
+			var md5 = hash.md5(file);
+			var sha1 = hash.sha1(file);
+			var sha256 = hash.sha256(file);
+			var evidence = `
+        <evidence type="product" confidence="HIGH">
+          <source>file</source>
+          <name>name</name>
+          <value>${dep.component}</value>
+        </evidence>
+        <evidence type="version" confidence="HIGH">
+          <source>file</source>
+          <name>version</name>
+          <value>${dep.version}</value>
+        </evidence>`;
+			var identifiers = `
+        <package confidence="HIGH">
+          <description>(${dep.component}:${dep.version})</description>
+          <id>${i}</id>
+        </package>`;
+			var vulns = dep.vulnerabilities && dep.vulnerabilities.length > 0 ? dep.vulnerabilities.map(v => {
+				var references = v.info.map(i => `
+            <reference>
+              <source>Retire.js</source>
+              <url>${i}</url>
+              <name>${i}</name>
+            </reference>`).join("");
+				var id = [v.identifiers && v.identifiers.CVE && v.identifiers.CVE[0], v.identifiers && v.identifiers.issue, dep.component + '@' + v.info[0]]	
+					.filter(n => n !== null)[0];
+				//TODO: Fix CVSS stuff - add to repo? add id to every bug in repo?
+				return `
+        <vulnerability source="retire">
+          <name>${dep.component}:${dep.version}</name>
+          <cvssV2>
+            <score>7.5</score>
+            <accessVector>NETWORK</accessVector>
+            <accessComplexity>LOW</accessComplexity>
+            <authenticationr>NONE</authenticationr>
+            <confidentialImpact>PARTIAL</confidentialImpact>
+            <integrityImpact>PARTIAL</integrityImpact>
+            <availabilityImpact>PARTIAL</availabilityImpact>
+            <severity>${v.severity || "medium"}</severity>
+          </cvssV2>
+          <description>${v.identifiers && v.identifiers.summary || "None"}</description>
+          <references>${references}
+          </references>
+          <vulnerableSoftware>
+              <software>${ v.atOrAbove ? "&gt;= " + v.atOrAbove: "" } &lt; ${v.below}</software>
+          </vulnerableSoftware>
+        </vulnerability>`; 
+      }).join('') : "";
+      return `    <dependency>
+      <fileName>${filename}</fileName>
+      <filePath>${filepath}</filePath>
+      <md5>${md5}</md5>
+      <sha1>${sha1}</sha1>
+      <sha256>${sha256}</sha256>
+      <evidenceCollected>${evidence}
+      </evidenceCollected>
+      <identifiers>${identifiers}
+      </identifiers>
+      <vulnerabilities>${vulns}
+      </vulnerabilities>
+    </dependency>`; }).join("\n")).join("\n"));
+    write(`  </dependencies>
+</analysis>`);
+		writer.close(callback); 
+	};
+}
+
+
+exports.configure = configureDepCheckLogger;

package/lib/reporters/json.js

@@ -0,0 +1,29 @@
+/*jshint esversion: 6 */
+
+var retire = require('../retire');
+
+function configureJsonLogger(logger, writer, config) {
+	var scanStart = Date.now();
+	var vulnsFound = false;
+	var finalResults = { version: retire.version, start: new Date(), data: [], messages: [], errors: [] };
+	logger.info = finalResults.messages.push;
+	logger.debug = config.verbose ? finalResults.messages.push : function() {};
+	logger.warn = logger.error = (message) => finalResults.errors.push(message);
+	logger.logVulnerableDependency = function(finding) {
+		vulnsFound = true;
+		finalResults.data.push(finding);
+	};
+	logger.logDependency = function(finding) { 
+		if (config.verbose && finding.results.length > 0) { 
+			finalResults.data.push(finding); 
+		} 
+	};
+	logger.close = function(callback) {
+		finalResults.time = (Date.now() - scanStart)/1000;
+		var res = (config.outputformat === "jsonsimple") ? finalResults.data : finalResults;
+		writer.out(JSON.stringify(res));
+		writer.close(callback); 
+	};
+}
+
+exports.configure = configureJsonLogger;

