retire 3.2.3 → 4.0.0

package/lib/reporters/cyclonedx-json.js

@@ -1,45 +1,73 @@
+"use strict";
 /*jshint esversion: 6 */
-
-var retire = require('../retire');
-var fs = require('fs');
-var uuidv4 = require('uuid').v4;
-
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const retire = __importStar(require("../retire"));
+const fs = __importStar(require("fs"));
+const uuid_1 = require("uuid");
 function configureCycloneDXJSONLogger(logger, writer, config, hash) {
-    var vulnsFound = false;
-    var finalResults = { version: retire.version, start: new Date(), data: [], messages: [], errors: [] };
+    let vulnsFound = false;
+    const finalResults = {
+        version: retire.version,
+        start: new Date().toISOString(),
+        data: [],
+        messages: [],
+        errors: []
+    };
     logger.info = finalResults.messages.push;
-    logger.debug = config.verbose ? finalResults.messages.push : function() {};
+    logger.debug = config.verbose ? finalResults.messages.push : function () { return; };
     logger.warn = logger.error = finalResults.errors.push;
-    logger.logVulnerableDependency = function(finding) {
+    logger.logVulnerableDependency = function (finding) {
         vulnsFound = true;
         finalResults.data.push(finding);
     };
-    logger.logDependency = function(finding) {
+    logger.logDependency = function (finding) {
         if (finding.results.length > 0) {
-          finalResults.data.push(finding); 
+            finalResults.data.push(finding);
         }
     };
-
-    logger.close = function(callback) {
-        var write = vulnsFound ? writer.err : writer.out;
-        finalResults.start = finalResults.start.toISOString();
-        var seen = {};
-        var components = finalResults.data.filter(d => d.results).map(r => r.results.map(dep => {
+    logger.close = function (callback) {
+        const write = vulnsFound ? writer.err : writer.out;
+        const seen = new Set();
+        const components = finalResults.data.filter(d => d.results).map(r => r.results.map(dep => {
             dep.version = (dep.version.split(".").length >= 3 ? dep.version : dep.version + ".0").replace(/-/g, ".");
-            var hashes;
-            var filepath = r.file || dep.file;
+            let hashes;
+            const filepath = r.file;
             if (filepath) {
-                var file = fs.readFileSync(filepath);
+                const file = fs.readFileSync(filepath);
                 hashes = [
-                    { "alg" : "MD5", "content" : hash.md5(file) },
-                    { "alg" : "SHA-1", "content" : hash.sha1(file) },
-                    { "alg" : "SHA-256", "content" : hash.sha256(file) },
-                    { "alg" : "SHA-512", "content" : hash.sha512(file) },
+                    { "alg": "MD5", "content": hash.md5(file) },
+                    { "alg": "SHA-1", "content": hash.sha1(file) },
+                    { "alg": "SHA-256", "content": hash.sha256(file) },
+                    { "alg": "SHA-512", "content": hash.sha512(file) },
                 ];
             }
-            var purl = `pkg:npm/${dep.component}@${dep.version}`;
-            if (seen[purl]) return undefined;
-            seen[purl] = true;
+            const purl = `pkg:npm/${dep.component}@${dep.version}`;
+            if (seen.has(purl))
+                return undefined;
+            seen.add(purl);
             return {
                 type: "library",
                 name: dep.component,
@@ -47,26 +75,27 @@ function configureCycloneDXJSONLogger(logger, writer, config, hash) {
                 purl: purl,
                 hashes: hashes
             };
-        }).filter(x => x != undefined)).reduce((a,b) => a.concat(b));
+        }).filter(x => x != undefined)).reduce((a, b) => a.concat(b));
         write(JSON.stringify({
-            bomFormat    : "CycloneDX",
-            specVersion  : "1.4",
-            serialNumber : `urn:uuid:${ uuidv4() }`,
-            version      : 1,
-            metadata     : {
-                timestamp : finalResults.start,
-                tools     : [
+            bomFormat: "CycloneDX",
+            specVersion: "1.4",
+            serialNumber: `urn:uuid:${(0, uuid_1.v4)()}`,
+            version: 1,
+            metadata: {
+                timestamp: finalResults.start,
+                tools: [
                     {
-                        vendor  : "RetireJS",
-                        name    : "retire.js",
-                        version : retire.version
+                        vendor: "RetireJS",
+                        name: "retire.js",
+                        version: retire.version
                     }
                 ]
             },
-            components   : components
+            components: components
         }, undefined, 2));
-        writer.close(callback); 
+        writer.close(callback);
     };
 }
-
-exports.configure = configureCycloneDXJSONLogger;
+exports.default = {
+    configure: configureCycloneDXJSONLogger
+};

