snyk 1.1244.0 → 1.1245.0

package/dist/cli/245.index.js

@@ -231577,6 +231577,8 @@ const debugModule = __webpack_require__(15158);
 const errors_1 = __webpack_require__(62153);
 const path = __webpack_require__(71017);
 const subprocess = __webpack_require__(24862);
+const fs = __webpack_require__(57147);
+const os = __webpack_require__(22037);
 const debug = debugModule('snyk');
 async function handle(operation, command, args) {
     debug(`running dotnet command: ${operation}: ${command}`);
@@ -231621,59 +231623,28 @@ async function run(projectPath, options) {
 }
 exports.run = run;
 async function publish(projectPath, targetFramework) {
-    var _a;
     const command = 'dotnet';
     const args = ['publish', '--nologo'];
     // Self-contained: Create all required .dlls for version investigation, don't rely on the environment.
     args.push('--sc');
+    // Use the current runtime of whatever platform we are on.
+    // This ensures that .dlls will be packaged containing the runtime assembly versions.
+    // TODO: (OSM-521) if/when we allow this to be dynamic based on user input, remember to change this.
+    args.push('--use-current-runtime');
     // If your .csproj file contains multiple <TargetFramework> references, you need to supply which one you want to publish.
     if (targetFramework) {
         args.push('--framework');
         args.push(targetFramework);
     }
+    // Define a temporary output dir to use for detecting .dlls to use for runtime version assembly detection.
+    const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), `snyk-nuget-plugin-publish-csharp-`));
+    args.push('--output');
+    args.push(tempDir);
     // The path that contains either some form of project file, or a .sln one.
     // See: https://learn.microsoft.com/en-us/dotnet/core/tools/dotnet-publish#arguments
     args.push(projectPath);
-    const response = await handle('publish', command, args);
-    // The default output folder is [project_file_folder]/bin/[configuration]/[framework]/[runtime]/publish/
-    // for a self-contained executable. Specifically determining an output folder with --output is deprecated,
-    // as it leads to unpredictable results for multiple target frameworks and runtimes, so we have to cherry-pick
-    // the folders.
-    // See: https://learn.microsoft.com/en-us/dotnet/core/compatibility/sdk/7.0/solution-level-output-no-longer-valid.
-    // FIXME: As we're not supporting multiple frameworks all over the place, we have to just take the first one.
-    //  It's probably safe, as runtime dll versions most likely don't differ much across *most* dependencies, but
-    //  OS-specific ones (e.g. crypto) might.
-    // Looking for something like <project_name> -> /path/to/<project_name>/bin/Debug/<target_framework>/publish/ on Unix.
-    // We could also just hope Microsoft never changes their naming convention, but I think this is less error-prone,
-    // and will potentially also support multiple target frameworks.
-    const publishDirLine = response.stdout
-        .split(/[\r\n]+/)
-        // Projects that are referring to other local projects in their PackageReference item groups will also be restored
-        // in a chained operation. The project we're interested in will be shown last, thus we reverse it.
-        .reverse()
-        // TODO: For multiple target frameworks, replace `find` with a map or something of that kind to return more than the first.
-        // The first thing to get published ought to be the project's own .dll or .exe file, depending on the architecture.
-        // E.g., something like:
-        // dotnet_6 -> /foo/bar/project/bin/Debug/net6.0/osx-arm64/project_name.dll
-        // Either way, since we're forcing a publish of a self-contained project, all .dlls should be placed there.
-        // PRs are welcome!
-        .find((line) => line.endsWith('.dll') || line.endsWith('.exe'));
-    if (!publishDirLine) {
-        const err = `Could not find a valid publish path while reading stdout: ${response.stdout}`;
-        debug(err);
-        throw new errors_1.CliCommandError(`Unable to find a publish dir: ${err}`);
-    }
-    // dotnet_6 -> /foo/bar/project/bin/Debug/net6.0/osx-arm64/project_name.dll will then have the first part removed:
-    const [, publishedDllPath] = (_a = publishDirLine.split('->')) !== null && _a !== void 0 ? _a : [];
-    if (!publishedDllPath) {
-        const err = `Could not find a valid publish dir while splitting the line: ${publishDirLine}`;
-        debug(err);
-        throw new errors_1.CliCommandError(`Unable to find a publish dir: ${err}`);
-    }
-    // /foo/bar/project/bin/Debug/net6.0/osx-arm64/project_name.dll will then need to be stripped from a file name,
-    // in order to return just the so-called "publish dir":
-    const dirName = path.dirname(publishedDllPath.trim());
-    return dirName;
+    await handle('publish', command, args);
+    return tempDir;
 }
 exports.publish = publish;
 //# sourceMappingURL=dotnet.js.map
@@ -232522,7 +232493,9 @@ function buildGraph(projectName, projectAssets, runtimeAssembly, targetFramework
         return { ...acc, [nameWithVersion]: pkg };
     }, {});
     const topLevelDepPackages = topLevelDeps.reduce((acc, topLevelDepName) => {
-        const nameWithVersion = Object.keys(targetDeps).find((targetDep) => targetDep.startsWith(topLevelDepName));
+        const nameWithVersion = Object.keys(targetDeps).find((targetDep) => 
+        // Lowercase the comparison, as .csproj <PackageReference>s are not case-sensitive, and can be written however you like.
