retire 5.2.8 → 5.4.0

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## [5.4.0]
+
+### Improvements
+
+- Add possibility to exclude specific versions for a vulnerability (example: jquery-1.12.4-aem which has some extra patches).
+
+## [5.3.0]
+
+### Improvement
+
+- Add cyclonedxJSON1_6_VEX as output format for CycloneDX 1.6 with vulnerability information
+
 ## [5.2.8]
 
 ### Bugfix

package/lib/cli.js

@@ -70,7 +70,7 @@ const prg = commander_1.program
     .option('--jsrepo <path|url>', "Local or internal version of repo. Can be multiple comma separated. Default: 'central')")
     .option('--cachedir <path>', 'Path to use for local cache instead of /tmp/.retire-cache')
     .option('--proxy <url>', 'Proxy url (http://some.host:8080)')
-    .option('--outputformat <format>', 'Valid formats: text, json, jsonsimple, depcheck (experimental), cyclonedx, cyclonedxJSON and cyclonedxJSON1_6')
+    .option('--outputformat <format>', 'Valid formats: text, json, jsonsimple, depcheck (experimental), cyclonedx, cyclonedxJSON, cyclonedxJSON1_6, cyclonedxJSON1_6_VEX')
     .option('--outputpath <path>', 'File to which output should be written')
     .option('--ignore <paths>', 'Comma delimited list of paths to ignore')
     .option('--ignorefile <path>', 'Custom ignore file, defaults to .retireignore / .retireignore.json')
@@ -88,7 +88,7 @@ const colorwarn = prg.colors ? ansi_colors_1.default.red : (x) => x;
 const jsrepolocation = (prg.jsrepo ?? "'central'")
     .split(',')
     .map((x) => x === "'central'"
-    ? 'https://raw.githubusercontent.com/RetireJS/retire.js/master/repository/jsrepository-v4.json'
+    ? 'https://raw.githubusercontent.com/RetireJS/retire.js/master/repository/jsrepository-v5.json'
     : x);
 const ignorefile = prg.ignorefile ?? defaultIgnoreFiles.filter((x) => fs_1.default.existsSync(x))[0];
 const scanpath = prg.path ?? prg.jspath ?? '.';

package/lib/repo.js

@@ -54,6 +54,7 @@ function validateRepository(repo, replacer) {
         .object({
         below: versionValidator,
         atOrAbove: versionValidator.optional(),
+        excludes: z.array(versionValidator).optional(),
         severity: z.enum(keys),
         cwe: z.array(z.string().regex(/^CWE-[0-9]+$/)).min(1),
         identifiers: z

