snyk 1.1122.0 → 1.1124.0

package/dist/cli/784.index.js

@@ -3695,7 +3695,7 @@ exports.getExtraProjectCount = getExtraProjectCount;
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.filterOutProcessedWorkspaces = exports.getMultiPluginResult = void 0;
+exports.filterOutProcessedNpmWorkspaces = exports.filterOutProcessedYarnWorkspaces = exports.getMultiPluginResult = void 0;
 const cloneDeep = __webpack_require__(83465);
 const pathLib = __webpack_require__(85622);
 const cliInterface = __webpack_require__(65266);
@@ -3708,15 +3708,18 @@ const convert_single_splugin_res_to_multi_custom_1 = __webpack_require__(99695);
 const convert_multi_plugin_res_to_multi_custom_1 = __webpack_require__(23110);
 const errors_1 = __webpack_require__(55191);
 const yarn_workspaces_parser_1 = __webpack_require__(27326);
+const npm_workspaces_parser_1 = __webpack_require__(31744);
 const debug = debugModule('snyk-test');
 async function getMultiPluginResult(root, options, targetFiles) {
     var _a;
     const allResults = [];
     const failedResults = [];
-    // process any yarn workspaces first
+    // process any workspaces first
     // the files need to be proceeded together as they provide context to each other
-    const { scannedProjects, unprocessedFiles, } = await processYarnWorkspacesProjects(root, options, targetFiles);
-    allResults.push(...scannedProjects);
+    const { scannedProjects: scannedYarnResults, unprocessedFiles: unprocessedFilesFromYarn, } = await processYarnWorkspacesProjects(root, options, targetFiles);
+    allResults.push(...scannedYarnResults);
+    const { scannedProjects: scannedNpmResults, unprocessedFiles, } = await processNpmWorkspacesProjects(root, options, unprocessedFilesFromYarn);
+    allResults.push(...scannedNpmResults);
     debug(`Not part of a workspace: ${unprocessedFiles.join(', ')}}`);
     // process the rest 1 by 1 sent to relevant plugins
     for (const targetFile of unprocessedFiles) {
@@ -3768,7 +3771,7 @@ async function processYarnWorkspacesProjects(root, options, targetFiles) {
             strictOutOfSync: options.strictOutOfSync,
             dev: options.dev,
         }, targetFiles);
-        const unprocessedFiles = filterOutProcessedWorkspaces(root, scannedProjects, targetFiles);
+        const unprocessedFiles = filterOutProcessedYarnWorkspaces(root, scannedProjects, targetFiles);
         return { scannedProjects, unprocessedFiles };
     }
     catch (e) {
@@ -3776,7 +3779,21 @@ async function processYarnWorkspacesProjects(root, options, targetFiles) {
         return { scannedProjects: [], unprocessedFiles: targetFiles };
     }
 }
-function filterOutProcessedWorkspaces(root, scannedProjects, allTargetFiles) {
+async function processNpmWorkspacesProjects(root, options, targetFiles) {
+    try {
+        const { scannedProjects } = await npm_workspaces_parser_1.processNpmWorkspaces(root, {
+            strictOutOfSync: options.strictOutOfSync,
+            dev: options.dev,
+        }, targetFiles);
+        const unprocessedFiles = filterOutProcessedNpmWorkspaces(root, scannedProjects, targetFiles);
+        return { scannedProjects, unprocessedFiles };
+    }
+    catch (e) {
+        debug('Error during detecting or processing Npm Workspaces: ', e);
+        return { scannedProjects: [], unprocessedFiles: targetFiles };
+    }
+}
+function filterOutProcessedYarnWorkspaces(root, scannedProjects, allTargetFiles) {
     const targetFiles = [];
     const scanned = scannedProjects
         .map((p) => p.targetFile)
@@ -3801,7 +3818,33 @@ function filterOutProcessedWorkspaces(root, scannedProjects, allTargetFiles) {
