retire 4.1.0 → 4.2.0

package/lib/reporters/depcheck.js

@@ -30,13 +30,17 @@ function configureDepCheckLogger(logger, writer, config, hash) {
     let vulnsFound = false;
     const finalResults = {
         version: retire.version,
-        start: new Date().toISOString().replace("Z", "+0000"),
+        start: new Date().toISOString().replace('Z', '+0000'),
         data: [],
         messages: [],
-        errors: []
+        errors: [],
     };
     logger.info = finalResults.messages.push;
-    logger.debug = config.verbose ? finalResults.messages.push : () => { return; };
+    logger.debug = config.verbose
+        ? finalResults.messages.push
+        : () => {
+            return;
+        };
     logger.warn = logger.error = finalResults.errors.push;
     logger.logVulnerableDependency = (finding) => {
         vulnsFound = true;
@@ -53,7 +57,7 @@ function configureDepCheckLogger(logger, writer, config, hash) {
 <analysis xmlns="https://jeremylong.github.io/DependencyCheck/dependency-check.2.3.xsd">
   <scanInfo>
     <engineVersion>${retire.version}</engineVersion>
-    <dataSource><name>${config.jsRepo || "Retire.js github js repo"}</name><timestamp>${finalResults.start}</timestamp></dataSource>
+    <dataSource><name>${config.jsRepo || 'Retire.js github js repo'}</name><timestamp>${finalResults.start}</timestamp></dataSource>
    </scanInfo>
    <projectInfo>
    	<name>${config.path}</name>
@@ -61,11 +65,14 @@ function configureDepCheckLogger(logger, writer, config, hash) {
     <credits>retire.js</credits>
    </projectInfo>
    <dependencies>`);
-        write(finalResults.data.filter(d => d.results).map(r => r.results.map((dep, i) => {
+        write(finalResults.data
+            .filter((d) => d.results)
+            .map((r) => r.results
+            .map((dep, i) => {
             const filepath = r.file;
             if (!filepath)
                 return;
-            const filename = filepath.split("/").slice(-1);
+            const filename = filepath.split('/').slice(-1);
             const file = fs.readFileSync(filepath);
             const md5 = hash.md5(file);
             const sha1 = hash.sha1(file);
@@ -86,17 +93,21 @@ function configureDepCheckLogger(logger, writer, config, hash) {
           <description>(${dep.component}:${dep.version})</description>
           <id>${i}</id>
         </package>`;
-            const vulns = dep.vulnerabilities && dep.vulnerabilities.length > 0 ? dep.vulnerabilities.map(v => {
-                const references = v.info.map(i => `
+            const vulns = dep.vulnerabilities && dep.vulnerabilities.length > 0
+                ? dep.vulnerabilities
+                    .map((v) => {
+                    const references = v.info
+                        .map((i) => `
             <reference>
               <source>Retire.js</source>
               <url>${i}</url>
               <name>${i}</name>
-            </reference>`).join("");
-                //  const id = [v.identifiers && v.identifiers.CVE && v.identifiers.CVE[0], v.identifiers && v.identifiers.issue, dep.component + '@' + v.info[0]]	
-                //  .filter(n => n !== null)[0];
-                //TODO: Fix CVSS stuff - add to repo? add id to every bug in repo?
-                return `
+            </reference>`)
+                        .join('');
+                    //  const id = [v.identifiers && v.identifiers.CVE && v.identifiers.CVE[0], v.identifiers && v.identifiers.issue, dep.component + '@' + v.info[0]]
+                    //  .filter(n => n !== null)[0];
+                    //TODO: Fix CVSS stuff - add to repo? add id to every bug in repo?
+                    return `
         <vulnerability source="retire">
           <name>${dep.component}:${dep.version}</name>
           <cvssV2>
@@ -107,16 +118,18 @@ function configureDepCheckLogger(logger, writer, config, hash) {
             <confidentialImpact>PARTIAL</confidentialImpact>
             <integrityImpact>PARTIAL</integrityImpact>
             <availabilityImpact>PARTIAL</availabilityImpact>
-            <severity>${v.severity || "medium"}</severity>
+            <severity>${v.severity || 'medium'}</severity>
           </cvssV2>
-          <description>${v.identifiers && v.identifiers.summary || "None"}</description>
+          <description>${(v.identifiers && v.identifiers.summary) || 'None'}</description>
           <references>${references}
           </references>
           <vulnerableSoftware>
-              <software>${v.atOrAbove ? "&gt;= " + v.atOrAbove : ""} &lt; ${v.below}</software>
+              <software>${v.atOrAbove ? '&gt;= ' + v.atOrAbove : ''} &lt; ${v.below}</software>
           </vulnerableSoftware>
         </vulnerability>`;
-            }).join('') : "";
+                })
+                    .join('')
+                : '';
             return `    <dependency>
       <fileName>${filename}</fileName>
       <filePath>${filepath}</filePath>
@@ -130,12 +143,14 @@ function configureDepCheckLogger(logger, writer, config, hash) {
       <vulnerabilities>${vulns}
       </vulnerabilities>
     </dependency>`;
-        }).join("\n")).join("\n"));
+        })
+            .join('\n'))
+            .join('\n'));
         write(`  </dependencies>
 </analysis>`);
         writer.close(callback);
     };
 }
 exports.default = {
-    configure: configureDepCheckLogger
+    configure: configureDepCheckLogger,
 };

