snyk 1.1114.0 → 1.1115.0

package/.snyk

@@ -0,0 +1,20 @@
+# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.
+version: v1.25.0
+# ignores vulnerabilities until expiry date; change duration by modifying expiry date
+ignore:
+  SNYK-JS-SNYK-3037342:
+    - '*':
+        reason: Based on default version number
+        expires: 2030-01-10T00:00:00.000Z
+        created: 2023-03-03T14:26:54.682Z
+  SNYK-JS-SNYK-3038622:
+    - '*':
+        reason: Based on default version number
+        expires: 2030-01-10T00:00:00.000Z
+        created: 2023-03-03T14:32:41.690Z
+  SNYK-JS-SNYK-3111871:
+    - '*':
+        reason: Based on default version number
+        expires: 2030-01-10T00:00:00.000Z
+        created: 2023-03-03T14:33:35.717Z
+patch: {}

package/bin/snyk

@@ -1,2 +1,2 @@
 #!/usr/bin/env node
-require('../dist/cli/index.js');
+require('../wrapper_dist/index.js');

package/jest.config.js

@@ -0,0 +1,3 @@
+const { createJestConfig } = require('../test/createJestConfig');
+
+module.exports = createJestConfig({ displayName: 'ts-binary-wrapper' });

package/package.json

@@ -1,21 +1,13 @@
 {
   "name": "snyk",
-  "version": "1.1114.0",
+  "version": "1.1115.0",
   "description": "snyk library and cli utility",
   "files": [
-    "help/cli-commands",
-    "dist",
-    "bin",
-    "pysrc",
-    "config.default.json",
-    "SECURITY.md",
-    "LICENSE",
-    "README.md"
+    "*"
   ],
   "directories": {
     "lib": "src",
-    "test": "test",
-    "doc": "help/cli-commands"
+    "test": "test"
   },
   "bin": {
     "snyk": "bin/snyk"
@@ -23,27 +15,11 @@
   "engines": {
     "node": ">=12"
   },
-  "workspaces": [
-    "packages/*"
-  ],
   "scripts": {
-    "clean": "npx rimraf node_modules dist binary-releases test-results *.tgz tsconfig.tsbuildinfo .eslintcache pysrc packages/*/node_modules packages/*/dist packages/*/tsconfig.tsbuildinfo packages/*/*.tgz",
-    "format": "prettier --write '**/*.{js,ts,json,yaml,yml,md}' && npm run lint:js -- --fix",
-    "format:changes": "./scripts/format/prettier-changes.sh",
-    "lint": "npm-run-all --serial --continue-on-error lint:*",
-    "lint:js": "eslint --quiet --color --cache '**/*.{js,ts}'",
-    "lint:formatting": "prettier --check '**/*.{js,ts,json,yaml,yml,md}'",
-    "build": "patch-package && npm run build:dev",
-    "build:dev": "patch-package && npm run build --workspaces && npm run build-cli:dev",
-    "build:prod": "patch-package && npm run build --workspaces && npm run build-cli:prod",
-    "build-cli:dev": "node --max-old-space-size=8192 node_modules/webpack/bin/webpack.js --config webpack.dev.ts",
-    "build-cli:prod": "node --max-old-space-size=8192 node_modules/webpack/bin/webpack.js --config webpack.prod.ts",
-    "watch": "npm run build-cli:dev -- --watch",
-    "test": "npm run test:unit && npm run test:acceptance && npm run test:tap",
-    "test:unit": "jest --runInBand --testPathPattern '/test(/jest)?/unit/'",
-    "test:acceptance": "jest --runInBand --testPathPattern '/test(/jest)?/acceptance/'",
-    "test:tap": "tap -Rspec --timeout=300 --node-arg=-r --node-arg=ts-node/register test/tap/*.test.* ",
-    "test:smoke": "./scripts/run-smoke-tests-locally.sh"
+    "clean": "npx rimraf wrapper_dist tsconfig.tsbuildinfo",
+    "build": "tsc && cp -R src/generated wrapper_dist/",
+    "test": "npx jest test/*",
+    "postinstall": "node wrapper_dist/bootstrap.js exec"
   },
   "keywords": [
     "security",
@@ -58,25 +34,22 @@
   ],
   "author": "snyk.io",
   "license": "Apache-2.0",
-  "dependencies": {},
-  "devDependencies": {},
   "repository": {
     "type": "git",
     "url": "https://github.com/snyk/snyk.git"
   },
-  "pkg": {
-    "scripts": [
-      "dist/**/*.js",
-      "bin/snyk"
-    ],
-    "assets": [
-      "config.default.json",
-      "dist",
-      "help"
-    ]
-  },
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",
     "access": "public"
+  },
+  "devDependencies": {
+    "jest": "^29.4.1",
+    "rimraf": "^4.1.2",
+    "ts-jest": "^29.0.5",
+    "typescript": "^4.9.5"
+  },
+  "dependencies": {
+    "@sentry/node": "^7.36.0",
+    "global-agent": "^3.0.0"
   }
 }

