retire 5.4.3 → 5.5.0

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## [5.5.0]
+
+### Improvements
+
+- Include the vulnerability repositories used for the scan in the output: as `vulnerabilityRepositories` in the JSON report, and as `retirejs:vulnerability-repository` entries under `metadata.properties` in all CycloneDX reports.
+- CycloneDX 1.6 VEX output now identifies Retire.js as the source of each vulnerability and rating, including the repository URL when a single repository is used.
+
+### Bugfixes
+
+- CycloneDX 1.6 VEX output was not schema valid: `ratings[].source` was a string rather than an object, and version ranges were reported as `affects[].range` rather than nested under `affects[].versions[]`.
+
 ## [5.4.3]
 
 * Remove dependencies that are not needed anymore

package/lib/cli.js

@@ -95,7 +95,7 @@ const scanpath = prg.path ?? prg.jspath ?? '.';
 const log = reporting.open({
     colors: !!prg.colors,
     colorwarn,
-    jsRepo: jsrepolocation.join(', '),
+    jsRepo: jsrepolocation,
     outputformat: prg.outputformat,
     outputpath: prg.outputpath,
     path: scanpath,

package/lib/reporters/cyclonedx-1_6-json.js

@@ -68,6 +68,12 @@ function configureCycloneDXJSONLogger(logger, writer, config, hash) {
         const seen = new Map();
         const vulnerabilitiesCyclone = new Map();
         const includeVEX = config.outputformat === 'cyclonedxJSON1_6_VEX';
+        const repositories = (0, utils_1.vulnerabilityRepositories)(config.jsRepo);
+        // Only attributable to a single URL when exactly one repository was used
+        const retireSource = {
+            name: 'Retire.js',
+            url: repositories.length === 1 ? repositories[0] : undefined,
+        };
         const components = finalResults.data
             .filter((d) => d.results)
             .map((r) => r.results
@@ -106,13 +112,14 @@ function configureCycloneDXJSONLogger(logger, writer, config, hash) {
                         const { references, advisories } = mapUrls(vuln);
                         vulnerabilitiesCyclone.set(id, {
                             id,
+                            source: retireSource,
                             cwes: vuln.cwe.map((c) => parseInt(c.split("-")[1])),
                             description: vuln.identifiers.summary,
                             advisories: advisories,
                             references: references,
                             ratings: [
                                 {
-                                    source: 'Retire.js',
+                                    source: retireSource,
                                     severity: vuln.severity,
                                 },
                             ],
@@ -121,8 +128,13 @@ function configureCycloneDXJSONLogger(logger, writer, config, hash) {
                     }
                     vulnerabilitiesCyclone.get(id).affects.push({
                         ref: bomRef,
-                        // "vers:npm/1.2.3|>=2.0.0|<5.0.0"
-                        range: "vers:npm/" + (vuln.atOrAbove ? ">=" + vuln.atOrAbove + "|" : "") + "<" + vuln.below,
+                        versions: [
+                            {
+                                // "vers:npm/1.2.3|>=2.0.0|<5.0.0"
+                                range: 'vers:npm/' + (vuln.atOrAbove ? '>=' + vuln.atOrAbove + '|' : '') + '<' + vuln.below,
+                                status: 'affected',
+                            },
+                        ],
                     });
                 });
             });
@@ -156,6 +168,12 @@ function configureCycloneDXJSONLogger(logger, writer, config, hash) {
                         version: retire.version,
                     },
                 ],
+                properties: repositories.length
+                    ? repositories.map((repo) => ({
+                        name: 'retirejs:vulnerability-repository',
+                        value: repo,
+                    }))
+                    : undefined,
             },
             components: components,
             vulnerabilities: includeVEX ? Array.from(vulnerabilitiesCyclone.values()) : undefined,

package/lib/reporters/cyclonedx-json.js

@@ -65,6 +65,7 @@ function configureCycloneDXJSONLogger(logger, writer, config, hash) {
     };
     logger.close = function (callback) {
         const write = vulnsFound ? writer.err : writer.out;
+        const repositories = (0, utils_1.vulnerabilityRepositories)(config.jsRepo);
         const seen = new Map();
         const components = finalResults.data
             .filter((d) => d.results)
@@ -122,6 +123,12 @@ function configureCycloneDXJSONLogger(logger, writer, config, hash) {
                         version: retire.version,
                     },
                 ],
+                properties: repositories.length
+                    ? repositories.map((repo) => ({
+                        name: 'retirejs:vulnerability-repository',
+                        value: repo,
+                    }))
+                    : undefined,
             },
             components: components,
         }, undefined, 2));

