retire 5.1.3 → 5.2.0

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## [5.2.0]
+
+### Enhancement
+
+- Add license information to SBOM
+
+## [5.1.4]
+
+### Bugfix
+
+- Fix bug where deepScan would sometimes not report vulnerabilities
+
 ## [5.1.3]
 
 ### Bugfix

package/lib/cli.js

@@ -78,7 +78,7 @@ const colorwarn = prg.colors ? ansi_colors_1.default.red : (x) => x;
 const jsrepolocation = (prg.jsrepo ?? "'central'")
     .split(',')
     .map((x) => x === "'central'"
-    ? 'https://raw.githubusercontent.com/RetireJS/retire.js/master/repository/jsrepository-v2.json'
+    ? 'https://raw.githubusercontent.com/RetireJS/retire.js/master/repository/jsrepository-v4.json'
     : x);
 const ignorefile = prg.ignoreFile ?? defaultIgnoreFiles.filter((x) => fs_1.default.existsSync(x))[0];
 const scanpath = prg.path ?? prg.jspath ?? '.';

package/lib/deepscan.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.deepScan = deepScan;
 const astronomical_1 = require("astronomical");
+const retire_1 = require("./retire");
 function deepScan(content, repo) {
     const astQueries = {};
     const backMap = {};
@@ -30,7 +31,6 @@ function deepScan(content, repo) {
     return detected.reduce((acc, cur) => {
         if (acc.some((c) => c.component === cur.component && c.version === cur.version))
             return acc;
-        acc.push(cur);
-        return acc;
+        return acc.concat((0, retire_1.check)(cur.component, cur.version, repo));
     }, []);
 }

package/lib/license.d.ts

@@ -0,0 +1 @@
+export declare function evaluateLicense(licenses: string[], version: string): string[];

package/lib/license.js

@@ -0,0 +1,43 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.evaluateLicense = evaluateLicense;
+const retire_1 = require("./retire");
+function evaluateLicense(licenses, version) {
+    const parsedLicenses = licenses.map((license) => {
+        let splitIndex = license.indexOf(' ');
+        let licenseName = license.slice(0, splitIndex);
+        if (license.startsWith('(')) {
+            splitIndex = license.slice(1).indexOf(')') + 1;
+            licenseName = license.slice(1, splitIndex);
+        }
+        //console.log(license, '|', splitIndex, '|', licenseName, '|', license.slice(splitIndex + 1));
+        const ranges = license
+            .slice(splitIndex + 1)
+            .trim()
+            .split(';')
+            .map((range) => {
+            const [from, to] = range.split(' ').map((v) => v.trim());
+            if (!from.startsWith('>='))
+                throw new Error("Invalid license range: 'from' must start with '>=': " + range);
+            if (to && !to.startsWith('<'))
+                throw new Error("Invalid license range: 'to' must start with '<': " + range);
+            if (to && to.startsWith('<='))
+                throw new Error("Invalid license range: 'to' must start with '<': " + range);
+            return { from: from.replace('>=', ''), to: to ? to.replace('<', '') : undefined };
+        });
+        return { licenseName, ranges };
+    });
+    return parsedLicenses
+        .filter((parsedLicense) => {
+        return parsedLicense.ranges.some((range) => {
+            if (range.from && range.to) {
+                return (0, retire_1.isAtOrAbove)(version, range.from) && (0, retire_1.isAtOrAbove)(range.to, version);
+            }
+            if (range.from) {
+                return (0, retire_1.isAtOrAbove)(version, range.from);
+            }
+            return false;
+        });
+    })
+        .map((parsedLicense) => parsedLicense.licenseName);
+}

package/lib/repo.js

@@ -150,6 +150,11 @@ function validateRepository(repo, replacer) {
             ast: z.array(z.string()).optional(),
         })
             .strict(),
+        licenses: z
+            .array(z
+            .string()
+            .regex(/(\([A-Za-z\-0-9.]+( OR [A-Za-z\-0-9.]+)+\)|[A-Za-z\-0-9.]+) >=[0-9.]+( <[0-9.]+)?(;>=[0-9.]+( <[0-9.]+)?)*/))
+            .optional(),
     })
         .strict());
     return validator.safeParse(repo);

