snyk 1.1260.0 → 1.1261.0

package/dist/cli/245.index.js

@@ -226490,7 +226490,7 @@ exports.extractPkgsFromNpmLockV2 = extractPkgsFromNpmLockV2;
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.getChildNodeKey = exports.buildDepGraphNpmLockV2 = exports.parseNpmLockV2Project = exports.extractPkgsFromNpmLockV2 = void 0;
+exports.matchOverrideKey = exports.getChildNodeKey = exports.buildDepGraphNpmLockV2 = exports.parseNpmLockV2Project = exports.extractPkgsFromNpmLockV2 = void 0;
 const extract_npm_lock_v2_pkgs_1 = __webpack_require__(61253);
 Object.defineProperty(exports, "extractPkgsFromNpmLockV2", ({ enumerable: true, get: function () { return extract_npm_lock_v2_pkgs_1.extractPkgsFromNpmLockV2; } }));
 const dep_graph_1 = __webpack_require__(71479);
@@ -226577,9 +226577,16 @@ const dfsVisit = async (depGraphBuilder, node, visitedMap, npmLockPkgs, strictOu
     }
 };
 const getChildNode = (name, depInfo, pkgs, strictOutOfSync, includeDevDeps, includeOptionalDeps, ancestry, pkgKeysByName, overrides) => {
+    let version = depInfo.version;
     const override = overrides &&
-        checkOverrides([...ancestry, { name, version: depInfo.version }], overrides);
-    let childNodeKey = (0, exports.getChildNodeKey)(name, override ? override : depInfo.version, ancestry, pkgs, pkgKeysByName);
+        checkOverrides([...ancestry, { name, version }], overrides);
+    if (override) {
+        version = override;
+    }
+    if (version.startsWith('npm:')) {
+        version = version.split('@').pop() || version;
+    }
+    let childNodeKey = (0, exports.getChildNodeKey)(name, version, ancestry, pkgs, pkgKeysByName);
     if (!childNodeKey) {
         if (strictOutOfSync) {
             throw new errors_1.OutOfSyncError(`${name}@${depInfo.version}`, parsers_1.LockfileType.npm);
@@ -226726,7 +226733,7 @@ const checkOverrides = (ancestry, overrides) => {
     // First traverse into overrides from root down
     for (const [idx, pkg] of ancestryWithoutRoot.entries()) {
         // Do we have this in overrides
-        const override = overrides[pkg.name] || overrides[`${pkg.name}@${pkg.version}`];
+        const override = (0, exports.matchOverrideKey)(overrides, pkg);
         // If we dont find current element move down the ancestry
         if (!override) {
             continue;
@@ -226752,6 +226759,37 @@ const checkOverrides = (ancestry, overrides) => {
     }
     return;
 };
+// Here we have to match our pkg to
+// possible keys in the overrides object
+const matchOverrideKey = (overrides, pkg) => {
+    if (overrides[pkg.name]) {
+        return overrides[pkg.name];
+    }
+    const overrideKeysNameToVersions = Object.keys(overrides).reduce((acc, key) => {
+        // Split the key to separate the package name from the version spec
+        const atIndex = key.lastIndexOf('@');
+        const name = key.substring(0, atIndex);
+        const versionSpec = key.substring(atIndex + 1);
+        // Check if the package name already exists in the accumulator
+        if (!acc[name]) {
+            acc[name] = [];
+        }
+        // Add the version spec to the list of versions for this package name
+        acc[name].push(versionSpec);
+        return acc;
+    }, {});
+    const computedOverrides = overrideKeysNameToVersions[pkg.name];
+    if (computedOverrides) {
+        for (const versionSpec of computedOverrides) {
+            const isPkgVersionSubsetOfOverrideSpec = semver.subset(pkg.version, semver.validRange(versionSpec));
+            if (isPkgVersionSubsetOfOverrideSpec) {
+                return overrides[`${pkg.name}@${versionSpec}`];
+            }
+        }
+    }
+    return null;
+};
+exports.matchOverrideKey = matchOverrideKey;
 //# sourceMappingURL=index.js.map
 
 /***/ }),
@@ -237200,7 +237238,9 @@ async function buildDepGraphFromFiles(root, targetFile, manifestType, useProject
     if (!((_a = projectAssets.project) === null || _a === void 0 ? void 0 : _a.frameworks)) {
         throw new errors_1.FileNotProcessableError(`unable to detect any target framework in manifest file ${safeTargetFile}, a valid one is needed to continue down this path.`);
     }
-    const targetFrameworks = Object.keys(projectAssets.project.frameworks);
+    // Scan all 'frameworks' detected in the project.assets.json file, and use the targetAlias if detected and
+    // otherwise the raw key name, as it's not guaranteed that all framework objects contains a targetAlias.
