retire 4.2.2 → 4.2.3

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## [4.2.3]
+
+### Bugfix
+
+- Generate correct purl for moment.js
+
 ## [4.2.2]
 
 ### Bugfix

package/lib/repo.js

@@ -125,7 +125,7 @@ function loadFromCache(url, cachedir, options) {
 function asbowerrepo(jsRepo) {
     const result = {};
     Object.keys(jsRepo).map((k) => {
-        [jsRepo[k].bowername || k].map((b) => {
+        (jsRepo[k].bowername || [k]).map((b) => {
             result[b] = result[b] || { vulnerabilities: [] };
             result[b].vulnerabilities = result[b].vulnerabilities.concat(jsRepo[k].vulnerabilities);
         });

package/lib/reporters/cyclonedx-json.js

@@ -27,6 +27,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const retire = __importStar(require("../retire"));
 const fs = __importStar(require("fs"));
 const uuid_1 = require("uuid");
+const utils_1 = require("./utils");
 function configureCycloneDXJSONLogger(logger, writer, config, hash) {
     let vulnsFound = false;
     const finalResults = {
@@ -71,7 +72,7 @@ function configureCycloneDXJSONLogger(logger, writer, config, hash) {
                     { alg: 'SHA-512', content: hash.sha512(file) },
                 ];
             }
-            const purl = `pkg:npm/${dep.component}@${dep.version}`;
+            const purl = (0, utils_1.generatePURL)(dep);
             if (seen.has(purl))
                 return undefined;
             seen.add(purl);
@@ -84,7 +85,7 @@ function configureCycloneDXJSONLogger(logger, writer, config, hash) {
             };
         })
             .filter((x) => x != undefined))
-            .reduce((a, b) => a.concat(b));
+            .reduce((a, b) => a.concat(b), []);
         write(JSON.stringify({
             bomFormat: 'CycloneDX',
             specVersion: '1.4',

package/lib/reporters/cyclonedx.js

@@ -27,6 +27,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const retire = __importStar(require("../retire"));
 const fs = __importStar(require("fs"));
 const uuid_1 = require("uuid");
+const utils_1 = require("./utils");
 function configureCycloneDXLogger(logger, writer, config, hash) {
     let vulnsFound = false;
     const finalResults = {
@@ -72,7 +73,7 @@ function configureCycloneDXLogger(logger, writer, config, hash) {
             <hash alg="SHA-512">${hash.sha512(file)}</hash>
           </hashes>`;
             }
-            const purl = `pkg:npm/${dep.component}@${dep.version}`;
+            const purl = (0, utils_1.generatePURL)(dep);
             if (seen.has(purl))
                 return '';
             seen.add(purl);

package/lib/reporters/utils.d.ts

@@ -0,0 +1,2 @@
+import { Component } from '../types';
+export declare function generatePURL(component: Component): string;

package/lib/reporters/utils.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.generatePURL = void 0;
+function generatePURL(component) {
+    const compName = component.npmname || component.component;
+    return `pkg:npm/${compName}@${component.version}`;
+}
+exports.generatePURL = generatePURL;

package/lib/retire.js

@@ -4,7 +4,7 @@
  */
 
 var exports = exports || {};
-exports.version = '4.2.2';
+exports.version = '4.2.3';
 
 function isDefined(o) {
   return typeof o !== 'undefined';
@@ -29,7 +29,7 @@ function scan(data, extractor, repo, matcher) {
       var match = matcher(extractors[i], data);
       if (match) {
         match = match.replace(/(\.|-)min$/, '');
-        detected.push({ version: match, component: component, detection: extractor });
+        detected.push({ version: match, component: component, npmname: repo[component].npmname, detection: extractor });
       }
     }
   }
@@ -65,7 +65,7 @@ function scanhash(hash, repo) {
     var hashes = repo[component].extractors.hashes;
     if (!isDefined(hashes)) continue;
     if (hashes.hasOwnProperty(hash)) {
-      return [{ version: hashes[hash], component: component, detection: 'hash' }];
+      return [{ version: hashes[hash], component: component, npmname: repo[component].npmname, detection: 'hash' }];
     }
   }
   return [];
@@ -76,6 +76,7 @@ function check(results, repo) {
     var result = results[r];
     if (!isDefined(repo[result.component])) continue;
     var vulns = repo[result.component].vulnerabilities;
+    result.npmname = repo[result.component].npmname;
     for (var i in vulns) {
       if (!isDefined(vulns[i].below) || !isAtOrAbove(result.version, vulns[i].below)) {
         if (isDefined(vulns[i].atOrAbove) && !isAtOrAbove(result.version, vulns[i].atOrAbove)) {

package/lib/types.d.ts

@@ -1,7 +1,8 @@
 /// <reference types="node" />
 import { Logger } from './reporting';
 export type Repository = Record<string, {
-    bowername?: string;
+    bowername?: string[];
+    npmname?: string;
     vulnerabilities: Vulnerability[];
     extractors: {
         func?: string[];
@@ -28,6 +29,7 @@ export type Vulnerability = {
 };
 export type Component = {
     component: string;
+    npmname?: string;
     version: string;
     vulnerabilities?: Vulnerability[];
 };

package/package.json

@@ -2,7 +2,7 @@
   "author": "Erlend Oftedal <erlend@oftedal.no>",
   "name": "retire",
   "description": "Retire is a tool for detecting use of vulnerable libraries",
-  "version": "4.2.2",
+  "version": "4.2.3",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",