snyk 1.1244.0 → 1.1246.0

package/dist/cli/245.index.js

@@ -11391,7 +11391,7 @@ exports.readJSON = readJSON;
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.DEFAULT_ERROR_MESSAGES = exports.NETWORK_ERRORS = exports.ErrorCodes = exports.DCIGNORE_DRAFTS = exports.IGNORE_FILES_NAMES = exports.IGNORES_DEFAULT = exports.REQUEST_RETRY_DELAY = exports.MAX_RETRY_ATTEMPTS = exports.POLLING_INTERVAL = exports.UPLOAD_CONCURRENCY = exports.MAX_UPLOAD_ATTEMPTS = exports.CACHE_KEY = exports.EXCLUDED_NAMES = exports.DOTSNYK_FILENAME = exports.DCIGNORE_FILENAME = exports.GITIGNORE_FILENAME = exports.GIT_FILENAME = exports.ENCODE_TYPE = exports.HASH_ALGORITHM = exports.MAX_FILE_SIZE = exports.MAX_PAYLOAD = void 0;
+exports.DEFAULT_ERROR_MESSAGES = exports.NETWORK_ERRORS = exports.ErrorCodes = exports.DCIGNORE_DRAFTS = exports.IGNORE_FILES_NAMES = exports.IGNORES_DEFAULT = exports.ORG_ID_REGEXP = exports.REQUEST_RETRY_DELAY = exports.MAX_RETRY_ATTEMPTS = exports.POLLING_INTERVAL = exports.UPLOAD_CONCURRENCY = exports.MAX_UPLOAD_ATTEMPTS = exports.CACHE_KEY = exports.EXCLUDED_NAMES = exports.DOTSNYK_FILENAME = exports.DCIGNORE_FILENAME = exports.GITIGNORE_FILENAME = exports.GIT_FILENAME = exports.ENCODE_TYPE = exports.HASH_ALGORITHM = exports.MAX_FILE_SIZE = exports.MAX_PAYLOAD = void 0;
 const dcignore_1 = __webpack_require__(55086);
 exports.MAX_PAYLOAD = 4 * 1024 * 1024;
 exports.MAX_FILE_SIZE = 1024 * 1024;
@@ -11408,6 +11408,7 @@ exports.UPLOAD_CONCURRENCY = 2;
 exports.POLLING_INTERVAL = 500;
 exports.MAX_RETRY_ATTEMPTS = 10; // Request retries on network errors
 exports.REQUEST_RETRY_DELAY = 5 * 1000; // delay between retries in milliseconds
+exports.ORG_ID_REGEXP = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
 exports.IGNORES_DEFAULT = [`**/${exports.GIT_FILENAME}/**`];
 exports.IGNORE_FILES_NAMES = [exports.GITIGNORE_FILENAME, exports.DCIGNORE_FILENAME, exports.DOTSNYK_FILENAME];
 exports.DCIGNORE_DRAFTS = {
@@ -12014,17 +12015,17 @@ const httpUtils_1 = __webpack_require__(11294);
 // The trick to typecast union type alias
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
 function isSubsetErrorCode(code, messages) {
-    if (code in messages) {
-        return true;
-    }
-    return false;
+    return code in messages;
 }
-function generateError(errorCode, messages, apiName, error) {
+function generateError(errorCode, messages, apiName, errorMessage, jsonApiError) {
+    if (jsonApiError) {
+        return httpUtils_1.generateErrorWithDetail(jsonApiError, errorCode, apiName);
+    }
     if (!isSubsetErrorCode(errorCode, messages)) {
-        throw { errorCode, messages, apiName };
+        throw { statusCode: errorCode, statusText: errorMessage || 'unknown error occurred', apiName };
     }
     const statusCode = errorCode;
-    const statusText = error !== null && error !== void 0 ? error : messages[errorCode];
+    const statusText = errorMessage !== null && errorMessage !== void 0 ? errorMessage : messages[errorCode];
     return {
         type: 'error',
         error: {
@@ -12045,8 +12046,7 @@ const GENERIC_ERROR_MESSAGES = {
 async function compressAndEncode(payload) {
     // encode payload and compress;
     const deflate = util_1.promisify(zlib_1.gzip);
-    const compressedPayload = await deflate(Buffer.from(JSON.stringify(payload)).toString('base64'));
-    return compressedPayload;
+    return await deflate(Buffer.from(JSON.stringify(payload)).toString('base64'));
 }
 exports.compressAndEncode = compressAndEncode;
 function startSession(options) {
@@ -12123,7 +12123,7 @@ async function getFilters(baseURL, source, attempts = constants_1.MAX_RETRY_ATTE
     if (res.success) {
         return { type: 'success', value: res.body };
     }
-    return generateError(res.errorCode, GENERIC_ERROR_MESSAGES, apiName);
