snyk-nuget-plugin 1.8.0 → 1.10.0

package/.eslintrc

@@ -25,7 +25,7 @@
       }
     ],
     "max-depth": [1, 3],
-    "max-len": [1, 80],
+    "max-len": [1, 100],
     "max-statements": [1, 25],
     "new-cap": 0,
     "no-caller": 2,

package/README.md

@@ -8,4 +8,4 @@ Snyk helps you find, fix and monitor for known vulnerabilities in your dependenc
 
 ## Snyk NuGet CLI Plugin
 
-The plugin provides dependency metadata for NuGet projects that manifest dependencies in `project.json` or `packages.config` files.
+The plugin provides dependency metadata for NuGet projects that manifest dependencies in `project.json`, `packages.config` or `project.assets.json` files.

package/lib/index.js

@@ -1,6 +1,7 @@
-var path = require('path');
-var dotnetParser = require('./dotnet-parser');
-var paketParser = require('snyk-paket-parser');
+'use strict';
+const path = require('path');
+const nugetParser = require('./nuget-parser');
+const paketParser = require('snyk-paket-parser');
 
 function determineManifestType(filename) {
   switch (true) {
@@ -25,16 +26,15 @@ function determineManifestType(filename) {
 module.exports = {
   inspect: function (root, targetFile, options) {
     options = options || {};
-    var fileContentPath = path.resolve(root || '.', targetFile || '.');
-    var manifestType;
+    let manifestType;
     try {
       manifestType = determineManifestType(path.basename(targetFile || root));
     } catch (error) {
       return Promise.reject(error);
     }
 
-    var createPackageTree = function (depTree) {
-      var targetFramework = depTree.meta ? depTree.meta.targetFramework : undefined; // TODO implement for paket and more than one framework
+    const createPackageTree = function (depTree) {
+      const targetFramework = depTree.meta ? depTree.meta.targetFramework : undefined; // TODO implement for paket and more than one framework
       delete depTree.meta;
       return {
         package: depTree,
@@ -56,12 +56,11 @@ module.exports = {
       ).then(createPackageTree);
     }
 
-    return dotnetParser.parse(
+    return nugetParser.buildDepTreeFromFiles(
       root,
       targetFile,
       options.packagesFolder,
-      fileContentPath,
-      manifestType).then(createPackageTree);
-
+      manifestType,
+      options['assets-project-name']).then(createPackageTree);
   },
 };

package/lib/nuget-parser/csproj-parser.js

@@ -0,0 +1,75 @@
+'use strict';
+const fs = require('fs');
+const path = require('path');
+const parseXML = require('xml2js').parseString;
+const debug = require('debug')('snyk');
+const _ = require('lodash');
+
+function getTargetFrameworksFromProjFile(rootDir) {
+  debug('Looking for your .csproj file in ' + rootDir);
+  const csprojPath = findFile(rootDir, /.*\.csproj$/);
+  if (csprojPath) {
+    debug('Checking .net framework version in .csproj file ' + csprojPath);
+
+    const csprojContents = fs.readFileSync(csprojPath);
+
+    let frameworks = [];
+    parseXML(csprojContents, function (err, parsedCsprojContents) {
+      if (err) {
+        throw err;
+      }
+      const versionLoc = _.get(parsedCsprojContents, 'Project.PropertyGroup[0]');
+      const versions = _.compact(_.concat([],
+        _.get(versionLoc, 'TargetFrameworkVersion[0]') ||
+        _.get(versionLoc, 'TargetFramework[0]') ||
+        _.get(versionLoc, 'TargetFrameworks[0]', '').split(';')));
+
+      if (versions.length < 1) {
+        debug('Could not find TargetFrameworkVersion/TargetFramework' +
+          '/TargetFrameworks defined in the Project.PropertyGroup field of ' +
+          'your .csproj file');
+      }
+      frameworks = _.compact(_.map(versions, toReadableFramework));
+      if (versions.length > 1 && frameworks.length < 1) {
+        debug('Could not find valid/supported .NET version in csproj file located at' + csprojPath);
+      }
+    });
+    return frameworks[0];
+  }
+  debug('.csproj file not found in ' + rootDir + '.');
+}
+
+function toReadableFramework(targetFramework) {
+  const typeMapping = {
+    v: '.NETFramework',
+    net: '.NETFramework',
+    netstandard: '.NETStandard',
+    netcoreapp: '.NETCore',
+  };
+
+  for (const type in typeMapping) {
+    if (new RegExp(type + /\d.?\d(.?\d)?$/.source).test(targetFramework)) {
+      return {
+        framework: typeMapping[type],
+        version: targetFramework.split(type)[1],
+        original: targetFramework,
+      };
+    }
+  }
+}
+
+function findFile(rootDir, filter) {
+  if (!fs.existsSync(rootDir)) {
+    throw new Error('No such path: ' + rootDir);
+  }
+  const files = fs.readdirSync(rootDir);
+  for (let i = 0; i < files.length; i++) {
+    const filename = path.resolve(rootDir, files[i]);
+
+    if (filter.test(filename)) {
+      return filename;
+    }
+  }
+}
+
+module.exports = getTargetFrameworksFromProjFile;

