snyk 1.1223.0 → 1.1225.0

package/dist/cli/245.index.js

@@ -230643,6 +230643,9 @@ async function inspect(root, targetFile, options) {
         options.strict)
             .then(createPackageTree);
     }
+    if (options['target-framework'] && !options['dotnet-runtime-resolution']) {
+        return Promise.reject(new errors_1.CliCommandError('target framework flag is currently only supported when also scanning with runtime resolution using the `--dotnet-runtime-resolution` flag'));
+    }
     if (options['dotnet-runtime-resolution']) {
         if (manifestType !== types_1.ManifestType.DOTNET_CORE) {
             return Promise.reject(new errors_1.FileNotProcessableError(`runtime resolution flag is currently only supported for: .NET versions 5 and higher, all versions of .NET Core and all versions of .NET Standard projects. Supplied project type was parsed as ${manifestType}.`));
@@ -230651,11 +230654,10 @@ async function inspect(root, targetFile, options) {
 \x1b[33m⚠ WARNING\x1b[0m: Testing a .NET project with runtime resolution enabled. 
 This should be considered experimental and not relied upon for production use.
 Please report issues with this beta feature by submitting a support ticket, and attach the output of running this command
-with the debug (-d) flag at \x1b[4mhttps://support.snyk.io/hc/en-us/requests/new\x1b[0m.
-`);
+with the debug (-d) flag at \x1b[4mhttps://support.snyk.io/hc/en-us/requests/new\x1b[0m.`);
         // TODO: Replaced by a CLI argument when project is stabilized
         const useRuntimeDependencies = true;
-        const result = await nugetParser.buildDepGraphFromFiles(root, targetFile, manifestType, options['assets-project-name'], useRuntimeDependencies, options['project-name-prefix']);
+        const result = await nugetParser.buildDepGraphFromFiles(root, targetFile, manifestType, options['assets-project-name'], useRuntimeDependencies, options['project-name-prefix'], options['target-framework']);
         return {
             dependencyGraph: result.dependencyGraph,
             package: 'n/a',
@@ -230722,12 +230724,17 @@ async function restore(projectPath) {
     return;
 }
 exports.restore = restore;
-async function publish(projectPath) {
+async function publish(projectPath, targetFramework) {
     var _a;
     const command = 'dotnet';
     const args = ['publish', '--nologo'];
     // Self-contained: Create all required .dlls for version investigation, don't rely on the environment.
     args.push('--sc');
+    // If your .csproj file contains multiple <TargetFramework> references, you need to supply which one you want to publish.
+    if (targetFramework) {
+        args.push('--framework');
+        args.push(targetFramework);
+    }
     // The path that contains either some form of project file, or a .sln one.
     // See: https://learn.microsoft.com/en-us/dotnet/core/tools/dotnet-publish#arguments
     args.push(projectPath);
@@ -230935,17 +230942,25 @@ function getFileContents(fileContentPath) {
         throw new errors_1.FileNotProcessableError(error);
     }
 }
-async function buildDepGraphFromFiles(root, targetFile, manifestType, useProjectNameFromAssetsFile, useRuntimeDependencies, projectNamePrefix) {
+async function buildDepGraphFromFiles(root, targetFile, manifestType, useProjectNameFromAssetsFile, useRuntimeDependencies, projectNamePrefix, targetFramework) {
     var _a, _b;
     const safeRoot = root || '.';
     const safeTargetFile = targetFile || '.';
     const fileContentPath = path.resolve(safeRoot, safeTargetFile);
     const fileContent = getFileContents(fileContentPath);
     const projectRootFolder = path.resolve(fileContentPath, '../../');
-    const targetFramework = await csProjParser.getTargetFrameworksFromProjFile(projectRootFolder);
-    if (!targetFramework) {
+    const targetFrameworks = csProjParser
+        .getTargetFrameworksFromProjFile(projectRootFolder)
+        // The rest of the type is not needed in this context
+        .map((tf) => tf.original);
+    if (targetFrameworks.length <= 0) {
         throw new errors_1.FileNotProcessableError(`unable to detect a target framework in ${projectRootFolder}, a valid one is needed to continue down this path.`);
     }
+    if (targetFramework && !targetFrameworks.includes(targetFramework)) {
+        console.log(`\x1b[33m⚠ WARNING\x1b[0m: Supplied targetframework \x1b[1m${targetFramework}\x1b[0m was not detected in the supplied 
+manifest file. Available targetFrameworks detected was \x1b[1m${targetFrameworks.join(',')}\x1b[0m. 