+    return generateError(res.errorCode, GENERIC_ERROR_MESSAGES, apiName, undefined, res.jsonApiError);
 }
 exports.getFilters = getFilters;
 function commonHttpHeaders(options) {
@@ -12167,7 +12167,7 @@ async function createBundle(options) {
     if (res.success) {
         return { type: 'success', value: res.body };
     }
-    return generateError(res.errorCode, CREATE_BUNDLE_ERROR_MESSAGES, 'createBundle');
+    return generateError(res.errorCode, CREATE_BUNDLE_ERROR_MESSAGES, 'createBundle', undefined, res.jsonApiError);
 }
 exports.createBundle = createBundle;
 const CHECK_BUNDLE_ERROR_MESSAGES = {
@@ -12193,7 +12193,7 @@ async function checkBundle(options) {
     });
     if (res.success)
         return { type: 'success', value: res.body };
-    return generateError(res.errorCode, CHECK_BUNDLE_ERROR_MESSAGES, 'checkBundle');
+    return generateError(res.errorCode, CHECK_BUNDLE_ERROR_MESSAGES, 'checkBundle', undefined, res.jsonApiError);
 }
 exports.checkBundle = checkBundle;
 const EXTEND_BUNDLE_ERROR_MESSAGES = {
@@ -12226,7 +12226,7 @@ async function extendBundle(options) {
     });
     if (res.success)
         return { type: 'success', value: res.body };
-    return generateError(res.errorCode, EXTEND_BUNDLE_ERROR_MESSAGES, 'extendBundle');
+    return generateError(res.errorCode, EXTEND_BUNDLE_ERROR_MESSAGES, 'extendBundle', undefined, res.jsonApiError);
 }
 exports.extendBundle = extendBundle;
 // eslint-disable-next-line no-shadow
@@ -12272,9 +12272,10 @@ async function getAnalysis(options) {
         },
     };
     const res = await needle_1.makeRequest(config);
-    if (res.success)
+    if (res.success) {
         return { type: 'success', value: res.body };
-    return generateError(res.errorCode, GET_ANALYSIS_ERROR_MESSAGES, 'getAnalysis');
+    }
+    return generateError(res.errorCode, GET_ANALYSIS_ERROR_MESSAGES, 'getAnalysis', undefined, res.jsonApiError);
 }
 exports.getAnalysis = getAnalysis;
 const REPORT_ERROR_MESSAGES = {
@@ -12321,7 +12322,7 @@ async function initReport(options) {
     const res = await needle_1.makeRequest(config);
     if (res.success)
         return { type: 'success', value: res.body.reportId };
-    return generateError(res.errorCode, REPORT_ERROR_MESSAGES, 'initReport');
+    return generateError(res.errorCode, REPORT_ERROR_MESSAGES, 'initReport', undefined, res.jsonApiError);
 }
 exports.initReport = initReport;
 /**
@@ -12346,7 +12347,7 @@ async function getReport(options) {
     const res = await needle_1.makeRequest(config);
     if (res.success)
         return { type: 'success', value: res.body };
-    return generateError(res.errorCode, REPORT_ERROR_MESSAGES, 'getReport', (_a = res.error) === null || _a === void 0 ? void 0 : _a.message);
+    return generateError(res.errorCode, REPORT_ERROR_MESSAGES, 'getReport', (_a = res.error) === null || _a === void 0 ? void 0 : _a.message, res.jsonApiError);
 }
 exports.getReport = getReport;
 /**
@@ -12377,7 +12378,7 @@ async function initScmReport(options) {
     const res = await needle_1.makeRequest(config);
     if (res.success)
         return { type: 'success', value: res.body.testId };
-    return generateError(res.errorCode, REPORT_ERROR_MESSAGES, 'initReport');
+    return generateError(res.errorCode, REPORT_ERROR_MESSAGES, 'initReport', undefined, res.jsonApiError);
 }
 exports.initScmReport = initScmReport;
 /**
@@ -12402,7 +12403,7 @@ async function getScmReport(options) {
     const res = await needle_1.makeRequest(config);
     if (res.success)
         return { type: 'success', value: res.body };
-    return generateError(res.errorCode, REPORT_ERROR_MESSAGES, 'getReport', (_a = res.error) === null || _a === void 0 ? void 0 : _a.message);