package/lib/{dependency.js → nuget-parser/dependency.js}

@@ -1,3 +1,4 @@
+'use strict';
 var debug = require('debug')('snyk');
 
 function Dependency(name, version) {

package/lib/{formats → nuget-parser}/dotnet-core-parser.js

@@ -1,7 +1,7 @@
 'use strict';
-var Dependency = require('../dependency');
-var debug = require('debug')('snyk');
-var _ = require('lodash');
+const Dependency = require('../nuget-parser/dependency');
+const debug = require('debug')('snyk');
+const _ = require('lodash');
 
 // TODO: any convention for global vars? (gFreqDeps)
 let freqDeps = {};
@@ -84,16 +84,8 @@ function buildTreeRecursive(targetDeps, depName, parent, treeDepth) {
     });
 }
 
-
-function getFrameworkObjToRun(manifest) {
+function getFrameworkToRun(manifest) {
   const frameworks = _.get(manifest, 'project.frameworks');
-  if (!frameworks) {
-    throw new Error('No frameworks were found in project.assets.json');
-  }
-
-  if (_.isEmpty(frameworks)) {
-    throw new Error('0 frameworks were found in project.assets.json');
-  }
 
   debug(`Available frameworks: '${Object.keys(frameworks)}'`);
 
@@ -101,19 +93,10 @@ function getFrameworkObjToRun(manifest) {
   // taking only the first 1
   const selectedFrameworkKey = Object.keys(frameworks)[0];
   debug(`Selected framework: '${selectedFrameworkKey}'`);
-  return frameworks[selectedFrameworkKey];
+  return selectedFrameworkKey;
 }
 
-
 function getTargetObjToRun(manifest) {
-  if (!manifest.targets) {
-    throw new Error('No targets were found in project.assets.json');
-  }
-
-  if (_.isEmpty(manifest.targets)) {
-    throw new Error('0 targets were found in project.assets.json');
-  }
-
   debug(`Available targets: '${Object.keys(manifest.targets)}'`);
 
   let selectedTargetKey = Object.keys(manifest.targets)[0];
@@ -123,38 +106,70 @@ function getTargetObjToRun(manifest) {
   return manifest.targets[selectedTargetKey];
 }
 
-
-function parse(fileContent, packageTree) {
-  const manifest = JSON.parse(fileContent);
-
+function validateManifest(manifest) {
   if (!manifest.project) {
     throw new Error('Project field was not found in project.assets.json');
   }
 
-  if (manifest.project.version) {
-    packageTree.version = manifest.project.version;
+  if (!manifest.project.frameworks) {
+    throw new Error('No frameworks were found in project.assets.json');
   }
 
-  const selectedFrameworkObj = getFrameworkObjToRun(manifest);
-  const selectedTargetObj = getTargetObjToRun(manifest);
-
-  initFreqDepsDict();
-
-  const directDependencies = collectFlatList(selectedFrameworkObj.dependencies);
-  debug(`directDependencies: '${directDependencies}'`);
+  if (_.isEmpty(manifest.project.frameworks)) {
+    throw new Error('0 frameworks were found in project.assets.json');
+  }
 
-  directDependencies.forEach(function (directDep) {
-    debug(`First order dep: '${directDep}'`);
-    buildTreeRecursive(selectedTargetObj, directDep, packageTree, 0);
-  });
+  if (!manifest.targets) {
+    throw new Error('No targets were found in project.assets.json');
+  }
 
-  if (!_.isEmpty(freqDeps.dependencies.dependencies)) {
-    packageTree.dependencies['freqSystemDependencies'] = freqDeps.dependencies;
+  if (_.isEmpty(manifest.targets)) {
+    throw new Error('0 targets were found in project.assets.json');
   }
-  // to disconnect the object references inside the tree
-  // JSON parse/stringify is used
-  let pathedTree = JSON.parse(JSON.stringify(packageTree.dependencies));
-  packageTree.dependencies = pathedTree;
 }
 
