snyk-nuget-plugin 2.1.0 → 2.2.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -4,7 +4,6 @@ exports.generateRuntimeAssemblies = void 0;
|
|
|
4
4
|
const errors = require("../errors/");
|
|
5
5
|
const fs = require("fs");
|
|
6
6
|
const lodash_1 = require("lodash");
|
|
7
|
-
const path = require("path");
|
|
8
7
|
const debugModule = require("debug");
|
|
9
8
|
const debug = debugModule('snyk');
|
|
10
9
|
// The Nuget dependency resolution rule of lowest applicable version
|
|
@@ -27,44 +26,30 @@ function generateRuntimeAssemblies(filePath) {
|
|
|
27
26
|
// .NETCoreApp,Version=v6.0/alpine-armv6
|
|
28
27
|
// ... etc.
|
|
29
28
|
// See all: https://github.com/dotnet/runtime/blob/bd83e17052d3c09022bad1d91dca860ca6b27ab9/src/libraries/Microsoft.NETCore.Platforms/src/runtime.json
|
|
30
|
-
|
|
29
|
+
let runtimeAssemblyVersions = {};
|
|
31
30
|
Object.entries(deps.targets).forEach(([target, dependencies]) => {
|
|
32
31
|
// Ignore target frameworks without dependencies, as they hold no dlls and thus no assembly versions to gauge.
|
|
33
32
|
if ((0, lodash_1.isEmpty)(dependencies)) {
|
|
34
33
|
return;
|
|
35
34
|
}
|
|
36
|
-
//
|
|
37
|
-
//
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
// "Castle.Core/4.4.1": {...},
|
|
42
|
-
// "runtimepack.Microsoft.NETCore.App.Runtime.osx-arm64/6.0.16": { runtime: {...} },
|
|
43
|
-
// ... etc.
|
|
44
|
-
const runtimes = {};
|
|
45
|
-
let name;
|
|
46
|
-
let runtime;
|
|
47
|
-
for (const packageInfo of Object.values(dependencies)) {
|
|
48
|
-
if (!('runtime' in packageInfo)) {
|
|
49
|
-
continue;
|
|
50
|
-
}
|
|
51
|
-
// This can be either one or more runtime deps nested under a single leaf.
|
|
52
|
-
runtime = packageInfo.runtime;
|
|
53
|
-
if (runtime && Object.keys(runtime).length > 0) {
|
|
54
|
-
for (const [fullName, version] of Object.entries(runtime)) {
|
|
55
|
-
if ((0, lodash_1.isEmpty)(version)) {
|
|
56
|
-
continue;
|
|
57
|
-
}
|
|
58
|
-
// For some versions of .NET, the dependency version generated can be more than just the System.* name, but a
|
|
59
|
-
// full path-like structure, such as lib/netstandard2.0/System.Buffers.dll, so extract as needed:
|
|
60
|
-
name = path.basename(fullName);
|
|
61
|
-
runtimes[name] = version;
|
|
62
|
-
}
|
|
63
|
-
}
|
|
35
|
+
// Since we're running `dotnet publish` with `--use-current-runtime`, this should exist in the dependency list,
|
|
36
|
+
// but guard against it to ensure good user feedback in case we did something wrong.
|
|
37
|
+
const runtimePack = Object.keys(dependencies).find((dep) => dep.startsWith('runtimepack'));
|
|
38
|
+
if (!runtimePack) {
|
|
39
|
+
throw new errors.FileNotProcessableError(`could not find any runtimepack.* identifier in the ${target} dependency`);
|
|
64
40
|
}
|
|
65
|
-
|
|
66
|
-
|
|
41
|
+
// The runtimepack contains all the current RuntimeIdentifier (RID) assemblies which we are interested in.
|
|
42
|
+
// Such as
|
|
43
|
+
// "runtimepack.Microsoft.NETCore.App.Runtime.osx-arm64/6.0.16": {
|
|
44
|
+
// "runtime": {
|
|
45
|
+
// "Microsoft.CSharp.dll": { .. assembly version 6.0.0 }
|
|
46
|
+
// }
|
|
47
|
+
// }
|
|
48
|
+
// We traverse all those and store them for the dependency graph build.
|
|
49
|
+
if (!('runtime' in dependencies[runtimePack])) {
|
|
50
|
+
throw new errors.FileNotProcessableError(`could not find any runtime list in the ${runtimePack} dependency`);
|
|
67
51
|
}
|
|
52
|
+
const runtimes = dependencies[runtimePack]['runtime'];
|
|
68
53
|
// Dig down into the specific runtimepack which contains all the assembly versions of
|
|
69
54
|
// the bundled DLLs for the given runtime, as:
|
|
70
55
|
// "runtimepack.Microsoft.NETCore.App.Runtime.osx-arm64/6.0.16": {
|
|
@@ -80,19 +65,20 @@ function generateRuntimeAssemblies(filePath) {
|
|
|
80
65
|
// (...)
|
|
81
66
|
// We currently only address assemblyVersions. FileVersion might become relevant, depending
|
|
82
67
|
// on how vulnerabilities are reported in the future.
|
|
83
|
-
runtimeAssemblyVersions
|
|
68
|
+
runtimeAssemblyVersions = Object.entries(runtimes).reduce((acc, [dll, versions]) => {
|
|
84
69
|
// Take the version number (N.N.N.N) and remove the last element, in order for vulndb to understand anything.
|
|
85
70
|
acc[dll] = versions.assemblyVersion.split('.').slice(0, -1).join('.');
|
|
86
71
|
return acc;
|
|
87
72
|
}, {});
|
|
73
|
+
// `dotnet publish` does not support multiple consecutive `--runtime` parameters, so there should really only
|
|
74
|
+
// be one. Thus, drop iterating more.
