retire 3.2.3 → 4.0.0

package/lib/types.d.ts

@@ -0,0 +1,83 @@
+/// <reference types="node" />
+import { Logger } from "./reporting";
+export type Repository = Record<string, {
+    bowername?: string;
+    vulnerabilities: Vulnerability[];
+    extractors: {
+        func?: string[];
+        uri?: string[];
+        filename?: string[];
+        filecontent?: string[];
+        filecontentreplace?: string[];
+        hashes?: Record<string, string>;
+    };
+}>;
+export type Vulnerability = {
+    below: string;
+    atOrAbove?: string;
+    severity: SeverityLevel;
+    identifiers?: {
+        CVE?: string[];
+        bug?: string;
+        issue?: string;
+        summary?: string;
+    };
+    info: string[];
+};
+export type Component = {
+    component: string;
+    version: string;
+    vulnerabilities?: Vulnerability[];
+};
+export type Finding = {
+    results: Component[];
+    file: string;
+};
+export type Hasher = {
+    sha1: (data: string) => string;
+};
+export declare const severityLevels: {
+    readonly none: 0;
+    readonly low: 1;
+    readonly medium: 2;
+    readonly high: 3;
+    readonly critical: 4;
+};
+export type SeverityLevel = keyof typeof severityLevels;
+export type PathDescriptor = {
+    path: string;
+    justification?: string;
+};
+export type ComponentDescriptor = {
+    component: string;
+    version?: string;
+    severity?: string;
+    identifiers?: Vulnerability["identifiers"];
+    justification?: string;
+};
+type Descriptor = (PathDescriptor | ComponentDescriptor);
+export type Options = {
+    log: Logger;
+    proxy?: string;
+    insecure?: boolean;
+    cacertbuf?: Buffer;
+    process?: (data: string) => string;
+    nocache: boolean;
+    cachedir: string;
+    ext?: string;
+    ignore: {
+        descriptors?: Array<Descriptor>;
+        paths: RegExp[];
+        pathsAsString: string[];
+    };
+    severity: SeverityLevel;
+    verbose?: boolean;
+    outputformat?: string;
+    outputpath?: string;
+    colors?: boolean;
+    colorwarn: (msg: string) => string;
+    jsRepo?: string;
+    path: string;
+    exitwith: number;
+};
+export {};

package/lib/types.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.severityLevels = void 0;
+exports.severityLevels = {
+    none: 0,
+    low: 1,
+    medium: 2,
+    high: 3,
+    critical: 4
+};

package/lib/utils.d.ts

@@ -0,0 +1,11 @@
+type LogMethod = (...message: unknown[]) => void;
+export declare function info(options: {
+    logger?: LogMethod;
+}): (...message: unknown[]) => void;
+export declare function warn(options: {
+    warnlogger?: LogMethod;
+    logger?: LogMethod;
+}): (...message: unknown[]) => void;
+export declare function pick(p: Record<string, unknown>, keys: string[]): Record<typeof keys[number], unknown>;
+export declare function flatten<T>(e: T[][]): T[];
+export {};

package/lib/utils.js

@@ -1,57 +1,31 @@
-
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.flatten = exports.pick = exports.warn = exports.info = void 0;
 function info(options) {
-	return function(message) {
-		(options.logger || console.log)(message);
-	};
+    return function (...message) {
+        (options.logger || console.log)(message);
+    };
 }
-
+exports.info = info;
 function warn(options) {
-	return function(message) {
-		(options.warnlogger || options.logger || console.warn)(message);
-	};
+    return function (...message) {
+        (options.warnlogger || options.logger || console.warn)(message);
+    };
 }
-
-exports.pick = function(p, keys) {
-	var result = {};
-	keys.forEach(function(k) { 
-		if (p.hasOwnProperty(k)) {
-			result[k] = p[k];
-		}
-	});
-	return result;
-};
-
-exports.extend = function(o, a) {
-	var result = exports.pick(o, Object.keys(o));
-	exports.map(a, function(v,k){ result[k] = v; });
-	return result;
-};
-
-exports.map = function(o, fn) {
-	return Object.keys(o).map(function(k) { return fn(o[k], k); });
-};
-
-exports.find = function(ar, fn) {
-	for(var i in ar) {
-		if (fn(ar[i])) return ar[i];
-	}
-	return undefined;
-};
-
-exports.detect = exports.find;
-
-exports.flatten = function(e) {
-	return e.reduce(function(x,y) { return x.concat(y); }, []);
-};
-
-exports.forwardEvent = function(emitter, evt) {
-	return function() {
-		emitter.emit(evt, arguments[0]);
-	};
-};
-
-exports.every = function(things, predicate){
-	return Object.keys(things)
-		.map(function(k) { return predicate(k, things[k]); })
-		.reduce(function(x,y) { return x && y; }, true);
-};
+exports.warn = warn;
+function pick(p, keys) {
+    const result = {};
+    keys.forEach((k) => {
+        if (k in p) {
+            result[k] = p[k];
+        }
+    });
+    return result;
+}
+exports.pick = pick;
+;
+function flatten(e) {
+    return e.reduce((x, y) => x.concat(y), []);
+}
+exports.flatten = flatten;
+;

