retire 4.0.0 → 4.1.0

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+
+## [4.1.0]
+
+### Additions
+- Option to check results for the component from OSV
+- Option to use more than one JS repository
+
+### Bugfixes
+- Remove dropexternal as it never worked
+
+## [4.0.1]
+
+### Breaking changes
+- Not really a breaking change as the change was introduced in 4.0.0, but node.js >= 14.0.0 is required to run retire.js >= 4.0.0 going forward
+
 ## [4.0.0]
 
 ### Breaking changes

package/README.md

@@ -15,23 +15,24 @@ Usage: retire [options]
 Options:
   -V, --version            output the version number
   -v, --verbose            Show identified files (by default only vulnerable files are shown)
-  -x, --dropexternal       Don't include project provided vulnerability repository
   -c, --nocache            Don't use local cache
   --jspath <path>          Folder to scan for javascript files
   --path <path>            Folder to scan for both
-  --jsrepo <path|url>      Local or internal version of repo
+  --jsrepo <path|url>      Local or internal version of repo. Can be multiple comma separated. Default: 'central')
   --cachedir <path>        Path to use for local cache instead of /tmp/.retire-cache
   --proxy <url>            Proxy url (http://some.host:8080)
   --outputformat <format>  Valid formats: text, json, jsonsimple, depcheck (experimental), cyclonedx and cyclonedxJSON
   --outputpath <path>      File to which output should be written
   --ignore <paths>         Comma delimited list of paths to ignore
   --ignorefile <path>      Custom ignore file, defaults to .retireignore / .retireignore.json
-  --severity <level>       Specify the bug severity level from which the process fails. Allowed levels none, low, medium, high, critical. Default: none
+  --severity <level>       Specify the bug severity level from which the process fails. Allowed levels none, low, medium, high, critical.
+                           Default: none
   --exitwith <code>        Custom exit code (default: 13) when vulnerabilities are found
   --colors                 Enable color output (console output only)
   --insecure               Enable fetching remote jsrepo/noderepo files from hosts using an insecure or self-signed SSL (TLS) certificate
   --ext <extensions>       Comman separated list of file extensions for javascript files. The default is "js"
   --cacert <path>          Use the specified certificate file to verify the peer used for fetching remote jsrepo/noderepo files
+  --includeOsv             Include OSV advisories in the output
   -h, --help               display help for command
 ````
 

package/lib/cli.js

@@ -55,11 +55,10 @@ if (process.argv.includes("--node") || process.argv.includes("-n")) {
 const prg = commander_1.program
     .version(retire.version)
     .option('-v, --verbose', 'Show identified files (by default only vulnerable files are shown)')
-    .option('-x, --dropexternal', "Don't include project provided vulnerability repository")
     .option('-c, --nocache', "Don't use local cache")
     .option('--jspath <path>', 'Folder to scan for javascript files')
     .option('--path <path>', 'Folder to scan for both')
-    .option('--jsrepo <path|url>', 'Local or internal version of repo')
+    .option('--jsrepo <path|url>', 'Local or internal version of repo. Can be multiple comma separated. Default: \'central\')')
     .option('--cachedir <path>', 'Path to use for local cache instead of /tmp/.retire-cache')
     .option('--proxy <url>', 'Proxy url (http://some.host:8080)')
     .option('--outputformat <format>', 'Valid formats: text, json, jsonsimple, depcheck (experimental), cyclonedx and cyclonedxJSON')
@@ -72,20 +71,22 @@ const prg = commander_1.program
     .option('--insecure', 'Enable fetching remote jsrepo/noderepo files from hosts using an insecure or self-signed SSL (TLS) certificate')
     .option('--ext <extensions>', 'Comman separated list of file extensions for javascript files. The default is "js"')
     .option('--cacert <path>', 'Use the specified certificate file to verify the peer used for fetching remote jsrepo/noderepo files')
+    .option('--includeOsv', 'Include OSV advisories in the output')
     .parse()
     .opts();
 const colorwarn = prg.colors ? ansi_colors_1.default.red : (x) => x;
-const jsrepolocation = (_a = prg.jsrepo) !== null && _a !== void 0 ? _a : "https://raw.githubusercontent.com/RetireJS/retire.js/master/repository/jsrepository.json";
+const jsrepolocation = ((_a = prg.jsrepo) !== null && _a !== void 0 ? _a : "'central'").split(",")
+    .map((x) => x === "'central'" ? "https://raw.githubusercontent.com/RetireJS/retire.js/master/repository/jsrepository.json" : x);
 const ignorefile = (_b = prg.ignoreFile) !== null && _b !== void 0 ? _b : defaultIgnoreFiles.filter((x) => fs_1.default.existsSync(x))[0];