package/lib/reporters/cyclonedx.js

@@ -65,6 +65,10 @@ function configureCycloneDXLogger(logger, writer, config, hash) {
     };
     logger.close = function (callback) {
         const write = vulnsFound ? writer.err : writer.out;
+        const repositories = (0, utils_1.vulnerabilityRepositories)(config.jsRepo)
+            .map((repo) => `
+      <property name="retirejs:vulnerability-repository">${escapeXml(repo)}</property>`)
+            .join('');
         const seen = new Set();
         const components = finalResults.data
             .filter((d) => d.results.length > 0)
@@ -109,7 +113,9 @@ function configureCycloneDXLogger(logger, writer, config, hash) {
             <name>retire.js</name>
             <version>${retire.version}</version>
         </tool>
-    </tools>
+    </tools>${repositories ? `
+    <properties>${repositories}
+    </properties>` : ''}
   </metadata>
   <components>${components}
   </components>
@@ -117,6 +123,13 @@ function configureCycloneDXLogger(logger, writer, config, hash) {
         writer.close(callback);
     };
 }
+function escapeXml(value) {
+    return value
+        .replace(/&/g, '&amp;')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;');
+}
 function mapLicenses(licenses) {
     if (!licenses)
         return '';

package/lib/reporters/json.js

@@ -35,6 +35,7 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 const retire = __importStar(require("../retire"));
+const utils_1 = require("./utils");
 exports.default = {
     configure: (logger, writer, config) => {
         const scanStart = Date.now();
@@ -45,6 +46,7 @@ exports.default = {
             messages: [],
             errors: [],
             time: undefined,
+            vulnerabilityRepositories: (0, utils_1.vulnerabilityRepositories)(config.jsRepo),
         };
         logger.info = finalResults.messages.push;
         logger.debug = config.verbose

package/lib/reporters/utils.d.ts

@@ -1,2 +1,6 @@
 import { Component } from '../types';
 export declare function generatePURL(component: Component): string;
+/**
+ * The vulnerability repositories used for the scan, as configured via --jsrepo.
+ */
+export declare function vulnerabilityRepositories(jsRepo: string[] | undefined): string[];

package/lib/reporters/utils.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.generatePURL = generatePURL;
+exports.vulnerabilityRepositories = vulnerabilityRepositories;
 function encodePURLchars(str) {
     return str.replace(/[^A-Za-z0-9.+/=%-]/g, (match) => '%' + ('0' + match.charCodeAt(0).toString(16).toUpperCase()).slice(-2));
 }
@@ -13,3 +14,11 @@ function generatePURL(component) {
     const compName = component.npmname || component.component;
     return `pkg:npm/${encodePURLchars(compName)}@${encodePURLchars(component.version)}`;
 }
+/**
+ * The vulnerability repositories used for the scan, as configured via --jsrepo.
+ */
+function vulnerabilityRepositories(jsRepo) {
+    if (!jsRepo)
+        return [];
+    return jsRepo.map((repo) => repo.trim()).filter((repo) => repo.length > 0);
+}

package/lib/reporting.d.ts

@@ -4,7 +4,7 @@ export type LoggerOptions = {
     verbose: boolean;
     colors: boolean;
     outputformat: string;
-    jsRepo: string;
+    jsRepo: string[];
     path: string;
     colorwarn: (s: string) => string;
 };

package/lib/retire.js

@@ -4,7 +4,7 @@
  */
 
 var exports = exports || {};
-exports.version = '5.4.3';
+exports.version = '5.5.0';
 
 function isDefined(o) {
   return typeof o !== 'undefined';

package/package.json

@@ -2,7 +2,7 @@
   "author": "Erlend Oftedal <erlend@oftedal.no>",
   "name": "retire",
   "description": "Retire is a tool for detecting use of vulnerable libraries",
-  "version": "5.4.3",
+  "version": "5.5.0",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",
@@ -14,30 +14,26 @@
   "main": "./lib/retire.js",
   "dependencies": {
     "ansi-colors": "^4.1.1",
-    "astronomical": "^3.0.0",
+    "astronomical": "^3.2.0",
     "commander": "^10.0.1",
     "proxy-agent": "^6.4.0",
     "walkdir": "0.4.1",
     "zod": "^3.22.4"
   },
   "devDependencies": {
-    "@types/chai": "^4.3.17",
-    "@types/jest": "^29.5.14",
     "@types/node": "^18.13.0",
     "@types/uuid": "^9.0.0",
     "@typescript-eslint/eslint-plugin": "^7.1.1",
     "@typescript-eslint/parser": "^7.1.1",
-    "chai": "^4.x.x",
     "eslint": "^8.34.0",
     "eslint-config-prettier": "^9.0.0",
     "jsonschema": "^1.4.1",
     "prettier": "^3.1.0",
-    "ts-jest": "^29.3.4",
     "ts-node": "^10.9.2",
     "typescript": "^5.0.4"
   },
   "scripts": {
-    "test": "rm   -rf spec/out && mkdir -p spec/out && jest --ci --runInBand",
+    "test": "TS_NODE_PROJECT=tsconfig.spec.json node --require ts-node/register --test \"spec/tests/**/*.spec.ts\"",
     "build": "tsc && chmod ugo+x lib/cli.js && cp src/retire.d.ts lib/retire.d.ts && cp ../LICENSE.md .",
     "watch": "tsc --watch ",
     "typecheck": "tsc --noEmit",