+    return generateError(res.errorCode, REPORT_ERROR_MESSAGES, 'getReport', (_a = res.error) === null || _a === void 0 ? void 0 : _a.message, res.jsonApiError);
 }
 exports.getScmReport = getScmReport;
 //# sourceMappingURL=http.js.map
@@ -12517,6 +12518,7 @@ const https_1 = __importDefault(__webpack_require__(95687));
 const url_1 = __webpack_require__(57310);
 const emitter_1 = __webpack_require__(37544);
 const constants_1 = __webpack_require__(65765);
+const httpUtils_1 = __webpack_require__(11294);
 const sleep = (duration) => new Promise(resolve => setTimeout(resolve, duration));
 const TIMEOUT_DEFAULT = 600000;
 const agentOptions = {
@@ -12529,7 +12531,7 @@ const agentOptions = {
     rejectUnauthorized: !global.ignoreUnknownCA,
 };
 async function makeRequest(payload, attempts = constants_1.MAX_RETRY_ATTEMPTS) {
-    var _a;
+    var _a, _b;
     let data;
     if (!payload.isJson && payload.body) {
         data = payload.body;
@@ -12564,6 +12566,7 @@ async function makeRequest(payload, attempts = constants_1.MAX_RETRY_ATTEMPTS) {
     do {
         let errorCode;
         let error;
+        let jsonApiError;
         let response;
         try {
             response = await needle_1.default(method, url, data, options);
@@ -12580,6 +12583,11 @@ async function makeRequest(payload, attempts = constants_1.MAX_RETRY_ATTEMPTS) {
         }
         // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment, @typescript-eslint/no-unsafe-member-access
         const errorMessage = (_a = response === null || response === void 0 ? void 0 : response.body) === null || _a === void 0 ? void 0 : _a.error;
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment,@typescript-eslint/no-unsafe-member-access
+        const errors = (_b = response === null || response === void 0 ? void 0 : response.body) === null || _b === void 0 ? void 0 : _b.errors;
+        if (httpUtils_1.isJsonApiErrors(errors)) {
+            jsonApiError = errors[0];
+        }
         if (errorMessage) {
             error = error !== null && error !== void 0 ? error : new Error(errorMessage);
         }
@@ -12599,7 +12607,7 @@ async function makeRequest(payload, attempts = constants_1.MAX_RETRY_ATTEMPTS) {
         }
         else {
             attempts = 0;
-            return { success: false, errorCode, error };
+            return { success: false, errorCode, error, jsonApiError };
         }
     } while (attempts > 0);
     return { success: false, errorCode: constants_1.ErrorCodes.serviceUnavailable, error: undefined };
@@ -12737,16 +12745,17 @@ exports.reportScm = reportScm;
 /***/ }),
 
 /***/ 11294:
-/***/ ((__unused_webpack_module, exports) => {
+/***/ ((__unused_webpack_module, exports, __webpack_require__) => {
 
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.getURL = void 0;
+exports.generateErrorWithDetail = exports.isJsonApiErrors = exports.getURL = void 0;
+const constants_1 = __webpack_require__(65765);
 function getURL(baseURL, path, orgId) {
     if (routeToGateway(baseURL)) {
-        if (!orgId) {
-            throw new Error('Org is required for this operation');
+        if (!isValidOrg(orgId)) {
+            throw new Error('A valid Org id is required for this operation');
         }
         return `${baseURL}/hidden/orgs/${orgId}/code${path}`;
     }
@@ -12756,6 +12765,41 @@ exports.getURL = getURL;
 function routeToGateway(baseURL) {
     return baseURL.includes('snykgov.io');
 }
+function isValidOrg(orgId) {
+    return orgId !== undefined && constants_1.ORG_ID_REGEXP.test(orgId);
+}
+function isJsonApiErrors(input) {
+    if (!Array.isArray(input) || input.length < 1) {
+        return false;
+    }
+    for (const element of input) {
+        if (typeof element !== 'object' ||
+            !('status' in element) ||