+Will attempt to build dependency graph anyway, but the operation might fail.`);
+    }
     const parser = PARSERS['dotnet-core-v2'];
     const manifest = await parser.fileContentParser.parse(fileContent);
     let resolvedProjectName = getRootName(root, projectRootFolder, projectNamePrefix);
@@ -230959,15 +230974,25 @@ async function buildDepGraphFromFiles(root, targetFile, manifestType, useProject
             debug(`project.assets.json file doesn't contain a value for 'projectName'. Using default value: ${resolvedProjectName}`);
         }
     }
+    // TODO: OSM-347 - return vulnerability scans for all
+    let decidedTargetFramework;
+    if (!targetFramework) {
+        console.log(`No targetFramework supplied, defaulting to using the first in the list of the manifest (\x1b[1m${targetFrameworks[0]}\x1b[0m).
+Supply a targetFramework by using the \x1b[1m--target-framework\x1b[0m argument.`);
+        decidedTargetFramework = targetFrameworks[0];
+    }
+    else {
+        decidedTargetFramework = targetFramework;
+    }
     let assemblyVersions = {};
     if (useRuntimeDependencies) {
-        if (!runtimeAssembly.isSupported(targetFramework)) {
-            throw new errors_1.FileNotProcessableError(`runtime resolution flag is currently only supported for: .NET versions 5 and higher, all versions of .NET Core and all versions of .NET Standard projects. Supplied versions was parsed as: ${targetFramework === null || targetFramework === void 0 ? void 0 : targetFramework.framework}.`);
+        if (!runtimeAssembly.isSupported(decidedTargetFramework)) {
+            throw new errors_1.FileNotProcessableError(`runtime resolution flag is currently only supported for: .NET versions 5 and higher, all versions of .NET Core and all versions of .NET Standard projects. Supplied versions was parsed as: ${decidedTargetFramework}.`);
         }
         // Ensure `dotnet` is installed on the system or fail trying.
         await dotnet.validate();
         // Run `dotnet publish` to create a self-contained publishable binary with included .dlls for assembly version inspection.
-        const publishDir = await dotnet.publish(projectRootFolder);
+        const publishDir = await dotnet.publish(projectRootFolder, decidedTargetFramework);
         // Then inspect the dependency graph for the runtimepackage's assembly versions.
         const depsFile = path.resolve(publishDir, `${projectNameFromManifestFile}.deps.json`);
         assemblyVersions = runtimeAssembly.generateRuntimeAssemblies(depsFile);
@@ -230975,7 +231000,7 @@ async function buildDepGraphFromFiles(root, targetFile, manifestType, useProject
     const depGraph = parser.depParser.parse(resolvedProjectName, manifest, assemblyVersions);
     return {
         dependencyGraph: depGraph,
-        targetFramework: targetFramework === null || targetFramework === void 0 ? void 0 : targetFramework.original,
+        targetFramework: decidedTargetFramework,
     };
 }
 exports.buildDepGraphFromFiles = buildDepGraphFromFiles;
@@ -230994,21 +231019,24 @@ async function buildDepTreeFromFiles(root, targetFile, packagesFolderPath, manif
         packageFormatVersion: 'nuget:0.0.0',
         version: '0.0.0',
     };
-    let targetFramework;
+    let targetFrameworks;
     try {
         if (manifestType === types_1.ManifestType.DOTNET_CORE) {
-            targetFramework = await csProjParser.getTargetFrameworksFromProjFile(projectRootFolder);
+            targetFrameworks =
+                csProjParser.getTargetFrameworksFromProjFile(projectRootFolder);
         }
         else {
             // .csproj is in the same directory as packages.config or project.json
             const fileContentParentDirectory = path.resolve(fileContentPath, '../');
-            targetFramework = await csProjParser.getTargetFrameworksFromProjFile(fileContentParentDirectory);
+            targetFrameworks = csProjParser.getTargetFrameworksFromProjFile(fileContentParentDirectory);