package/src/bootstrap.ts

@@ -0,0 +1,27 @@
+import * as common from './common';
+import * as process from 'process';
+
+const errorContextMessage = 'Download Error';
+
+(async () => {
+  try {
+    const config = common.getCurrentConfiguration();
+    const executable = config.getLocalLocation();
+
+    if (process.argv.includes('exec')) {
+      const filenameShasum = config.getShasumFile();
+      const downloadUrl = config.getDownloadLocation();
+
+      const downloadError = await common.downloadExecutable(
+        downloadUrl,
+        executable,
+        filenameShasum,
+      );
+      if (downloadError !== undefined) {
+        throw downloadError;
+      }
+    }
+  } catch (err) {
+    await common.logError(errorContextMessage, err);
+  }
+})();

package/src/common.ts

@@ -0,0 +1,375 @@
+// must be set before we import 'global-agent/bootstrap'
+process.env.GLOBAL_AGENT_ENVIRONMENT_VARIABLE_NAMESPACE = '';
+process.env.HTTPS_PROXY =
+  process.env.HTTPS_PROXY ?? process.env.https_proxy ?? '';
+process.env.HTTP_PROXY = process.env.HTTP_PROXY ?? process.env.http_proxy ?? '';
+process.env.NO_PROXY = process.env.NO_PROXY ?? process.env.no_proxy ?? '';
+
+import 'global-agent/bootstrap';
+import * as path from 'path';
+import * as os from 'os';
+import * as fs from 'fs';
+import { spawnSync } from 'child_process';
+import * as https from 'https';
+import { createHash } from 'crypto';
+import * as Sentry from '@sentry/node';
+
+export const versionFile = path.join(__dirname, 'generated', 'version');
+export const shasumFile = path.join(__dirname, 'generated', 'sha256sums.txt');
+const binaryDeploymentsFilePath = path.join(
+  __dirname,
+  'generated',
+  'binary-deployments.json',
+);
+
+export class WrapperConfiguration {
+  private version: string;
+  private binaryName: string;
+  private expectedSha256sum: string;
+
+  public constructor(
+    version: string,
+    binaryName: string,
+    expectedSha256sum: string,
+  ) {
+    this.version = version;
+    this.binaryName = binaryName;
+    this.expectedSha256sum = expectedSha256sum;
+  }
+
+  public getVersion(): string {
+    return this.version;
+  }
+
+  public getBinaryName(): string {
+    return this.binaryName;
+  }
+
+  public getDownloadLocation(): string {
+    const baseUrl = 'https://static.snyk.io/cli/v';
+    return baseUrl + this.version + '/' + this.binaryName;
+  }
+
+  public getLocalLocation(): string {
+    const currentFolder = __dirname;
+    return path.join(currentFolder, this.binaryName);
+  }
+
+  public getShasumFile(): string {
+    return this.expectedSha256sum;
+  }
+}
+
+export function determineBinaryName(platform: string, arch: string): string {
+  let osname = platform;
+  let archname = arch;
+
+  switch (osname) {
+    case 'win32':
+      osname = 'windows';
+      break;
+    case 'linux': {
+      let isAlpine = false;
+      try {
+        const result = spawnSync('cat /etc/os-release', { shell: true });
+        isAlpine = result.stdout
+          .toString()
+          .toLowerCase()
+          .includes('id=alpine');
+      } catch {
+        isAlpine = false;
+      }
+
+      if (isAlpine) {
+        osname = 'alpine';
+      }
+
+      break;
+    }
+  }
+
+  switch (arch) {
+    case 'x64':
+    case 'amd64':
+      archname = 'amd64';
+      break;
+  }
+
+  const supportedPlatforms = require(binaryDeploymentsFilePath);
+  const binaryName = supportedPlatforms[osname][archname];
+
+  if (binaryName === undefined) {
+    const defaultErrorMsg =
+      ' The current platform (' +
+      osname +
+      ' ' +
+      archname +
+      ') is not supported by Snyk.\n' +
+      ' You may want to consider using Docker to run Snyk, for details see: https://docs.snyk.io/snyk-cli/install-the-snyk-cli#snyk-cli-in-a-docker-image\n' +