 const scanpath = (_c = prg.path) !== null && _c !== void 0 ? _c : ".";
 const log = reporting.open({
     colors: !!prg.colors,
     colorwarn,
-    jsRepo: jsrepolocation,
+    jsRepo: jsrepolocation.join(", "),
     outputformat: prg.outputformat,
     outputpath: prg.outputpath,
     path: scanpath,
-    verbose: !!prg.verbose
+    verbose: !!prg.verbose,
 });
 const severity = (_d = prg.severity) !== null && _d !== void 0 ? _d : "none";
 if (!(severity in types_1.severityLevels)) {
@@ -103,7 +104,9 @@ const config = {
     cachedir: (_h = prg.cachedir) !== null && _h !== void 0 ? _h : path_1.default.resolve(os_1.default.tmpdir(), '.retire-cache/'),
     log: log,
     severity: severity,
-    exitwith: (_j = prg.exitwith) !== null && _j !== void 0 ? _j : 13
+    exitwith: (_j = prg.exitwith) !== null && _j !== void 0 ? _j : 13,
+    includeOsv: !!prg.includeOsv,
+    verbose: !!prg.verbose,
 };
 log.info(`retire.js v${retire.version}`);
 function exitWithError(msg) {
@@ -177,17 +180,20 @@ process.on('uncaughtException', (err, ...rest) => {
 events.on('stop', (err) => {
     exitWithError(err);
 });
-(jsrepolocation.match(/^https?:\/\//)
-    ? repo.loadrepository(jsrepolocation, config)
-    : repo.loadrepositoryFromFile(jsrepolocation, config))
-    .then((jsRepo) => {
+Promise.all(jsrepolocation.map((jsr) => (jsr.match(/^https?:\/\//)
+    ? repo.loadrepository(jsr, config)
+    : repo.loadrepositoryFromFile(jsr, config)))).then((jsRepos) => {
     resolve.scanJsFiles(config.path, config)
         .on('jsfile', (file) => {
-        scanner.scanJsFile(file, jsRepo, config);
+        jsRepos.forEach((jsRepo) => {
+            scanner.scanJsFile(file, jsRepo, config);
+        });
     })
         .on('bowerfile', (bowerfile) => {
-        const bowerRepo = repo.asbowerrepo(jsRepo);
-        scanner.scanBowerFile(bowerfile, bowerRepo, config);
+        jsRepos.forEach((jsRepo) => {
+            const bowerRepo = repo.asbowerrepo(jsRepo);
+            scanner.scanBowerFile(bowerfile, bowerRepo, config);
+        });
     })
         .on('end', () => {
         events.emit('scan-done');

package/lib/depsdev.d.ts

@@ -0,0 +1,3 @@
+import { Options } from "./types";
+import { Vulnerability } from "./types";
+export declare function checkOSV(packageName: string, version: string, options: Options): Promise<Vulnerability[]>;

package/lib/depsdev.js

@@ -0,0 +1,78 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkOSV = void 0;
+const https_1 = __importDefault(require("https"));
+const retire_1 = require("./retire");
+function loadJson(url, options) {
+    options.log.debug("Downloading " + url + " ...");
+    return new Promise((resolve, reject) => {
+        const req = https_1.default.request(url, res => {
+            const data = [];
+            res.on('data', c => data.push(c));
+            res.on('end', () => {
+                const result = Buffer.concat(data).toString();
+                resolve(JSON.parse(result));
+            });
+        });
+        req.on('error', err => {
+            reject(err);
+        });
+        req.end();
+    });
+}
+function getVulnerabilities(packageName, version, options) {
+    return loadJson(`https://api.deps.dev/v3alpha/systems/npm/packages/${packageName}/versions/${version}`, options);
+}
+function scoreToSeverity(score) {
+    if (score > 7)
+        return "high";
+    if (score > 4)
+        return "medium";
+    return "low";
+}
+function loadAdvisory(packageName, version, id, options) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const osvAdvisory = yield loadJson(`https://api.osv.dev/v1/vulns/${id}`, options);
+        const advisory = yield loadJson(`https://api.deps.dev/v3alpha/advisories/${id}`, options);
+        const simplifiedRepo = {
+            [packageName]: {
+                vulnerabilities: osvAdvisory.affected.map(({ ranges }) => ranges.map(({ events }) => ({
+                    atOrAbove: events[0].introduced,
+                    below: events[0].fixed,
+                    severity: scoreToSeverity(advisory.cvss3Score),
+                    identifiers: {
+                        githubID: id,
+                        CVE: osvAdvisory.aliases.filter(x => x.startsWith("CVE-")),
+                        summary: advisory.title
+                    },
+                    info: osvAdvisory.references.map(({ url }) => url)
+                }))).reduce((a, b) => a.concat(b), []),
+                extractors: {}
+            }
+        };
+        return (0, retire_1.check)(packageName, version, simplifiedRepo);
+    });
+}
+function checkOSV(packageName, version, options) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const versionInfo = yield getVulnerabilities(packageName, version, options);
+        if (versionInfo.advisoryKeys.length == 0)
+            return [];