+            !('code' in element) ||
+            !('title' in element) ||
+            !('detail' in element)) {
+            return false;
+        }
+    }
+    return true;
+}
+exports.isJsonApiErrors = isJsonApiErrors;
+function generateErrorWithDetail(error, statusCode, apiName) {
+    var _a;
+    const errorLink = (_a = error.links) === null || _a === void 0 ? void 0 : _a.about;
+    const detail = `${error.title}${error.detail ? `: ${error.detail}` : ''}${errorLink ? ` (more info: ${errorLink})` : ``}`;
+    const statusText = error.title;
+    return {
+        type: 'error',
+        error: {
+            apiName,
+            statusCode: statusCode,
+            statusText,
+            detail,
+        },
+    };
+}
+exports.generateErrorWithDetail = generateErrorWithDetail;
 //# sourceMappingURL=httpUtils.js.map
 
 /***/ }),
@@ -231577,6 +231621,8 @@ const debugModule = __webpack_require__(15158);
 const errors_1 = __webpack_require__(62153);
 const path = __webpack_require__(71017);
 const subprocess = __webpack_require__(24862);
+const fs = __webpack_require__(57147);
+const os = __webpack_require__(22037);
 const debug = debugModule('snyk');
 async function handle(operation, command, args) {
     debug(`running dotnet command: ${operation}: ${command}`);
@@ -231621,59 +231667,28 @@ async function run(projectPath, options) {
 }
 exports.run = run;
 async function publish(projectPath, targetFramework) {
-    var _a;
     const command = 'dotnet';
     const args = ['publish', '--nologo'];
     // Self-contained: Create all required .dlls for version investigation, don't rely on the environment.
     args.push('--sc');
+    // Use the current runtime of whatever platform we are on.
+    // This ensures that .dlls will be packaged containing the runtime assembly versions.
+    // TODO: (OSM-521) if/when we allow this to be dynamic based on user input, remember to change this.
+    args.push('--use-current-runtime');
     // If your .csproj file contains multiple <TargetFramework> references, you need to supply which one you want to publish.
     if (targetFramework) {
         args.push('--framework');
         args.push(targetFramework);
     }
+    // Define a temporary output dir to use for detecting .dlls to use for runtime version assembly detection.
+    const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), `snyk-nuget-plugin-publish-csharp-`));
+    args.push('--output');
+    args.push(tempDir);
     // The path that contains either some form of project file, or a .sln one.
     // See: https://learn.microsoft.com/en-us/dotnet/core/tools/dotnet-publish#arguments
     args.push(projectPath);
-    const response = await handle('publish', command, args);
-    // The default output folder is [project_file_folder]/bin/[configuration]/[framework]/[runtime]/publish/
-    // for a self-contained executable. Specifically determining an output folder with --output is deprecated,
-    // as it leads to unpredictable results for multiple target frameworks and runtimes, so we have to cherry-pick
-    // the folders.
-    // See: https://learn.microsoft.com/en-us/dotnet/core/compatibility/sdk/7.0/solution-level-output-no-longer-valid.
-    // FIXME: As we're not supporting multiple frameworks all over the place, we have to just take the first one.
-    //  It's probably safe, as runtime dll versions most likely don't differ much across *most* dependencies, but
-    //  OS-specific ones (e.g. crypto) might.
-    // Looking for something like <project_name> -> /path/to/<project_name>/bin/Debug/<target_framework>/publish/ on Unix.
-    // We could also just hope Microsoft never changes their naming convention, but I think this is less error-prone,
-    // and will potentially also support multiple target frameworks.
