snyk 1.1145.0 → 1.1146.0

package/dist/cli/917.index.js

@@ -2857,6 +2857,56 @@ exports.UnsupportedEntitlementError = UnsupportedEntitlementError;
 UnsupportedEntitlementError.ERROR_CODE = 403;
 
 
+/***/ }),
+
+/***/ 83539:
+/***/ ((__unused_webpack_module, exports, __webpack_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.getLevel = exports.getResults = void 0;
+const groupBy = __webpack_require__(20276);
+const map = __webpack_require__(80820);
+const legacy_1 = __webpack_require__(34013);
+function getResults(testResult) {
+    const groupedVulnerabilities = groupBy(testResult.vulnerabilities, 'id');
+    return map(groupedVulnerabilities, ([vuln]) => ({
+        ruleId: vuln.id,
+        level: getLevel(vuln),
+        message: {
+            text: `This file introduces a vulnerable ${vuln.packageName} package with a ${vuln.severity} severity vulnerability.`,
+        },
+        locations: [
+            {
+                physicalLocation: {
+                    artifactLocation: {
+                        uri: testResult.displayTargetFile,
+                    },
+                    region: {
+                        startLine: vuln.lineNumber || 1,
+                    },
+                },
+            },
+        ],
+    }));
+}
+exports.getResults = getResults;
+function getLevel(vuln) {
+    switch (vuln.severity) {
+        case legacy_1.SEVERITY.CRITICAL:
+        case legacy_1.SEVERITY.HIGH:
+            return 'error';
+        case legacy_1.SEVERITY.MEDIUM:
+            return 'warning';
+        case legacy_1.SEVERITY.LOW:
+        default:
+            return 'note';
+    }
+}
+exports.getLevel = getLevel;
+
+
 /***/ }),
 
 /***/ 56223:
@@ -3619,11 +3669,11 @@ exports.countSuppressedIssues = (suppressedIssues) => {
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.getLevel = exports.getResults = exports.getRules = exports.createSarifOutputForOpenSource = void 0;
+exports.getRules = exports.createSarifOutputForOpenSource = void 0;
 const upperFirst = __webpack_require__(90039);
 const groupBy = __webpack_require__(20276);
 const map = __webpack_require__(80820);
-const legacy_1 = __webpack_require__(34013);
+const get_sarif_result_1 = __webpack_require__(83539);
 const LOCK_FILES_TO_MANIFEST_MAP = {
     'Gemfile.lock': 'Gemfile',
     'package-lock.json': 'package.json',
@@ -3645,7 +3695,7 @@ function createSarifOutputForOpenSource(testResults) {
                     rules: getRules(testResult),
                 },
             },
-            results: getResults(testResult),
+            results: get_sarif_result_1.getResults(testResult),
         })),
     };
 }
@@ -3699,42 +3749,6 @@ ${vuln.description}`.replace(/##\s/g, '# '),
     });
 }
 exports.getRules = getRules;
-function getResults(testResult) {
-    const groupedVulnerabilities = groupBy(testResult.vulnerabilities, 'id');
-    return map(groupedVulnerabilities, ([vuln]) => ({
-        ruleId: vuln.id,
-        level: getLevel(vuln),
-        message: {
-            text: `This file introduces a vulnerable ${vuln.packageName} package with a ${vuln.severity} severity vulnerability.`,
-        },
-        locations: [
-            {
-                physicalLocation: {
-                    artifactLocation: {
-                        uri: testResult.displayTargetFile,
-                    },
-                    region: {
-                        startLine: vuln.lineNumber || 1,
-                    },
-                },
-            },
-        ],
-    }));
-}
-exports.getResults = getResults;
-function getLevel(vuln) {
-    switch (vuln.severity) {
-        case legacy_1.SEVERITY.CRITICAL:
-        case legacy_1.SEVERITY.HIGH:
-            return 'error';
-        case legacy_1.SEVERITY.MEDIUM:
-            return 'warning';
-        case legacy_1.SEVERITY.LOW:
-        default:
-            return 'note';
-    }
-}
-exports.getLevel = getLevel;
 function getIntroducedThrough(vuln) {
     const [firstFrom, secondFrom] = vuln.from || [];
     return vuln.from.length > 2
@@ -3753,18 +3767,20 @@ function getIntroducedThrough(vuln) {
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.getResults = exports.getTool = exports.getIssueLevel = exports.createSarifOutputForContainers = void 0;
-const legacy_1 = __webpack_require__(34013);
+exports.getTool = exports.getIssueLevel = exports.createSarifOutputForContainers = void 0;
 const upperFirst = __webpack_require__(90039);
+const legacy_1 = __webpack_require__(34013);
+const get_sarif_result_1 = __webpack_require__(83539);
 function createSarifOutputForContainers(testResults) {
     const sarifRes = {
+        $schema: 'https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json',
         version: '2.1.0',
         runs: [],
     };
     testResults.forEach((testResult) => {
         sarifRes.runs.push({
             tool: getTool(testResult),
-            results: getResults(testResult),
+            results: get_sarif_result_1.getResults(testResult),
         });
     });
     return sarifRes;
@@ -3789,11 +3805,12 @@ function getTool(testResult) {
     const pushedIds = {};
     tool.driver.rules = testResult.vulnerabilities
         .map((vuln) => {
+        var _a, _b, _c;
         if (pushedIds[vuln.id]) {
             return;
         }
         const level = getIssueLevel(vuln.severity);
-        const cve = vuln['identifiers']['CVE'][0];
+        const cve = (_b = (_a = vuln.identifiers) === null || _a === void 0 ? void 0 : _a.CVE) === null || _b === void 0 ? void 0 : _b.join();
         pushedIds[vuln.id] = true;
         return {
             id: vuln.id,
@@ -3813,7 +3830,12 @@ function getTool(testResult) {
                 level: level,
             },
             properties: {
-                tags: ['security', ...vuln.identifiers.CWE],
+                tags: [
+                    'security',
+                    ...(((_c = vuln.identifiers) === null || _c === void 0 ? void 0 : _c.CWE) || []),
+                    // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+                    testResult.packageManager,
+                ],
             },
         };
     })
@@ -3821,34 +3843,6 @@ function getTool(testResult) {
     return tool;
 }
 exports.getTool = getTool;
-function getResults(testResult) {
-    const results = [];
-    if (!testResult.vulnerabilities) {
-        return results;
-    }
-    testResult.vulnerabilities.forEach((vuln) => {
-        results.push({
-            ruleId: vuln.id,
-            message: {
-                text: `This file introduces a vulnerable ${vuln.packageName} package with a ${vuln.severity} severity vulnerability.`,
-            },
-            locations: [
-                {
-                    physicalLocation: {
-                        artifactLocation: {
-                            uri: testResult.displayTargetFile,
-                        },
-                        region: {
-                            startLine: vuln.lineNumber || 1,
-                        },
-                    },
-                },
-            ],
-        });
-    });
-    return results;
-}
-exports.getResults = getResults;
 
 
 /***/ }),