snyk 1.1146.0 → 1.1148.0

package/dist/cli/95.index.js

@@ -158222,7 +158222,9 @@ Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.determinePaths = exports.readRawBuildInfo = exports.extractModuleInformation = exports.GoBinary = void 0;
 const depGraph = __webpack_require__(26326);
 const event_loop_spinner_1 = __webpack_require__(77158);
-const path = __webpack_require__(85622);
+// NOTE: Paths will always be normalized to POSIX even on Windows.
+// This makes it easier to ignore differences between Linux and Windows.
+const path_1 = __webpack_require__(85622);
 const varint = __webpack_require__(94676);
 const _1 = __webpack_require__(5998);
 const go_module_1 = __webpack_require__(79160);
@@ -158258,8 +158260,9 @@ class GoBinary {
     // matchFilesToModules goes through all files, extracts the package name and
     // adds it to the relevant module in the GoBinary.
     matchFilesToModules(files) {
-        const { modCachePath, vendorPath } = determinePaths(this.modules, files);
-        for (const fileName of files) {
+        const normalizedFiles = files.map((file) => path_1.posix.normalize(file));
+        const { modCachePath, vendorPath } = determinePaths(this.modules, normalizedFiles);
+        for (const fileName of normalizedFiles) {
             if (fileName === "<autogenerated>") {
                 continue;
             }
@@ -158304,8 +158307,8 @@ class GoBinary {
                     // (github.com/my/pkg@v0.0.1/a.go), the path.parse expression returns
                     // just a slash. This would result in a package name with a trailing
                     // slash, which is incorrect.
-                    let dirName = path.parse(parts[1]).dir;
-                    if (dirName === "/") {
+                    let dirName = path_1.posix.parse(parts[1]).dir;
+                    if (dirName === path_1.posix.sep) {
                         dirName = "";
                     }
                     const pkgName = module.name + dirName;
@@ -158323,7 +158326,9 @@ function extractModuleInformation(binary) {
     if (!mod) {
         throw Error("binary contains empty module info");
     }
-    const [pathDirective, mainModuleLine, ...versionsLines] = mod.split("\n");
+    const [pathDirective, mainModuleLine, ...versionsLines] = mod
+        .replace("\r", "")
+        .split("\n");
     const lineSplit = mainModuleLine.split("\t");
     let name = lineSplit[1];
     if (lineSplit[0] !== "mod") {
@@ -158527,7 +158532,7 @@ function isTrimmed(files) {
     // whether `trimpath` has been used or not, but there are binaries out there
     // that have trimmed paths without that annotation (for example
     // kyverno@v1.8.1).
-    return files.every((file) => !file.startsWith("/"));
+    return files.every((file) => !file.startsWith(path_1.posix.sep));
 }
 // determinePaths returns the modCachePath and vendorPath for a binary.
 // goModCachePath is the path at which the modules are downloaded to. When
@@ -158539,12 +158544,13 @@ function isTrimmed(files) {
 // Binaries built with `-trimpath` will have all paths trimmed away, meaning
 // that both returned values will be empty.
 function determinePaths(modules, files) {
-    if (isTrimmed(files)) {
+    const normalizedFiles = files.map((file) => path_1.posix.normalize(file));
+    if (isTrimmed(normalizedFiles)) {
         return { modCachePath: "", vendorPath: "" };
     }
     return {
-        modCachePath: determineGoModCachePath(modules, files),
-        vendorPath: determineVendorPath(modules, files),
+        modCachePath: determineGoModCachePath(modules, normalizedFiles),
+        vendorPath: determineVendorPath(modules, normalizedFiles),
     };
 }
 exports.determinePaths = determinePaths;
@@ -158556,7 +158562,10 @@ function determineVendorPath(modules, files) {
     // We check for other files in that root to make sure that we really got the
     // right vendor folder, and not just a random folder named `vendor` somewhere.
     for (const [, mod] of Object.entries(modules)) {
-        const vendoredModulePath = path.join("vendor", mod.name) + "/";
+        // use path.join so that we will always get linux-style paths even if
+        // the plugin runs on Windows. This is necessary because the Go binaries
+        // always contain linux-style path separators.
