retire 5.2.8 → 5.3.0

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## [5.3.0]
+
+### Improvement
+
+- Add cyclonedxJSON1_6_VEX as output format for CycloneDX 1.6 with vulnerability information
+
 ## [5.2.8]
 
 ### Bugfix

package/lib/cli.js

@@ -70,7 +70,7 @@ const prg = commander_1.program
     .option('--jsrepo <path|url>', "Local or internal version of repo. Can be multiple comma separated. Default: 'central')")
     .option('--cachedir <path>', 'Path to use for local cache instead of /tmp/.retire-cache')
     .option('--proxy <url>', 'Proxy url (http://some.host:8080)')
-    .option('--outputformat <format>', 'Valid formats: text, json, jsonsimple, depcheck (experimental), cyclonedx, cyclonedxJSON and cyclonedxJSON1_6')
+    .option('--outputformat <format>', 'Valid formats: text, json, jsonsimple, depcheck (experimental), cyclonedx, cyclonedxJSON, cyclonedxJSON1_6, cyclonedxJSON1_6_VEX')
     .option('--outputpath <path>', 'File to which output should be written')
     .option('--ignore <paths>', 'Comma delimited list of paths to ignore')
     .option('--ignorefile <path>', 'Custom ignore file, defaults to .retireignore / .retireignore.json')

package/lib/reporters/cyclonedx-1_6-json.js

@@ -66,6 +66,8 @@ function configureCycloneDXJSONLogger(logger, writer, config, hash) {
     logger.close = function (callback) {
         const write = vulnsFound ? writer.err : writer.out;
         const seen = new Map();
+        const vulnerabilitiesCyclone = new Map();
+        const includeVEX = config.outputformat === 'cyclonedxJSON1_6_VEX';
         const components = finalResults.data
             .filter((d) => d.results)
             .map((r) => r.results
@@ -93,7 +95,39 @@ function configureCycloneDXJSONLogger(logger, writer, config, hash) {
                 return undefined;
             }
             const nameParts = dep.component.split('/').reverse();
+            const bomRef = purl;
+            dep.vulnerabilities?.forEach((vuln) => {
+                // Pick valid identifiers for VEX
+                const ids = vuln.identifiers?.CVE ?? (vuln.identifiers?.githubID ? [vuln.identifiers.githubID] : undefined);
+                if (!ids)
+                    return;
+                ids.forEach((id) => {
+                    if (!vulnerabilitiesCyclone.has(id)) {
+                        const { references, advisories } = mapUrls(vuln);
+                        vulnerabilitiesCyclone.set(id, {
+                            id,
+                            cwes: vuln.cwe.map((c) => parseInt(c.split("-")[1])),
+                            description: vuln.identifiers.summary,
+                            advisories: advisories,
+                            references: references,
+                            ratings: [
+                                {
+                                    source: 'Retire.js',
+                                    severity: vuln.severity,
+                                },
+                            ],
+                            affects: [],
+                        });
+                    }
+                    vulnerabilitiesCyclone.get(id).affects.push({
+                        ref: bomRef,
+                        // "vers:npm/1.2.3|>=2.0.0|<5.0.0"
+                        range: "vers:npm/" + (vuln.atOrAbove ? ">=" + vuln.atOrAbove + "|" : "") + "<" + vuln.below,
+                    });
+                });
+            });
             const result = {
+                "bom-ref": bomRef,
                 type: 'library',
                 name: nameParts[0],
                 group: nameParts[1],
@@ -118,12 +152,13 @@ function configureCycloneDXJSONLogger(logger, writer, config, hash) {
                 tools: [
                     {
                         vendor: 'RetireJS',
-                        name: 'retire.js',
+                        name: 'retire',
                         version: retire.version,
                     },
                 ],
             },
             components: components,
+            vulnerabilities: includeVEX ? Array.from(vulnerabilitiesCyclone.values()) : undefined,
         }, undefined, 2));
         writer.close(callback);
     };
@@ -137,6 +172,21 @@ function mapLicenses(licenses) {
         return [{ license: { name: 'Commercial' } }];
     return [{ expression: licenses[0] }];
 }
+function mapUrls(vulnerability) {
+    const references = [];
+    if (vulnerability.identifiers.CVE) {
+        const nvdlink = `https://nvd.nist.gov/vuln/detail/${vulnerability.identifiers.CVE[0]}`;
+        references.push({ id: vulnerability.identifiers.CVE[0], source: { name: 'NVD', url: nvdlink } });
+    }
+    if (vulnerability.identifiers.githubID) {
+        const ghsa = `https://github.com/advisories/${vulnerability.identifiers.githubID}`;
+        references.push({ id: vulnerability.identifiers.githubID, source: { name: 'GitHub Advisories', url: ghsa } });
+    }
+    const advisories = vulnerability.info
+        .filter((url) => !url.startsWith('https://nvd.nist.gov/vuln/detail/') && !url.startsWith('https://github.com/advisories/'))
+        .map((u) => ({ url: u }));
+    return { references, advisories };
+}
 exports.default = {
     configure: configureCycloneDXJSONLogger,
 };

package/lib/reporting.js

@@ -54,6 +54,7 @@ const loggers = {
     cyclonedx: cyclonedx_1.default,
     cyclonedxJSON: cyclonedx_json_1.default,
     cyclonedxJSON1_6: cyclonedx_1_6_json_1.default,
+    cyclonedxJSON1_6_VEX: cyclonedx_1_6_json_1.default,
     clean: console_1.default,
     jsonsimple: json_1.default,
 };

package/lib/retire.js

@@ -4,7 +4,7 @@
  */
 
 var exports = exports || {};
-exports.version = '5.2.8';
+exports.version = '5.3.0';
 
 function isDefined(o) {
   return typeof o !== 'undefined';

package/package.json

@@ -2,7 +2,7 @@
   "author": "Erlend Oftedal <erlend@oftedal.no>",
   "name": "retire",
   "description": "Retire is a tool for detecting use of vulnerable libraries",
-  "version": "5.2.8",
+  "version": "5.3.0",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",