package/lib/reporters/cyclonedx-1_6-json.js

@@ -66,6 +66,8 @@ function configureCycloneDXJSONLogger(logger, writer, config, hash) {
     logger.close = function (callback) {
         const write = vulnsFound ? writer.err : writer.out;
         const seen = new Map();
+        const vulnerabilitiesCyclone = new Map();
+        const includeVEX = config.outputformat === 'cyclonedxJSON1_6_VEX';
         const components = finalResults.data
             .filter((d) => d.results)
             .map((r) => r.results
@@ -93,7 +95,39 @@ function configureCycloneDXJSONLogger(logger, writer, config, hash) {
                 return undefined;
             }
             const nameParts = dep.component.split('/').reverse();
+            const bomRef = purl;
+            dep.vulnerabilities?.forEach((vuln) => {
+                // Pick valid identifiers for VEX
+                const ids = vuln.identifiers?.CVE ?? (vuln.identifiers?.githubID ? [vuln.identifiers.githubID] : undefined);
+                if (!ids)
+                    return;
+                ids.forEach((id) => {
+                    if (!vulnerabilitiesCyclone.has(id)) {
+                        const { references, advisories } = mapUrls(vuln);
+                        vulnerabilitiesCyclone.set(id, {
+                            id,
+                            cwes: vuln.cwe.map((c) => parseInt(c.split("-")[1])),
+                            description: vuln.identifiers.summary,
+                            advisories: advisories,
+                            references: references,
+                            ratings: [
+                                {
+                                    source: 'Retire.js',
+                                    severity: vuln.severity,
+                                },
+                            ],
+                            affects: [],
+                        });
+                    }
+                    vulnerabilitiesCyclone.get(id).affects.push({
+                        ref: bomRef,
+                        // "vers:npm/1.2.3|>=2.0.0|<5.0.0"
+                        range: "vers:npm/" + (vuln.atOrAbove ? ">=" + vuln.atOrAbove + "|" : "") + "<" + vuln.below,
+                    });
+                });
+            });
             const result = {
+                "bom-ref": bomRef,
                 type: 'library',
                 name: nameParts[0],
                 group: nameParts[1],
@@ -118,12 +152,13 @@ function configureCycloneDXJSONLogger(logger, writer, config, hash) {
                 tools: [
                     {
                         vendor: 'RetireJS',
-                        name: 'retire.js',
+                        name: 'retire',
                         version: retire.version,
                     },
                 ],
             },
             components: components,
+            vulnerabilities: includeVEX ? Array.from(vulnerabilitiesCyclone.values()) : undefined,
         }, undefined, 2));
         writer.close(callback);
     };
@@ -137,6 +172,21 @@ function mapLicenses(licenses) {
         return [{ license: { name: 'Commercial' } }];
     return [{ expression: licenses[0] }];
 }
+function mapUrls(vulnerability) {
+    const references = [];
+    if (vulnerability.identifiers.CVE) {
+        const nvdlink = `https://nvd.nist.gov/vuln/detail/${vulnerability.identifiers.CVE[0]}`;
+        references.push({ id: vulnerability.identifiers.CVE[0], source: { name: 'NVD', url: nvdlink } });
+    }
+    if (vulnerability.identifiers.githubID) {
+        const ghsa = `https://github.com/advisories/${vulnerability.identifiers.githubID}`;
+        references.push({ id: vulnerability.identifiers.githubID, source: { name: 'GitHub Advisories', url: ghsa } });
+    }
+    const advisories = vulnerability.info
+        .filter((url) => !url.startsWith('https://nvd.nist.gov/vuln/detail/') && !url.startsWith('https://github.com/advisories/'))
+        .map((u) => ({ url: u }));
+    return { references, advisories };
+}
 exports.default = {
     configure: configureCycloneDXJSONLogger,
 };

package/lib/reporting.js

@@ -54,6 +54,7 @@ const loggers = {
     cyclonedx: cyclonedx_1.default,
     cyclonedxJSON: cyclonedx_json_1.default,
     cyclonedxJSON1_6: cyclonedx_1_6_json_1.default,
+    cyclonedxJSON1_6_VEX: cyclonedx_1_6_json_1.default,
     clean: console_1.default,
     jsonsimple: json_1.default,
 };

package/lib/retire.js

@@ -4,7 +4,7 @@
  */
 
 var exports = exports || {};
-exports.version = '5.2.8';
+exports.version = '5.4.0';
 
 function isDefined(o) {
   return typeof o !== 'undefined';
@@ -103,6 +103,9 @@ function check(results, repo) {
         if (isDefined(vulns[i].atOrAbove) && !isAtOrAbove(result.version, vulns[i].atOrAbove)) {
           continue;
         }
+        if (isDefined(vulns[i].excludes) && vulns[i].excludes.includes(result.version)) {
+          continue;
+        }
         var vulnerability = { info: vulns[i].info, below: vulns[i].below, atOrAbove: vulns[i].atOrAbove };
         if (vulns[i].severity) {
           vulnerability.severity = vulns[i].severity;

package/lib/types.d.ts

@@ -18,6 +18,7 @@ export type Repository = Record<string, {
 export type Vulnerability = {
     below: string;
     atOrAbove?: string;
+    excludes?: string[];
     severity: SeverityLevel;
     cwe: string[];
     identifiers: {

package/package.json

@@ -2,7 +2,7 @@
   "author": "Erlend Oftedal <erlend@oftedal.no>",
   "name": "retire",
   "description": "Retire is a tool for detecting use of vulnerable libraries",
-  "version": "5.2.8",
+  "version": "5.4.0",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",
@@ -14,7 +14,7 @@
   "main": "./lib/retire.js",
   "dependencies": {
     "ansi-colors": "^4.1.1",
-    "astronomical": "^2.0.1",
+    "astronomical": "^2.1.1-rc.1",
     "commander": "^10.0.1",
     "proxy-agent": "^6.4.0",
     "uuid": "^9.0.1",
@@ -22,8 +22,8 @@
     "zod": "^3.22.4"
   },
   "devDependencies": {
-    "@types/jest": "^29.5.14",
     "@types/chai": "^4.3.17",
+    "@types/jest": "^29.5.14",
     "@types/node": "^18.13.0",
     "@types/uuid": "^9.0.0",
     "@typescript-eslint/eslint-plugin": "^7.1.1",