package/lib/reporting.js

@@ -0,0 +1,93 @@
+/*jshint esversion: 6 */
+
+var retire = require('./retire');
+var utils = require('./utils');
+var fs = require('fs');
+var crypto = require('crypto');
+
+var loggers = {
+  console  : require("./reporters/console"),
+  text     : require("./reporters/console"),
+  json     : require("./reporters/json"),
+  depcheck : require("./reporters/depcheck"),
+  cyclonedx: require("./reporters/cyclonedx")
+};
+loggers.clean = loggers.console;
+loggers.jsonsimple = loggers.json;
+
+
+var colorwarn = function(x) { return x; };
+
+var verbose = false;
+
+function hashContent(hash, content) {
+  var h = crypto.createHash(hash);
+  h.update(content);
+  return h.digest('hex'); 
+}
+
+var hash = {
+  md5: (file) => hashContent('md5', file),
+  sha1: (file) => hashContent('sha1', file),
+  sha256: (file) => hashContent('sha256', file),
+  sha512: (file) => hashContent('sha512', file),
+};
+
+
+
+var writer = {
+  out: console.log,
+  err: function(x) { console.warn(colorwarn(x)); },
+  close : function() { }
+};
+
+var logger = {
+  info : function(x) { writer.out(x); },
+  debug : function(x) { if (verbose) writer.out(x); },
+  warn : function(x) { writer.err(x); },
+  error : function(x) { writer.err(x); },
+
+  logDependency : function(finding) { },
+  logVulnerableDependency: function(finding) { },
+  close: function() { writer.close(); }
+};
+
+
+
+function configureFileWriter(config) {
+  var fileOutput = {
+    fileDescriptor: fs.openSync(config.outputpath, "w")
+  };
+  if (fileOutput.fileDescriptor < 0) {
+    console.error("Could not open " + config.outputpath + " for writing");
+    process.exit(9);
+  } 
+  fileOutput.stream = fs.createWriteStream('', {fd: fileOutput.fileDescriptor, autoClose: false});
+  var writeToFile = function(message) {
+    fileOutput.stream.write(message);
+    fileOutput.stream.write('\n');
+  };
+  writer.out = writer.err = writeToFile;
+  writer.close = function() {
+    fileOutput.stream.on('finish', function() {
+      fs.closeSync(fileOutput.fileDescriptor);
+    });
+    fileOutput.stream.end();
+  };
+}
+
+exports.open = function(config) {
+  verbose = config.verbose;
+  if (config.colors) colorwarn = config.colorwarn;
+  var format = config.outputformat || "console";
+  if (Object.keys(loggers).indexOf(format) == -1) {
+    console.warn("Invalid outputformat: " + format);
+    process.exit(1);
+  }
+  loggers[format].configure(logger, writer, config, hash);
+
+  if (typeof config.outputpath === 'string') { 
+    configureFileWriter(config); 
+  }
+  return logger;
+};