package/lib/reporters/json.d.ts

@@ -1,3 +1,3 @@
-import { ConfigurableLogger } from "../reporting";
+import { ConfigurableLogger } from '../reporting';
 declare const _default: ConfigurableLogger;
 export default _default;

package/lib/reporters/json.js

@@ -34,10 +34,14 @@ exports.default = {
             data: [],
             messages: [],
             errors: [],
-            time: undefined
+            time: undefined,
         };
         logger.info = finalResults.messages.push;
-        logger.debug = config.verbose ? finalResults.messages.push : () => { return; };
+        logger.debug = config.verbose
+            ? finalResults.messages.push
+            : () => {
+                return;
+            };
         logger.warn = logger.error = (message) => finalResults.errors.push(message);
         logger.logVulnerableDependency = (finding) => {
             finalResults.data.push(finding);
@@ -49,9 +53,9 @@ exports.default = {
         };
         logger.close = function (callback) {
             finalResults.time = (Date.now() - scanStart) / 1000;
-            const res = (config.outputformat === "jsonsimple") ? finalResults.data : finalResults;
+            const res = config.outputformat === 'jsonsimple' ? finalResults.data : finalResults;
             writer.out(JSON.stringify(res));
             writer.close(callback);
         };
-    }
+    },
 };

package/lib/reporting.d.ts

@@ -1,5 +1,5 @@
 /// <reference types="node" />
-import { Finding } from "./types";
+import { Finding } from './types';
 export type LoggerOptions = {
     outputpath: string;
     verbose: boolean;
@@ -17,7 +17,7 @@ export type Hasher = {
 };
 export declare const hash: Hasher;
 export type Writer = {
-    out: (...args: Parameters<typeof console["log"]>) => void;
+    out: (...args: Parameters<(typeof console)['log']>) => void;
     err: (x: string) => void;
     close: (callback?: () => void) => void;
 };

package/lib/reporting.js

@@ -42,9 +42,11 @@ const loggers = {
     cyclonedx: cyclonedx_1.default,
     cyclonedxJSON: cyclonedx_json_1.default,
     clean: console_1.default,
-    jsonsimple: json_1.default
+    jsonsimple: json_1.default,
+};
+let colorwarn = (x) => {
+    return x;
 };
-let colorwarn = (x) => { return x; };
 let verbose = false;
 function hashContent(hash, content) {
     const h = crypto.createHash(hash);
@@ -59,31 +61,46 @@ exports.hash = {
 };
 const writer = {
     out: console.log,
-    err: (x) => { console.warn(colorwarn(x)); },
-    close: () => { return; }
+    err: (x) => {
+        console.warn(colorwarn(x));
+    },
+    close: () => {
+        return;
+    },
 };
 const logger = {
-    info: (x) => { writer.out(x); },
-    debug: (x) => { if (verbose)
-        writer.out(x); },
-    warn: (x) => { writer.err(x); },
-    error: (x) => { writer.err(x); },
-    logDependency: () => { return; },
-    logVulnerableDependency: () => { return; },
-    close: () => writer.close()
+    info: (x) => {
+        writer.out(x);
+    },
+    debug: (x) => {
+        if (verbose)
+            writer.out(x);
+    },
+    warn: (x) => {
+        writer.err(x);
+    },
+    error: (x) => {
+        writer.err(x);
+    },
+    logDependency: () => {
+        return;
+    },
+    logVulnerableDependency: () => {
+        return;
+    },
+    close: () => writer.close(),
 };
-;
 function configureFileWriter(config) {
     if (!config.outputpath)
         return;
-    const fileDescriptor = fs.openSync(config.outputpath, "w");
+    const fileDescriptor = fs.openSync(config.outputpath, 'w');
     if (fileDescriptor < 0) {
         console.error(`Could not open ${config.outputpath} for writing`);
         process.exit(9);
     }
     const fileOutput = {
         fileDescriptor,
-        stream: fs.createWriteStream('', { fd: fileDescriptor, autoClose: false })
+        stream: fs.createWriteStream('', { fd: fileDescriptor, autoClose: false }),
     };
     const writeToFile = (message) => {
         fileOutput.stream.write(message);
@@ -102,7 +119,7 @@ function open(config) {
     verbose = (_a = config.verbose) !== null && _a !== void 0 ? _a : false;
     if (config.colors)
         colorwarn = config.colorwarn;
-    const format = config.outputformat || "console";
+    const format = config.outputformat || 'console';
     if (!(format in loggers)) {
         console.warn(`Invalid outputformat: ${format}`);
         process.exit(1);
@@ -112,4 +129,3 @@ function open(config) {
     return logger;
 }
 exports.open = open;
-;

package/lib/resolve.d.ts

@@ -1,4 +1,4 @@
 /// <reference types="node" />
-import { EventEmitter as Emitter } from "events";
-import { Options } from "./types";
+import { EventEmitter as Emitter } from 'events';
+import { Options } from './types';
 export declare function scanJsFiles(path: string, options: Options): Emitter;

package/lib/resolve.js

@@ -27,8 +27,8 @@ exports.scanJsFiles = void 0;
 const fs = __importStar(require("fs"));
 const walkdir = __importStar(require("walkdir"));
 function scanJsFiles(path, options) {
-    const finder = walkdir.find(path, { "follow_symlinks": false, "no_return": true });
-    const ext = (options.ext || "js").split(",").map((e) => `.${e}`);
+    const finder = walkdir.find(path, { follow_symlinks: false, no_return: true });
+    const ext = (options.ext || 'js').split(',').map((e) => `.${e}`);
     function onFile(file) {
         if (ext.some((e) => file.endsWith(e))) {
             finder.emit('jsfile', file);

package/lib/retire.js

@@ -1,166 +1,163 @@
-/* 
- * This file is used by the browser plugins and the Cli scanner and thus 
- * cannot have any external dependencies (no require)	
+/*
+ * This file is used by the browser plugins and the Cli scanner and thus
+ * cannot have any external dependencies (no require)
  */
 
 var exports = exports || {};
-exports.version = '4.1.0';
+exports.version = '4.2.0';
 
 function isDefined(o) {
-	return typeof o !== 'undefined';
+  return typeof o !== 'undefined';
 }
 
-function uniq(results){
-	var keys = {};
-	return results.filter(function(r) {
-		var k = r.component + ' ' + r.version;
-		keys[k] = keys[k] || 0;
-		return keys[k]++ === 0;
-	});
+function uniq(results) {
+  var keys = {};
+  return results.filter(function (r) {
+    var k = r.component + ' ' + r.version;
+    keys[k] = keys[k] || 0;
+    return keys[k]++ === 0;
+  });
 }
 
 function scan(data, extractor, repo, matcher) {
-	matcher = matcher || simpleMatch;
-	var detected = [];
-	for (var component in repo) {
-		var extractors = repo[component].extractors[extractor];
-		if (!isDefined(extractors)) continue;
-		for (var i in extractors) {
-			var match = matcher(extractors[i], data);
-			if (match) {
-				match = match.replace(/(\.|-)min$/, "");
-				detected.push({ version: match, component: component, detection: extractor });
-			}
-		}
-	}
-	return uniq(detected);
+  matcher = matcher || simpleMatch;
+  var detected = [];
+  for (var component in repo) {
+    var extractors = repo[component].extractors[extractor];
+    if (!isDefined(extractors)) continue;
+    for (var i in extractors) {
+      var match = matcher(extractors[i], data);
+      if (match) {
+        match = match.replace(/(\.|-)min$/, '');
+        detected.push({ version: match, component: component, detection: extractor });
+      }
+    }
+  }
+  return uniq(detected);
 }
 
 function simpleMatch(regex, data) {
-	var re = new RegExp(regex);
-	var match = re.exec(data);
-	return match ? match[1] : null;
+  var re = new RegExp(regex);
+  var match = re.exec(data);
+  return match ? match[1] : null;
 }
 function replacementMatch(regex, data) {
-	var ar = /^\/(.*[^\\])\/([^\/]+)\/$/.exec(regex);
-	var re = new RegExp(ar[1]);
-	var match = re.exec(data);
-	var ver = null;
-	if (match) {
-		ver = match[0].replace(new RegExp(ar[1]), ar[2]);
-		return ver;
-	}
-	return null;
+  var ar = /^\/(.*[^\\])\/([^\/]+)\/$/.exec(regex);
+  var re = new RegExp(ar[1]);
+  var match = re.exec(data);
+  var ver = null;
+  if (match) {
+    ver = match[0].replace(new RegExp(ar[1]), ar[2]);
+    return ver;
+  }
+  return null;
 }
 
 function splitAndMatchAll(tokenizer) {
-  return function(regex, data) {
-		var elm = data.split(tokenizer).pop();
-		return simpleMatch('^' + regex + '$', elm);
+  return function (regex, data) {
+    var elm = data.split(tokenizer).pop();
+    return simpleMatch('^' + regex + '$', elm);
   };
 }
 
-
-
 function scanhash(hash, repo) {
-	for (var component in repo) {
-		var hashes = repo[component].extractors.hashes;
-		if (!isDefined(hashes)) continue;
-		if (hashes.hasOwnProperty(hash)) {
-			return [{ version: hashes[hash], component: component, detection: 'hash' }];
-		}
-	}
-	return [];
+  for (var component in repo) {
+    var hashes = repo[component].extractors.hashes;
+    if (!isDefined(hashes)) continue;
+    if (hashes.hasOwnProperty(hash)) {
+      return [{ version: hashes[hash], component: component, detection: 'hash' }];
+    }
+  }
+  return [];
 }
 
-
-
 function check(results, repo) {
-	for (var r in results) {
-		var result = results[r];
-		if (!isDefined(repo[result.component])) continue;
-		var vulns = repo[result.component].vulnerabilities;
-		for (var i in vulns) {
-			if (!isDefined(vulns[i].below) || !isAtOrAbove(result.version, vulns[i].below)) {
-				if (isDefined(vulns[i].atOrAbove) && !isAtOrAbove(result.version, vulns[i].atOrAbove)) {
-					continue;
-				}
-				var vulnerability = { info : vulns[i].info, below: vulns[i].below, atOrAbove: vulns[i].atOrAbove };
-				if (vulns[i].severity) {
-					vulnerability.severity = vulns[i].severity;
-				}
-				if (vulns[i].identifiers) {
-					vulnerability.identifiers = vulns[i].identifiers;
-				}
-				result.vulnerabilities = result.vulnerabilities || [];
-				result.vulnerabilities.push(vulnerability);
-			}
-		}
-	}
-	return results;
+  for (var r in results) {
+    var result = results[r];
+    if (!isDefined(repo[result.component])) continue;
+    var vulns = repo[result.component].vulnerabilities;
+    for (var i in vulns) {
+      if (!isDefined(vulns[i].below) || !isAtOrAbove(result.version, vulns[i].below)) {
+        if (isDefined(vulns[i].atOrAbove) && !isAtOrAbove(result.version, vulns[i].atOrAbove)) {
+          continue;
+        }
+        var vulnerability = { info: vulns[i].info, below: vulns[i].below, atOrAbove: vulns[i].atOrAbove };
+        if (vulns[i].severity) {
+          vulnerability.severity = vulns[i].severity;
+        }
+        if (vulns[i].identifiers) {
+          vulnerability.identifiers = vulns[i].identifiers;
+        }
+        result.vulnerabilities = result.vulnerabilities || [];
+        result.vulnerabilities.push(vulnerability);
+      }
+    }
+  }
+  return results;
 }
 
