retire 5.5.0 → 5.6.0

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## [5.6.0]
+
+### Improvements
+
+- Report when repository certificate errors are ignored (`--insecure`): as `ignoreRepositoryCertificateErrors` in the JSON report, and as a `retirejs:ignore-repository-certificate-errors` entry under `metadata.properties` in all CycloneDX reports. The entry is only present when the option is set.
+
 ## [5.5.0]
 
 ### Improvements

package/lib/cli.js

@@ -96,6 +96,7 @@ const log = reporting.open({
     colors: !!prg.colors,
     colorwarn,
     jsRepo: jsrepolocation,
+    insecure: prg.insecure,
     outputformat: prg.outputformat,
     outputpath: prg.outputpath,
     path: scanpath,

package/lib/reporters/cyclonedx-1_6-json.js

@@ -68,12 +68,16 @@ function configureCycloneDXJSONLogger(logger, writer, config, hash) {
         const seen = new Map();
         const vulnerabilitiesCyclone = new Map();
         const includeVEX = config.outputformat === 'cyclonedxJSON1_6_VEX';
-        const repositories = (0, utils_1.vulnerabilityRepositories)(config.jsRepo);
+        const vulnerabilityRepositoriesList = (0, utils_1.vulnerabilityRepositories)(config.jsRepo);
         // Only attributable to a single URL when exactly one repository was used
         const retireSource = {
             name: 'Retire.js',
-            url: repositories.length === 1 ? repositories[0] : undefined,
+            url: vulnerabilityRepositoriesList.length === 1 ? vulnerabilityRepositoriesList[0] : undefined,
         };
+        const properties = vulnerabilityRepositoriesList.map((repo) => ({ name: 'retirejs:vulnerability-repository', value: repo }));
+        if (config.insecure) {
+            properties.push({ name: 'retirejs:ignore-repository-certificate-errors', value: 'true' });
+        }
         const components = finalResults.data
             .filter((d) => d.results)
             .map((r) => r.results
@@ -168,12 +172,7 @@ function configureCycloneDXJSONLogger(logger, writer, config, hash) {
                         version: retire.version,
                     },
                 ],
-                properties: repositories.length
-                    ? repositories.map((repo) => ({
-                        name: 'retirejs:vulnerability-repository',
-                        value: repo,
-                    }))
-                    : undefined,
+                properties: properties.length ? properties : undefined,
             },
             components: components,
             vulnerabilities: includeVEX ? Array.from(vulnerabilitiesCyclone.values()) : undefined,

package/lib/reporters/cyclonedx-json.js

@@ -65,7 +65,10 @@ function configureCycloneDXJSONLogger(logger, writer, config, hash) {
     };
     logger.close = function (callback) {
         const write = vulnsFound ? writer.err : writer.out;
-        const repositories = (0, utils_1.vulnerabilityRepositories)(config.jsRepo);
+        const properties = (0, utils_1.vulnerabilityRepositories)(config.jsRepo).map((repo) => ({ name: 'retirejs:vulnerability-repository', value: repo }));
+        if (config.insecure) {
+            properties.push({ name: 'retirejs:ignore-repository-certificate-errors', value: 'true' });
+        }
         const seen = new Map();
         const components = finalResults.data
             .filter((d) => d.results)
@@ -123,12 +126,7 @@ function configureCycloneDXJSONLogger(logger, writer, config, hash) {
                         version: retire.version,
                     },
                 ],
-                properties: repositories.length
-                    ? repositories.map((repo) => ({
-                        name: 'retirejs:vulnerability-repository',
-                        value: repo,
-                    }))
-                    : undefined,
+                properties: properties.length ? properties : undefined,
             },
             components: components,
         }, undefined, 2));

package/lib/reporters/cyclonedx.js

@@ -65,9 +65,16 @@ function configureCycloneDXLogger(logger, writer, config, hash) {
     };
     logger.close = function (callback) {
         const write = vulnsFound ? writer.err : writer.out;
-        const repositories = (0, utils_1.vulnerabilityRepositories)(config.jsRepo)
-            .map((repo) => `
-      <property name="retirejs:vulnerability-repository">${escapeXml(repo)}</property>`)
+        const propertyList = (0, utils_1.vulnerabilityRepositories)(config.jsRepo).map((repo) => ({
+            name: 'retirejs:vulnerability-repository',
+            value: repo,
+        }));
+        if (config.insecure) {
+            propertyList.push({ name: 'retirejs:ignore-repository-certificate-errors', value: 'true' });
+        }
+        const properties = propertyList
+            .map((property) => `
+      <property name="${escapeXml(property.name)}">${escapeXml(property.value)}</property>`)
             .join('');
         const seen = new Set();
         const components = finalResults.data
@@ -113,8 +120,8 @@ function configureCycloneDXLogger(logger, writer, config, hash) {
             <name>retire.js</name>
             <version>${retire.version}</version>
         </tool>
-    </tools>${repositories ? `
-    <properties>${repositories}
+    </tools>${properties ? `
+    <properties>${properties}
     </properties>` : ''}
   </metadata>
   <components>${components}

package/lib/reporters/json.js

@@ -47,6 +47,7 @@ exports.default = {
             errors: [],
             time: undefined,
             vulnerabilityRepositories: (0, utils_1.vulnerabilityRepositories)(config.jsRepo),
+            ignoreRepositoryCertificateErrors: config.insecure,
         };
         logger.info = finalResults.messages.push;
         logger.debug = config.verbose

package/lib/reporting.d.ts

@@ -5,6 +5,7 @@ export type LoggerOptions = {
     colors: boolean;
     outputformat: string;
     jsRepo: string[];
+    insecure?: boolean;
     path: string;
     colorwarn: (s: string) => string;
 };

package/lib/retire.js

@@ -4,7 +4,7 @@
  */
 
 var exports = exports || {};
-exports.version = '5.5.0';
+exports.version = '5.6.0';
 
 function isDefined(o) {
   return typeof o !== 'undefined';

package/package.json

@@ -2,7 +2,7 @@
   "author": "Erlend Oftedal <erlend@oftedal.no>",
   "name": "retire",
   "description": "Retire is a tool for detecting use of vulnerable libraries",
-  "version": "5.5.0",
+  "version": "5.6.0",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",