snyk 1.1055.0 → 1.1056.0

package/dist/cli/263.index.js

@@ -142568,7 +142568,7 @@ Object.defineProperty(exports, "__esModule", ({ value: true }));
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.readRawBuildInfo = exports.extractModuleInformation = exports.GoBinary = void 0;
+exports.determinePaths = exports.readRawBuildInfo = exports.extractModuleInformation = exports.GoBinary = void 0;
 const depGraph = __webpack_require__(26326);
 const event_loop_spinner_1 = __webpack_require__(77158);
 const path = __webpack_require__(85622);
@@ -142608,36 +142608,29 @@ class GoBinary {
     // matchFilesToModules goes through all files, extracts the package name and
     // adds it to the relevant module in the GoBinary.
     matchFilesToModules(files) {
-        // goModCachePath is the path at which the modules are downloaded to. When
-        // building a Go binary, this is usually either $GOMODCACHE or
-        // $GOROOT/pkg/mod. Binaries built with `-trimpath` will have that module
-        // cache path trimmed away, meaning that the goModCachePath will always be
-        // empty.
-        let goModCachePath = "";
-        let moduleName = (mod) => {
-            return mod.fullName();
-        };
+        const { modCachePath, vendorPath } = determinePaths(this.modules, files);
         for (const fileName of files) {
             if (fileName === "<autogenerated>") {
                 continue;
             }
-            // As long as the goModCachePath is not set, try finding it. We do not
-            // have a way of knowing whether we're checking a `-trimpath` binary, so
-            // for `-trimpath` binaries we will be wasting a couple of cycles by
-            // trying to find the goModCachePath for every file.
-            if (goModCachePath === "") {
-                [goModCachePath, moduleName] = this.determineModuleCachePath(fileName);
-            }
-            // Assuming that goModCachePath is set, this is true for files outside the
-            // modPath, which is usually the developers files (the built module) and
-            // Go source files (stdlib, runtime etc). If it is not set, this check is
-            // meaningless.
-            if (!fileName.startsWith(goModCachePath)) {
+            let moduleName = (mod) => mod.fullName();
+            let pkgFile = "";
+            if (vendorPath && fileName.startsWith(vendorPath)) {
+                moduleName = (mod) => mod.name;
+                pkgFile = trimPrefix(fileName, vendorPath);
+            }
+            else if (modCachePath && fileName.startsWith(modCachePath)) {
+                moduleName = (mod) => mod.fullName();
+                pkgFile = trimPrefix(fileName, modCachePath);
+            }
+            else if (!vendorPath && !modCachePath) {
+                // is trimmed
+                pkgFile = fileName;
+            }
+            else {
+                // skip file, probably a file from the Go source.
                 continue;
             }
-            // remove the go module cache path at the beginning of the file name,
-            // leaving only the module + file paths.
-            const pkgFile = fileName.slice(goModCachePath.length);
             // Try to find the module that matches our file name, and if found,
             // extract the package name out of it.
             // Go source files will not be matched by any module, so they will be
@@ -142673,40 +142666,6 @@ class GoBinary {
             }
         }
     }
-    determineModuleCachePath(fileName) {
-        // this is the module name as it appears in the directory on *non-vendored*
-        // dependencies, e.g. "/go/pkg/mod/github.com/my/repo@v1.0.0".
-        const fullName = (m) => {
-            return m.fullName();
-        };
-        for (const [, mod] of Object.entries(this.modules)) {
-            if (!fileName.includes(mod.name)) {
-                continue;
-            }
-            const parts = fileName.split(fullName(mod));
-            if (parts.length === 2) {
-                return [parts[0], fullName];
-            }
-            else {
-                const parts = fileName.split(path.join("vendor", mod.name));
-                if (parts.length === 2) {
-                    return [
-                        // trailing slash is important to properly separate module name from
-                        // directory. parts[0] would always include it, so we also need to
-                        // add it to "vendor".
-                        path.join(parts[0], "vendor/"),
-                        // for vendored modules, the directory does not contain the version,
-                        // e.g. /app/vendor/github.com/my/repo/. As such, the "full name" of
-                        // the module should also not contain the version string.
-                        (m) => {
-                            return m.name;
-                        },
-                    ];
-                }
-            }
-        }
-        return ["", fullName];
-    }
 }
 exports.GoBinary = GoBinary;
 function extractModuleInformation(binary) {
@@ -142902,6 +142861,72 @@ function readString(binaryFile, ptrSize, readPtr, addr) {
     }
     return data.toString("binary");
 }
+function isTrimmed(files) {
+    // the easiest way to detect trimmed binaries: the filenames will all be
+    // relative.
+    // There usually is a `build` line in the Go binary's metadata that denotes
+    // whether `trimpath` has been used or not, but there are binaries out there
+    // that have trimmed paths without that annotation (for example
+    // kyverno@v1.8.1).
+    return files.every((file) => !file.startsWith("/"));
+}
+// determinePaths returns the modCachePath and vendorPath for a binary.
+// goModCachePath is the path at which the modules are downloaded to. When
+// building a Go binary, this is usually either $GOMODCACHE or
+// $GOROOT/pkg/mod.
+// The vendorPath is the path where vendored files are located, which is usually
+// the main module's location + "/vendor".
+//
+// Binaries built with `-trimpath` will have all paths trimmed away, meaning
+// that both returned values will be empty.
+function determinePaths(modules, files) {
+    if (isTrimmed(files)) {
+        return { modCachePath: "", vendorPath: "" };
+    }
+    return {
+        modCachePath: determineGoModCachePath(modules, files),
+        vendorPath: determineVendorPath(modules, files),
+    };
+}
+exports.determinePaths = determinePaths;
+function determineVendorPath(modules, files) {
+    // to determine the vendor path, we search for a file that contains
+    // `vendor/<module name>`. This file also contains the "root" of the
+    // repository, e.g. `/app/vendor/<module-name>`. This means that the `main`
+    // package is located somewhere in `/app/...`.
+    // We check for other files in that root to make sure that we really got the
+    // right vendor folder, and not just a random folder named `vendor` somewhere.
+    for (const [, mod] of Object.entries(modules)) {
+        const vendoredModulePath = path.join("vendor", mod.name) + "/";
+        const file = files.find((file) => file.includes(vendoredModulePath));
+        if (file) {
+            // make sure that we find other files in that path not in the vendor
+            // folder.
+            const mainModulePath = file.split(vendoredModulePath)[0];
+            const success = files.find((file) => file.includes(mainModulePath) && !file.includes(vendoredModulePath));
+            if (success) {
+                return path.join(mainModulePath, "vendor") + "/";
+            }
+        }
+    }
+    return "";
+}
+function determineGoModCachePath(modules, files) {
+    // files in the go mod cache path always contain the module name and version.
+    for (const [, mod] of Object.entries(modules)) {
+        const file = files.find((file) => file.includes("/" + mod.fullName()));
+        if (file) {
+            return file.split(mod.fullName())[0];
+        }
+    }
+    return "";
+}
+function trimPrefix(s, prefix) {
+    if (s.startsWith(prefix)) {
+        return s.substring(prefix.length);
+    }
+    return s;
+}
 //# sourceMappingURL=go-binary.js.map
 
 /***/ }),