retire 5.2.0 → 5.2.2

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## [5.2.2]
+
+### Bugfix
+
+- Encode purls correctly in SBOM
+
+## [5.2.1]
+
+### Bugfix
+
+- Add missing CWEs in response
+
 ## [5.2.0]
 
 ### Enhancement

package/lib/repo.js

@@ -132,7 +132,7 @@ function validateRepository(repo, replacer) {
         bowername: z.array(z.string().regex(/^[a-z0-9.-]+$/i)).optional(),
         basePurl: z
             .string()
-            .regex(/^pkg:[a-z0-9/]+$/i)
+            .regex(/^pkg:[a-z0-9%.-/]+$/i)
             .optional(),
         npmname: z
             .string()

package/lib/reporters/utils.js

@@ -1,10 +1,15 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.generatePURL = generatePURL;
+function encodePURLchars(str) {
+    return str.replace(/[^A-Za-z0-9.+/=%-]/g, (match) => '%' + ('0' + match.charCodeAt(0).toString(16).toUpperCase()).slice(-2));
+}
 function generatePURL(component) {
     if (component.basePurl) {
-        return component.basePurl + '@' + component.version;
+        const [pType, ...rest] = component.basePurl.split(':');
+        const pathElements = rest.join(':').split('/').map(encodePURLchars).join('/');
+        return `${pType}:${pathElements}@${encodePURLchars(component.version)}`;
     }
     const compName = component.npmname || component.component;
-    return `pkg:npm/${compName}@${component.version}`;
+    return `pkg:npm/${encodePURLchars(compName)}@${encodePURLchars(component.version)}`;
 }

package/lib/retire.js

@@ -4,7 +4,7 @@
  */
 
 var exports = exports || {};
-exports.version = '5.2.0';
+exports.version = '5.2.2';
 
 function isDefined(o) {
   return typeof o !== 'undefined';
@@ -110,6 +110,9 @@ function check(results, repo) {
         if (vulns[i].identifiers) {
           vulnerability.identifiers = vulns[i].identifiers;
         }
+        if (vulns[i].cwe) {
+          vulnerability.cwe = vulns[i].cwe;
+        }
         result.vulnerabilities = result.vulnerabilities || [];
         result.vulnerabilities.push(vulnerability);
       }

package/package.json

@@ -2,7 +2,7 @@
   "author": "Erlend Oftedal <erlend@oftedal.no>",
   "name": "retire",
   "description": "Retire is a tool for detecting use of vulnerable libraries",
-  "version": "5.2.0",
+  "version": "5.2.2",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",
@@ -22,6 +22,8 @@
     "zod": "^3.22.4"
   },
   "devDependencies": {
+    "@types/chai": "^4.3.17",
+    "@types/mocha": "^10.0.7",
     "@types/node": "^18.13.0",
     "@types/uuid": "^9.0.0",
     "@typescript-eslint/eslint-plugin": "^7.1.1",