package/lib/reporters/cyclonedx.d.ts

@@ -0,0 +1,3 @@
+import { ConfigurableLogger } from "../reporting";
+declare const _default: ConfigurableLogger;
+export default _default;

package/lib/reporters/cyclonedx.js

@@ -1,64 +1,91 @@
+"use strict";
 /*jshint esversion: 6 */
-
-var retire = require('../retire');
-var fs = require('fs');
-var uuidv4 = require('uuid').v4;
-
-
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const retire = __importStar(require("../retire"));
+const fs = __importStar(require("fs"));
+const uuid_1 = require("uuid");
 function configureCycloneDXLogger(logger, writer, config, hash) {
-    var vulnsFound = false;
-    var finalResults = { version: retire.version, start: new Date(), data: [], messages: [], errors: [] };
+    let vulnsFound = false;
+    const finalResults = {
+        version: retire.version,
+        start: new Date(),
+        data: [],
+        messages: [],
+        errors: []
+    };
     logger.info = finalResults.messages.push;
-    logger.debug = config.verbose ? finalResults.messages.push : function() {};
+    logger.debug = config.verbose ? finalResults.messages.push : () => { return; };
     logger.warn = logger.error = finalResults.errors.push;
-    logger.logVulnerableDependency = function(finding) {
+    logger.logVulnerableDependency = function (finding) {
         vulnsFound = true;
         finalResults.data.push(finding);
     };
-    logger.logDependency = function(finding) {
+    logger.logDependency = function (finding) {
         if (finding.results.length > 0) {
-          finalResults.data.push(finding);
+            finalResults.data.push(finding);
         }
     };
-
-    logger.close = function(callback) {
-      var write = vulnsFound ? writer.err : writer.out;
-      var seen = {};
-      var components = finalResults.data.filter(d => d.results).map(r => r.results.map(dep => {
-          dep.version = (dep.version.split(".").length >= 3 ? dep.version : dep.version + ".0").replace(/-/g, ".");
-          var filepath = r.file || dep.file;
-          if (filepath) {
-            var filename = filepath.split("/").slice(-1);
-            var file = fs.readFileSync(filepath);
-              hashes = `
+    logger.close = function (callback) {
+        const write = vulnsFound ? writer.err : writer.out;
+        const seen = new Set();
+        const components = finalResults.data.filter(d => d.results).map(r => r.results.map(dep => {
+            dep.version = (dep.version.split(".").length >= 3 ? dep.version : dep.version + ".0").replace(/-/g, ".");
+            const filepath = r.file;
+            let hashes = "";
+            if (filepath) {
+                const file = fs.readFileSync(filepath);
+                hashes = `
           <hashes>
             <hash alg="MD5">${hash.md5(file)}</hash>
             <hash alg="SHA-1">${hash.sha1(file)}</hash>
             <hash alg="SHA-256">${hash.sha256(file)}</hash>
             <hash alg="SHA-512">${hash.sha512(file)}</hash>
           </hashes>`;
-          }
-          var purl = `pkg:npm/${dep.component}@${dep.version}`;
-          var hashes = "";
-          if (seen[purl]) return '';
-          seen[purl] = true;
-          return `
+            }
+            const purl = `pkg:npm/${dep.component}@${dep.version}`;
+            if (seen.has(purl))
+                return '';
+            seen.add(purl);
+            return `
     <component type="library">
       <name>${dep.component}</name>
       <version>${dep.version}</version>${hashes}
       <purl>${purl}</purl>
       <modified>false</modified>
     </component>`;
-    }).join("")).join("");
+        }).join("")).join("");
         write(`<?xml version="1.0"?>
-<bom xmlns="http://cyclonedx.org/schema/bom/1.4" serialNumber="urn:uuid:${ uuidv4() }" version="1">
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4" serialNumber="urn:uuid:${(0, uuid_1.v4)()}" version="1">
   <metadata>
     <timestamp>${finalResults.start.toISOString()}</timestamp>
     <tools>
         <tool>
             <vendor>RetireJS</vendor>
             <name>retire.js</name>
-            <version>${ retire.version }</version>
+            <version>${retire.version}</version>
         </tool>
     </tools>
   </metadata>
@@ -68,5 +95,6 @@ function configureCycloneDXLogger(logger, writer, config, hash) {
         writer.close(callback);
     };
 }
-
-exports.configure = configureCycloneDXLogger;
+exports.default = {
+    configure: configureCycloneDXLogger
+};