+        targetDep.toLowerCase().startsWith(topLevelDepName.toLowerCase()));
         if (!nameWithVersion) {
             throw new errors_1.InvalidManifestError(`cant find a name and a version in assets file, something's very malformed`);
         }
@@ -233078,7 +233051,6 @@ exports.generateRuntimeAssemblies = void 0;
 const errors = __webpack_require__(62153);
 const fs = __webpack_require__(57147);
 const lodash_1 = __webpack_require__(96486);
-const path = __webpack_require__(71017);
 const debugModule = __webpack_require__(15158);
 const debug = debugModule('snyk');
 // The Nuget dependency resolution rule of lowest applicable version
@@ -233101,44 +233073,30 @@ function generateRuntimeAssemblies(filePath) {
     // .NETCoreApp,Version=v6.0/alpine-armv6
     // ... etc.
     // See all: https://github.com/dotnet/runtime/blob/bd83e17052d3c09022bad1d91dca860ca6b27ab9/src/libraries/Microsoft.NETCore.Platforms/src/runtime.json
-    const runtimeAssemblyVersions = {};
+    let runtimeAssemblyVersions = {};
     Object.entries(deps.targets).forEach(([target, dependencies]) => {
         // Ignore target frameworks without dependencies, as they hold no dlls and thus no assembly versions to gauge.
         if ((0, lodash_1.isEmpty)(dependencies)) {
             return;
         }
-        // The RuntimeIdentifier's (RID) dependencies are located as `runtime` objects under dependencies.
-        // Depending on the TargetFramework, they can be located different places, so we need to iterate the whole
-        // list of targets for their `runtime` objects
-        // E.g., find the first entry in the list of targets as:
-        //  "your-top-level-project/1.0.0": {...},
-        //  "Castle.Core/4.4.1": {...},
-        //  "runtimepack.Microsoft.NETCore.App.Runtime.osx-arm64/6.0.16": { runtime: {...} },
-        // ... etc.
-        const runtimes = {};
-        let name;
-        let runtime;
-        for (const packageInfo of Object.values(dependencies)) {
-            if (!('runtime' in packageInfo)) {
-                continue;
-            }
-            // This can be either one or more runtime deps nested under a single leaf.
-            runtime = packageInfo.runtime;
-            if (runtime && Object.keys(runtime).length > 0) {
-                for (const [fullName, version] of Object.entries(runtime)) {
-                    if ((0, lodash_1.isEmpty)(version)) {
-                        continue;
-                    }
-                    // For some versions of .NET, the dependency version generated can be more than just the System.* name, but a
-                    // full path-like structure, such as lib/netstandard2.0/System.Buffers.dll, so extract as needed:
-                    name = path.basename(fullName);
-                    runtimes[name] = version;
-                }
-            }
-        }
-        if (!runtimes) {
-            throw new errors.FileNotProcessableError(`could not find any runtime dependencies in the ${target} dependency`);
-        }
+        // Since we're running `dotnet publish` with `--use-current-runtime`, this should exist in the dependency list,
+        // but guard against it to ensure good user feedback in case we did something wrong.
+        const runtimePack = Object.keys(dependencies).find((dep) => dep.startsWith('runtimepack'));
+        if (!runtimePack) {
+            throw new errors.FileNotProcessableError(`could not find any runtimepack.* identifier in the ${target} dependency`);
+        }
+        // The runtimepack contains all the current RuntimeIdentifier (RID) assemblies which we are interested in.
+        // Such as
+        //   "runtimepack.Microsoft.NETCore.App.Runtime.osx-arm64/6.0.16": {
+        //         "runtime": {
+        //           "Microsoft.CSharp.dll": { .. assembly version 6.0.0 }
+        //          }
+        //   }
+        // We traverse all those and store them for the dependency graph build.
+        if (!('runtime' in dependencies[runtimePack])) {
+            throw new errors.FileNotProcessableError(`could not find any runtime list in the ${runtimePack} dependency`);
+        }
+        const runtimes = dependencies[runtimePack]['runtime'];
         // Dig down into the specific runtimepack which contains all the assembly versions of
         // the bundled DLLs for the given runtime, as:
         // "runtimepack.Microsoft.NETCore.App.Runtime.osx-arm64/6.0.16": {
@@ -233154,19 +233112,20 @@ function generateRuntimeAssemblies(filePath) {
         //  (...)
         // We currently only address assemblyVersions. FileVersion might become relevant, depending
         // on how vulnerabilities are reported in the future.
-        runtimeAssemblyVersions[target] = Object.entries(runtimes).reduce((acc, [dll, versions]) => {
+        runtimeAssemblyVersions = Object.entries(runtimes).reduce((acc, [dll, versions]) => {
             // Take the version number (N.N.N.N) and remove the last element, in order for vulndb to understand anything.
             acc[dll] = versions.assemblyVersion.split('.').slice(0, -1).join('.');
             return acc;
         }, {});
+        // `dotnet publish` does not support multiple consecutive `--runtime` parameters, so there should really only
+        // be one. Thus, drop iterating more.
+        return;
     });
     if ((0, lodash_1.isEmpty)(runtimeAssemblyVersions)) {
         throw new errors.FileNotProcessableError('collection of runtime assembly versions was empty, that should not happen');
     }
     debug('finished extracting runtime assemblies from ' + filePath);
-    // FIXME: This has been done to make the future easier, as we probably soon will need to support multiple
-    //  RIDs. Currently, we are only looking at the first one.
-    return Object.values(runtimeAssemblyVersions)[0];
+    return runtimeAssemblyVersions;
 }
 exports.generateRuntimeAssemblies = generateRuntimeAssemblies;
 //# sourceMappingURL=runtime-assembly.js.map