-module.exports = parse;
+module.exports = {
+  parse: function (tree, manifest) {
+    return new Promise(function parseFileContents(resolve, reject) {
+      debug('Trying to parse dot-net-cli manifest');
+
+      try {
+        validateManifest(manifest);
+      } catch (err) {
+        debug('Invalid project.assets.json manifest file');
+        reject(err);
+      }
+
+      if (manifest.project.version) {
+        tree.version = manifest.project.version;
+      }
+
+      // If a targetFramework was not found in the proj file, we will extract it from the lock file
+      if (!tree.meta.targetFramework) {
+        tree.meta.targetFramework = getFrameworkToRun(manifest);
+      }
+      const selectedFrameworkObj = manifest.project.frameworks[tree.meta.targetFramework];
+
+      // We currently ignore the found targetFramework when looking for target dependencies
+      const selectedTargetObj = getTargetObjToRun(manifest);
+
+      initFreqDepsDict();
+
+      const directDependencies = collectFlatList(selectedFrameworkObj.dependencies);
+      debug(`directDependencies: '${directDependencies}'`);
+
+      directDependencies.forEach(function (directDep) {
+        debug(`First order dep: '${directDep}'`);
+        buildTreeRecursive(selectedTargetObj, directDep, tree, 0);
+      });
+
+      if (!_.isEmpty(freqDeps.dependencies.dependencies)) {
+        tree.dependencies['freqSystemDependencies'] = freqDeps.dependencies;
+      }
+      // to disconnect the object references inside the tree
+      // JSON parse/stringify is used
+      tree.dependencies = JSON.parse(JSON.stringify(tree.dependencies));
+      resolve(tree);
+    });
+  },
+};

package/lib/nuget-parser/dotnet-framework-parser.js

@@ -0,0 +1,140 @@
+'use strict';
+const fs = require('fs');
+const debug = require('debug')('snyk');
+const path = require('path');
+const Dependency = require('./dependency');
+const parseNuspec = require('./nuspec-parser');
+const _ = require('lodash');
+
+function injectPath(dep, packagesFolder) {
+  dep.path = dep.localPath ?
+    path.resolve(packagesFolder, dep.localPath)
+    : path.resolve(packagesFolder, dep.name + '.' + dep.version);
+  if (dep.localPath) {
+    delete dep.localPath;
+  }
+}
+
+function scanInstalled(installedPackages, packagesFolder) {
+  const flattenedPackageList = {};
+  debug('Located ' + installedPackages.length + ' packages in manifest');
+  installedPackages.forEach(function (entry) {
+    injectPath(entry, packagesFolder);
+    flattenedPackageList[entry.name] =
+      flattenedPackageList[entry.name] || entry;
+    debug('Entry: ' + entry.name + ' -> ' + entry.path);
+  });
+  try {
+    debug('Scanning local installed folders');
+    debug('Trying to read from installed packages folder: ' + packagesFolder);
+    fs.readdirSync(packagesFolder)
+      .map(function (folderName) {
+        try {
+          return Dependency.from.folderName(folderName);
+        } catch (err) {
+          debug('Unable to parse dependency from folder');
+          debug(err);
+        }
+      })
+      .forEach(function (dep) {
+        if (dep) {
+          injectPath(dep, packagesFolder);
+          // only add a package from packages folder if version is different
+          if (flattenedPackageList[dep.name] &&
+            flattenedPackageList[dep.name].version !== dep.version) {
+            // prefer found from packages folder (dep) over existing
+            debug('For package ' + dep.name + ' the version ' +
+              flattenedPackageList[dep.name].version +
+              ' was extracted from manifest file.' +
+              '\nWe are overwriting it with version ' + dep.version +
+              ' from the packages folder');
+            flattenedPackageList[dep.name] = dep;
+          }
+        }
+      });
+  } catch (err) {
+    debug('Could not complete packages folder scanning');
+    debug(err);
+  }
+  return flattenedPackageList;
+}
+
+function fetchNugetInformationFromPackages(flattenedPackageList, targetFramework) {
+  const nuspecParserChain = [];
+  // begin collecting information from .nuget files on installed packages
+  debug('Trying to analyze .nuspec files');
+  for (const name in flattenedPackageList) {
+    const dep = flattenedPackageList[name];
+    debug('...' + name);
+    nuspecParserChain.push(parseNuspec(dep, targetFramework));
+  }
+  return Promise.all(nuspecParserChain);
+}
+
+function processNugetInformation(nuspecResolutionChain) {
+  const nuspecResolutions = {};
+  nuspecResolutionChain.forEach(function (resolution) {
+    if (!resolution) {
+      return;
+    } // jscs:ignore
+    debug('.nuspec analyzed for ' + resolution.name);
+    nuspecResolutions[resolution.name] = resolution;
+  });
+  return nuspecResolutions;
+}
+
+module.exports = {
+  parse: function (tree, manifest, targetFramework, packagesFolder) {
+    if (!targetFramework) {
+      throw new Error('No valid Dotnet target framework found');
+    }
+
+    const flattenedPackageList = scanInstalled(manifest, packagesFolder);
+    return fetchNugetInformationFromPackages(flattenedPackageList, targetFramework)
+      .then(processNugetInformation)
+      .then(function buildDependencyTree(nuspecResolutions) {
+        // .nuget parsing is complete, returned as array of promise resolutions
+        // now the flat list should be rebuilt as a tree
+        debug('Building dependency tree');
+        function buildTree(node, requiredChildren, repository) {
+          requiredChildren.forEach(function (requiredChild) {
+            let transitiveDependency;
+            if (flattenedPackageList[requiredChild.name]) {
+              // fetch from repo
+              transitiveDependency =
+                flattenedPackageList[requiredChild.name].cloneShallow();
+            } else {
+              // create as new (uninstalled)
+              transitiveDependency = new Dependency(
+                requiredChild.name,
+                requiredChild.version);
+            }
+            const transitiveChildren =
+              (nuspecResolutions[transitiveDependency.name] &&
+                nuspecResolutions[transitiveDependency.name].children) || [];
+            buildTree(
+              transitiveDependency,
+              transitiveChildren,
+              repository);
+            node.dependencies[transitiveDependency.name] = transitiveDependency;
+          });
+        }
+
+        const _nugtKeyCount = Object.keys(nuspecResolutions).length;
+        Object.keys(flattenedPackageList).forEach(function (packageName) {
+          tree.dependencies[packageName] =
+            flattenedPackageList[packageName].cloneShallow();
+        });
+        if (_nugtKeyCount > 0) {
+          // local folders scanned, build list from .nuspec
+          for (const key in nuspecResolutions) {
+            const resolution = nuspecResolutions[key];
+            const node = flattenedPackageList[resolution.name].cloneShallow();
+            buildTree(node, resolution.children, flattenedPackageList);
+            tree.dependencies[node.name] = node;
+          }
+        }
+        return tree;
+      });
+  },
+};