             // finally, for the .NETFramework project, try to assume the framework using dotnet-deps-parser
-            if (!targetFramework) {
+            if (targetFrameworks.length <= 0) {
                 // currently only process packages.config files
                 if (manifestType === types_1.ManifestType.PACKAGES_CONFIG) {
-                    targetFramework =
-                        await packagesConfigParser.getMinimumTargetFramework(fileContent);
+                    const minimumTargetFramework = await packagesConfigParser.getMinimumTargetFramework(fileContent);
+                    if (minimumTargetFramework) {
+                        targetFrameworks = [minimumTargetFramework];
+                    }
                 }
             }
         }
@@ -231016,8 +231044,10 @@ async function buildDepTreeFromFiles(root, targetFile, packagesFolderPath, manif
     catch (error) {
         return Promise.reject(error);
     }
+    // TODO: OSM-347 - use more than just the first one we find
+    const targetFramework = targetFrameworks.length > 0 ? targetFrameworks[0].original : undefined;
     tree.meta = {
-        targetFramework: targetFramework ? targetFramework.original : undefined, // TODO implement for more than one TF
+        targetFramework: targetFramework,
     };
     const parser = PARSERS[manifestType];
     const manifest = await parser.fileContentParser.parse(fileContent, tree);
@@ -231066,49 +231096,49 @@ function findFile(rootDir, filter) {
     }
     return;
 }
-async function getTargetFrameworksFromProjFile(rootDir) {
-    return new Promise((resolve, reject) => {
-        debug('Looking for your .csproj file in ' + rootDir);
-        const csprojPath = findFile(rootDir, /.*\.csproj$/);
-        if (!csprojPath) {
-            debug('.csproj file not found in ' + rootDir + '.');
-            resolve(undefined);
+function getTargetFrameworksFromProjFile(rootDir) {
+    debug('Looking for your .csproj file in ' + rootDir);
+    const csprojPath = findFile(rootDir, /.*\.csproj$/);
+    if (!csprojPath) {
+        debug('.csproj file not found in ' + rootDir + '.');
+        return [];
+    }
+    debug(`Checking .NET framework version in .csproj file ${csprojPath}`);
+    const csprojContents = fs.readFileSync(csprojPath, 'utf-8');
+    let result = [];
+    parseXML.parseString(csprojContents, (err, parsedCsprojContents) => {
+        var _a, _b;
+        if (err) {
+            throw new errors_1.FileNotProcessableError(err);
+        }
+        const parsedTargetFrameworks = ((_b = (_a = parsedCsprojContents === null || parsedCsprojContents === void 0 ? void 0 : parsedCsprojContents.Project) === null || _a === void 0 ? void 0 : _a.PropertyGroup) === null || _b === void 0 ? void 0 : _b.reduce((targetFrameworks, propertyGroup) => {
+            var _a, _b, _c;
+            const targetFrameworkSource = ((_a = propertyGroup === null || propertyGroup === void 0 ? void 0 : propertyGroup.TargetFrameworkVersion) === null || _a === void 0 ? void 0 : _a[0]) ||
+                ((_b = propertyGroup === null || propertyGroup === void 0 ? void 0 : propertyGroup.TargetFramework) === null || _b === void 0 ? void 0 : _b[0]) ||
+                ((_c = propertyGroup === null || propertyGroup === void 0 ? void 0 : propertyGroup.TargetFrameworks) === null || _c === void 0 ? void 0 : _c[0]) ||
+                '';
+            return targetFrameworks
+                .concat(targetFrameworkSource.split(';'))
+                .filter(Boolean);
+        }, [])) || [];
+        if (parsedTargetFrameworks.length < 1) {
+            debug('Could not find TargetFrameworkVersion/TargetFramework' +
+                '/TargetFrameworks defined in the Project.PropertyGroup field of ' +
+                'your .csproj file');
+            result = [];
             return;
         }
-        debug('Checking .net framework version in .csproj file ' + csprojPath);
-        const csprojContents = fs.readFileSync(csprojPath);