package/lib/resolve.js

@@ -0,0 +1,101 @@
+/* global require, exports */
+
+var walkdir			= require('walkdir'),
+	fs						= require('fs'),
+	readInstalled	= require('read-installed'),
+	emitter				= require('events').EventEmitter;
+
+
+function listdep(parent, dep, level, deps) {
+	var stack = [];
+	var dedup = {};
+	stack.push({parent: parent, dep: dep, level: level}); 
+	while (typeof (o = stack.pop()) !== 'undefined') {
+		for (var i in o.dep.dependencies) {
+			cyclic = false;
+			dep_parent = o.parent;
+			while (typeof dep_parent !== 'undefined') {
+				if (dep_parent.component === i) {
+					cyclic = true;
+					break;
+				} else {
+					dep_parent = dep_parent.parent;
+				}
+			}
+			if (cyclic) {
+				continue;
+			}
+			var id = i + "@" + o.dep.dependencies[i].version;
+			if (dedup[id]) continue;
+			dedup[id] = true;
+			var d = { 
+				module: { component: i, version: o.dep.dependencies[i].version }
+			};
+			if (o.dep.dependencies[i].path) {
+				d.file = "node_modules" + o.dep.dependencies[i].path.split("node_modules").slice(1).join("node_modules") + '/package.json';
+			}
+			deps.push(d);
+			stack.push({parent: d, dep: o.dep.dependencies[i], level: o.level + 1}); 
+		}
+	}
+}
+
+function getNodeDependencies(path, limit) {
+	var events = new emitter();
+	readInstalled(path, {}, function (er, pkginfo) {
+		var deps = [];
+		if (limit) {
+			var packages = JSON.parse(fs.readFileSync(path +'/package.json'));
+			filter = [];			
+
+			var filter = packages.dependencies ? Object.keys(packages.dependencies) : [];
+
+			Object.keys(pkginfo.dependencies)
+				.filter(function(d) { return !pkginfo.dependencies[d]._requiredBy || pkginfo.dependencies[d]._requiredBy.indexOf("/") > -1 || pkginfo.dependencies[d]._requiredBy.indexOf("#DEV:/") > -1;  })
+				.filter(function(d) { return filter.indexOf(d) == -1; })
+				.forEach(function(d) { delete pkginfo.dependencies[d]; });
+		}
+		var notInstalled = Object.keys(pkginfo.dependencies).filter(function (d) {
+			return !pkginfo.dependencies[d].path;
+		});
+		if (notInstalled.length > 0) {
+			return events.emit('error', 'Could not find dependencies: ' + notInstalled.join(', ') + '. You may need to run npm install');
+		}
+		listdep({file: 'package.json',component: pkginfo.name, version: pkginfo.version}, pkginfo, 1, deps);
+		events.emit('done', deps);				
+	});
+	return events;
+}
+
+function scanJsFiles(path, options) {
+	var finder = walkdir.find(path, { "follow_symlinks" : false, "no_return": true });
+	function onFile(file){
+		if (file.match(/\.js$/)) {
+			finder.emit('jsfile', file);
+		}
+		if (file.match(/\/bower.json$/)) {
+			finder.emit('bowerfile', file);
+		}
+	}
+	finder.on('file', onFile);
+	finder.on('link', function(link) {		
+		if (fs.existsSync(link)) {
+			var file = fs.realpathSync(link);
+			if (fs.lstatSync(file).isFile()) {
+				onFile(link);
+			}
+		} else {
+			options.log.warn('Could not follow symlink: ' + link);
+		}
+	});
+	return finder;
+}
+
+exports.scanJsFiles = function(path, options) {
+	return scanJsFiles(path, options);
+};
+
+exports.getNodeDependencies = function(path, limit) {
+	return getNodeDependencies(path, limit);
+};
+