package/package.json

@@ -2,38 +2,59 @@
   "author": "Erlend Oftedal <erlend@oftedal.no>",
   "name": "retire",
   "description": "Retire is a tool for detecting use of vulnerable libraries",
-  "version": "3.2.3",
+  "version": "4.0.0",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",
     "url": "https://github.com/RetireJS/retire.js.git"
   },
   "bin": {
-    "retire": "./bin/retire"
+    "retire": "./lib/cli.js"
   },
   "main": "./lib/retire.js",
   "dependencies": {
     "ansi-colors": "^4.1.1",
-    "commander": "2.5.x",
+    "commander": "^10.0.0",
     "proxy-agent": "^5.0.0",
-    "read-installed": "^4.0.3",
     "uuid": "^8.3.2",
-    "walkdir": "0.4.1"
+    "walkdir": "0.4.1",
+    "zod": "^3.20.6"
   },
   "devDependencies": {
+    "@types/node": "^18.13.0",
+    "@types/uuid": "^9.0.0",
+    "@typescript-eslint/eslint-plugin": "^5.51.0",
+    "@typescript-eslint/parser": "^5.51.0",
     "chai": "^4.3.4",
-    "jshint": "^2.13.4",
+    "eslint": "^8.34.0",
+    "eslint-config-prettier": "^8.6.0",
     "jsonschema": "^1.4.1",
-    "libxmljs": "^0.19.10",
-    "mocha": "^9.2.0"
+    "libxmljs": "^1.0.8",
+    "mocha": "^9.2.0",
+    "prettier": "^2.8.4",
+    "typescript": "^4.9.5"
   },
   "scripts": {
-    "test": "./test"
+    "test": "./test",
+    "build": "tsc && chmod ugo+x lib/cli.js",
+    "watch": "tsc --watch ",
+    "lint": "eslint . --ext .ts --fix --ignore-path ../.gitignore",
+    "check": "npm run lint && npm run typecheck"
   },
   "engines": {
     "node": ">= 6.0.0"
   },
   "keywords": [
-    "sbom", "sbom-tool", "sbom-generator", "security", "cli", "software-composition-analysis", "sca"
+    "sbom",
+    "sbom-tool",
+    "sbom-generator",
+    "security",
+    "cli",
+    "software-composition-analysis",
+    "sca"
+  ],
+  "files" : [
+    "lib/**/*",
+    "CHANGELOG.md"
   ]
 }