 function isAtOrAbove(version1, version2) {
-	var v1 = version1.split(/[\.\-]/g);
-	var v2 = version2.split(/[\.\-]/g);
-	var l = v1.length > v2.length ? v1.length : v2.length;
-	for (var i = 0; i < l; i++) {
-		var v1_c = toComparable(v1[i]);
-		var v2_c = toComparable(v2[i]);
-		if (typeof v1_c !== typeof v2_c) return typeof v1_c === 'number';
-		if (v1_c > v2_c) return true;
-		if (v1_c < v2_c) return false;
-	}
-	return true;
+  var v1 = version1.split(/[\.\-]/g);
+  var v2 = version2.split(/[\.\-]/g);
+  var l = v1.length > v2.length ? v1.length : v2.length;
+  for (var i = 0; i < l; i++) {
+    var v1_c = toComparable(v1[i]);
+    var v2_c = toComparable(v2[i]);
+    if (typeof v1_c !== typeof v2_c) return typeof v1_c === 'number';
+    if (v1_c > v2_c) return true;
+    if (v1_c < v2_c) return false;
+  }
+  return true;
 }
 
 function toComparable(n) {
-	if (!isDefined(n)) return 0;
-	if (n.match(/^[0-9]+$/)) {
-		return parseInt(n, 10);
-	}
-	return n;
+  if (!isDefined(n)) return 0;
+  if (n.match(/^[0-9]+$/)) {
+    return parseInt(n, 10);
+  }
+  return n;
 }
 
-
 //------- External API -------
 
-exports.check = function(component, version, repo) {
-	return check([{component: component, version: version}], repo);
+exports.check = function (component, version, repo) {
+  return check([{ component: component, version: version }], repo);
 };
 
-exports.replaceVersion = function(jsRepoJsonAsText) {
-	return jsRepoJsonAsText.replace(/§§version§§/g, '[0-9][0-9.a-z_\\\\-]+');
+exports.replaceVersion = function (jsRepoJsonAsText) {
+  return jsRepoJsonAsText.replace(/§§version§§/g, '[0-9][0-9.a-z_\\\\-]+');
 };
 
-exports.isVulnerable = function(results) {
-	for (var r in results) {
-		if (results[r].hasOwnProperty('vulnerabilities') && results[r].vulnerabilities != undefined && results[r].vulnerabilities.length > 0) return true;
-	}
-	return false;
+exports.isVulnerable = function (results) {
+  for (var r in results) {
+    if (
+      results[r].hasOwnProperty('vulnerabilities') &&
+      results[r].vulnerabilities != undefined &&
+      results[r].vulnerabilities.length > 0
+    )
+      return true;
+  }
+  return false;
 };
 
-exports.scanUri = function(uri, repo) {
-	var result = scan(uri, 'uri', repo);
-	return check(result, repo);
+exports.scanUri = function (uri, repo) {
+  var result = scan(uri, 'uri', repo);
+  return check(result, repo);
 };
 
-exports.scanFileName = function(fileName, repo) {
-	var result = scan(fileName, 'filename', repo, splitAndMatchAll('/'));
-	return check(result, repo);
+exports.scanFileName = function (fileName, repo) {
+  var result = scan(fileName, 'filename', repo, splitAndMatchAll('/'));
+  return check(result, repo);
 };
 
-exports.scanFileContent = function(content, repo, hasher) {
-	var normalizedContent = content.toString().replace(/(\r\n|\r)/g, "\n");
-	var result = scan(normalizedContent, 'filecontent', repo);
-	if (result.length === 0) {
-		result = scan(normalizedContent, 'filecontentreplace', repo, replacementMatch);
-	}
-	if (result.length === 0) {
-		result = scanhash(hasher.sha1(normalizedContent), repo);
-	}
-	return check(result, repo);
+exports.scanFileContent = function (content, repo, hasher) {
+  var normalizedContent = content.toString().replace(/(\r\n|\r)/g, '\n');
+  var result = scan(normalizedContent, 'filecontent', repo);
+  if (result.length === 0) {
+    result = scan(normalizedContent, 'filecontentreplace', repo, replacementMatch);
+  }
+  if (result.length === 0) {
+    result = scanhash(hasher.sha1(normalizedContent), repo);
+  }
+  return check(result, repo);
 };
-
-
-

package/lib/scanner.d.ts

@@ -1,4 +1,4 @@
-import { Finding, Options, Repository } from "./types";
+import { Finding, Options, Repository } from './types';
 export declare function scanJsFile(file: string, repo: Repository, options: Options): void;
 export declare function scanBowerFile(file: string, repo: Repository, options: Options): void;
 export declare function on(event: 'vulnerable-dependency-found' | 'dependency-found', handler: (finding: Finding) => void): void;