package/lib/nuget-parser/index.js

@@ -0,0 +1,88 @@
+'use strict';
+const fs = require('fs');
+const path = require('path');
+const debug = require('debug')('snyk');
+const getTargetFrameworkFromProjFile = require('./csproj-parser');
+const _ = require('lodash');
+
+const dotnetCoreParser = require('./dotnet-core-parser');
+const dotnetFrameworkParser = require('./dotnet-framework-parser');
+const projectJsonParser = require('./project-json-parser');
+const packagesConfigParser = require('./packages-config-parser');
+
+const PARSERS = {
+  'dotnet-core': {
+    depParser: dotnetCoreParser,
+    fileContentParser: JSON,
+  },
+  'project.json': {
+    depParser: dotnetFrameworkParser,
+    fileContentParser: projectJsonParser,
+  },
+  'packages.config': {
+    depParser: dotnetFrameworkParser,
+    fileContentParser: packagesConfigParser,
+  },
+};
+
+function getPackagesFolder(packagesFolder, projectRootFolder) {
+  if (packagesFolder) {
+    return path.resolve(process.cwd(), packagesFolder);
+  }
+  return path.resolve(projectRootFolder, 'packages');
+}
+
+module.exports = {
+  buildDepTreeFromFiles: function (root, targetFile, packagesFolderPath, manifestType, useProjectNameFromAssetsFile) {
+    const fileContentPath = path.resolve(root || '.', targetFile || '.');
+    let fileContent;
+    try {
+      fileContent = fs.readFileSync(fileContentPath).toString();
+    } catch (error) {
+      return Promise.reject(error);
+    }
+    const projectRootFolder = path.resolve(fileContentPath, '../../');
+    const packagesFolder = getPackagesFolder(packagesFolderPath, projectRootFolder);
+
+    const tree = {
+      name: path.basename(root || projectRootFolder),
+      version: '0.0.0',
+      packageFormatVersion: 'nuget:0.0.0',
+      dependencies: {},
+    };
+
+    let targetFramework;
+    try {
+      if (manifestType === 'dotnet-core') {
+        targetFramework = getTargetFrameworkFromProjFile(projectRootFolder);
+      } else {
+        // .csproj is in the same directory as packages.config or project.json
+        targetFramework = getTargetFrameworkFromProjFile(path.resolve(fileContentPath, '../'));
+      }
+    } catch (error) {
+      return Promise.reject(error);
+    }
+
+    tree.meta = {
+      targetFramework: targetFramework ? targetFramework.original : undefined, //TODO implement for more than one TF
+    };
+
+    const parser = PARSERS[manifestType];
+    let manifest = parser.fileContentParser.parse(fileContent, tree);
+
+    if (manifestType === 'dotnet-core' && useProjectNameFromAssetsFile) {
+      let projectName = _.get(manifest, 'project.restore.projectName');
+      if (projectName) {
+        tree.name = projectName;
+      } else {
+        debug("project.assets.json file doesn't contain a value for 'projectName'. Using default value: " + tree.name);
+      }
+    }
+
+    return parser.depParser.parse(
+      tree,
+      manifest,
+      targetFramework,
+      packagesFolder);
+  },
+};

package/lib/{nuspec-parser.js → nuget-parser/nuspec-parser.js}

@@ -1,24 +1,25 @@
-var JSZip = require('jszip');
-var fs = require('fs');
-var path = require('path');
-var parseXML = require('xml2js').parseString;
-var Dependency = require('./dependency');
-var _ = require('lodash');
-var debug = require('debug')('snyk');
+'use strict';
+const JSZip = require('jszip');
+const fs = require('fs');
+const path = require('path');
+const parseXML = require('xml2js').parseString;
+const Dependency = require('./dependency');
+const _ = require('lodash');
+const debug = require('debug')('snyk');
 
 const targetFrameworkRegex = /([.a-zA-Z]+)([.0-9]+)/;
 