package/bin/retire

@@ -1,236 +0,0 @@
-#!/usr/bin/env node
-/*jshint esversion: 6 */
-
-var utils     = require('../lib/utils'),
-    program   = require('commander'),
-    retire    = require('../lib/retire'),
-    repo      = require('../lib/repo'),
-    resolve   = require('../lib/resolve'),
-    scanner   = require('../lib/scanner'),
-    reporting = require('../lib/reporting'),
-    forward   = require('../lib/utils').forwardEvent,
-    os        = require('os'),
-    path      = require('path'),
-    fs        = require('fs'),
-    colors    = require('ansi-colors'),
-    emitter   = new require('events').EventEmitter;
-
-var events = new emitter();
-var jsRepo = null;
-var bowerRepo = null;
-var nodeRepo = null;
-var failProcess = false;
-var defaultIgnoreFiles = ['.retireignore', '.retireignore.json'];
-
-var severityLevels = {
-  none: 0,
-  low: 1,
-  medium: 2,
-  high: 3,
-  critical: 4
-};
-
-
-
-/*
- * Parse command line flags.
- */
-program
-  .version(retire.version)
-  .option('')
-  .option('-p, --package', 'limit node scan to packages where parent is mentioned in package.json (ignore node_modules)')
-  .option('-n, --node',    'Run node dependency scan only')
-  .option('-j, --js',      'Run scan of JavaScript files only')
-  .option('-v, --verbose', 'Show identified files (by default only vulnerable files are shown)')
-  .option('-x, --dropexternal', "Don't include project provided vulnerability repository")
-  .option('-c, --nocache', "Don't use local cache")
-  .option('')
-  .option('--jspath <path>', 'Folder to scan for javascript files')
-  .option('--nodepath <path>', 'Folder to scan for node files')
-  .option('--path <path>', 'Folder to scan for both')
-  .option('--jsrepo <path|url>', 'Local or internal version of repo')
-  .option('--noderepo <path|url>', 'Local or internal version of repo')
-  .option('--cachedir <path>', 'Path to use for local cache instead of /tmp/.retire-cache')
-  .option('--proxy <url>', 'Proxy url (http://some.host:8080)')
-  .option('--outputformat <format>', 'Valid formats: text, json, jsonsimple, depcheck (experimental), cyclonedx and cyclonedxJSON')
-  .option('--outputpath <path>', 'File to which output should be written')
-  .option('--ignore <paths>', 'Comma delimited list of paths to ignore')
-  .option('--ignorefile <path>', 'Custom ignore file, defaults to .retireignore / .retireignore.json')
-  .option('--severity <level>', 'Specify the bug severity level from which the process fails. Allowed levels none, low, medium, high, critical. Default: none')
-  .option('--exitwith <code>', 'Custom exit code (default: 13) when vulnerabilities are found')
-  .option('--colors', 'Enable color output (console output only)')
-  .option('--insecure', 'Enable fetching remote jsrepo/noderepo files from hosts using an insecure or self-signed SSL (TLS) certificate')
-  .option('--ext <extensions>', 'Comman separated list of file extensions for javascript files. The default is "js"')
-  .option('--cacert <path>', 'Use the specified certificate file to verify the peer used for fetching remote jsrepo/noderepo files')
-  .parse(process.argv);
-
-var config = utils.extend({ path: '.' }, utils.pick(program, [
-  'package', 'node', 'js', 'jspath', 'verbose', 'nodepath', 'path', 'jsrepo', 'noderepo',
-  'dropexternal', 'nocache', 'proxy', 'ignore', 'ignorefile', 'outputformat', 'outputpath',
-  'severity', 'exitwith', 'colors', 'includemeta', 'cachedir', 'insecure', 'cacert', 'ext'
-]));
-
-if (!config.nocache && !config.cachedir) {
-  config.cachedir = path.resolve(os.tmpdir(), '.retire-cache/');
-}
-
-config.ignore = config.ignore ? utils.map(config.ignore.split(','), function(e) { return path.resolve(e); }) : [];
-config.ignore = { paths : config.ignore, descriptors: [] };
-config.colorwarn = config.colors ? colors.red : x => x;
-
-if (!config.ignorefile) {
-  config.ignorefile = defaultIgnoreFiles.filter(function(x){ return fs.existsSync(x); })[0];
-}
-var log = reporting.open(config);
-config.log = log;
-log.info("retire.js v" + retire.version);
-
-function exitWithError(msg) {
-  log.error(config.colorwarn(msg));
-  process.exitCode = 1;
-  log.close();
-}
-
-
-if(!config.severity) {
-  config.severity = 'none';
-} else if (!severityLevels.hasOwnProperty(config.severity)) {
-  exitWithError('Error: Invalid severity level (' + config.severity + '). Valid levels are: ' + Object.keys(severityLevels).join(', '));
-}
-
-if(config.cacert) {
-  if (!fs.existsSync(config.cacert)) {
-    exitWithError('Error: Could not read cacert file: ' + config.cacert);