package/lib/retire.js

@@ -0,0 +1,184 @@
+/* 
+ * This file is used by the browser plugins and the Cli scanner and thus 
+ * cannot have any external dependencies (no require)	
+ */
+
+var exports = exports || {};
+exports.version = '3.0.0';
+
+function isDefined(o) {
+	return typeof o !== 'undefined';
+}
+
+function uniq(results){
+	var keys = {};
+	return results.filter(function(r) {
+		var k = r.component + ' ' + r.version;
+		keys[k] = keys[k] || 0;
+		return keys[k]++ === 0;
+	});
+}
+
+function scan(data, extractor, repo, matcher) {
+	matcher = matcher || simpleMatch;
+	var detected = [];
+	for (var component in repo) {
+		var extractors = repo[component].extractors[extractor];
+		if (!isDefined(extractors)) continue;
+		for (var i in extractors) {
+			var match = matcher(extractors[i], data);
+			if (match) {
+				match = match.replace(/(\.|-)min$/, "");
+				detected.push({ version: match, component: component, detection: extractor });
+			}
+		}
+	}
+	return uniq(detected);
+}
+
+function simpleMatch(regex, data) {
+	var re = new RegExp(regex);
+	var match = re.exec(data);
+	return match ? match[1] : null;
+}
+function replacementMatch(regex, data) {
+	var ar = /^\/(.*[^\\])\/([^\/]+)\/$/.exec(regex);
+	var re = new RegExp(ar[1]);
+	var match = re.exec(data);
+	var ver = null;
+	if (match) {
+		ver = match[0].replace(new RegExp(ar[1]), ar[2]);
+		return ver;
+	}
+	return null;
+}
+
+function splitAndMatchAll(tokenizer) {
+  return function(regex, data) {
+		var elm = data.split(tokenizer).pop();
+		return simpleMatch('^' + regex + '$', elm);
+  };
+}
+
+
+
+function scanhash(hash, repo) {
+	for (var component in repo) {
+		var hashes = repo[component].extractors.hashes;
+		if (!isDefined(hashes)) continue;
+		if (hashes.hasOwnProperty(hash)) {
+			return [{ version: hashes[hash], component: component, detection: 'hash' }];
+		}
+	}
+	return [];
+}
+
+
+
+function check(results, repo) {
+	for (var r in results) {
+		var result = results[r];
+		if (!isDefined(repo[result.component])) continue;
+		var vulns = repo[result.component].vulnerabilities;
+		for (var i in vulns) {
+			if (!isDefined(vulns[i].below) || !isAtOrAbove(result.version, vulns[i].below)) {
+				if (isDefined(vulns[i].atOrAbove) && !isAtOrAbove(result.version, vulns[i].atOrAbove)) {
+					continue;
+				}
+				var vulnerability = { info : vulns[i].info, below: vulns[i].below, atOrAbove: vulns[i].atOrAbove };
+				if (vulns[i].severity) {
+					vulnerability.severity = vulns[i].severity;
+				}
+				if (vulns[i].identifiers) {
+					vulnerability.identifiers = vulns[i].identifiers;
+				}
+				result.vulnerabilities = result.vulnerabilities || [];
+				result.vulnerabilities.push(vulnerability);
+			}
+		}
+	}
+	return results;
+}
+
+function unique(ar) {
+	var r = [];
+	ar.forEach(function(e) { 
+		if (r.indexOf(e) == -1) r.push(e);
+	});
+	return r;
+}
+
+
+function isAtOrAbove(version1, version2) {
+	var v1 = version1.split(/[\.\-]/g);
+	var v2 = version2.split(/[\.\-]/g);
+	var l = v1.length > v2.length ? v1.length : v2.length;
+	for (var i = 0; i < l; i++) {
+		var v1_c = toComparable(v1[i]);
+		var v2_c = toComparable(v2[i]);
+		if (typeof v1_c !== typeof v2_c) return typeof v1_c === 'number';
+		if (v1_c > v2_c) return true;
+		if (v1_c < v2_c) return false;
+	}
+	return true;
+}
+
+function toComparable(n) {
+	if (!isDefined(n)) return 0;
+	if (n.match(/^[0-9]+$/)) {
+		return parseInt(n, 10);
+	}
+	return n;
+}
+
+
+//------- External API -------
+
+exports.check = function(component, version, repo) {
+	return check([{component: component, version: version}], repo);
+};
+
+exports.replaceVersion = function(jsRepoJsonAsText) {
+	return jsRepoJsonAsText.replace(/§§version§§/g, '[0-9][0-9.a-z_\\\\-]+');
+};
+
+exports.isVulnerable = function(results) {
+	for (var r in results) {
+		if (results[r].hasOwnProperty('vulnerabilities')) return true;
+	}
+	return false;
+};
+
+exports.scanUri = function(uri, repo) {
+	var result = scan(uri, 'uri', repo);
+	return check(result, repo);
+};
+
+exports.scanFileName = function(fileName, repo) {
+	var result = scan(fileName, 'filename', repo, splitAndMatchAll('/'));
+	return check(result, repo);
+};
+
+exports.scanFileContent = function(content, repo, hasher) {
+	var normalizedContent = content.toString().replace(/(\r\n|\r)/g, "\n");
+	var result = scan(normalizedContent, 'filecontent', repo);
+	if (result.length === 0) {
+		result = scan(normalizedContent, 'filecontentreplace', repo, replacementMatch);
+	}
+	if (result.length === 0) {
+		result = scanhash(hasher.sha1(normalizedContent), repo);
+	}
+	return check(result, repo);
+};
+
+exports.scanNodeDependency = function(dependency, npmrepo, options) {
+	if (!isDefined(dependency.version)) {
+		if (options.log) options.log.warn('Missing version for ' + dependency.component + '. Need to run npm install ?');
+		return [];
+	}
+	if (!isDefined(npmrepo[dependency.component])) return [{component: dependency.component, version: dependency.version, file: dependency.file}];
+	return check([dependency], npmrepo);
+};
+
+
+