+      ' If you experience errors please check http://support.snyk.io/.';
+    throw Error(getWarningMessage(defaultErrorMsg));
+  }
+
+  return binaryName;
+}
+
+export function getCurrentVersion(filename: string): string {
+  try {
+    const version = fs.readFileSync(filename);
+    return version.toString().trim();
+  } catch {
+    return '';
+  }
+}
+
+export function getCurrentSha256sum(
+  binaryName: string,
+  filename: string,
+): string {
+  try {
+    const allsums = fs.readFileSync(filename).toString();
+    const re = new RegExp('^([a-zA-Z0-9]+)[\\s\\*]+' + binaryName + '$', 'mig');
+    const result = re.exec(allsums);
+    if (result) {
+      return result[1];
+    }
+  } catch {
+    //
+  }
+
+  return 'unknown-shasum-' + binaryName;
+}
+
+export function getCurrentConfiguration(): WrapperConfiguration {
+  const binaryName = determineBinaryName(os.platform(), os.arch());
+  const version = getCurrentVersion(versionFile);
+  const expectedSha256sum = getCurrentSha256sum(binaryName, shasumFile);
+  return new WrapperConfiguration(version, binaryName, expectedSha256sum);
+}
+
+export function getCliArguments(inputArgv: string[]): string[] {
+  const cliArguments = inputArgv.slice(2);
+  return cliArguments;
+}
+
+export function debugEnabled(cliArguments: string[]): boolean {
+  let debugIndex = cliArguments.indexOf('--debug');
+
+  if (debugIndex < 0) {
+    debugIndex = cliArguments.indexOf('-d');
+  }
+
+  return debugIndex >= 0;
+}
+
+export function runWrapper(executable: string, cliArguments: string[]): number {
+  interface SpawnError extends Error {
+    errno: number;
+    code: string;
+    syscall: string;
+    path: string;
+    spawnargs: string[];
+  }
+
+  const debug = debugEnabled(cliArguments);
+
+  if (debug) {
+    console.error('Executing: ' + executable + ' ' + cliArguments.join(' '));
+  }
+
+  const res = spawnSync(executable, cliArguments, {
+    shell: false,
+    stdio: 'inherit',
+  });
+
+  if (res.status !== null) {
+    if (debug) {
+      console.error(res);
+    }
+
+    return res.status;
+  } else {
+    console.error(res);
+    if (!formatErrorMessage((res.error as SpawnError).code)) {
+      console.error('Failed to spawn child process. (' + executable + ')');
+    }
+
+    return 2;
+  }
+}
+
+export function getWarningMessage(message: string): string {
+  return `\n------------------------------- Warning -------------------------------\n${message}\n------------------------------- Warning -------------------------------\n`;
+}
+
+export function formatErrorMessage(message: string): boolean {
+  const eaccesWarning =
+    "You don't have the permissions to install Snyk. Please try the following options:\n" +
+    '* If you are installing with increased privileges (for example sudo), try adding --unsafe-perm as a parameter to npm install\n' +
+    '* If you run NPM <= 6, please upgrade to a later version.\n' +
+    'If the problems persist please check http://support.snyk.io/.';
+
+  const certificateError =
+    'If you are running Snyk in an environment that intercepts SSL traffic, please specify\n' +
+    'your custom CA certificates via the NODE_EXTRA_CA_CERTS environment variable.\n' +
+    'See https://nodejs.org/api/cli.html#node_extra_ca_certsfile for additional information.';
+
+  const degradedCLIWarning =
+    'You are currently running a degraded version of the Snyk CLI.\n' +
+    'As a result, some features of the CLI will be unavailable.\n' +
+    'For information on how to resolve this, please see this article: https://docs.snyk.io/snyk-cli/installing-snyk-cli-as-a-binary-via-npm\n' +
+    'For any assistance, please check http://support.snyk.io/.';
+
+  let warning = '';
+
+  if (message.includes('EACCES')) {
+    warning = eaccesWarning;
+  } else if (message.includes('certificate')) {
+    warning = certificateError;
+  } else if (message.includes('legacy-cli')) {
+    warning = degradedCLIWarning;
+  } else {
+    return false;
+  }
+
+  console.error(getWarningMessage(warning));
+  return true;
+}
+
+export function downloadExecutable(
+  downloadUrl: string,
+  filename: string,
+  filenameShasum: string,
+): Promise<Error | undefined> {
+  return new Promise<Error | undefined>(function(resolve) {
+    const options = new URL(downloadUrl);
+    const temp = path.join(__dirname, Date.now().toString());
+    const fileStream = fs.createWriteStream(temp);
+    const shasum = createHash('sha256');
+
+    const cleanupAfterError = (error: Error) => {
+      try {
+        fs.unlinkSync(temp);
+      } catch (e) {
+        // ignoring any error during cleaning up after an error
+      }
+
+      resolve(error);
+    };
+
+    // shasum events
+    shasum.on('error', cleanupAfterError);
+
+    // filestream events
+    fileStream.on('error', (e) => {
+      cleanupAfterError(e);
+    });
+
+    fileStream.on('finish', () => {
+      // compare shasums
+      const actualShasum = shasum.digest('hex');
+
+      const debugMessage =
+        'Shasums:\n- actual:   ' +
+        actualShasum +
+        '\n- expected: ' +
+        filenameShasum;
+
+      if (filenameShasum && actualShasum != filenameShasum) {
+        cleanupAfterError(Error('Shasum comparison failed!\n' + debugMessage));
+      } else {
+        console.error(debugMessage);
+
+        // finally rename the file and change permissions
+        fs.renameSync(temp, filename);
+        fs.chmodSync(filename, 0o755);
+        console.error('Downloaded successfull! ');
+      }
+
+      resolve(undefined);
+    });
+
+    console.error(
+      "Downloading from '" + downloadUrl + "' to '" + filename + "'",
+    );
+
+    const req = https.request(options, (res) => {
+      // response events
+      res.on('error', cleanupAfterError);
+      res.on('end', () => {
+        shasum.end();
+        fileStream.end();
+      });
+
+      // pipe data
+      res.pipe(fileStream);
+      res.pipe(shasum);
+    });
+
+    req.on('error', (e) => {
+      cleanupAfterError(e);
+    });
+
+    req.on('response', (incoming) => {
+      if (
+        incoming.statusCode &&
+        !(200 <= incoming.statusCode && incoming.statusCode < 300)
+      ) {
+        req.destroy();
+        cleanupAfterError(
+          Error(
+            'Download failed! Server Response: ' +
+              incoming.statusCode +
+              ' ' +
+              incoming.statusMessage +
+              ' (' +
+              downloadUrl +
+              ')',
+          ),
+        );
+      }
+    });
+
+    req.end();
+  });
+}
+
+export async function logError(
+  context: string,
+  err,
+  printToConsole = true,
+): Promise<void> {
+  if (isAnalyticsEnabled()) {
+    // init error reporting
+    const version = getCurrentVersion(versionFile);
+    Sentry.init({
+      dsn:
+        'https://3e845233db8c4f43b4c4b9245f1d7bd6@o30291.ingest.sentry.io/4504599528079360',
+      release: version,
+    });
+
+    // report error
+    const sentryError = new Error('[' + context + '] ' + err.message);
+    sentryError.stack = err.stack;
+    Sentry.captureException(sentryError);
+    await Sentry.close();
+  }
+
+  // finally log the error to the console as well
+  if (printToConsole) {
+    console.error('\n');
+    console.error(err);
+    formatErrorMessage(err.message);
+  }
+}
+
+export function isAnalyticsEnabled(): boolean {
+  if (
+    process.env.snyk_disable_analytics == '1' ||
+    process.env.SNYK_DISABLE_ANALYTICS == '1'
+  ) {
+    return false;
+  }
+
+  return true;
+}