-        let targetFrameworks = [];
-        parseXML.parseString(csprojContents, (err, parsedCsprojContents) => {
-            var _a, _b;
-            if (err) {
-                reject(new errors_1.FileNotProcessableError(err));
-                return;
-            }
-            const parsedTargetFrameworks = ((_b = (_a = parsedCsprojContents === null || parsedCsprojContents === void 0 ? void 0 : parsedCsprojContents.Project) === null || _a === void 0 ? void 0 : _a.PropertyGroup) === null || _b === void 0 ? void 0 : _b.reduce((targetFrameworks, propertyGroup) => {
-                var _a, _b, _c;
-                const targetFrameworkSource = ((_a = propertyGroup === null || propertyGroup === void 0 ? void 0 : propertyGroup.TargetFrameworkVersion) === null || _a === void 0 ? void 0 : _a[0]) ||
-                    ((_b = propertyGroup === null || propertyGroup === void 0 ? void 0 : propertyGroup.TargetFramework) === null || _b === void 0 ? void 0 : _b[0]) ||
-                    ((_c = propertyGroup === null || propertyGroup === void 0 ? void 0 : propertyGroup.TargetFrameworks) === null || _c === void 0 ? void 0 : _c[0]) ||
-                    '';
-                return targetFrameworks
-                    .concat(targetFrameworkSource.split(';'))
-                    .filter(Boolean);
-            }, [])) || [];
-            if (parsedTargetFrameworks.length < 1) {
-                debug('Could not find TargetFrameworkVersion/TargetFramework' +
-                    '/TargetFrameworks defined in the Project.PropertyGroup field of ' +
-                    'your .csproj file');
-            }
-            targetFrameworks = parsedTargetFrameworks
-                .map(framework_1.toReadableFramework)
-                .filter(Boolean);
-            if (parsedTargetFrameworks.length > 1 && targetFrameworks.length < 1) {
-                debug('Could not find valid/supported .NET version in csproj file located at' +
-                    csprojPath);
-            }
-            resolve(targetFrameworks[0]);
-        });
+        const targetFrameworks = parsedTargetFrameworks
+            .map(framework_1.toReadableFramework)
+            .filter(Boolean);
+        if (parsedTargetFrameworks.length > 1 && targetFrameworks.length < 1) {
+            debug('Could not find valid/supported .NET version in csproj file located at' +
+                csprojPath);
+        }
+        result = targetFrameworks;
+        return;
     });
+    return result;
 }
 exports.getTargetFrameworksFromProjFile = getTargetFrameworksFromProjFile;
 //# sourceMappingURL=csproj-parser.js.map
@@ -231274,7 +231304,7 @@ function validateManifest(manifest) {
         throw new errors_1.InvalidManifestError('0 targets were found in project.assets.json');
     }
 }
-async function parse(tree, manifest) {
+function parse(tree, manifest) {
     debug('Trying to parse dot-net-cli manifest');
     validateManifest(manifest);
     if (manifest.project.version) {
@@ -231956,11 +231986,8 @@ const debug = debugModule('snyk');
 // For a list of version naming currently available, see
 // https://learn.microsoft.com/en-us/dotnet/standard/frameworks#supported-target-frameworks
 function isSupported(targetFramework) {
-    if (!('original' in targetFramework)) {
-        return false;
-    }
     // Everything that does not start with 'net' is already game over. E.g. Windows Phone (wp) or silverlight (sl) etc.
-    if (!targetFramework.original.startsWith('net')) {
+    if (!targetFramework.startsWith('net')) {
         return false;
     }
     // What's left is:
@@ -231969,7 +231996,7 @@ function isSupported(targetFramework) {
     // - .NET Standard: netstandardN.N and
     // - .NET Framework: netNNN, all of which we support except the latter.
     // So if there's a dot, we're good.
-    if (targetFramework.original.includes('.')) {
+    if (targetFramework.includes('.')) {
         return true;
     }
     // Otherwise it's something before .NET 5 and we're out