package/lib/reporters/cyclonedx-1_6-json.js

@@ -89,6 +89,7 @@ function configureCycloneDXJSONLogger(logger, writer, config, hash) {
                 purl: purl,
                 hashes: hashes,
                 evidence,
+                licenses: mapLicenses(dep.licenses),
             };
             seen.set(purl, result);
             return result;
@@ -115,6 +116,15 @@ function configureCycloneDXJSONLogger(logger, writer, config, hash) {
         writer.close(callback);
     };
 }
+function mapLicenses(licenses) {
+    if (!licenses)
+        return [];
+    if (licenses.length == 0)
+        return [];
+    if (licenses[0] == 'commercial')
+        return [{ license: { name: 'Commercial' } }];
+    return [{ expression: licenses[0] }];
+}
 exports.default = {
     configure: configureCycloneDXJSONLogger,
 };

package/lib/reporters/cyclonedx-json.js

@@ -88,6 +88,7 @@ function configureCycloneDXJSONLogger(logger, writer, config, hash) {
                 version: dep.version,
                 purl: purl,
                 hashes: hashes,
+                licenses: mapLicenses(dep.licenses),
                 properties,
             };
             seen.set(purl, result);
@@ -115,6 +116,15 @@ function configureCycloneDXJSONLogger(logger, writer, config, hash) {
         writer.close(callback);
     };
 }
+function mapLicenses(licenses) {
+    if (!licenses)
+        return [];
+    if (licenses.length == 0)
+        return [];
+    if (licenses[0] == 'commercial')
+        return [{ license: { name: 'Commercial' } }];
+    return [{ expression: licenses[0] }];
+}
 exports.default = {
     configure: configureCycloneDXJSONLogger,
 };

package/lib/reporters/cyclonedx.js

@@ -57,7 +57,7 @@ function configureCycloneDXLogger(logger, writer, config, hash) {
         const write = vulnsFound ? writer.err : writer.out;
         const seen = new Set();
         const components = finalResults.data
-            .filter((d) => d.results)
+            .filter((d) => d.results.length > 0)
             .map((r) => r.results
             .map((dep) => {
             dep.version = (dep.version.split('.').length >= 3 ? dep.version : dep.version + '.0').replace(/-/g, '.');
@@ -81,6 +81,7 @@ function configureCycloneDXLogger(logger, writer, config, hash) {
     <component type="library">
       <name>${dep.component}</name>
       <version>${dep.version}</version>${hashes}
+      <licenses>${mapLicenses(dep.licenses)}</licenses>
       <purl>${purl}</purl>
       <modified>false</modified>
     </component>`;
@@ -105,6 +106,15 @@ function configureCycloneDXLogger(logger, writer, config, hash) {
         writer.close(callback);
     };
 }
+function mapLicenses(licenses) {
+    if (!licenses)
+        return '';
+    if (licenses.length == 0)
+        return '';
+    if (licenses[0] == 'commercial')
+        return '<license><name>Commercial</name></license>';
+    return `<expression>${licenses[0]}</expression>`;
+}
 exports.default = {
     configure: configureCycloneDXLogger,
 };

package/lib/retire.d.ts

@@ -12,4 +12,6 @@ export declare function scanFileName(fileName: string, repo: Repository, include
 
 export declare function scanFileContent(content: string, repo: Repository, hasher: Hasher): Component[];
 
+export declare function isAtOrAbove(versionA: string, versionB: string): boolean;
+
 export declare const version: string;

package/lib/retire.js

@@ -4,7 +4,7 @@
  */
 
 var exports = exports || {};
-exports.version = '5.1.3';
+exports.version = '5.2.0';
 
 function isDefined(o) {
   return typeof o !== 'undefined';
@@ -186,3 +186,5 @@ exports.scanFileContent = function (content, repo, hasher) {
   }
   return check(result, repo);
 };
+
+exports.isAtOrAbove = isAtOrAbove;