|
|
75
|
+
return;
|
|
88
76
|
});
|
|
89
77
|
if ((0, lodash_1.isEmpty)(runtimeAssemblyVersions)) {
|
|
90
78
|
throw new errors.FileNotProcessableError('collection of runtime assembly versions was empty, that should not happen');
|
|
91
79
|
}
|
|
92
80
|
debug('finished extracting runtime assemblies from ' + filePath);
|
|
93
|
-
|
|
94
|
-
// RIDs. Currently, we are only looking at the first one.
|
|
95
|
-
return Object.values(runtimeAssemblyVersions)[0];
|
|
81
|
+
return runtimeAssemblyVersions;
|
|
96
82
|
}
|
|
97
83
|
exports.generateRuntimeAssemblies = generateRuntimeAssemblies;
|
|
98
84
|
//# sourceMappingURL=runtime-assembly.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"runtime-assembly.js","sourceRoot":"","sources":["../../lib/nuget-parser/runtime-assembly.ts"],"names":[],"mappings":";;;AACA,qCAAqC;AACrC,yBAAyB;AACzB,mCAAiC;AACjC,
|
|
1
|
+
{"version":3,"file":"runtime-assembly.js","sourceRoot":"","sources":["../../lib/nuget-parser/runtime-assembly.ts"],"names":[],"mappings":";;;AACA,qCAAqC;AACrC,yBAAyB;AACzB,mCAAiC;AACjC,qCAAqC;AAErC,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;AAWlC,oEAAoE;AACpE,yGAAyG;AACzG,6GAA6G;AAC7G,8GAA8G;AAC9G,yBAAyB;AACzB,kHAAkH;AAClH,wBAAwB;AACxB,wFAAwF;AACxF,SAAgB,yBAAyB,CAAC,QAAgB;IACxD,KAAK,CAAC,qCAAqC,GAAG,QAAQ,CAAC,CAAC;IAExD,MAAM,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAEpD,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE;QACjB,MAAM,IAAI,MAAM,CAAC,uBAAuB,CACtC,yCAAyC,CAC1C,CAAC;KACH;IAED,wDAAwD;IACxD,sCAAsC;IACtC,wCAAwC;IACxC,WAAW;IACX,sJAAsJ;IACtJ,IAAI,uBAAuB,GAAqB,EAAE,CAAC;IACnD,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAkB,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,YAAY,CAAC,EAAE,EAAE;QACzE,8GAA8G;QAC9G,IAAI,IAAA,gBAAO,EAAC,YAAY,CAAC,EAAE;YACzB,OAAO;SACR;QAED,+GAA+G;QAC/G,oFAAoF;QACpF,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CACzD,GAAG,CAAC,UAAU,CAAC,aAAa,CAAC,CAC9B,CAAC;QAEF,IAAI,CAAC,WAAW,EAAE;YAChB,MAAM,IAAI,MAAM,CAAC,uBAAuB,CACtC,sDAAsD,MAAM,aAAa,CAC1E,CAAC;SACH;QAED,0GAA0G;QAC1G,UAAU;QACV,oEAAoE;QACpE,uBAAuB;QACvB,kEAAkE;QAClE,aAAa;QACb,MAAM;QACN,uEAAuE;QACvE,IAAI,CAAC,CAAC,SAAS,IAAI,YAAY,CAAC,WAAW,CAAC,CAAC,EAAE;YAC7C,MAAM,IAAI,MAAM,CAAC,uBAAuB,CACtC,0CAA0C,WAAW,aAAa,CACnE,CAAC;SACH;QAED,MAAM,QAAQ,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC,SAAS,CAAC,CAAC;QAEtD,qFAAqF;QACrF,8CAA8C;QAC9C,kEAAkE;QAClE,iBAAiB;QACjB,gCAAgC;QAChC,sCAAsC;QACtC,wCAAwC;QACxC,SAAS;QACT,0CAA0C;QAC1C,uCAAuC;QACvC,2CAA2C;QAC3C,SAAS;QACT,SAAS;QACT,2FAA2F;QAC3F,qDAAqD;QACrD,uBAAuB,GAAG,MAAM,CAAC,OAAO,CAAC,QAAoB,CAAC,CAAC,MAAM,CACnE,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,EAAE;YACvB,6GAA6G;YAC7G,GAAG,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACtE,OAAO,GAAG,CAAC;QACb,CAAC,EACD,EAAE,CACH,CAAC;QAEF,6GAA6G;QAC7G,qCAAqC;QACrC,OAAO;IACT,CAAC,CAAC,CAAC;IAEH,IAAI,IAAA,gBAAO,EAAC,uBAAuB,CAAC,EAAE;QACpC,MAAM,IAAI,MAAM,CAAC,uBAAuB,CACtC,2EAA2E,CAC5E,CAAC;KACH;IAED,KAAK,CAAC,8CAA8C,GAAG,QAAQ,CAAC,CAAC;IAEjE,OAAO,uBAAuB,CAAC;AACjC,CAAC;AA1FD,8DA0FC"}
|
|
@@ -58,7 +58,6 @@ export interface ProjectAssets {
|
|
|
58
58
|
project: Project;
|
|
59
59
|
}
|
|
60
60
|
export type AssemblyVersions = Record<string, string>;
|
|
61
|
-
export type RuntimeAssemblyVersions = Record<string, AssemblyVersions>;
|
|
62
61
|
export interface DotNetFile {
|
|
63
62
|
name: string;
|
|
64
63
|
contents: string;
|
package/package.json
CHANGED