retire 5.0.0 → 5.1.0

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # Changelog
 
+## [5.1.0]
+
+## Add
+
+- Support for CycloneDX 1.6 JSON as output format
+- Adding file location as property in CycloneDX 1.4 JSON output
+
+## [5.0.1]
+
+### Fix
+
+- Fix filename issue for windows file paths
+
+## [5.0.0]
+
+No changes. Just moving from beta to final.
+
 ## [5.0.0-beta.1]
 
 ### Added

package/lib/cli.js

@@ -60,7 +60,7 @@ const prg = commander_1.program
     .option('--jsrepo <path|url>', "Local or internal version of repo. Can be multiple comma separated. Default: 'central')")
     .option('--cachedir <path>', 'Path to use for local cache instead of /tmp/.retire-cache')
     .option('--proxy <url>', 'Proxy url (http://some.host:8080)')
-    .option('--outputformat <format>', 'Valid formats: text, json, jsonsimple, depcheck (experimental), cyclonedx and cyclonedxJSON')
+    .option('--outputformat <format>', 'Valid formats: text, json, jsonsimple, depcheck (experimental), cyclonedx, cyclonedxJSON and cyclonedxJSON1_6')
     .option('--outputpath <path>', 'File to which output should be written')
     .option('--ignore <paths>', 'Comma delimited list of paths to ignore')
     .option('--ignorefile <path>', 'Custom ignore file, defaults to .retireignore / .retireignore.json')

package/lib/deepscan.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.deepScan = void 0;
+exports.deepScan = deepScan;
 const astronomical_1 = require("astronomical");
 function deepScan(content, repo) {
     const astQueries = {};
@@ -34,4 +34,3 @@ function deepScan(content, repo) {
         return acc;
     }, []);
 }
-exports.deepScan = deepScan;

package/lib/depsdev.js

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.checkOSV = void 0;
+exports.checkOSV = checkOSV;
 const https_1 = __importDefault(require("https"));
 const retire_1 = require("./retire");
 function loadJson(url, options) {
@@ -80,4 +80,3 @@ async function checkOSV(packageName, version, options) {
         return [];
     }
 }
-exports.checkOSV = checkOSV;

package/lib/repo.js

@@ -23,7 +23,10 @@ var __importStar = (this && this.__importStar) || function (mod) {
     return result;
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.loadrepositoryFromFile = exports.loadrepository = exports.asbowerrepo = exports.validateRepository = void 0;
+exports.validateRepository = validateRepository;
+exports.asbowerrepo = asbowerrepo;
+exports.loadrepository = loadrepository;
+exports.loadrepositoryFromFile = loadrepositoryFromFile;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const http = __importStar(require("http"));
@@ -151,7 +154,6 @@ function validateRepository(repo, replacer) {
         .strict());
     return validator.safeParse(repo);
 }
-exports.validateRepository = validateRepository;
 function formatValidationError(error) {
     return JSON.stringify(error.format(), (key, value) => (Array.isArray(value) && value.length === 0 ? undefined : value), 2);
 }
@@ -255,7 +257,6 @@ function asbowerrepo(jsRepo) {
     });
     return result;
 }
-exports.asbowerrepo = asbowerrepo;
 async function loadrepository(repoUrl, options) {
     options = { ...options, process: retire.replaceVersion };
     if (options.nocache) {
@@ -263,9 +264,7 @@ async function loadrepository(repoUrl, options) {
     }
     return await loadFromCache(repoUrl, options.cachedir, options);
 }
-exports.loadrepository = loadrepository;
 async function loadrepositoryFromFile(filepath, options) {
     options = { ...options, process: retire.replaceVersion };
     return await loadJsonFromFile(filepath, options);
 }
-exports.loadrepositoryFromFile = loadrepositoryFromFile;

package/lib/reporters/cyclonedx-1_6-json.d.ts

@@ -0,0 +1,3 @@
+import { ConfigurableLogger } from '../reporting';
+declare const _default: ConfigurableLogger;
+export default _default;

package/lib/reporters/cyclonedx-1_6-json.js

@@ -0,0 +1,118 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const retire = __importStar(require("../retire"));
+const fs = __importStar(require("fs"));
+const uuid_1 = require("uuid");
+const utils_1 = require("./utils");
+const path = __importStar(require("path"));
+function configureCycloneDXJSONLogger(logger, writer, config, hash) {
+    let vulnsFound = false;
+    const finalResults = {
+        version: retire.version,
+        start: new Date().toISOString(),
+        data: [],
+        messages: [],
+        errors: [],
+    };
+    logger.info = finalResults.messages.push;
+    logger.debug = config.verbose
+        ? finalResults.messages.push
+        : function () {
+            return;
+        };
+    logger.warn = logger.error = finalResults.errors.push;
+    logger.logVulnerableDependency = function (finding) {
+        vulnsFound = true;
+        finalResults.data.push(finding);
+    };
+    logger.logDependency = function (finding) {
+        if (finding.results.length > 0) {
+            finalResults.data.push(finding);
+        }
+    };
+    logger.close = function (callback) {
+        const write = vulnsFound ? writer.err : writer.out;
+        const seen = new Map();
+        const components = finalResults.data
+            .filter((d) => d.results)
+            .map((r) => r.results
+            .map((dep) => {
+            dep.version = (dep.version.split('.').length >= 3 ? dep.version : dep.version + '.0').replace(/-/g, '.');
+            let hashes;
+            const filepath = r.file;
+            const evidence = { occurrences: [] };
+            if (filepath) {
+                const file = fs.readFileSync(filepath);
+                const relativePath = path.relative(process.cwd(), filepath);
+                evidence.occurrences.push({ location: relativePath });
+                hashes = [
+                    { alg: 'MD5', content: hash.md5(file) },
+                    { alg: 'SHA-1', content: hash.sha1(file) },
+                    { alg: 'SHA-256', content: hash.sha256(file) },
+                    { alg: 'SHA-512', content: hash.sha512(file) },
+                ];
+            }
+            const purl = (0, utils_1.generatePURL)(dep);
+            if (seen.has(purl)) {
+                seen.get(purl)?.evidence.occurrences.push(...evidence.occurrences);
+                return undefined;
+            }
+            const result = {
+                type: 'library',
+                name: dep.component,
+                version: dep.version,
+                purl: purl,
+                hashes: hashes,
+                evidence,
+            };
+            seen.set(purl, result);
+            return result;
+        })
+            .filter((x) => x != undefined))
+            .reduce((a, b) => a.concat(b), []);
+        write(JSON.stringify({
+            bomFormat: 'CycloneDX',
+            specVersion: '1.6',
+            serialNumber: `urn:uuid:${(0, uuid_1.v4)()}`,
+            version: 1,
+            metadata: {
+                timestamp: finalResults.start,
+                tools: [
+                    {
+                        vendor: 'RetireJS',
+                        name: 'retire.js',
+                        version: retire.version,
+                    },
+                ],
+            },
+            components: components,
+        }, undefined, 2));
+        writer.close(callback);
+    };
+}
+exports.default = {
+    configure: configureCycloneDXJSONLogger,
+};

package/lib/reporters/cyclonedx-json.js

@@ -1,5 +1,4 @@
 "use strict";
-/*jshint esversion: 6 */
 var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
     if (k2 === undefined) k2 = k;
     var desc = Object.getOwnPropertyDescriptor(m, k);
@@ -28,6 +27,7 @@ const retire = __importStar(require("../retire"));
 const fs = __importStar(require("fs"));
 const uuid_1 = require("uuid");
 const utils_1 = require("./utils");
+const path = __importStar(require("path"));
 function configureCycloneDXJSONLogger(logger, writer, config, hash) {
     let vulnsFound = false;
     const finalResults = {
@@ -63,8 +63,11 @@ function configureCycloneDXJSONLogger(logger, writer, config, hash) {
             dep.version = (dep.version.split('.').length >= 3 ? dep.version : dep.version + '.0').replace(/-/g, '.');
             let hashes;
             const filepath = r.file;
+            const properties = [];
             if (filepath) {
                 const file = fs.readFileSync(filepath);
+                const relativePath = path.relative(process.cwd(), filepath);
+                properties.push({ name: 'location', value: relativePath });
                 hashes = [
                     { alg: 'MD5', content: hash.md5(file) },
                     { alg: 'SHA-1', content: hash.sha1(file) },
@@ -82,6 +85,7 @@ function configureCycloneDXJSONLogger(logger, writer, config, hash) {
                 version: dep.version,
                 purl: purl,
                 hashes: hashes,
+                properties,
             };
         })
             .filter((x) => x != undefined))

package/lib/reporters/utils.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.generatePURL = void 0;
+exports.generatePURL = generatePURL;
 function generatePURL(component) {
     if (component.basePurl) {
         return component.basePurl + '@' + component.version;
@@ -8,4 +8,3 @@ function generatePURL(component) {
     const compName = component.npmname || component.component;
     return `pkg:npm/${compName}@${component.version}`;
 }
-exports.generatePURL = generatePURL;

package/lib/reporting.d.ts

@@ -1,6 +1,3 @@
-/// <reference types="node" />
-/// <reference types="node" />
-/// <reference types="node" />
 import { Finding } from './types';
 export type LoggerOptions = {
     outputpath: string;

package/lib/reporting.js

@@ -26,7 +26,8 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.open = exports.hash = void 0;
+exports.hash = void 0;
+exports.open = open;
 const fs = __importStar(require("fs"));
 const crypto = __importStar(require("crypto"));
 const console_1 = __importDefault(require("./reporters/console"));
@@ -34,6 +35,7 @@ const json_1 = __importDefault(require("./reporters/json"));
 const depcheck_1 = __importDefault(require("./reporters/depcheck"));
 const cyclonedx_1 = __importDefault(require("./reporters/cyclonedx"));
 const cyclonedx_json_1 = __importDefault(require("./reporters/cyclonedx-json"));
+const cyclonedx_1_6_json_1 = __importDefault(require("./reporters/cyclonedx-1_6-json"));
 const loggers = {
     console: console_1.default,
     text: console_1.default,
@@ -41,6 +43,7 @@ const loggers = {
     depcheck: depcheck_1.default,
     cyclonedx: cyclonedx_1.default,
     cyclonedxJSON: cyclonedx_json_1.default,
+    cyclonedxJSON1_6: cyclonedx_1_6_json_1.default,
     clean: console_1.default,
     jsonsimple: json_1.default,
 };
@@ -127,4 +130,3 @@ function open(config) {
     configureFileWriter(config);
     return logger;
 }
-exports.open = open;

package/lib/resolve.d.ts

@@ -1,4 +1,3 @@
-/// <reference types="node" />
 import { EventEmitter as Emitter } from 'events';
 import { Options } from './types';
 export declare function scanJsFiles(path: string, options: Options): Emitter;

package/lib/resolve.js

@@ -23,7 +23,7 @@ var __importStar = (this && this.__importStar) || function (mod) {
     return result;
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.scanJsFiles = void 0;
+exports.scanJsFiles = scanJsFiles;
 const fs = __importStar(require("fs"));
 const walkdir = __importStar(require("walkdir"));
 function scanJsFiles(path, options) {
@@ -51,4 +51,3 @@ function scanJsFiles(path, options) {
     });
     return finder;
 }
-exports.scanJsFiles = scanJsFiles;

package/lib/retire.js

@@ -4,7 +4,7 @@
  */
 
 var exports = exports || {};
-exports.version = '5.0.0';
+exports.version = '5.1.0';
 
 function isDefined(o) {
   return typeof o !== 'undefined';
@@ -168,7 +168,7 @@ exports.scanUri = function (uri, repo) {
 };
 
 exports.scanFileName = function (fileName, repo) {
-  var result = scan(fileName, 'filename', repo, splitAndMatchAll('/'));
+  var result = scan(fileName, 'filename', repo, splitAndMatchAll(/[\/\\]/));
   return check(result, repo);
 };
 

package/lib/scanner.js

@@ -23,7 +23,9 @@ var __importStar = (this && this.__importStar) || function (mod) {
     return result;
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.on = exports.scanBowerFile = exports.scanJsFile = void 0;
+exports.scanJsFile = scanJsFile;
+exports.scanBowerFile = scanBowerFile;
+exports.on = on;
 const events_1 = require("events");
 const retire = __importStar(require("./retire"));
 const fs = __importStar(require("fs"));
@@ -137,7 +139,6 @@ function scanJsFile(file, repo, options) {
     }
     emitResults({ file: file, results: results }, options);
 }
-exports.scanJsFile = scanJsFile;
 function scanBowerFile(file, repo, options) {
     if (options.ignore && shouldIgnorePath([file], options.ignore)) {
         return;
@@ -153,8 +154,6 @@ function scanBowerFile(file, repo, options) {
         options.log.warn(`Could not parse file: ${file}`);
     }
 }
-exports.scanBowerFile = scanBowerFile;
 function on(event, handler) {
     events.on(event, handler);
 }
-exports.on = on;

package/lib/types.d.ts

@@ -1,4 +1,3 @@
-/// <reference types="node" />
 import { Logger } from './reporting';
 export type Repository = Record<string, {
     bowername?: string[];

package/lib/utils.js

@@ -1,18 +1,19 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.flatten = exports.pick = exports.warn = exports.info = void 0;
+exports.info = info;
+exports.warn = warn;
+exports.pick = pick;
+exports.flatten = flatten;
 function info(options) {
     return function (...message) {
         (options.logger || console.log)(message);
     };
 }
-exports.info = info;
 function warn(options) {
     return function (...message) {
         (options.warnlogger || options.logger || console.warn)(message);
     };
 }
-exports.warn = warn;
 function pick(p, keys) {
     const result = {};
     keys.forEach((k) => {
@@ -22,8 +23,6 @@ function pick(p, keys) {
     });
     return result;
 }
-exports.pick = pick;
 function flatten(e) {
     return e.reduce((x, y) => x.concat(y), []);
 }
-exports.flatten = flatten;

package/package.json

@@ -2,7 +2,7 @@
   "author": "Erlend Oftedal <erlend@oftedal.no>",
   "name": "retire",
   "description": "Retire is a tool for detecting use of vulnerable libraries",
-  "version": "5.0.0",
+  "version": "5.1.0",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",
@@ -30,10 +30,10 @@
     "eslint": "^8.34.0",
     "eslint-config-prettier": "^9.0.0",
     "jsonschema": "^1.4.1",
-    "libxmljs": "^1.0.8",
     "mocha": "^10.2.0",
     "prettier": "^3.1.0",
-    "typescript": "^5.0.4"
+    "typescript": "^5.0.4",
+    "xsd-schema-validator": "^0.9.0"
   },
   "scripts": {
     "test": "./test",