-function parseNuspec(dep, targetFrameworks, sep) {
+function parseNuspec(dep, targetFramework, sep) {
   return Promise.resolve()
     .then(function () {
-      var pathSep = sep || '.';
-      var nupkgPath =
+      const pathSep = sep || '.';
+      const nupkgPath =
         path.resolve(dep.path, dep.name + pathSep + dep.version + '.nupkg');
-      var nupkgData = fs.readFileSync(nupkgPath);
+      const nupkgData = fs.readFileSync(nupkgPath);
       return JSZip.loadAsync(nupkgData);
     })
     .then(function (nuspecZipData) {
-      var nuspecFile = Object.keys(nuspecZipData.files).find(function (file) {
+      const nuspecFile = Object.keys(nuspecZipData.files).find(function (file) {
         return (path.extname(file) === '.nuspec');
       });
       return nuspecZipData.files[nuspecFile].async('string');
@@ -30,7 +31,7 @@ function parseNuspec(dep, targetFrameworks, sep) {
             return reject(err);
           }
 
-          var ownDeps = [];
+          let ownDeps = [];
           // We are only going to check the first targetFramework we encounter
           // in the future we may want to support multiple, but only once
           // we have dependency version conflict resolution implemented
@@ -40,7 +41,7 @@ function parseNuspec(dep, targetFrameworks, sep) {
 
               // Find and add target framework version specific dependencies
               const depsForTargetFramework =
-              extractDepsForTargetFrameworks(rawDependency, targetFrameworks);
+              extractDepsForTargetFramework(rawDependency, targetFramework);
 
               if (depsForTargetFramework && depsForTargetFramework.group) {
                 ownDeps = _.concat(ownDeps,
@@ -87,7 +88,7 @@ function extractDepsForPlainGroups(rawDependency) {
     });
 }
 
-function extractDepsForTargetFrameworks(rawDependency, targetFrameworks) {
+function extractDepsForTargetFramework(rawDependency, targetFramework) {
   return rawDependency && _(rawDependency.group)
     .filter(function (group) {
       return group && group.$ && group.$.targetFramework &&
@@ -103,16 +104,16 @@ function extractDepsForTargetFrameworks(rawDependency, targetFrameworks) {
     })
     .orderBy(['framework', 'version'], ['asc', 'desc'])
     .find(function (group) {
-      return targetFrameworks[0].framework === group.framework &&
-        targetFrameworks[0].version >= group.version;
+      return targetFramework.framework === group.framework &&
+        targetFramework.version >= group.version;
     });
 }
 
 function extractDepsFromRaw(rawDependencies) {
-  var deps = [];
+  const deps = [];
   _.forEach(rawDependencies, function (dependency) {
     if (dependency && dependency.$) {
-      var dep = new Dependency(dependency.$.id, dependency.$.version);
+      const dep = new Dependency(dependency.$.id, dependency.$.version);
       deps.push(dep);
     }
   });

package/lib/nuget-parser/packages-config-parser.js

@@ -0,0 +1,28 @@
+'use strict';
+const parseXML = require('xml2js').parseString;
+const debug = require('debug')('snyk');
+const Dependency = require('./dependency');
+
+function parsePackagesConfigFileContents(fileContent) {
+  const installedPackages = [];
+  debug('Trying to parse packages.config manifest');
+  parseXML(fileContent, function (err, result) {
+    if (err) {
+      throw err;
+    } else {
+      const packages = result.packages.package || [];
+
+      packages.forEach(
+        function scanPackagesConfigNode(node) {
+          const installedDependency =
+            Dependency.from.packgesConfigEntry(node);
+          installedPackages.push(installedDependency);
+        });
+    }
+  });
+  return installedPackages;
+}
+
+module.exports = {
+  parse: parsePackagesConfigFileContents,
+};