-    const publishDirLine = response.stdout
-        .split(/[\r\n]+/)
-        // Projects that are referring to other local projects in their PackageReference item groups will also be restored
-        // in a chained operation. The project we're interested in will be shown last, thus we reverse it.
-        .reverse()
-        // TODO: For multiple target frameworks, replace `find` with a map or something of that kind to return more than the first.
-        // The first thing to get published ought to be the project's own .dll or .exe file, depending on the architecture.
-        // E.g., something like:
-        // dotnet_6 -> /foo/bar/project/bin/Debug/net6.0/osx-arm64/project_name.dll
-        // Either way, since we're forcing a publish of a self-contained project, all .dlls should be placed there.
-        // PRs are welcome!
-        .find((line) => line.endsWith('.dll') || line.endsWith('.exe'));
-    if (!publishDirLine) {
-        const err = `Could not find a valid publish path while reading stdout: ${response.stdout}`;
-        debug(err);
-        throw new errors_1.CliCommandError(`Unable to find a publish dir: ${err}`);
-    }
-    // dotnet_6 -> /foo/bar/project/bin/Debug/net6.0/osx-arm64/project_name.dll will then have the first part removed:
-    const [, publishedDllPath] = (_a = publishDirLine.split('->')) !== null && _a !== void 0 ? _a : [];
-    if (!publishedDllPath) {
-        const err = `Could not find a valid publish dir while splitting the line: ${publishDirLine}`;
-        debug(err);
-        throw new errors_1.CliCommandError(`Unable to find a publish dir: ${err}`);
-    }
-    // /foo/bar/project/bin/Debug/net6.0/osx-arm64/project_name.dll will then need to be stripped from a file name,
-    // in order to return just the so-called "publish dir":
-    const dirName = path.dirname(publishedDllPath.trim());
-    return dirName;
+    await handle('publish', command, args);
+    return tempDir;
 }
 exports.publish = publish;
 //# sourceMappingURL=dotnet.js.map
@@ -232522,7 +232537,9 @@ function buildGraph(projectName, projectAssets, runtimeAssembly, targetFramework
         return { ...acc, [nameWithVersion]: pkg };
     }, {});
     const topLevelDepPackages = topLevelDeps.reduce((acc, topLevelDepName) => {
-        const nameWithVersion = Object.keys(targetDeps).find((targetDep) => targetDep.startsWith(topLevelDepName));
+        const nameWithVersion = Object.keys(targetDeps).find((targetDep) => 
+        // Lowercase the comparison, as .csproj <PackageReference>s are not case-sensitive, and can be written however you like.
+        targetDep.toLowerCase().startsWith(topLevelDepName.toLowerCase()));
         if (!nameWithVersion) {
             throw new errors_1.InvalidManifestError(`cant find a name and a version in assets file, something's very malformed`);
         }
@@ -233078,7 +233095,6 @@ exports.generateRuntimeAssemblies = void 0;
 const errors = __webpack_require__(62153);
 const fs = __webpack_require__(57147);
 const lodash_1 = __webpack_require__(96486);
-const path = __webpack_require__(71017);
 const debugModule = __webpack_require__(15158);
 const debug = debugModule('snyk');
 // The Nuget dependency resolution rule of lowest applicable version
@@ -233101,44 +233117,30 @@ function generateRuntimeAssemblies(filePath) {
     // .NETCoreApp,Version=v6.0/alpine-armv6
     // ... etc.
     // See all: https://github.com/dotnet/runtime/blob/bd83e17052d3c09022bad1d91dca860ca6b27ab9/src/libraries/Microsoft.NETCore.Platforms/src/runtime.json
-    const runtimeAssemblyVersions = {};
+    let runtimeAssemblyVersions = {};
     Object.entries(deps.targets).forEach(([target, dependencies]) => {
         // Ignore target frameworks without dependencies, as they hold no dlls and thus no assembly versions to gauge.
         if ((0, lodash_1.isEmpty)(dependencies)) {
             return;
         }
-        // The RuntimeIdentifier's (RID) dependencies are located as `runtime` objects under dependencies.