package/lib/reporters/depcheck.d.ts

@@ -0,0 +1,3 @@
+import { ConfigurableLogger } from "../reporting";
+declare const _default: ConfigurableLogger;
+export default _default;

package/lib/reporters/depcheck.js

@@ -1,34 +1,59 @@
+"use strict";
 /*jshint esversion: 6 */
-
-var retire = require('../retire');
-var fs = require('fs');
-
-
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const retire = __importStar(require("../retire"));
+const fs = __importStar(require("fs"));
 function configureDepCheckLogger(logger, writer, config, hash) {
-	var vulnsFound = false;
-	var finalResults = { version: retire.version, start: new Date(), data: [], messages: [], errors: [] };
-	logger.info = finalResults.messages.push;
-	logger.debug = config.verbose ? finalResults.messages.push : function() {};
-	logger.warn = logger.error = finalResults.errors.push;
-	logger.logVulnerableDependency = function(finding) {
-		vulnsFound = true;
-		finalResults.data.push(finding);
-	};
-	logger.logDependency = function(finding) {
-		if (config.verbose && finding.results.length > 0) { 
-			finalResults.data.push(finding); 
-		} 
-	};
-
-	logger.close = function(callback) {
-		var write = vulnsFound ? writer.err : writer.out;
-		finalResults.start = finalResults.start.toISOString().replace("Z", "+0000");
-		write(`<?xml version="1.0"?>
+    let vulnsFound = false;
+    const finalResults = {
+        version: retire.version,
+        start: new Date().toISOString().replace("Z", "+0000"),
+        data: [],
+        messages: [],
+        errors: []
+    };
+    logger.info = finalResults.messages.push;
+    logger.debug = config.verbose ? finalResults.messages.push : () => { return; };
+    logger.warn = logger.error = finalResults.errors.push;
+    logger.logVulnerableDependency = (finding) => {
+        vulnsFound = true;
+        finalResults.data.push(finding);
+    };
+    logger.logDependency = (finding) => {
+        if (config.verbose && finding.results.length > 0) {
+            finalResults.data.push(finding);
+        }
+    };
+    logger.close = (callback) => {
+        const write = vulnsFound ? writer.err : writer.out;
+        write(`<?xml version="1.0"?>
 <analysis xmlns="https://jeremylong.github.io/DependencyCheck/dependency-check.2.3.xsd">
   <scanInfo>
     <engineVersion>${retire.version}</engineVersion>
     <dataSource><name>${config.jsRepo || "Retire.js github js repo"}</name><timestamp>${finalResults.start}</timestamp></dataSource>
-    <dataSource><name>${config.nodeRepo || "Retire.js github node repo"}</name><timestamp>${finalResults.start}</timestamp></dataSource>
    </scanInfo>
    <projectInfo>
    	<name>${config.path}</name>
@@ -36,14 +61,16 @@ function configureDepCheckLogger(logger, writer, config, hash) {
     <credits>retire.js</credits>
    </projectInfo>
    <dependencies>`);
-		write(finalResults.data.filter(d => d.results).map(r => r.results.map((dep, i) => {
-			var filepath = r.file || dep.file;
-			var filename = filepath.split("/").slice(-1);
-			var file = fs.readFileSync(filepath);
-			var md5 = hash.md5(file);
-			var sha1 = hash.sha1(file);
-			var sha256 = hash.sha256(file);
-			var evidence = `
+        write(finalResults.data.filter(d => d.results).map(r => r.results.map((dep, i) => {
+            const filepath = r.file;