+    const targetFrameworks = Object.entries(projectAssets.project.frameworks).map(([key, value]) => ('targetAlias' in value ? value.targetAlias : key));
     if (targetFrameworks.length <= 0) {
         throw new errors_1.FileNotProcessableError(`unable to detect a target framework in ${projectRootFolder}, a valid one is needed to continue down this path.`);
     }
@@ -237662,8 +237702,6 @@ function buildGraph(projectName, projectAssets, publishedProjectDeps, runtimeAss
         name: projectName,
         version: projectAssets.project.version,
     });
-    // That's what `dotnet` wants to call this project. Which is not always the same as what Snyk wants to call it.
-    const restoreProjectName = `${projectAssets.project.restore.projectName}/${projectAssets.project.version}`;
     // We publish to one RID and one only, so we can safely assume that the true dependencies will exist in this key.
     // E.g. targets -> .NETCoreApp,Version=v8.0/osx-arm64
     const runtimeTarget = publishedProjectDeps.runtimeTarget.name;
@@ -237674,26 +237712,22 @@ function buildGraph(projectName, projectAssets, publishedProjectDeps, runtimeAss
     if (!(runtimeTarget in publishedProjectDeps.targets)) {
         throw new errors_1.InvalidManifestError(`no ${runtimeTarget} found in targets object, cannot continue without it`);
     }
-    if (!(restoreProjectName in publishedProjectDeps.targets[runtimeTarget])) {
-        throw new errors_1.InvalidManifestError(`no ${restoreProjectName} found in ${runtimeTarget} object, cannot continue without it`);
-    }
-    const topLevelDependencies = Object.keys(publishedProjectDeps.targets[runtimeTarget][restoreProjectName]
-        .dependencies);
+    // What `dotnet` wants to call this project is not always the same as what Snyk wants to call it, and the version
+    // postfix is not the same as what's defined in `project.assets.json` due to NuGet version normalization, which is
+    // not applied during publish, only during restore. So we have to rely on the fact that the name is enough.
+    const restoreProjectName = Object.keys(publishedProjectDeps.targets[runtimeTarget]).find((f) => f.startsWith(projectAssets.project.restore.projectName));
+    if (!restoreProjectName) {
+        throw new errors_1.InvalidManifestError(`no project name containing ${projectAssets.project.restore.projectName} found in ${runtimeTarget} object, cannot continue without it`);
+    }
+    // Find names and versions of all dependencies of the root package. These are already structured correctly in
+    // the deps.json generated by `dotnet publish`.
+    const topLevelDepPackages = publishedProjectDeps.targets[runtimeTarget][restoreProjectName]
+        .dependencies;
     // Iterate over all the dependencies found in the target dependency list, and build the depGraph based off of that.
     const targetDependencies = Object.entries(publishedProjectDeps.targets[runtimeTarget]).reduce((acc, entry) => {
         const [nameWithVersion, pkg] = entry;
         return { ...acc, [nameWithVersion]: pkg };
     }, {});
-    const topLevelDepPackages = topLevelDependencies.reduce((acc, topLevelDepName) => {
-        const nameWithVersion = Object.keys(targetDependencies).find((targetDep) => 
-        // Lowercase the comparison, as .csproj <PackageReference>s are not case-sensitive, and can be written however you like.