package/lib/nuget-parser/project-json-parser.js

@@ -0,0 +1,73 @@
+'use strict';
+const debug = require('debug')('snyk');
+const Dependency = require('./dependency');
+
+function scanForDependencies(obj, deps) {
+  deps = deps || {};
+  if (typeof obj !== 'object') {
+    return deps;
+  }
+  Object.keys(obj).forEach(function (key) {
+    if (key === 'dependencies') {
+      const dependencies = obj.dependencies;
+      Object.keys(dependencies).forEach(function (key) {
+        const depName = key;
+        let version = dependencies[key];
+        if (typeof version === 'object') {
+          version = version.version;
+        }
+        if (typeof version === 'undefined') {
+          version = 'unknown';
+        } else {
+          version = version.toString();
+        }
+        deps[depName] = version;
+      });
+    } else {
+      scanForDependencies(obj[key], deps);
+    }
+  });
+  return deps;
+}
+
+function parseJsonManifest(fileContent) {
+  const rawContent = JSON.parse(fileContent);
+  const result = {};
+  result.dependencies = scanForDependencies(rawContent, {});
+  if (typeof rawContent.project === 'object') {
+    const pData = rawContent.project;
+    const name = (pData.restore && pData.restore.projectName);
+    result.project = {
+      version: pData.version || '0.0.0',
+    };
+    if (name) {
+      result.project.name = name;
+    }
+  }
+  return result;
+}
+
+function parseProjectJsonFileContents(fileContent, tree) {
+  const installedPackages = [];
+  debug('Trying to parse project.json format manifest');
+  const projectData = parseJsonManifest(fileContent);
+  const rawDependencies = projectData.dependencies;
+  debug(rawDependencies);
+  if (rawDependencies) {
+    for (const name in rawDependencies) {
+      // Array<{ "libraryName": "version" }>
+      const version = rawDependencies[name];
+      const newDependency = new Dependency(name, version, null);
+      installedPackages.push(newDependency);
+    }
+  }
+  if (projectData.project) {
+    tree.name = projectData.project.name;
+    tree.version = projectData.project.version;
+  }
+  return installedPackages;
+}
+
+module.exports = {
+  parse: parseProjectJsonFileContents,
+};

package/package.json

@@ -34,5 +34,5 @@
     "tap": "12.4.1",
     "tap-only": "0.0.5"
   },
-  "version": "1.8.0"
+  "version": "1.10.0"
 }