-  }
-  config.cacertbuf = fs.readFileSync(config.cacert);
-}
-
-if(config.ignorefile) {
-  if (!fs.existsSync(config.ignorefile)) {
-    exitWithError('Error: Could not read ignore file: ' + config.ignorefile);
-  }
-  if (config.ignorefile.substr(-5) === ".json") {
-    try {
-      var ignored = JSON.parse(fs.readFileSync(config.ignorefile).toString());
-    } catch(e) {
-      exitWithError('Error: Invalid ignore file: ' + config.ignorefile, e);
-    }
-    config.ignore.descriptors = ignored;
-    var ignoredPaths = ignored
-      .map(function(x) { return x.path; })
-      .filter(function(x) { return x; });
-    config.ignore.paths = config.ignore.paths.concat(ignoredPaths);
-  } else {
-    var lines = fs.readFileSync(config.ignorefile).toString().split(/\r\n|\n/g).filter(function(e) { return e !== ''; });
-    ignored = utils.map(lines, function(e) { return e[0] === '@' ? e.slice(1) : path.resolve(e); });
-    config.ignore.paths = config.ignore.paths.concat(ignored);
-  }
-}
-config.ignore.paths = config.ignore.paths
-  .map(p => p.replace(/[.+?^${}()|[\]\\]/g, '\\$&'))
-  .map(p => p.replace(/[*]{1,2}/g, (a) => a.length == 2 ? ".*" : "[^/]*"))
-  .map(s => new RegExp(s)
-);
-
-scanner.on('vulnerable-dependency-found', function(result) {
-  vulnsFound = true;
-  var levels = result.results
-    .map(function(r) {
-      return r.vulnerabilities ? r.vulnerabilities.map(function(v) {
-        return severityLevels[v.severity || 'critical'];
-      }) : []; });
-  var severity = utils.flatten(levels).reduce(function(x,y) { return x > y ? x : y; });
-  if(severity >= severityLevels[config.severity]) {
-    failProcess = true;
-  }
-});
-
-scanner.on('vulnerable-dependency-found', log.logVulnerableDependency);
-scanner.on('dependency-found', log.logDependency);
-
-
-events.on('load-js-repo', function() {
-  (config.jsrepo ?
-    (config.jsrepo.match(/^https?:\/\//) ?
-      repo.loadrepository(config.jsrepo, config)
-      : repo.loadrepositoryFromFile(config.jsrepo, config))
-    : repo.loadrepository('https://raw.githubusercontent.com/RetireJS/retire.js/master/repository/jsrepository.json', config)
-  ).on('stop', forward(events, 'stop'))
-  .on('done', function(repo) {
-      jsRepo = repo;
-      events.emit('js-repo-loaded');
-  });
-});
-
-
-events.on('load-node-repo', function() {
-  (config.noderepo ?
-    (config.noderepo.match(/^https?:\/\//) ?
-      repo.loadrepository(config.noderepo, config)
-      : repo.loadrepositoryFromFile(config.noderepo, config))
-    : repo.loadrepository('https://raw.githubusercontent.com/RetireJS/retire.js/master/repository/npmrepository.json', config)
-  ).on('done', function(repo) {
-      nodeRepo = repo;
-      events.emit('node-repo-loaded');
-  }).on('stop', forward(events, 'stop'));
-});
-
-events.on('js-repo-loaded', function() {
-  events.emit(config.js ? 'scan-js' : 'load-node-repo');
-});
-
-events.on('node-repo-loaded', function() {
-  events.emit(config.node ? 'scan-node' : 'scan-js');
-});
-
-
-events.on('scan-js', function() {
-  resolve.scanJsFiles(config.jspath || config.path, config)
-    .on('jsfile', function(file) {
-      scanner.scanJsFile(file, jsRepo, config);
-    })
-    .on('bowerfile', function(bowerfile) {
-      bowerRepo = bowerRepo || repo.asbowerrepo(jsRepo);
-      scanner.scanBowerFile(bowerfile, bowerRepo, config);
-    })
-    .on('end', function() {
-      events.emit('js-scanned');
-    });
-});
-
-events.on('scan-node', function() {
-  console.warn('DEPRECATION NOTICE: The node scanning is deprecated and will be removed soon. See https://github.com/RetireJS/retire.js/wiki/Deprecating-the-node.js-scanner ');
-  resolve.getNodeDependencies(config.nodepath || config.path, config.package).on('done', function(dependencies) {
-    scanner.scanDependencies(dependencies, nodeRepo, config);
-    events.emit('scan-done');
-  }).on('error', function(err) {
-    console.warn("ERROR: " + err);
-    process.exit(1);
-  });
-});
-
-events.on('js-scanned', function() {
-  events.emit(!config.js ? 'scan-node' : 'scan-done');
-});
-
-events.on('scan-done', function() {
-  process.exitCode = failProcess ? (config.exitwith || 13) : 0;
-  log.close();
-});
-
-
-process.on('uncaughtException', function (err) {
-  console.warn('Exception caught: ', arguments);
-  console.warn(err.stack);
-  process.exit(1);
-});
-
-events.on('stop', function() {
-  exitWithError.apply(null, arguments);
-});
-
-if (config.node) {
-  events.emit('load-node-repo');
-} else {
-  events.emit('load-js-repo');
-}