+            if (!filepath)
+                return;
+            const filename = filepath.split("/").slice(-1);
+            const file = fs.readFileSync(filepath);
+            const md5 = hash.md5(file);
+            const sha1 = hash.sha1(file);
+            const sha256 = hash.sha256(file);
+            const evidence = `
         <evidence type="product" confidence="HIGH">
           <source>file</source>
           <name>name</name>
@@ -54,22 +81,22 @@ function configureDepCheckLogger(logger, writer, config, hash) {
           <name>version</name>
           <value>${dep.version}</value>
         </evidence>`;
-			var identifiers = `
+            const identifiers = `
         <package confidence="HIGH">
           <description>(${dep.component}:${dep.version})</description>
           <id>${i}</id>
         </package>`;
-			var vulns = dep.vulnerabilities && dep.vulnerabilities.length > 0 ? dep.vulnerabilities.map(v => {
-				var references = v.info.map(i => `
+            const vulns = dep.vulnerabilities && dep.vulnerabilities.length > 0 ? dep.vulnerabilities.map(v => {
+                const references = v.info.map(i => `
             <reference>
               <source>Retire.js</source>
               <url>${i}</url>
               <name>${i}</name>
             </reference>`).join("");
-				var id = [v.identifiers && v.identifiers.CVE && v.identifiers.CVE[0], v.identifiers && v.identifiers.issue, dep.component + '@' + v.info[0]]	
-					.filter(n => n !== null)[0];
-				//TODO: Fix CVSS stuff - add to repo? add id to every bug in repo?
-				return `
+                //  const id = [v.identifiers && v.identifiers.CVE && v.identifiers.CVE[0], v.identifiers && v.identifiers.issue, dep.component + '@' + v.info[0]]	
+                //  .filter(n => n !== null)[0];
+                //TODO: Fix CVSS stuff - add to repo? add id to every bug in repo?
+                return `
         <vulnerability source="retire">
           <name>${dep.component}:${dep.version}</name>
           <cvssV2>
@@ -86,11 +113,11 @@ function configureDepCheckLogger(logger, writer, config, hash) {
           <references>${references}
           </references>
           <vulnerableSoftware>
-              <software>${ v.atOrAbove ? "&gt;= " + v.atOrAbove: "" } &lt; ${v.below}</software>
+              <software>${v.atOrAbove ? "&gt;= " + v.atOrAbove : ""} &lt; ${v.below}</software>
           </vulnerableSoftware>
-        </vulnerability>`; 
-      }).join('') : "";
-      return `    <dependency>
+        </vulnerability>`;
+            }).join('') : "";
+            return `    <dependency>
       <fileName>${filename}</fileName>
       <filePath>${filepath}</filePath>
       <md5>${md5}</md5>
@@ -102,12 +129,13 @@ function configureDepCheckLogger(logger, writer, config, hash) {
       </identifiers>
       <vulnerabilities>${vulns}
       </vulnerabilities>
-    </dependency>`; }).join("\n")).join("\n"));
-    write(`  </dependencies>
+    </dependency>`;
+        }).join("\n")).join("\n"));
+        write(`  </dependencies>
 </analysis>`);
-		writer.close(callback); 
-	};
+        writer.close(callback);
+    };
 }
-
-
-exports.configure = configureDepCheckLogger;
+exports.default = {
+    configure: configureDepCheckLogger
+};