package/src/generated/binary-deployments.json

@@ -0,0 +1,16 @@
+{
+  "darwin": {
+    "amd64": "snyk-macos",
+    "arm64": "snyk-macos"
+  },
+  "windows": {
+    "amd64": "snyk-win.exe"
+  },
+  "alpine": {
+    "amd64": "snyk-alpine"
+  },
+  "linux": {
+    "amd64": "snyk-linux",
+    "arm64": "snyk-linux-arm64"
+  }
+}

package/src/generated/sha256sums.txt

@@ -0,0 +1,10 @@
+6505c380a999d92fb32058c8ad3b00d0f3d38f24b7931c509d5d038f08283e4b  docker-mac-signed-bundle.tar.gz
+e5d33e097cecae5a06cf8823f96d87d1cb19e5ac3f9e7533121dc195df71915f  snyk-alpine
+79f87f12fc866d6ef6221e65449ebc5e5acd02c172908149c4fe52fb1d695399  snyk-fix.tgz
+cd6b42c1576213deb43381fbca47121c1b797342c8f36101ec41d1cc427aae04  snyk-for-docker-desktop-darwin-arm64.tar.gz
+0c9e8cf7e99b2767510edd008cc4a9f3147e207d5e310ffd8317e3e54cf97a64  snyk-for-docker-desktop-darwin-x64.tar.gz
+8ff5c2555fde80b227a3ee53aecf378ef780e2adc20aaa80b14d11ac981b2b28  snyk-linux-arm64
+9f13c7f7ff53984c9556185fb8945c5517b73934ca76538575e1ec998c086911  snyk-linux
+0aad5b3b4f11679cb37ad7f95726ea01cf4cd7ada3bd8a70fca3bc843791f260  snyk-macos
+f36e5c2138452e16c2c242748ec6ec0299144adc05a84a47e2844892181e9c6b  snyk-protect.tgz
+0397c9e6f91e1542faa2b9594dfa4cfda478becbedf501874fa4c19175c1d9b5  snyk-win.exe

package/src/generated/version

@@ -0,0 +1 @@
+1.1115.0

package/src/index.ts

@@ -0,0 +1,67 @@
+#!/usr/bin/env node
+
+import { argv } from 'process';
+import * as common from './common';
+import * as fs from 'fs';
+import * as path from 'path';
+
+const errorContextMessage = 'Runtime';
+const fallbackScript = path.join(__dirname, '..', 'dist', 'cli', 'index.js');
+const legacyCLIflag = '--legacy-cli';
+
+function run(executable: string): number {
+  let cliArguments = common.getCliArguments(argv);
+
+  if (executable.endsWith('.js')) {
+    cliArguments = [executable].concat(cliArguments);
+    executable = argv[0]; // node runtime
+  }
+
+  const exitCode = common.runWrapper(executable, cliArguments);
+  return exitCode;
+}
+
+(async () => {
+  let fallbackToLegacyCLI = argv.includes(legacyCLIflag);
+
+  if (fallbackToLegacyCLI === false) {
+    try {
+      const config = common.getCurrentConfiguration();
+      const executable = config.getLocalLocation();
+
+      if (!fs.existsSync(executable)) {
+        console.error("Executable doesn't exist, trying to download.");
+
+        const downloadError = await common.downloadExecutable(
+          config.getDownloadLocation(),
+          executable,
+          config.getShasumFile(),
+        );
+        if (downloadError !== undefined) {
+          throw downloadError;
+        }
+      }
+
+      // run the executable
+      process.exit(run(executable));
+    } catch (error) {
+      fallbackToLegacyCLI = true;
+      await common.logError(errorContextMessage, error);
+    }
+  } else {
+    // if --legacy-clli is enabled create a log messaeg
+    await common.logError(
+      errorContextMessage,
+      Error(legacyCLIflag + ' is set'),
+      false,
+    );
+  }
+
+  if (fallbackToLegacyCLI) {
+    common.formatErrorMessage('legacy-cli');
+    const exitCode = run(fallbackScript);
+    common.formatErrorMessage('legacy-cli');
+
+    process.exit(exitCode);
+  }
+})();