     }
     return targetFiles;
 }
-exports.filterOutProcessedWorkspaces = filterOutProcessedWorkspaces;
+exports.filterOutProcessedYarnWorkspaces = filterOutProcessedYarnWorkspaces;
+function filterOutProcessedNpmWorkspaces(root, scannedProjects, allTargetFiles) {
+    const targetFiles = [];
+    const scanned = scannedProjects
+        .map((p) => p.targetFile)
+        .map((p) => pathLib.resolve(process.cwd(), root, p));
+    const all = allTargetFiles.map((p) => ({
+        path: pathLib.resolve(process.cwd(), root, p),
+        original: p,
+    }));
+    for (const entry of all) {
+        const { path, original } = entry;
+        const { base } = pathLib.parse(path);
+        if (!['package.json', 'package-lock.json'].includes(base)) {
+            targetFiles.push(original);
+            continue;
+        }
+        // standardise to package.json
+        // we discover the lockfiles but targetFile is package.json
+        if (!scanned.includes(path.replace('package-lock.json', 'package.json'))) {
+            targetFiles.push(original);
+            continue;
+        }
+    }
+    return targetFiles;
+}
+exports.filterOutProcessedNpmWorkspaces = filterOutProcessedNpmWorkspaces;
 
 
 /***/ }),
@@ -3915,8 +3958,9 @@ const modulesParser = __webpack_require__(85994);
 const lockParser = __webpack_require__(82791);
 const analytics = __webpack_require__(82744);
 const missing_targetfile_error_1 = __webpack_require__(56775);
+const snyk_nodejs_lockfile_parser_1 = __webpack_require__(423);
+const path = __webpack_require__(85622);
 async function inspect(root, targetFile, options = {}) {
-    var _a;
     if (!targetFile) {
         throw missing_targetfile_error_1.MissingTargetFileError(root);
     }
@@ -3928,17 +3972,30 @@ async function inspect(root, targetFile, options = {}) {
         : await modulesParser.parse(root, targetFile, options);
     let scannedProjects = [];
     if (isResDepGraph(depRes)) {
-        if (depRes.pkgManager.version) {
-            analytics.add('lockfileVersion', depRes.pkgManager.version);
-        }
         scannedProjects = [{ depGraph: depRes }];
     }
     else {
-        if ((_a = depRes.meta) === null || _a === void 0 ? void 0 : _a.lockfileVersion) {
-            analytics.add('lockfileVersion', depRes.meta.lockfileVersion);
-        }
         scannedProjects = [{ depTree: depRes }];
     }
+    if (isLockFileBased) {
+        const lockFileFullPath = path.resolve(root, targetFile);
+        const lockfileVersion = snyk_nodejs_lockfile_parser_1.getLockfileVersionFromFile(lockFileFullPath);
+        switch (lockfileVersion) {
+            case snyk_nodejs_lockfile_parser_1.NodeLockfileVersion.NpmLockV1:
+            case snyk_nodejs_lockfile_parser_1.NodeLockfileVersion.YarnLockV1:
+                analytics.add('lockfileVersion', 1);
+                break;
+            case snyk_nodejs_lockfile_parser_1.NodeLockfileVersion.NpmLockV2:
+            case snyk_nodejs_lockfile_parser_1.NodeLockfileVersion.YarnLockV2:
+                analytics.add('lockfileVersion', 2);
+                break;
+            case snyk_nodejs_lockfile_parser_1.NodeLockfileVersion.NpmLockV3:
+                analytics.add('lockfileVersion', 3);
+                break;
+            default:
+                break;
+        }
+    }
     return {
         plugin: {
             name: 'snyk-nodejs-lockfile-parser',
@@ -3998,7 +4055,9 @@ async function parse(root, targetFile, options) {
     const strictOutOfSync = options.strictOutOfSync !== false;
     const lockfileVersion = lockFileParser.getLockfileVersionFromFile(lockFileFullPath);