package/lib/dotnet-parser.js

@@ -1,231 +0,0 @@
-var fs = require('fs');
-var parseXML = require('xml2js').parseString;
-var Dependency = require('./dependency');
-var path = require('path');
-var parseNuspec = require('./nuspec-parser');
-var jsonManifestParser = require('./json-manifest-parser');
-var debug = require('debug')('snyk');
-var projectJsonFormatParser = require('./formats/dotnet-core-parser');
-var determineDotnetVersions = require('./proj-parser');
-
-function injectProjectData(tree, projectData) {
-  tree.name = projectData.project.name;
-  tree.version = projectData.project.version;
-}
-
-function injectPath(dep, packagesFolder) {
-  dep.path =
-    dep.localPath ?
-      path.resolve(packagesFolder, dep.localPath)
-      : path.resolve(packagesFolder, dep.name + '.' + dep.version);
-  if (dep.localPath) {
-    delete dep.localPath;
-  }
-}
-
-function getPackagesFolder(packagesFolder, projectRootFolder) {
-  if (packagesFolder) {
-    return path.resolve(process.cwd(), packagesFolder);
-  }
-  return path.resolve(projectRootFolder, 'packages');
-}
-
-module.exports = {
-  parse: function (root, targetFile, packagesFolder, fileContentPath, manifestType) {
-    var fileContent;
-    try {
-      fileContent = fs.readFileSync(fileContentPath).toString();
-    } catch (error) {
-      return Promise.reject(error);
-    }
-    var projectRootFolder = path.resolve(fileContentPath, '../../');
-    var packagesFolder = getPackagesFolder(packagesFolder, projectRootFolder);
-    var dotnetVersions;
-
-    try {
-      if (manifestType === 'dotnet-core') {
-        dotnetVersions = determineDotnetVersions(projectRootFolder);
-      } else {
-        // .csproj is in the same directory as packages.config or project.json
-        dotnetVersions = determineDotnetVersions(path.resolve(fileContentPath, '../'));
-      }
-    } catch (error) {
-      return Promise.reject(error);
-    }
-
-    debug('Loaded ' + targetFile + ' with manifest type '
-      + manifestType + ' for .NET version ' + dotnetVersions);
-
-    var flattendPackageList = {};
-    var nuspecResolutions = {};
-
-    var tree = {
-      name: path.basename(root || projectRootFolder),
-      version: '0.0.0',
-      packageFormatVersion: 'nuget:0.0.0',
-      dependencies: {},
-      meta: {
-        targetFramework: dotnetVersions[0].original, //TODO implement for more than one TF
-      },
-    };
-
-    return new Promise(function parseFileContents(resolve, reject) {
-      var installedPackages = [];
-      switch (manifestType) {
-        case 'dotnet-core': {
-          debug('Trying to parse dot-net-cli manifest');
-          projectJsonFormatParser(fileContent, tree);
-          resolve([]); // skip installed dependencies parsing
-          break;
-        }
-        case 'project.json': {
-          debug('Trying to parse project.json format manifest');
-          var projectData = jsonManifestParser.parse(fileContent);
-          var rawDependencies = projectData.dependencies;
-          debug(rawDependencies);
-          if (rawDependencies) {
-            for (var name in rawDependencies) {
-              // Array<{ "libraryName": "version" }>
-              var version = rawDependencies[name];
-              var newDependency = new Dependency(name, version, null);
-              installedPackages.push(newDependency);
-            }
-          }
-          if (projectData.project) {
-            injectProjectData(tree, projectData);
-          }
-          resolve(installedPackages);
-          break;
-        }
-        case 'packages.config': {
-          debug('Trying to parse packages.config manifest');
-          parseXML(fileContent, function scanPackagesConfig(err, result) {
-            if (err) {
-              reject(err);
-            } else {
-              result.packages.package.forEach(
-                function scanPackagesConfigNode(node) {
-                  var installedDependency =
-                    Dependency.from.packgesConfigEntry(node);
-                  installedPackages.push(installedDependency);
-                });
-              resolve(installedPackages);
-            }
-          });
-          break;
-        }
-      }
-    }).then(function scanInstalled(installedPackages) {
-      if (manifestType !== 'dotnet-core') {
-        debug('Located ' + installedPackages.length + ' packages in manifest');
-        installedPackages.forEach(function (entry) {
-          injectPath(entry, packagesFolder);
-          flattendPackageList[entry.name] =
-            flattendPackageList[entry.name] || entry;
-          debug('Entry: ' + entry.name + ' -> ' + entry.path);
-        });
-        try {
-          debug('Scanning local installed folders');
-          debug('Trying to read from installed packages folder: ' +
-            packagesFolder);
-          fs.readdirSync(packagesFolder)
-            .map(function (folderName) {
-              return Dependency.from.folderName(folderName);
-            })
-            .forEach(function (dep) {
-              injectPath(dep, packagesFolder);
-              // only add a package from packages folder if version is different
-              if (flattendPackageList[dep.name] &&
-                flattendPackageList[dep.name].version !== dep.version) {
-                // prefer found from packages folder (dep) over existing
-                debug('For package ' + dep.name + ' the version ' +
-                  flattendPackageList[dep.name].version +
-                  ' was extracted from manifest file.' +
-                  '\nWe are overwriting it with version ' + dep.version +
-                  ' from the packages folder');
-                flattendPackageList[dep.name] = dep;
-              }
-            });
-        } catch (err) {
-          debug('Could not complete packages folder scanning');
-          debug(err);
-        }
-      } else {
-        debug('Located ' +
-          Object.keys(tree.dependencies).length + 'packages in manifest');
-        var sorted = {};
-        Object.keys(flattendPackageList).sort().forEach(function (key) {
-          sorted[key] = flattendPackageList[key];
-        });
-        flattendPackageList = sorted;
-      }
-    }).then(function fetchNugetInformationFromPackages() {
-      var nuspecParserChain = [];
-      if (manifestType !== 'dotnet-core') {
-        // begin collecting information from .nuget files on installed packages
-        debug('Trying to analyze .nuspec files');
-        for (var name in flattendPackageList) {
-          var dep = flattendPackageList[name];
-          debug('...' + name);
-          nuspecParserChain.push(parseNuspec(dep, dotnetVersions));
-        }
-      }
-      return Promise.all(nuspecParserChain);
-    }).then(function processNugetInformation(nuspecResolutionChain) {
-      if (manifestType !== 'dotnet-core') {
-        nuspecResolutionChain.forEach(function (resolution) {
-          if (!resolution) {
-            return;
-          } // jscs:ignore
-          debug('.nuspec analyzed for ' + resolution.name);
-          nuspecResolutions[resolution.name] = resolution;
-        });
-      }
-    }).then(function buildDependencyTree() {
-      // .nuget parsing is complete, returned as array of promise resolutions
-      // now the flat list should be rebuilt as a tree
-      debug('Building dependency tree');
-      function buildTree(node, requiredChildren, repository) {
-        requiredChildren.forEach(function (requiredChild) {
-          var transitiveDependency;
-          if (flattendPackageList[requiredChild.name]) {
-            // fetch from repo
-            transitiveDependency =
-              flattendPackageList[requiredChild.name].cloneShallow();
-          } else {
-            // create as new (uninstalled)
-            transitiveDependency = new Dependency(
-              requiredChild.name,
-              requiredChild.version);
-          }
-          var transitiveChildren =
-            (nuspecResolutions[transitiveDependency.name] &&
-              nuspecResolutions[transitiveDependency.name].children) || [];
-          buildTree(
-            transitiveDependency,
-            transitiveChildren,
-            repository);
-          node.dependencies[transitiveDependency.name] = transitiveDependency;
-        });
-      }
-
-      var _nugtKeyCount = Object.keys(nuspecResolutions).length;
-      Object.keys(flattendPackageList).forEach(function (packageName) {
-        tree.dependencies[packageName] =
-          flattendPackageList[packageName].cloneShallow();
-      });
-      if (_nugtKeyCount > 0) {
-        // local folders scanned, build list from .nuspec
-        for (var key in nuspecResolutions) {
-          var resolution = nuspecResolutions[key];
-          var node = flattendPackageList[resolution.name].cloneShallow();
-          buildTree(node, resolution.children, flattendPackageList);
-          tree.dependencies[node.name] = node;
-        }
-      }
-      return tree;
-    })['catch'](function (err) {
-      throw (err);
-    });
-  },
-};