+        const comps = yield Promise.all(versionInfo.advisoryKeys.map(({ id }) => loadAdvisory(packageName, version, id, options)));
+        const flattened = comps.reduce((a, b) => a.concat(b), []);
+        return flattened.map(x => { var _a; return (_a = x.vulnerabilities) !== null && _a !== void 0 ? _a : []; }).reduce((a, b) => a.concat(b), []);
+    });
+}
+exports.checkOSV = checkOSV;

package/lib/reporters/console.js

@@ -53,8 +53,8 @@ function printVulnerability(component, config) {
             string += `severity: ${vulnerability.severity}; `;
         }
         if (vulnerability.identifiers) {
-            string += Object.entries(vulnerability.identifiers).map(([id, name]) => {
-                return `${name}: ${utils.flatten([[id]]).join(' ')}`;
+            string += Object.entries(vulnerability.identifiers).map(([name, id]) => {
+                return `${name}: ${utils.flatten([Array.isArray(id) ? id : [id]]).join(' ')}`;
             }).join(', ') + '; ';
         }
         string += vulnerability.info.join(config.outputformat === 'clean' ? '\n' : ' ');

package/lib/retire.js

@@ -4,7 +4,7 @@
  */
 
 var exports = exports || {};
-exports.version = '4.0.0';
+exports.version = '4.1.0';
 
 function isDefined(o) {
 	return typeof o !== 'undefined';
@@ -100,15 +100,6 @@ function check(results, repo) {
 	return results;
 }
 
-function unique(ar) {
-	var r = [];
-	ar.forEach(function(e) { 
-		if (r.indexOf(e) == -1) r.push(e);
-	});
-	return r;
-}
-
-
 function isAtOrAbove(version1, version2) {
 	var v1 = version1.split(/[\.\-]/g);
 	var v2 = version2.split(/[\.\-]/g);
@@ -144,7 +135,7 @@ exports.replaceVersion = function(jsRepoJsonAsText) {
 
 exports.isVulnerable = function(results) {
 	for (var r in results) {
-		if (results[r].hasOwnProperty('vulnerabilities')) return true;
+		if (results[r].hasOwnProperty('vulnerabilities') && results[r].vulnerabilities != undefined && results[r].vulnerabilities.length > 0) return true;
 	}
 	return false;
 };

package/lib/scanner.js

@@ -29,6 +29,7 @@ const retire = __importStar(require("./retire"));
 const fs = __importStar(require("fs"));
 const crypto = __importStar(require("crypto"));
 const path = __importStar(require("path"));
+const depsdev_1 = require("./depsdev");
 const events = new events_1.EventEmitter();
 const hash = {
     'sha1': (data) => {
@@ -38,6 +39,35 @@ const hash = {
     }
 };
 function emitResults(finding, options) {
+    if (options.includeOsv === true) {
+        Promise
+            .all(finding.results.map((r) => (0, depsdev_1.checkOSV)(r.component, r.version, options).then(v => { var _a; return r.vulnerabilities = ((_a = r.vulnerabilities) !== null && _a !== void 0 ? _a : []).concat(v); })))
+            .then(() => filterAndEmitResults(finding, options));
+    }
+    else {
+        filterAndEmitResults(finding, options);
+    }
+}
+function getIdentifiers(v) {
+    var _a, _b, _c, _d, _e, _f, _g, _h;
+    return ((_b = (_a = v.identifiers) === null || _a === void 0 ? void 0 : _a.CVE) !== null && _b !== void 0 ? _b : [])
+        .concat((_d = (_c = v.identifiers) === null || _c === void 0 ? void 0 : _c.bug) !== null && _d !== void 0 ? _d : [])
+        .concat((_f = (_e = v.identifiers) === null || _e === void 0 ? void 0 : _e.issue) !== null && _f !== void 0 ? _f : [])
+        .concat((_h = (_g = v.identifiers) === null || _g === void 0 ? void 0 : _g.githubID) !== null && _h !== void 0 ? _h : []);
+}
+function uniqueVulnerabilities(vulnerabilities) {
+    if (!vulnerabilities)
+        return undefined;
+    const unique = [];
+    for (const v of vulnerabilities) {
+        if (!unique.some(u => getIdentifiers(u).some(i => getIdentifiers(v).includes(i)))) {
+            unique.push(v);
+        }
+    }
+    return unique;
+}
+function filterAndEmitResults(finding, options) {
+    finding.results.forEach(r => r.vulnerabilities = uniqueVulnerabilities(r.vulnerabilities));
     if (options.ignore)
         removeIgnored(finding.results, options.ignore);
     if (!options.verbose)

package/lib/types.d.ts

@@ -21,6 +21,7 @@ export type Vulnerability = {
         bug?: string;
         issue?: string;
         summary?: string;
+        githubID?: string;
     };
     info: string[];
 };
@@ -79,5 +80,6 @@ export type Options = {
     jsRepo?: string;
     path: string;
     exitwith: number;
+    includeOsv?: boolean;
 };
 export {};

package/package.json

@@ -2,7 +2,7 @@
   "author": "Erlend Oftedal <erlend@oftedal.no>",
   "name": "retire",
   "description": "Retire is a tool for detecting use of vulnerable libraries",
-  "version": "4.0.0",
+  "version": "4.1.0",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",
@@ -42,7 +42,7 @@
     "check": "npm run lint && npm run typecheck"
   },
   "engines": {
-    "node": ">= 6.0.0"
+    "node": ">= 14.0.0"
   },
   "keywords": [
     "sbom",