     if (lockfileVersion === snyk_nodejs_lockfile_parser_1.NodeLockfileVersion.YarnLockV1 ||
-        lockfileVersion === snyk_nodejs_lockfile_parser_1.NodeLockfileVersion.YarnLockV2) {
+        lockfileVersion === snyk_nodejs_lockfile_parser_1.NodeLockfileVersion.YarnLockV2 ||
+        lockfileVersion === snyk_nodejs_lockfile_parser_1.NodeLockfileVersion.NpmLockV2 ||
+        lockfileVersion === snyk_nodejs_lockfile_parser_1.NodeLockfileVersion.NpmLockV3) {
         return await buildDepGraph(root, manifestFileFullPath, lockFileFullPath, lockfileVersion, {
             includeDevDeps: options.dev || false,
             includeOptionalDeps: true,
@@ -4032,6 +4091,9 @@ async function buildDepGraph(root, manifestFilePath, lockfilePath, lockfileVersi
             return await lockFileParser.parseYarnLockV1Project(manifestFileContents, lockFileContents, options);
         case snyk_nodejs_lockfile_parser_1.NodeLockfileVersion.YarnLockV2:
             return lockFileParser.parseYarnLockV2Project(manifestFileContents, lockFileContents, options);
+        case snyk_nodejs_lockfile_parser_1.NodeLockfileVersion.NpmLockV2:
+        case snyk_nodejs_lockfile_parser_1.NodeLockfileVersion.NpmLockV3:
+            return lockFileParser.parseNpmLockV2Project(manifestFileContents, lockFileContents, options);
     }
     throw new Error('Failed to build dep graph from current project');
 }
@@ -4111,6 +4173,138 @@ async function parse(root, targetFile, options) {
 exports.parse = parse;
 
 
+/***/ }),
+
+/***/ 31744:
+/***/ ((__unused_webpack_module, exports, __webpack_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.packageJsonBelongsToWorkspace = exports.getWorkspacesMap = exports.processNpmWorkspaces = void 0;
+const baseDebug = __webpack_require__(15158);
+const pathUtil = __webpack_require__(85622);
+const sortBy = __webpack_require__(58254);
+const groupBy = __webpack_require__(20276);
+const micromatch = __webpack_require__(70850);
+const debug = baseDebug('snyk-npm-workspaces');
+const lockFileParser = __webpack_require__(423);
+const get_file_contents_1 = __webpack_require__(84210);
+const errors_1 = __webpack_require__(55191);
+async function processNpmWorkspaces(root, settings, targetFiles) {
+    // the order of npmTargetFiles folders is important
+    // must have the root level most folders at the top
+    const mappedAndFiltered = targetFiles
+        .map((p) => ({ path: p, ...pathUtil.parse(p) }))
+        .filter((res) => ['package.json', 'package-lock.json'].includes(res.base));
+    const sorted = sortBy(mappedAndFiltered, 'dir');
+    const grouped = groupBy(sorted, 'dir');
+    const npmTargetFiles = grouped;
+    debug(`Processing potential Npm workspaces (${targetFiles.length})`);
+    if (settings.yarnWorkspaces && Object.keys(npmTargetFiles).length === 0) {
+        throw errors_1.NoSupportedManifestsFoundError([root]);
+    }
+    let npmWorkspacesMap = {};
+    const workspacesFilesMap = {};
+    const result = {
+        plugin: {
+            name: 'snyk-nodejs-npm-workspaces',
+            runtime: process.version,
+        },
+        scannedProjects: [],
+    };
+    // the folders must be ordered highest first
+    for (const directory of Object.keys(npmTargetFiles)) {
+        debug(`Processing ${directory} as a potential npm workspace`);
+        let isWorkspacePackage = false;
+        let isRootPackageJson = false;
+        const packageJsonFileName = pathUtil.join(directory, 'package.json');
+        const packageJson = get_file_contents_1.getFileContents(root, packageJsonFileName);
+        npmWorkspacesMap = {
+            ...npmWorkspacesMap,