package/lib/scanner.js

@@ -0,0 +1,138 @@
+/*jshint esversion: 6 */
+var retire = require('./retire'),
+    fs     = require('fs'),
+    crypto = require('crypto'),
+    path   = require('path'),
+    utils  = require('./utils'),
+    emitter   = new require('events').EventEmitter;
+
+var events = new emitter();
+
+var hash = {
+  'sha1' : function(data) {
+    shasum   = crypto.createHash('sha1');
+    shasum.update(data);
+    return shasum.digest('hex');
+  }
+};
+
+function emitResults(finding, options) {
+  removeIgnored(finding.results, options.ignore);
+  if (!options.verbose) finding.results = finding.results.filter(f => retire.isVulnerable([f]));
+  if (finding.results.length == 0) return;
+  if (retire.isVulnerable(finding.results)) {
+    events.emit('vulnerable-dependency-found', finding);
+  } else {
+    events.emit('dependency-found', finding);
+  }
+
+}
+
+function shouldIgnorePath(fileSpecs, ignores) {
+  return utils.detect(ignores.paths, function(i) {
+    return utils.detect(fileSpecs, function(j) {
+      return i.test(j) || i.test(path.resolve(j)); 
+    });
+  });
+}
+
+function removeIgnored(results, ignores) {
+  if (!ignores.hasOwnProperty('descriptors')) return;
+  results.forEach(function(r) {
+    if (!r.hasOwnProperty('vulnerabilities')) return;
+    ignores.descriptors.forEach(function(i) {
+      if (r.component !== i.component) return;
+      if (i.version && r.version !== i.version) return;
+      if (i.severity && r.severity !== i.severity) return;
+      if (i.identifiers) {
+        removeIgnoredVulnerabilitiesByIdentifier(i.identifiers, r);
+        return;
+      }
+      r.vulnerabilities = [];
+    });
+    if (r.vulnerabilities.length === 0) delete r.vulnerabilities;
+  });
+}
+
+function removeIgnoredVulnerabilitiesByIdentifier(identifiers, result) {
+  result.vulnerabilities = result.vulnerabilities.filter(function(v) {
+    if (!v.hasOwnProperty("identifiers")) return true;
+    return !utils.every(identifiers, function(key, value) { return hasIdentifier(v, key, value); });
+  });
+}
+function hasIdentifier(vulnerability, key, value) {
+  if (!vulnerability.identifiers.hasOwnProperty(key)) return false;
+  var identifier = vulnerability.identifiers[key];
+  return Array.isArray(identifier) ? identifier.some(function(x) { return x === value; }) : identifier === value;
+}
+
+
+function scanJsFile(file, repo, options) {
+  if (options.ignore && shouldIgnorePath([file], options.ignore)) {
+    return;
+  }
+  var results = retire.scanFileName(file, repo);
+  if (!results || results.length === 0) {
+    results = retire.scanFileContent(fs.readFileSync(file), repo, hash);
+  }
+  emitResults({file: file, results: results}, options);
+}
+
+
+function scanDependencies(dependencies, nodeRepo, options) {
+  for (var i in dependencies) {
+    var dependency = dependencies[i];
+    var fileSpecs = [toModulePath(dependency)];
+    if (dependency.component) {
+      fileSpecs.push(dependency.component);
+    }
+
+    if (options.ignore && shouldIgnorePath(fileSpecs, options.ignore)) {
+      continue;
+    }
+    results = retire.scanNodeDependency(dependencies[i].module, nodeRepo, options);
+    emitResults({file: dependencies[i].file, results: results}, options);
+  }
+}
+
+function toModulePath(dep) {
+  function f(d) {
+    if (d.parent) return f(d.parent) + '/node_modules/' + d.component;
+    return '';
+  }
+  return path.resolve(f(dep).substring(1));
+}
+
+
+
+function scanBowerFile(file, repo, options) {
+  if (options.ignore && shouldIgnorePath([file], options.ignore)) {
+    return;
+  }
+  try {
+    var bower = JSON.parse(fs.readFileSync(file));
+    if (bower.version) {
+      var results = retire.check(bower.name, bower.version, repo);
+      emitResults({file: file, results: results}, options);
+    }
+  } catch (e) {
+    options.log.warn('Could not parse file: ' + file);
+  }
+}
+
+
+
+exports.scanDependencies = function(dependencies, nodeRepo, options) {
+  return scanDependencies(dependencies, nodeRepo, options);
+};
+exports.scanJsFile = function(file, repo, options) {
+  return scanJsFile(file, repo, options);
+};
+exports.scanBowerFile = function(file, repo, options) {
+  return scanBowerFile(file, repo, options);
+};
+exports.on = function(name, listener) {
+  events.on(name, listener);
+};
+
+