package/lib/find-folder.js

@@ -1,16 +0,0 @@
-var path = require('path');
-var fs = require('fs');
-
-function findFolder(dir) {
-  var parts = dir.split(path.sep);
-  var testPath;
-  while (parts.length > 0) {
-    testPath = path.join(parts.join(path.sep), 'packages');
-    if (fs.existsSync(testPath)) {
-      return testPath;
-    }
-    return false;
-  }
-}
-
-module.exports = findFolder;

package/lib/json-manifest-parser.js

@@ -1,46 +0,0 @@
-function scanForDependencies(obj, deps) {
-  deps = deps || {};
-  if (typeof obj !== 'object') {
-    return deps;
-  }
-  Object.keys(obj).forEach(function (key) {
-    if (key === 'dependencies') {
-      var dependencies = obj.dependencies;
-      Object.keys(dependencies).forEach(function (key) {
-        var depName = key;
-        var version = dependencies[key];
-        if (typeof version === 'object') {
-          version = version.version;
-        }
-        if (typeof version === 'undefined') {
-          version = 'unknown';
-        } else {
-          version = version.toString();
-        }
-        deps[depName] = version;
-      });
-    } else {
-      scanForDependencies(obj[key], deps);
-    }
-  });
-  return deps;
-}
-
-module.exports = {
-  parse: function parseJsonManifest(fileContent) {
-    var rawContent = JSON.parse(fileContent);
-    var result = {};
-    result.dependencies = scanForDependencies(rawContent, {});
-    if (typeof rawContent.project === 'object') {
-      var pData = rawContent.project;
-      var name = (pData.restore && pData.restore.projectName);
-      result.project = {
-        version: pData.version || '0.0.0',
-      };
-      if (name) {
-        result.project.name = name;
-      }
-    }
-    return result;
-  },
-};

package/lib/proj-parser.js

@@ -1,75 +0,0 @@
-const fs = require('fs');
-const path = require('path');
-const parseXML = require('xml2js').parseString;
-const debug = require('debug')('snyk');
-const _ = require('lodash');
-
-function determineDotnetVersions(rootDir) {
-  debug('Looking for your .csproj file in ' + rootDir);
-  const csprojPath = findFile(rootDir, /.*\.csproj$/);
-  if (!csprojPath) {
-    throw new Error('.csproj file not found in ' + rootDir + '. ' +
-      'Make sure project was built before running `snyk test`');
-  }
-  debug('Checking .net framework version in .csproj file ' + csprojPath);
-
-  const csprojContents = fs.readFileSync(csprojPath);
-
-  var frameworks = [];
-  parseXML(csprojContents, function (err, parsedCsprojContents) {
-    if (err) {
-      throw err;
-    }
-    const versionLoc = _.get(parsedCsprojContents, 'Project.PropertyGroup[0]');
-    const versions = _.compact(_.concat([],
-      _.get(versionLoc, 'TargetFrameworkVersion[0]') ||
-      _.get(versionLoc, 'TargetFramework[0]') ||
-      _.get(versionLoc, 'TargetFrameworks[0]', '').split(';')));
-
-    if (versions.length < 1) {
-      throw new Error('Could not find TargetFrameworkVersion/TargetFramework' +
-        '/TargetFrameworks defined in the Project.PropertyGroup field of ' +
-        'your .csproj file');
-    }
-    frameworks = _.compact(_.map(versions, toReadableFramework));
-  });
-  if (frameworks.length < 1) {
-    throw new Error('Could not find valid/supported .NET version');
-  }
-  return frameworks;
-}
-
-function toReadableFramework(targetFramework) {
-  const typeMapping = {
-    v: '.NETFramework',
-    net: '.NETFramework',
-    netstandard: '.NETStandard',
-    netcoreapp: '.NETCore',
-  };
-
-  for (var type in typeMapping) {
-    if (new RegExp(type + /\d.?\d(.?\d)?$/.source).test(targetFramework)) {
-      return {
-        framework: typeMapping[type],
-        version: targetFramework.split(type)[1],
-        original: targetFramework,
-      };
-    }
-  }
-}
-
-function findFile(rootDir, filter) {
-  if (!fs.existsSync(rootDir)) {
-    throw new Error('No such path: ' + rootDir);
-  }
-  const files = fs.readdirSync(rootDir);
-  for (var i = 0; i < files.length; i++) {
-    var filename = path.resolve(rootDir, files[i]);
-
-    if (filter.test(filename)) {
-      return filename;
-    }
-  }
-}
-
-module.exports = determineDotnetVersions;