+        const vendoredModulePath = path_1.posix.join("vendor", mod.name) + path_1.posix.sep;
         const file = files.find((file) => file.includes(vendoredModulePath));
         if (file) {
             // make sure that we find other files in that path not in the vendor
@@ -158564,7 +158573,7 @@ function determineVendorPath(modules, files) {
             const mainModulePath = file.split(vendoredModulePath)[0];
             const success = files.find((file) => file.includes(mainModulePath) && !file.includes(vendoredModulePath));
             if (success) {
-                return path.join(mainModulePath, "vendor") + "/";
+                return path_1.posix.join(mainModulePath, "vendor") + path_1.posix.sep;
             }
         }
     }
@@ -158573,7 +158582,7 @@ function determineVendorPath(modules, files) {
 function determineGoModCachePath(modules, files) {
     // files in the go mod cache path always contain the module name and version.
     for (const [, mod] of Object.entries(modules)) {
-        const file = files.find((file) => file.includes("/" + mod.fullName()));
+        const file = files.find((file) => file.includes(path_1.posix.sep + mod.fullName()));
         if (file) {
             return file.split(mod.fullName())[0];
         }
@@ -158624,28 +158633,31 @@ exports.goModulesToScannedProjects = exports.getGoModulesContentAction = exports
 const Debug = __webpack_require__(15158);
 const elf = __webpack_require__(18);
 const event_loop_spinner_1 = __webpack_require__(77158);
-const path = __webpack_require__(85622);
+// NOTE: Paths will always be normalized to POSIX even on Windows.
+// This makes it easier to ignore differences between Linux and Windows.
+const path_1 = __webpack_require__(85622);
 const go_binary_1 = __webpack_require__(6803);
 const debug = Debug("snyk");
 const ignoredPaths = [
-    path.normalize("/boot"),
-    path.normalize("/dev"),
-    path.normalize("/etc"),
-    path.normalize("/home"),
-    path.normalize("/media"),
-    path.normalize("/mnt"),
-    path.normalize("/proc"),
-    path.normalize("/root"),
-    path.normalize("/run"),
-    path.normalize("/sbin"),
-    path.normalize("/sys"),
-    path.normalize("/tmp"),
-    path.normalize("/var"),
+    path_1.posix.normalize("/boot"),
+    path_1.posix.normalize("/dev"),
+    path_1.posix.normalize("/etc"),
+    path_1.posix.normalize("/home"),
+    path_1.posix.normalize("/media"),
+    path_1.posix.normalize("/mnt"),
+    path_1.posix.normalize("/proc"),
+    path_1.posix.normalize("/root"),
+    path_1.posix.normalize("/run"),
+    path_1.posix.normalize("/sbin"),
+    path_1.posix.normalize("/sys"),
+    path_1.posix.normalize("/tmp"),
+    path_1.posix.normalize("/var"),
 ];
 exports.DEP_GRAPH_TYPE = "gomodules";
 function filePathMatches(filePath) {
-    const dirName = path.dirname(filePath);
-    return (!path.parse(filePath).ext &&
+    const normalizedPath = path_1.posix.normalize(filePath);
+    const dirName = path_1.posix.dirname(normalizedPath);
+    return (!path_1.posix.parse(normalizedPath).ext &&
         !ignoredPaths.some((ignorePath) => dirName.startsWith(ignorePath)));
 }
 exports.getGoModulesContentAction = {
@@ -158694,7 +158706,7 @@ async function findGoBinaries(stream, streamSize) {
                         .split(/\0+/g)
                         .filter(Boolean);
                     const go = strings[strings.length - 2];
-                    const buildIdParts = strings[strings.length - 1].split("/");
+                    const buildIdParts = strings[strings.length - 1].split(path_1.posix.sep);
                     // Build ID's precise form is actionID/[.../]contentID.
                     // Usually the buildID is simply actionID/contentID, but with exceptions.
                     // https://github.com/golang/go/blob/master/src/cmd/go/internal/work/buildid.go#L23
@@ -158753,6 +158765,12 @@ async function goModulesToScannedProjects(filePathToContent) {
                 facts: [depGraphFact],
                 identity: {
                     type: exports.DEP_GRAPH_TYPE,
+                    // TODO: The path will contain forward slashes on Linux or backslashes on Windows.
+                    // So if you scanned the exact same image but from two different machines,
+                    // we'd generate two different identities.
+                    // These two identities would create two different Projects if monitored... so is this a bug?
+                    // If we enforce forward-slashes in every case, would that create duplicate Projects
+                    // for existing users who are using the current "backslashes on Windows" behaviour?
                     targetFile: filePath,
                 },
             });