retire 3.2.3 → 4.0.0

package/lib/reporting.js

@@ -1,96 +1,115 @@
-/*jshint esversion: 6 */
-
-var retire = require('./retire');
-var utils = require('./utils');
-var fs = require('fs');
-var crypto = require('crypto');
-
-var loggers = {
-  console       : require("./reporters/console"),
-  text          : require("./reporters/console"),
-  json          : require("./reporters/json"),
-  depcheck      : require("./reporters/depcheck"),
-  cyclonedx     : require("./reporters/cyclonedx"),
-  cyclonedxJSON : require("./reporters/cyclonedx-json")
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
 };
-
-loggers.clean = loggers.console;
-loggers.jsonsimple = loggers.json;
-
-var colorwarn = function(x) { return x; };
-
-var verbose = false;
-
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.open = exports.hash = void 0;
+const fs = __importStar(require("fs"));
+const crypto = __importStar(require("crypto"));
+const console_1 = __importDefault(require("./reporters/console"));
+const json_1 = __importDefault(require("./reporters/json"));
+const depcheck_1 = __importDefault(require("./reporters/depcheck"));
+const cyclonedx_1 = __importDefault(require("./reporters/cyclonedx"));
+const cyclonedx_json_1 = __importDefault(require("./reporters/cyclonedx-json"));
+const loggers = {
+    console: console_1.default,
+    text: console_1.default,
+    json: json_1.default,
+    depcheck: depcheck_1.default,
+    cyclonedx: cyclonedx_1.default,
+    cyclonedxJSON: cyclonedx_json_1.default,
+    clean: console_1.default,
+    jsonsimple: json_1.default
+};
+let colorwarn = (x) => { return x; };
+let verbose = false;
 function hashContent(hash, content) {
-  var h = crypto.createHash(hash);
-  h.update(content);
-  return h.digest('hex'); 
+    const h = crypto.createHash(hash);
+    h.update(content);
+    return h.digest('hex');
 }
-
-var hash = {
-  md5: (file) => hashContent('md5', file),
-  sha1: (file) => hashContent('sha1', file),
-  sha256: (file) => hashContent('sha256', file),
-  sha512: (file) => hashContent('sha512', file),
+exports.hash = {
+    md5: (file) => hashContent('md5', file),
+    sha1: (file) => hashContent('sha1', file),
+    sha256: (file) => hashContent('sha256', file),
+    sha512: (file) => hashContent('sha512', file),
 };
-
-
-
-var writer = {
-  out: console.log,
-  err: function(x) { console.warn(colorwarn(x)); },
-  close : function() { }
+const writer = {
+    out: console.log,
+    err: (x) => { console.warn(colorwarn(x)); },
+    close: () => { return; }
 };
-
-var logger = {
-  info : function(x) { writer.out(x); },
-  debug : function(x) { if (verbose) writer.out(x); },
-  warn : function(x) { writer.err(x); },
-  error : function(x) { writer.err(x); },
-
-  logDependency : function(finding) { },
-  logVulnerableDependency: function(finding) { },
-  close: function() { writer.close(); }
+const logger = {
+    info: (x) => { writer.out(x); },
+    debug: (x) => { if (verbose)
+        writer.out(x); },
+    warn: (x) => { writer.err(x); },
+    error: (x) => { writer.err(x); },
+    logDependency: () => { return; },
+    logVulnerableDependency: () => { return; },
+    close: () => writer.close()
 };
-
-
-
+;
 function configureFileWriter(config) {
-  var fileOutput = {
-    fileDescriptor: fs.openSync(config.outputpath, "w")
-  };
-  if (fileOutput.fileDescriptor < 0) {
-    console.error("Could not open " + config.outputpath + " for writing");
-    process.exit(9);
-  } 
-  fileOutput.stream = fs.createWriteStream('', {fd: fileOutput.fileDescriptor, autoClose: false});
-  var writeToFile = function(message) {
-    fileOutput.stream.write(message);
-    fileOutput.stream.write('\n');
-  };
-  writer.out = writer.err = writeToFile;
-  writer.close = function() {
-    fileOutput.stream.on('finish', function() {
-      fs.closeSync(fileOutput.fileDescriptor);
-    });
-    fileOutput.stream.end();
-  };
+    if (!config.outputpath)
+        return;
+    const fileDescriptor = fs.openSync(config.outputpath, "w");
+    if (fileDescriptor < 0) {
+        console.error(`Could not open ${config.outputpath} for writing`);
+        process.exit(9);
+    }
+    const fileOutput = {
+        fileDescriptor,
+        stream: fs.createWriteStream('', { fd: fileDescriptor, autoClose: false })
+    };
+    const writeToFile = (message) => {
+        fileOutput.stream.write(message);
+        fileOutput.stream.write('\n');
+    };
+    writer.out = writer.err = writeToFile;
+    writer.close = () => {
+        fileOutput.stream.on('finish', () => {
+            fs.closeSync(fileOutput.fileDescriptor);
+        });
+        fileOutput.stream.end();
+    };
 }
-
-exports.open = function(config) {
-  verbose = config.verbose;
-  if (config.colors) colorwarn = config.colorwarn;
-  var format = config.outputformat || "console";
-  if (Object.keys(loggers).indexOf(format) == -1) {
-    console.warn("Invalid outputformat: " + format);
-    process.exit(1);
-  }
-  loggers[format].configure(logger, writer, config, hash);
-
-  if (typeof config.outputpath === 'string') { 
-    configureFileWriter(config); 
-  }
-  return logger;
-};
-
-exports.hash = hash;
+function open(config) {
+    var _a;
+    verbose = (_a = config.verbose) !== null && _a !== void 0 ? _a : false;
+    if (config.colors)
+        colorwarn = config.colorwarn;
+    const format = config.outputformat || "console";
+    if (!(format in loggers)) {
+        console.warn(`Invalid outputformat: ${format}`);
+        process.exit(1);
+    }
+    loggers[format].configure(logger, writer, config, exports.hash);
+    configureFileWriter(config);
+    return logger;
+}
+exports.open = open;
+;

package/lib/resolve.d.ts

@@ -0,0 +1,4 @@
+/// <reference types="node" />
+import { EventEmitter as Emitter } from "events";
+import { Options } from "./types";
+export declare function scanJsFiles(path: string, options: Options): Emitter;

package/lib/resolve.js

@@ -1,102 +1,54 @@
-/* global require, exports */
-
-var walkdir			= require('walkdir'),
-	fs						= require('fs'),
-	readInstalled	= require('read-installed'),
-	emitter				= require('events').EventEmitter;
-
-
-function listdep(parent, dep, level, deps) {
-	var stack = [];
-	var dedup = {};
-	stack.push({parent: parent, dep: dep, level: level}); 
-	while (typeof (o = stack.pop()) !== 'undefined') {
-		for (var i in o.dep.dependencies) {
-			cyclic = false;
-			dep_parent = o.parent;
-			while (typeof dep_parent !== 'undefined') {
-				if (dep_parent.component === i) {
-					cyclic = true;
-					break;
-				} else {
-					dep_parent = dep_parent.parent;
-				}
-			}
-			if (cyclic) {
-				continue;
-			}
-			var id = i + "@" + o.dep.dependencies[i].version;
-			if (dedup[id]) continue;
-			dedup[id] = true;
-			var d = { 
-				module: { component: i, version: o.dep.dependencies[i].version }
-			};
-			if (o.dep.dependencies[i].path) {
-				d.file = "node_modules" + o.dep.dependencies[i].path.split("node_modules").slice(1).join("node_modules") + '/package.json';
-			}
-			deps.push(d);
-			stack.push({parent: d, dep: o.dep.dependencies[i], level: o.level + 1}); 
-		}
-	}
-}
-
-function getNodeDependencies(path, limit) {
-	var events = new emitter();
-	readInstalled(path, {}, function (er, pkginfo) {
-		var deps = [];
-		if (limit) {
-			var packages = JSON.parse(fs.readFileSync(path +'/package.json'));
-			filter = [];			
-
-			var filter = packages.dependencies ? Object.keys(packages.dependencies) : [];
-
-			Object.keys(pkginfo.dependencies)
-				.filter(function(d) { return !pkginfo.dependencies[d]._requiredBy || pkginfo.dependencies[d]._requiredBy.indexOf("/") > -1 || pkginfo.dependencies[d]._requiredBy.indexOf("#DEV:/") > -1;  })
-				.filter(function(d) { return filter.indexOf(d) == -1; })
-				.forEach(function(d) { delete pkginfo.dependencies[d]; });
-		}
-		var notInstalled = Object.keys(pkginfo.dependencies).filter(function (d) {
-			return !pkginfo.dependencies[d].path;
-		});
-		if (notInstalled.length > 0) {
-			return events.emit('error', 'Could not find dependencies: ' + notInstalled.join(', ') + '. You may need to run npm install');
-		}
-		listdep({file: 'package.json',component: pkginfo.name, version: pkginfo.version}, pkginfo, 1, deps);
-		events.emit('done', deps);				
-	});
-	return events;
-}
-
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.scanJsFiles = void 0;
+const fs = __importStar(require("fs"));
+const walkdir = __importStar(require("walkdir"));
 function scanJsFiles(path, options) {
-	var finder = walkdir.find(path, { "follow_symlinks" : false, "no_return": true });
-	var ext = (options.ext || "js").split(",").map(function(e) { return  "." + e; });
-	function onFile(file){
-		if (ext.some(function(e) { return file.endsWith(e); })) {
-			finder.emit('jsfile', file);
-		}
-		if (file.match(/\/bower.json$/)) {
-			finder.emit('bowerfile', file);
-		}
-	}
-	finder.on('file', onFile);
-	finder.on('link', function(link) {		
-		if (fs.existsSync(link)) {
-			var file = fs.realpathSync(link);
-			if (fs.lstatSync(file).isFile()) {
-				onFile(link);
-			}
-		} else {
-			options.log.warn('Could not follow symlink: ' + link);
-		}
-	});
-	return finder;
+    const finder = walkdir.find(path, { "follow_symlinks": false, "no_return": true });
+    const ext = (options.ext || "js").split(",").map((e) => `.${e}`);
+    function onFile(file) {
+        if (ext.some((e) => file.endsWith(e))) {
+            finder.emit('jsfile', file);
+        }
+        if (file.match(/\/bower.json$/)) {
+            finder.emit('bowerfile', file);
+        }
+    }
+    finder.on('file', onFile);
+    finder.on('link', (link) => {
+        if (fs.existsSync(link)) {
+            const file = fs.realpathSync(link);
+            if (fs.lstatSync(file).isFile()) {
+                onFile(link);
+            }
+        }
+        else {
+            options.log.warn(`Could not follow symlink: ${link}`);
+        }
+    });
+    return finder;
 }
-
-exports.scanJsFiles = function(path, options) {
-	return scanJsFiles(path, options);
-};
-
-exports.getNodeDependencies = function(path, limit) {
-	return getNodeDependencies(path, limit);
-};
-
+exports.scanJsFiles = scanJsFiles;

package/lib/retire.js

@@ -4,7 +4,7 @@
  */
 
 var exports = exports || {};
-exports.version = '3.2.3';
+exports.version = '4.0.0';
 
 function isDefined(o) {
 	return typeof o !== 'undefined';
@@ -171,14 +171,5 @@ exports.scanFileContent = function(content, repo, hasher) {
 	return check(result, repo);
 };
 
-exports.scanNodeDependency = function(dependency, npmrepo, options) {
-	if (!isDefined(dependency.version)) {
-		if (options.log) options.log.warn('Missing version for ' + dependency.component + '. Need to run npm install ?');
-		return [];
-	}
-	if (!isDefined(npmrepo[dependency.component])) return [{component: dependency.component, version: dependency.version, file: dependency.file}];
-	return check([dependency], npmrepo);
-};
-
 
 

package/lib/scanner.d.ts

@@ -0,0 +1,4 @@
+import { Finding, Options, Repository } from "./types";
+export declare function scanJsFile(file: string, repo: Repository, options: Options): void;
+export declare function scanBowerFile(file: string, repo: Repository, options: Options): void;
+export declare function on(event: 'vulnerable-dependency-found' | 'dependency-found', handler: (finding: Finding) => void): void;

package/lib/scanner.js

@@ -1,138 +1,132 @@
-/*jshint esversion: 6 */
-var retire = require('./retire'),
-    fs     = require('fs'),
-    crypto = require('crypto'),
-    path   = require('path'),
-    utils  = require('./utils'),
-    emitter   = new require('events').EventEmitter;
-
-var events = new emitter();
-
-var hash = {
-  'sha1' : function(data) {
-    shasum   = crypto.createHash('sha1');
-    shasum.update(data);
-    return shasum.digest('hex');
-  }
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.on = exports.scanBowerFile = exports.scanJsFile = void 0;
+const events_1 = require("events");
+const retire = __importStar(require("./retire"));
+const fs = __importStar(require("fs"));
+const crypto = __importStar(require("crypto"));
+const path = __importStar(require("path"));
+const events = new events_1.EventEmitter();
+const hash = {
+    'sha1': (data) => {
+        const shasum = crypto.createHash('sha1');
+        shasum.update(data);
+        return shasum.digest('hex');
+    }
 };
-
 function emitResults(finding, options) {
-  removeIgnored(finding.results, options.ignore);
-  if (!options.verbose) finding.results = finding.results.filter(f => retire.isVulnerable([f]));
-  if (finding.results.length == 0) return;
-  if (retire.isVulnerable(finding.results)) {
-    events.emit('vulnerable-dependency-found', finding);
-  } else {
-    events.emit('dependency-found', finding);
-  }
-
+    if (options.ignore)
+        removeIgnored(finding.results, options.ignore);
+    if (!options.verbose)
+        finding.results = finding.results.filter(f => retire.isVulnerable([f]));
+    if (finding.results.length == 0)
+        return;
+    if (retire.isVulnerable(finding.results)) {
+        events.emit('vulnerable-dependency-found', finding);
+    }
+    else {
+        events.emit('dependency-found', finding);
+    }
 }
-
 function shouldIgnorePath(fileSpecs, ignores) {
-  return utils.detect(ignores.paths, function(i) {
-    return utils.detect(fileSpecs, function(j) {
-      return i.test(j) || i.test(path.resolve(j)); 
-    });
-  });
+    var _a, _b;
+    return (_b = (_a = ignores.paths) === null || _a === void 0 ? void 0 : _a.some((i) => {
+        return fileSpecs.some((j) => i.test(j) || i.test(path.resolve(j)));
+    })) !== null && _b !== void 0 ? _b : false;
 }
-
 function removeIgnored(results, ignores) {
-  if (!ignores.hasOwnProperty('descriptors')) return;
-  results.forEach(function(r) {
-    if (!r.hasOwnProperty('vulnerabilities')) return;
-    ignores.descriptors.forEach(function(i) {
-      if (r.component !== i.component) return;
-      if (i.version && r.version !== i.version) return;
-      if (i.severity && r.severity !== i.severity) return;
-      if (i.identifiers) {
-        removeIgnoredVulnerabilitiesByIdentifier(i.identifiers, r);
+    if (!("descriptors" in ignores))
         return;
-      }
-      r.vulnerabilities = [];
+    results.forEach((r) => {
+        var _a, _b;
+        if (!("vulnerabilities" in r))
+            return;
+        (_a = ignores.descriptors) === null || _a === void 0 ? void 0 : _a.filter((d) => "component" in d).forEach((i) => {
+            var _a;
+            if (r.component !== i.component)
+                return;
+            if (i.version && r.version !== i.version)
+                return;
+            if (i.severity) { //Remove vulnerabilities with the severity we want to drop
+                r.vulnerabilities = (_a = r.vulnerabilities) === null || _a === void 0 ? void 0 : _a.filter(v => v.severity != i.severity);
+                return;
+            }
+            if (i.identifiers) {
+                removeIgnoredVulnerabilitiesByIdentifier(Object.assign({}, i.identifiers), r);
+                return;
+            }
+            r.vulnerabilities = [];
+        });
+        if (((_b = r.vulnerabilities) === null || _b === void 0 ? void 0 : _b.length) === 0)
+            delete r.vulnerabilities;
     });
-    if (r.vulnerabilities.length === 0) delete r.vulnerabilities;
-  });
 }
-
 function removeIgnoredVulnerabilitiesByIdentifier(identifiers, result) {
-  result.vulnerabilities = result.vulnerabilities.filter(function(v) {
-    if (!v.hasOwnProperty("identifiers")) return true;
-    return !utils.every(identifiers, function(key, value) { return hasIdentifier(v, key, value); });
-  });
+    var _a;
+    result.vulnerabilities = (_a = result.vulnerabilities) === null || _a === void 0 ? void 0 : _a.filter((v) => {
+        if (!("identifiers" in v))
+            return true;
+        return !Object.entries(identifiers || {}).every(([key, value]) => hasIdentifier(Object.assign({}, v.identifiers), key, value));
+    });
 }
-function hasIdentifier(vulnerability, key, value) {
-  if (!vulnerability.identifiers.hasOwnProperty(key)) return false;
-  var identifier = vulnerability.identifiers[key];
-  return Array.isArray(identifier) ? identifier.some(function(x) { return x === value; }) : identifier === value;
+function hasIdentifier(identifiers, key, value) {
+    if (!(key in identifiers))
+        return false;
+    const identifier = identifiers[key];
+    return Array.isArray(identifier) ? identifier.some((x) => x === value) : identifier === value;
 }
-
-
 function scanJsFile(file, repo, options) {
-  if (options.ignore && shouldIgnorePath([file], options.ignore)) {
-    return;
-  }
-  var results = retire.scanFileName(file, repo);
-  if (!results || results.length === 0) {
-    results = retire.scanFileContent(fs.readFileSync(file), repo, hash);
-  }
-  emitResults({file: file, results: results}, options);
-}
-
-
-function scanDependencies(dependencies, nodeRepo, options) {
-  for (var i in dependencies) {
-    var dependency = dependencies[i];
-    var fileSpecs = [toModulePath(dependency)];
-    if (dependency.component) {
-      fileSpecs.push(dependency.component);
+    if (options.ignore && shouldIgnorePath([file], options.ignore)) {
+        return;
     }
-
-    if (options.ignore && shouldIgnorePath(fileSpecs, options.ignore)) {
-      continue;
+    let results = retire.scanFileName(file, repo);
+    if (!results || results.length === 0) {
+        results = retire.scanFileContent(fs.readFileSync(file, "utf-8"), repo, hash);
     }
-    results = retire.scanNodeDependency(dependencies[i].module, nodeRepo, options);
-    emitResults({file: dependencies[i].file, results: results}, options);
-  }
+    emitResults({ file: file, results: results }, options);
 }
-
-function toModulePath(dep) {
-  function f(d) {
-    if (d.parent) return f(d.parent) + '/node_modules/' + d.component;
-    return '';
-  }
-  return path.resolve(f(dep).substring(1));
-}
-
-
-
+exports.scanJsFile = scanJsFile;
 function scanBowerFile(file, repo, options) {
-  if (options.ignore && shouldIgnorePath([file], options.ignore)) {
-    return;
-  }
-  try {
-    var bower = JSON.parse(fs.readFileSync(file));
-    if (bower.version) {
-      var results = retire.check(bower.name, bower.version, repo);
-      emitResults({file: file, results: results}, options);
+    if (options.ignore && shouldIgnorePath([file], options.ignore)) {
+        return;
+    }
+    try {
+        const bower = JSON.parse(fs.readFileSync(file, "utf-8"));
+        if (bower.version) {
+            const results = retire.check(bower.name, bower.version, repo);
+            emitResults({ file: file, results: results }, options);
+        }
+    }
+    catch (e) {
+        options.log.warn(`Could not parse file: ${file}`);
     }
-  } catch (e) {
-    options.log.warn('Could not parse file: ' + file);
-  }
 }
-
-
-
-exports.scanDependencies = function(dependencies, nodeRepo, options) {
-  return scanDependencies(dependencies, nodeRepo, options);
-};
-exports.scanJsFile = function(file, repo, options) {
-  return scanJsFile(file, repo, options);
-};
-exports.scanBowerFile = function(file, repo, options) {
-  return scanBowerFile(file, repo, options);
-};
-exports.on = function(name, listener) {
-  events.on(name, listener);
-};
-
-
+exports.scanBowerFile = scanBowerFile;
+function on(event, handler) {
+    events.on(event, handler);
+}
+exports.on = on;
+;