package/lib/scanner.js

@@ -33,6 +33,7 @@ const crypto = __importStar(require("crypto"));
 const path = __importStar(require("path"));
 const depsdev_1 = require("./depsdev");
 const deepscan_1 = require("./deepscan");
+const license_1 = require("./license");
 const events = new events_1.EventEmitter();
 const hash = {
     sha1: (data) => {
@@ -41,12 +42,12 @@ const hash = {
         return shasum.digest('hex');
     },
 };
-function emitResults(finding, options) {
+function emitResults(finding, options, repo) {
     if (options.includeOsv === true) {
-        Promise.all(finding.results.map((r) => (0, depsdev_1.checkOSV)(r.component, r.version, options).then((v) => (r.vulnerabilities = (r.vulnerabilities ?? []).concat(v))))).then(() => filterAndEmitResults(finding, options));
+        Promise.all(finding.results.map((r) => (0, depsdev_1.checkOSV)(r.component, r.version, options).then((v) => (r.vulnerabilities = (r.vulnerabilities ?? []).concat(v))))).then(() => filterAndEmitResults(finding, options, repo));
     }
     else {
-        filterAndEmitResults(finding, options);
+        filterAndEmitResults(finding, options, repo);
     }
 }
 function getIdentifiers(v) {
@@ -66,12 +67,20 @@ function uniqueVulnerabilities(vulnerabilities) {
     }
     return unique;
 }
-function filterAndEmitResults(finding, options) {
+function addLicenses(components, repo) {
+    components.forEach((c) => {
+        const possibleLicenses = repo[c.component]?.licenses;
+        if (possibleLicenses)
+            c.licenses = (0, license_1.evaluateLicense)(possibleLicenses, c.version);
+    });
+}
+function filterAndEmitResults(finding, options, repo) {
     finding.results.forEach((r) => (r.vulnerabilities = uniqueVulnerabilities(r.vulnerabilities)));
     if (options.ignore)
         removeIgnored(finding.results, options.ignore);
     if (finding.results.length == 0)
         return;
+    addLicenses(finding.results, repo);
     if (retire.isVulnerable(finding.results)) {
         events.emit('vulnerable-dependency-found', finding);
     }
@@ -137,7 +146,7 @@ function scanJsFile(file, repo, options) {
             results = results.concat((0, deepscan_1.deepScan)(content, repo));
         }
     }
-    emitResults({ file: file, results: results }, options);
+    emitResults({ file: file, results: results }, options, repo);
 }
 function scanBowerFile(file, repo, options) {
     if (options.ignore && shouldIgnorePath([file], options.ignore)) {
@@ -147,7 +156,7 @@ function scanBowerFile(file, repo, options) {
         const bower = JSON.parse(fs.readFileSync(file, 'utf-8'));
         if (bower.version) {
             const results = retire.check(bower.name, bower.version, repo);
-            emitResults({ file: file, results: results }, options);
+            emitResults({ file: file, results: results }, options, repo);
         }
     }
     catch (e) {

package/lib/types.d.ts

@@ -13,6 +13,7 @@ export type Repository = Record<string, {
         hashes?: Record<string, string>;
         ast?: string[];
     };
+    licenses?: string[];
 }>;
 export type Vulnerability = {
     below: string;
@@ -35,6 +36,7 @@ export type Component = {
     version: string;
     vulnerabilities?: Vulnerability[];
     detection?: string;
+    licenses?: string[];
 };
 export type Finding = {
     results: Component[];

package/package.json

@@ -2,7 +2,7 @@
   "author": "Erlend Oftedal <erlend@oftedal.no>",
   "name": "retire",
   "description": "Retire is a tool for detecting use of vulnerable libraries",
-  "version": "5.1.3",
+  "version": "5.2.0",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",
@@ -32,6 +32,7 @@
     "jsonschema": "^1.4.1",
     "mocha": "^10.2.0",
     "prettier": "^3.1.0",
+    "ts-node": "^10.9.2",
     "typescript": "^5.0.4",
     "xsd-schema-validator": "^0.9.0"
   },
@@ -55,6 +56,7 @@
     "software-composition-analysis",
     "sca"
   ],
+  "type": "commonjs",
   "files": [
     "lib/**/*",
     "CHANGELOG.md"