-        // Depending on the TargetFramework, they can be located different places, so we need to iterate the whole
-        // list of targets for their `runtime` objects
-        // E.g., find the first entry in the list of targets as:
-        //  "your-top-level-project/1.0.0": {...},
-        //  "Castle.Core/4.4.1": {...},
-        //  "runtimepack.Microsoft.NETCore.App.Runtime.osx-arm64/6.0.16": { runtime: {...} },
-        // ... etc.
-        const runtimes = {};
-        let name;
-        let runtime;
-        for (const packageInfo of Object.values(dependencies)) {
-            if (!('runtime' in packageInfo)) {
-                continue;
-            }
-            // This can be either one or more runtime deps nested under a single leaf.
-            runtime = packageInfo.runtime;
-            if (runtime && Object.keys(runtime).length > 0) {
-                for (const [fullName, version] of Object.entries(runtime)) {
-                    if ((0, lodash_1.isEmpty)(version)) {
-                        continue;
-                    }
-                    // For some versions of .NET, the dependency version generated can be more than just the System.* name, but a
-                    // full path-like structure, such as lib/netstandard2.0/System.Buffers.dll, so extract as needed:
-                    name = path.basename(fullName);
-                    runtimes[name] = version;
-                }
-            }
-        }
-        if (!runtimes) {
-            throw new errors.FileNotProcessableError(`could not find any runtime dependencies in the ${target} dependency`);
-        }
+        // Since we're running `dotnet publish` with `--use-current-runtime`, this should exist in the dependency list,
+        // but guard against it to ensure good user feedback in case we did something wrong.
+        const runtimePack = Object.keys(dependencies).find((dep) => dep.startsWith('runtimepack'));
+        if (!runtimePack) {
+            throw new errors.FileNotProcessableError(`could not find any runtimepack.* identifier in the ${target} dependency`);
+        }
+        // The runtimepack contains all the current RuntimeIdentifier (RID) assemblies which we are interested in.
+        // Such as
+        //   "runtimepack.Microsoft.NETCore.App.Runtime.osx-arm64/6.0.16": {
+        //         "runtime": {
+        //           "Microsoft.CSharp.dll": { .. assembly version 6.0.0 }
+        //          }
+        //   }
+        // We traverse all those and store them for the dependency graph build.
+        if (!('runtime' in dependencies[runtimePack])) {
+            throw new errors.FileNotProcessableError(`could not find any runtime list in the ${runtimePack} dependency`);
+        }
+        const runtimes = dependencies[runtimePack]['runtime'];
         // Dig down into the specific runtimepack which contains all the assembly versions of
         // the bundled DLLs for the given runtime, as:
         // "runtimepack.Microsoft.NETCore.App.Runtime.osx-arm64/6.0.16": {
@@ -233154,19 +233156,20 @@ function generateRuntimeAssemblies(filePath) {
         //  (...)
         // We currently only address assemblyVersions. FileVersion might become relevant, depending
         // on how vulnerabilities are reported in the future.
-        runtimeAssemblyVersions[target] = Object.entries(runtimes).reduce((acc, [dll, versions]) => {
+        runtimeAssemblyVersions = Object.entries(runtimes).reduce((acc, [dll, versions]) => {
             // Take the version number (N.N.N.N) and remove the last element, in order for vulndb to understand anything.
             acc[dll] = versions.assemblyVersion.split('.').slice(0, -1).join('.');
             return acc;
         }, {});
+        // `dotnet publish` does not support multiple consecutive `--runtime` parameters, so there should really only
+        // be one. Thus, drop iterating more.
+        return;
     });
     if ((0, lodash_1.isEmpty)(runtimeAssemblyVersions)) {
         throw new errors.FileNotProcessableError('collection of runtime assembly versions was empty, that should not happen');
     }
     debug('finished extracting runtime assemblies from ' + filePath);
-    // FIXME: This has been done to make the future easier, as we probably soon will need to support multiple
-    //  RIDs. Currently, we are only looking at the first one.
-    return Object.values(runtimeAssemblyVersions)[0];
+    return runtimeAssemblyVersions;
 }
 exports.generateRuntimeAssemblies = generateRuntimeAssemblies;
 //# sourceMappingURL=runtime-assembly.js.map