package/lib/utils.js

@@ -0,0 +1,57 @@
+
+function info(options) {
+	return function(message) {
+		(options.logger || console.log)(message);
+	};
+}
+
+function warn(options) {
+	return function(message) {
+		(options.warnlogger || options.logger || console.warn)(message);
+	};
+}
+
+exports.pick = function(p, keys) {
+	var result = {};
+	keys.forEach(function(k) { 
+		if (p.hasOwnProperty(k)) {
+			result[k] = p[k];
+		}
+	});
+	return result;
+};
+
+exports.extend = function(o, a) {
+	var result = exports.pick(o, Object.keys(o));
+	exports.map(a, function(v,k){ result[k] = v; });
+	return result;
+};
+
+exports.map = function(o, fn) {
+	return Object.keys(o).map(function(k) { return fn(o[k], k); });
+};
+
+exports.find = function(ar, fn) {
+	for(var i in ar) { 
+		if (fn(ar[i])) return ar[i];
+	}
+	return undefined;
+};
+
+exports.detect = exports.find;
+
+exports.flatten = function(e) {
+	return e.reduce(function(x,y) { return x.concat(y); }, []);
+};
+
+exports.forwardEvent = function(emitter, evt) {
+	return function() {
+		emitter.emit(evt, arguments[0]);
+	};
+};
+
+exports.every = function(things, predicate){
+	return Object.keys(things)
+		.map(function(k) { return predicate(k, things[k]); })
+		.reduce(function(x,y) { return x && y; }, true);
+};

package/package.json

@@ -0,0 +1,33 @@
+{
+  "author": "Erlend Oftedal <erlend@oftedal.no>",
+  "name": "retire",
+  "description": "Retire is a tool for detecting use of vulnerable libraries",
+  "version": "3.0.2",
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/RetireJS/retire.js.git"
+  },
+  "bin": {
+    "retire": "./bin/retire"
+  },
+  "main": "./lib/retire.js",
+  "dependencies": {
+    "colors": "^1.1.2",
+    "commander": "2.5.x",
+    "https-proxy-agent": "^5.0.0",
+    "read-installed": "^4.0.3",
+    "walkdir": "0.4.1"
+  },
+  "devDependencies": {
+    "chai": "^4.2.0",
+    "jshint": "^2.12.0",
+    "mocha": "^8.1.3"
+  },
+  "scripts": {
+    "test": "./test"
+  },
+  "engines": {
+    "node": ">= 6.0.0"
+  }
+}