package/lib/reporters/json.d.ts

@@ -0,0 +1,3 @@
+import { ConfigurableLogger } from "../reporting";
+declare const _default: ConfigurableLogger;
+export default _default;

package/lib/reporters/json.js

@@ -1,29 +1,57 @@
+"use strict";
 /*jshint esversion: 6 */
-
-var retire = require('../retire');
-
-function configureJsonLogger(logger, writer, config) {
-	var scanStart = Date.now();
-	var vulnsFound = false;
-	var finalResults = { version: retire.version, start: new Date(), data: [], messages: [], errors: [] };
-	logger.info = finalResults.messages.push;
-	logger.debug = config.verbose ? finalResults.messages.push : function() {};
-	logger.warn = logger.error = (message) => finalResults.errors.push(message);
-	logger.logVulnerableDependency = function(finding) {
-		vulnsFound = true;
-		finalResults.data.push(finding);
-	};
-	logger.logDependency = function(finding) {
-		if (config.verbose && finding.results.length > 0) { 
-			finalResults.data.push(finding); 
-		} 
-	};
-	logger.close = function(callback) {
-		finalResults.time = (Date.now() - scanStart)/1000;
-		var res = (config.outputformat === "jsonsimple") ? finalResults.data : finalResults;
-		writer.out(JSON.stringify(res));
-		writer.close(callback); 
-	};
-}
-
-exports.configure = configureJsonLogger;
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const retire = __importStar(require("../retire"));
+exports.default = {
+    configure: (logger, writer, config) => {
+        const scanStart = Date.now();
+        const finalResults = {
+            version: retire.version,
+            start: new Date(),
+            data: [],
+            messages: [],
+            errors: [],
+            time: undefined
+        };
+        logger.info = finalResults.messages.push;
+        logger.debug = config.verbose ? finalResults.messages.push : () => { return; };
+        logger.warn = logger.error = (message) => finalResults.errors.push(message);
+        logger.logVulnerableDependency = (finding) => {
+            finalResults.data.push(finding);
+        };
+        logger.logDependency = function (finding) {
+            if (config.verbose && finding.results.length > 0) {
+                finalResults.data.push(finding);
+            }
+        };
+        logger.close = function (callback) {
+            finalResults.time = (Date.now() - scanStart) / 1000;
+            const res = (config.outputformat === "jsonsimple") ? finalResults.data : finalResults;
+            writer.out(JSON.stringify(res));
+            writer.close(callback);
+        };
+    }
+};

package/lib/reporting.d.ts

@@ -0,0 +1,36 @@
+/// <reference types="node" />
+import { Finding } from "./types";
+export type LoggerOptions = {
+    outputpath: string;
+    verbose: boolean;
+    colors: boolean;
+    outputformat: string;
+    jsRepo: string;
+    path: string;
+    colorwarn: (s: string) => string;
+};
+export type Hasher = {
+    md5: (file: Buffer | string) => string;
+    sha1: (file: Buffer | string) => string;
+    sha256: (file: Buffer | string) => string;
+    sha512: (file: Buffer | string) => string;
+};
+export declare const hash: Hasher;
+export type Writer = {
+    out: (...args: Parameters<typeof console["log"]>) => void;
+    err: (x: string) => void;
+    close: (callback?: () => void) => void;
+};
+export type Logger = {
+    info: (x: string) => void;
+    debug: (x: string) => void;
+    warn: (x: string) => void;
+    error: (x: string) => void;
+    logDependency: (finding: Finding) => void;
+    logVulnerableDependency: (finding: Finding) => void;
+    close: (callback?: () => void) => void;
+};
+export interface ConfigurableLogger {
+    configure: (logger: Logger, writer: Writer, config: LoggerOptions, hash: Hasher) => void;
+}
+export declare function open(config: LoggerOptions): Logger;