-        targetDep.toLowerCase().startsWith(topLevelDepName.toLowerCase()));
-        if (!nameWithVersion) {
-            throw new errors_1.InvalidManifestError(`cant find a name and a version in assets file, something's very malformed`);
-        }
-        const [name, version] = nameWithVersion.split('/');
-        return { ...acc, [name]: version };
-    }, {});
     const rootNode = {
         type: 'root',
         dependencies: topLevelDepPackages,
@@ -238260,23 +238294,21 @@ function generateRuntimeAssemblies(deps) {
     if (!deps.targets) {
         throw new errors.FileNotProcessableError('could not find any targets in deps file');
     }
-    // Run through all TargetFrameworks, indexed for example
-    // .NETCoreApp,Version=v6.0/osx-arm64,
-    // .NETCoreApp,Version=v6.0/alpine-armv6
+    if (!(runtimeTargetName in deps.targets)) {
+        throw new errors.FileNotProcessableError(`could not locate ${runtimeTargetName} in list of targets, cannot continue`);
+    }
+    // Run through all runtimepacks in target, indexed for example as
+    // runtimepack.Microsoft.NETCore.App.Runtime.osx-arm64/7.0.14
+    // runtimepack.Microsoft.AspNetCore.App.Runtime.osx-arm64/7.0.14
     // ... etc.
     // See all: https://github.com/dotnet/runtime/blob/bd83e17052d3c09022bad1d91dca860ca6b27ab9/src/libraries/Microsoft.NETCore.Platforms/src/runtime.json
     let runtimeAssemblyVersions = {};
-    Object.entries(deps.targets).forEach(([target, dependencies]) => {
-        // Ignore target frameworks without dependencies, as they hold no dlls and thus no assembly versions to gauge.
-        if ((0, lodash_1.isEmpty)(dependencies)) {
-            return;
-        }
-        // Since we're running `dotnet publish` with `--use-current-runtime`, this should exist in the dependency list,
-        // but guard against it to ensure good user feedback in case we did something wrong.
-        const runtimePack = Object.keys(dependencies).find((dep) => dep.startsWith('runtimepack'));
-        if (!runtimePack) {
-            throw new errors.FileNotProcessableError(`could not find any runtimepack.* identifier in the ${target} dependency`);
-        }
+    const runtimePacks = Object.keys(deps.targets[runtimeTargetName]).filter((t) => t.startsWith('runtimepack'));
+    if (runtimePacks.length <= 0) {
+        throw new errors.FileNotProcessableError(`could not find any runtimepack.* identifiers in ${runtimeTargetName}, cannot continue`);
+    }
+    runtimePacks.forEach((runtimePack) => {
+        const dependencies = deps.targets[runtimeTargetName][runtimePack];
         // The runtimepack contains all the current RuntimeIdentifier (RID) assemblies which we are interested in.
         // Such as
         //   "runtimepack.Microsoft.NETCore.App.Runtime.osx-arm64/6.0.16": {
@@ -238285,10 +238317,10 @@ function generateRuntimeAssemblies(deps) {
         //          }
         //   }
         // We traverse all those and store them for the dependency graph build.
-        if (!('runtime' in dependencies[runtimePack])) {
+        if (!('runtime' in dependencies)) {
             throw new errors.FileNotProcessableError(`could not find any runtime list in the ${runtimePack} dependency`);
         }
-        const runtimes = dependencies[runtimePack]['runtime'];
+        const runtimes = dependencies['runtime'];
         // Dig down into the specific runtimepack which contains all the assembly versions of
         // the bundled DLLs for the given runtime, as:
         // "runtimepack.Microsoft.NETCore.App.Runtime.osx-arm64/6.0.16": {
@@ -238304,14 +238336,14 @@ function generateRuntimeAssemblies(deps) {
         //  (...)
         // We currently only address assemblyVersions. FileVersion might become relevant, depending
         // on how vulnerabilities are reported in the future.
-        runtimeAssemblyVersions = Object.entries(runtimes).reduce((acc, [dll, versions]) => {
-            // Take the version number (N.N.N.N) and remove the last element, in order for vulndb to understand anything.
-            acc[dll] = versions.assemblyVersion.split('.').slice(0, -1).join('.');
-            return acc;
-        }, {});
-        // `dotnet publish` does not support multiple consecutive `--runtime` parameters, so there should really only
-        // be one. Thus, drop iterating more.
-        return;
+        runtimeAssemblyVersions = {
+            ...runtimeAssemblyVersions,
+            ...Object.entries(runtimes).reduce((acc, [dll, versions]) => {
+                // Take the version number (N.N.N.N) and remove the last element, in order for vulndb to understand anything.
+                acc[dll] = versions.assemblyVersion.split('.').slice(0, -1).join('.');
+                return acc;
+            }, {}),
+        };
     });
     if ((0, lodash_1.isEmpty)(runtimeAssemblyVersions)) {
         throw new errors.FileNotProcessableError('collection of runtime assembly versions was empty, that should not happen');