+            ...getWorkspacesMap(packageJson),
+        };
+        for (const workspaceRoot of Object.keys(npmWorkspacesMap)) {
+            const match = packageJsonBelongsToWorkspace(packageJsonFileName, npmWorkspacesMap, workspaceRoot);
+            if (match) {
+                debug(`${packageJsonFileName} matches an existing workspace pattern`);
+                workspacesFilesMap[packageJsonFileName] = {
+                    root: workspaceRoot,
+                };
+                isWorkspacePackage = true;
+            }
+            if (packageJsonFileName === workspaceRoot) {
+                isRootPackageJson = true;
+            }
+        }
+        if (!(isWorkspacePackage || isRootPackageJson)) {
+            debug(`${packageJsonFileName} is not part of any detected workspace, skipping`);
+            continue;
+        }
+        try {
+            const rootDir = isWorkspacePackage
+                ? pathUtil.dirname(workspacesFilesMap[packageJsonFileName].root)
+                : pathUtil.dirname(packageJsonFileName);
+            const rootLockfileName = pathUtil.join(rootDir, 'package-lock.json');
+            const lockContent = get_file_contents_1.getFileContents(root, rootLockfileName);
+            const res = lockFileParser.parseNpmLockV2Project(packageJson.content, lockContent.content, {
+                includeDevDeps: settings.dev || false,
+                strictOutOfSync: settings.strictOutOfSync || false,
+                includeOptionalDeps: false,
+                pruneCycles: true,
+            });
+            const project = {
+                packageManager: 'npm',
+                targetFile: pathUtil.relative(root, packageJson.fileName),
+                depGraph: res,
+                plugin: {
+                    name: 'snyk-nodejs-lockfile-parser',
+                    runtime: process.version,
+                },
+            };
+            result.scannedProjects.push(project);
+        }
+        catch (e) {
+            if (settings.yarnWorkspaces) {
+                throw e;
+            }
+            debug(`Error process workspace: ${packageJsonFileName}. ERROR: ${e}`);
+        }
+    }
+    if (!result.scannedProjects.length) {
+        debug(`No npm workspaces detected in any of the ${targetFiles.length} target files.`);
+    }
+    return result;
+}
+exports.processNpmWorkspaces = processNpmWorkspaces;
+function getWorkspacesMap(file) {
+    const workspacesMap = {};
+    if (!file) {
+        return workspacesMap;
+    }
+    try {
+        const rootFileWorkspacesDefinitions = JSON.parse(file.content).workspaces || false;
+        if (rootFileWorkspacesDefinitions && rootFileWorkspacesDefinitions.length) {
+            workspacesMap[file.fileName] = {
+                workspaces: rootFileWorkspacesDefinitions,
+            };
+        }
+    }
+    catch (e) {
+        debug('Failed to process a workspace', e.message);
+    }
+    return workspacesMap;
+}
+exports.getWorkspacesMap = getWorkspacesMap;
+function packageJsonBelongsToWorkspace(packageJsonFileName, workspacesMap, workspaceRoot) {
+    const workspaceRootFolder = pathUtil.dirname(workspaceRoot.replace(/\\/g, '/'));
+    const workspacesGlobs = (workspacesMap[workspaceRoot].workspaces || []).map((workspace) => pathUtil.join(workspaceRootFolder, workspace));
+    const match = micromatch.isMatch(packageJsonFileName.replace(/\\/g, '/'), workspacesGlobs.map((p) => pathUtil.normalize(pathUtil.join(p, 'package.json')).replace(/\\/g, '/')));
+    return match;
+}
+exports.packageJsonBelongsToWorkspace = packageJsonBelongsToWorkspace;
+
+
 /***/ }),
 
 /***/ 27326: