snyk 1.1260.0 → 1.1262.0

package/dist/cli/245.index.js

@@ -226490,7 +226490,7 @@ exports.extractPkgsFromNpmLockV2 = extractPkgsFromNpmLockV2;
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.getChildNodeKey = exports.buildDepGraphNpmLockV2 = exports.parseNpmLockV2Project = exports.extractPkgsFromNpmLockV2 = void 0;
+exports.matchOverrideKey = exports.getChildNodeKey = exports.buildDepGraphNpmLockV2 = exports.parseNpmLockV2Project = exports.extractPkgsFromNpmLockV2 = void 0;
 const extract_npm_lock_v2_pkgs_1 = __webpack_require__(61253);
 Object.defineProperty(exports, "extractPkgsFromNpmLockV2", ({ enumerable: true, get: function () { return extract_npm_lock_v2_pkgs_1.extractPkgsFromNpmLockV2; } }));
 const dep_graph_1 = __webpack_require__(71479);
@@ -226577,9 +226577,16 @@ const dfsVisit = async (depGraphBuilder, node, visitedMap, npmLockPkgs, strictOu
     }
 };
 const getChildNode = (name, depInfo, pkgs, strictOutOfSync, includeDevDeps, includeOptionalDeps, ancestry, pkgKeysByName, overrides) => {
+    let version = depInfo.version;
     const override = overrides &&
-        checkOverrides([...ancestry, { name, version: depInfo.version }], overrides);
-    let childNodeKey = (0, exports.getChildNodeKey)(name, override ? override : depInfo.version, ancestry, pkgs, pkgKeysByName);
+        checkOverrides([...ancestry, { name, version }], overrides);
+    if (override) {
+        version = override;
+    }
+    if (version.startsWith('npm:')) {
+        version = version.split('@').pop() || version;
+    }
+    let childNodeKey = (0, exports.getChildNodeKey)(name, version, ancestry, pkgs, pkgKeysByName);
     if (!childNodeKey) {
         if (strictOutOfSync) {
             throw new errors_1.OutOfSyncError(`${name}@${depInfo.version}`, parsers_1.LockfileType.npm);
@@ -226726,7 +226733,7 @@ const checkOverrides = (ancestry, overrides) => {
     // First traverse into overrides from root down
     for (const [idx, pkg] of ancestryWithoutRoot.entries()) {
         // Do we have this in overrides
-        const override = overrides[pkg.name] || overrides[`${pkg.name}@${pkg.version}`];
+        const override = (0, exports.matchOverrideKey)(overrides, pkg);
         // If we dont find current element move down the ancestry
         if (!override) {
             continue;
@@ -226752,6 +226759,37 @@ const checkOverrides = (ancestry, overrides) => {
     }
     return;
 };
+// Here we have to match our pkg to
+// possible keys in the overrides object
+const matchOverrideKey = (overrides, pkg) => {
+    if (overrides[pkg.name]) {
+        return overrides[pkg.name];
+    }
+    const overrideKeysNameToVersions = Object.keys(overrides).reduce((acc, key) => {
+        // Split the key to separate the package name from the version spec
+        const atIndex = key.lastIndexOf('@');
+        const name = key.substring(0, atIndex);
+        const versionSpec = key.substring(atIndex + 1);
+        // Check if the package name already exists in the accumulator
+        if (!acc[name]) {
+            acc[name] = [];
+        }
+        // Add the version spec to the list of versions for this package name
+        acc[name].push(versionSpec);
+        return acc;
+    }, {});
+    const computedOverrides = overrideKeysNameToVersions[pkg.name];
+    if (computedOverrides) {
+        for (const versionSpec of computedOverrides) {
+            const isPkgVersionSubsetOfOverrideSpec = semver.subset(pkg.version, semver.validRange(versionSpec));
+            if (isPkgVersionSubsetOfOverrideSpec) {
+                return overrides[`${pkg.name}@${versionSpec}`];
+            }
+        }
+    }
+    return null;
+};
+exports.matchOverrideKey = matchOverrideKey;
 //# sourceMappingURL=index.js.map
 
 /***/ }),
@@ -237086,7 +237124,7 @@ exports.generate = generate;
 
 /***/ }),
 
-/***/ 86139:
+/***/ 93935:
 /***/ ((__unused_webpack_module, exports) => {
 
 "use strict";
@@ -237200,7 +237238,9 @@ async function buildDepGraphFromFiles(root, targetFile, manifestType, useProject
     if (!((_a = projectAssets.project) === null || _a === void 0 ? void 0 : _a.frameworks)) {
         throw new errors_1.FileNotProcessableError(`unable to detect any target framework in manifest file ${safeTargetFile}, a valid one is needed to continue down this path.`);
     }
-    const targetFrameworks = Object.keys(projectAssets.project.frameworks);
+    // Scan all 'frameworks' detected in the project.assets.json file, and use the targetAlias if detected and
+    // otherwise the raw key name, as it's not guaranteed that all framework objects contains a targetAlias.
+    const targetFrameworks = Object.entries(projectAssets.project.frameworks).map(([key, value]) => ('targetAlias' in value ? value.targetAlias : key));
     if (targetFrameworks.length <= 0) {
         throw new errors_1.FileNotProcessableError(`unable to detect a target framework in ${projectRootFolder}, a valid one is needed to continue down this path.`);
     }
@@ -237340,7 +237380,7 @@ const fs = __webpack_require__(57147);
 const path = __webpack_require__(71017);
 const parseXML = __webpack_require__(5055);
 const debugModule = __webpack_require__(15158);
-const framework_1 = __webpack_require__(86139);
+const framework_1 = __webpack_require__(93935);
 const debug = debugModule('snyk');
 function findFile(rootDir, filter) {
     if (!fs.existsSync(rootDir)) {
@@ -237662,8 +237702,6 @@ function buildGraph(projectName, projectAssets, publishedProjectDeps, runtimeAss
         name: projectName,
         version: projectAssets.project.version,
     });
-    // That's what `dotnet` wants to call this project. Which is not always the same as what Snyk wants to call it.
-    const restoreProjectName = `${projectAssets.project.restore.projectName}/${projectAssets.project.version}`;
     // We publish to one RID and one only, so we can safely assume that the true dependencies will exist in this key.
     // E.g. targets -> .NETCoreApp,Version=v8.0/osx-arm64
     const runtimeTarget = publishedProjectDeps.runtimeTarget.name;
@@ -237674,26 +237712,22 @@ function buildGraph(projectName, projectAssets, publishedProjectDeps, runtimeAss
     if (!(runtimeTarget in publishedProjectDeps.targets)) {
         throw new errors_1.InvalidManifestError(`no ${runtimeTarget} found in targets object, cannot continue without it`);
     }
-    if (!(restoreProjectName in publishedProjectDeps.targets[runtimeTarget])) {
-        throw new errors_1.InvalidManifestError(`no ${restoreProjectName} found in ${runtimeTarget} object, cannot continue without it`);
-    }
-    const topLevelDependencies = Object.keys(publishedProjectDeps.targets[runtimeTarget][restoreProjectName]
-        .dependencies);
+    // What `dotnet` wants to call this project is not always the same as what Snyk wants to call it, and the version
+    // postfix is not the same as what's defined in `project.assets.json` due to NuGet version normalization, which is
+    // not applied during publish, only during restore. So we have to rely on the fact that the name is enough.
+    const restoreProjectName = Object.keys(publishedProjectDeps.targets[runtimeTarget]).find((f) => f.startsWith(projectAssets.project.restore.projectName));
+    if (!restoreProjectName) {
+        throw new errors_1.InvalidManifestError(`no project name containing ${projectAssets.project.restore.projectName} found in ${runtimeTarget} object, cannot continue without it`);
+    }
+    // Find names and versions of all dependencies of the root package. These are already structured correctly in
+    // the deps.json generated by `dotnet publish`.
+    const topLevelDepPackages = publishedProjectDeps.targets[runtimeTarget][restoreProjectName]
+        .dependencies;
     // Iterate over all the dependencies found in the target dependency list, and build the depGraph based off of that.
     const targetDependencies = Object.entries(publishedProjectDeps.targets[runtimeTarget]).reduce((acc, entry) => {
         const [nameWithVersion, pkg] = entry;
         return { ...acc, [nameWithVersion]: pkg };
     }, {});
-    const topLevelDepPackages = topLevelDependencies.reduce((acc, topLevelDepName) => {
-        const nameWithVersion = Object.keys(targetDependencies).find((targetDep) => 
-        // Lowercase the comparison, as .csproj <PackageReference>s are not case-sensitive, and can be written however you like.
-        targetDep.toLowerCase().startsWith(topLevelDepName.toLowerCase()));
-        if (!nameWithVersion) {
-            throw new errors_1.InvalidManifestError(`cant find a name and a version in assets file, something's very malformed`);
-        }
-        const [name, version] = nameWithVersion.split('/');
-        return { ...acc, [name]: version };
-    }, {});
     const rootNode = {
         type: 'root',
         dependencies: topLevelDepPackages,
@@ -238106,7 +238140,7 @@ exports.getMinimumTargetFramework = exports.parse = exports.fromPackagesConfigEn
 const parseXML = __webpack_require__(5055);
 const debugModule = __webpack_require__(15158);
 const depsParser = __webpack_require__(91885);
-const framework_1 = __webpack_require__(86139);
+const framework_1 = __webpack_require__(93935);
 const debug = debugModule('snyk');
 function fromPackagesConfigEntry(manifest) {
     debug('Extracting by packages.config entry:' +
@@ -238260,23 +238294,21 @@ function generateRuntimeAssemblies(deps) {
     if (!deps.targets) {
         throw new errors.FileNotProcessableError('could not find any targets in deps file');
     }
-    // Run through all TargetFrameworks, indexed for example
-    // .NETCoreApp,Version=v6.0/osx-arm64,
-    // .NETCoreApp,Version=v6.0/alpine-armv6
+    if (!(runtimeTargetName in deps.targets)) {
+        throw new errors.FileNotProcessableError(`could not locate ${runtimeTargetName} in list of targets, cannot continue`);
+    }
+    // Run through all runtimepacks in target, indexed for example as
+    // runtimepack.Microsoft.NETCore.App.Runtime.osx-arm64/7.0.14
+    // runtimepack.Microsoft.AspNetCore.App.Runtime.osx-arm64/7.0.14
     // ... etc.
     // See all: https://github.com/dotnet/runtime/blob/bd83e17052d3c09022bad1d91dca860ca6b27ab9/src/libraries/Microsoft.NETCore.Platforms/src/runtime.json
     let runtimeAssemblyVersions = {};
-    Object.entries(deps.targets).forEach(([target, dependencies]) => {
-        // Ignore target frameworks without dependencies, as they hold no dlls and thus no assembly versions to gauge.
-        if ((0, lodash_1.isEmpty)(dependencies)) {
-            return;
-        }
-        // Since we're running `dotnet publish` with `--use-current-runtime`, this should exist in the dependency list,
-        // but guard against it to ensure good user feedback in case we did something wrong.
-        const runtimePack = Object.keys(dependencies).find((dep) => dep.startsWith('runtimepack'));
-        if (!runtimePack) {
-            throw new errors.FileNotProcessableError(`could not find any runtimepack.* identifier in the ${target} dependency`);
-        }
+    const runtimePacks = Object.keys(deps.targets[runtimeTargetName]).filter((t) => t.startsWith('runtimepack'));
+    if (runtimePacks.length <= 0) {
+        throw new errors.FileNotProcessableError(`could not find any runtimepack.* identifiers in ${runtimeTargetName}, cannot continue`);
+    }
+    runtimePacks.forEach((runtimePack) => {
+        const dependencies = deps.targets[runtimeTargetName][runtimePack];
         // The runtimepack contains all the current RuntimeIdentifier (RID) assemblies which we are interested in.
         // Such as
         //   "runtimepack.Microsoft.NETCore.App.Runtime.osx-arm64/6.0.16": {
@@ -238285,10 +238317,10 @@ function generateRuntimeAssemblies(deps) {
         //          }
         //   }
         // We traverse all those and store them for the dependency graph build.
-        if (!('runtime' in dependencies[runtimePack])) {
+        if (!('runtime' in dependencies)) {
             throw new errors.FileNotProcessableError(`could not find any runtime list in the ${runtimePack} dependency`);
         }
-        const runtimes = dependencies[runtimePack]['runtime'];
+        const runtimes = dependencies['runtime'];
         // Dig down into the specific runtimepack which contains all the assembly versions of
         // the bundled DLLs for the given runtime, as:
         // "runtimepack.Microsoft.NETCore.App.Runtime.osx-arm64/6.0.16": {
@@ -238304,14 +238336,14 @@ function generateRuntimeAssemblies(deps) {
         //  (...)
         // We currently only address assemblyVersions. FileVersion might become relevant, depending
         // on how vulnerabilities are reported in the future.
-        runtimeAssemblyVersions = Object.entries(runtimes).reduce((acc, [dll, versions]) => {
-            // Take the version number (N.N.N.N) and remove the last element, in order for vulndb to understand anything.
-            acc[dll] = versions.assemblyVersion.split('.').slice(0, -1).join('.');
-            return acc;
-        }, {});
-        // `dotnet publish` does not support multiple consecutive `--runtime` parameters, so there should really only
-        // be one. Thus, drop iterating more.
-        return;
+        runtimeAssemblyVersions = {
+            ...runtimeAssemblyVersions,
+            ...Object.entries(runtimes).reduce((acc, [dll, versions]) => {
+                // Take the version number (N.N.N.N) and remove the last element, in order for vulndb to understand anything.
+                acc[dll] = versions.assemblyVersion.split('.').slice(0, -1).join('.');
+                return acc;
+            }, {}),
+        };
     });
     if ((0, lodash_1.isEmpty)(runtimeAssemblyVersions)) {
         throw new errors.FileNotProcessableError('collection of runtime assembly versions was empty, that should not happen');
@@ -239270,12 +239302,19 @@ exports.buildDepGraph = buildDepGraph;
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.LockFileNotValid = exports.packageSpecsFrom = void 0;
+exports.packageSpecsFrom = void 0;
 const toml = __webpack_require__(5022);
+const error_catalog_nodejs_public_1 = __webpack_require__(88404);
 function packageSpecsFrom(lockFileContents) {
-    const lockFile = toml.parse(lockFileContents);
+    let lockFile;
+    try {
+        lockFile = toml.parse(lockFileContents);
+    }
+    catch (error) {
+        throw new error_catalog_nodejs_public_1.OpenSourceEcosystems.UnparseableLockFileError('The poetry.lock file is not parsable.', { error });
+    }
     if (!lockFile.package) {
-        throw new LockFileNotValid();
+        throw new error_catalog_nodejs_public_1.OpenSourceEcosystems.UnparseableLockFileError('The poetry.lock file contains no package stanza.');
     }
     return lockFile.package.map((pkg) => {
         return {
@@ -239286,13 +239325,6 @@ function packageSpecsFrom(lockFileContents) {
     });
 }
 exports.packageSpecsFrom = packageSpecsFrom;
-class LockFileNotValid extends Error {
-    constructor() {
-        super("The poetry.lock file contains no package stanza'");
-        this.name = 'LockFileNotValid';
-    }
-}
-exports.LockFileNotValid = LockFileNotValid;
 //# sourceMappingURL=lock-file-parser.js.map
 
 /***/ }),
@@ -239303,8 +239335,9 @@ exports.LockFileNotValid = LockFileNotValid;
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.ManifestFileNotValid = exports.getDependenciesFrom = exports.pkgInfoFrom = void 0;
+exports.getDependenciesFrom = exports.pkgInfoFrom = void 0;
 const toml = __webpack_require__(5022);
+const error_catalog_nodejs_public_1 = __webpack_require__(88404);
 function pkgInfoFrom(manifestFileContents) {
     let manifest;
     try {
@@ -239314,16 +239347,22 @@ function pkgInfoFrom(manifestFileContents) {
             version: manifest.tool.poetry.version,
         };
     }
-    catch (_a) {
-        throw new ManifestFileNotValid();
+    catch (error) {
+        throw new error_catalog_nodejs_public_1.OpenSourceEcosystems.UnparseableManifestError('The pyproject.toml file is not parsable.', { error });
     }
 }
 exports.pkgInfoFrom = pkgInfoFrom;
 function getDependenciesFrom(manifestFileContents, includeDevDependencies) {
     var _a;
-    const manifest = toml.parse(manifestFileContents);
+    let manifest;
+    try {
+        manifest = toml.parse(manifestFileContents);
+    }
+    catch (error) {
+        throw new error_catalog_nodejs_public_1.OpenSourceEcosystems.UnparseableManifestError('The pyproject.toml file is not parsable.', { error });
+    }
     if (!((_a = manifest.tool) === null || _a === void 0 ? void 0 : _a.poetry)) {
-        throw new ManifestFileNotValid();
+        throw new error_catalog_nodejs_public_1.OpenSourceEcosystems.UnparseableManifestError('The pyproject.toml is not a valid poetry file.');
     }
     const dependencies = dependenciesFrom(manifest).map((dep) => ({
         name: dep,
@@ -239361,13 +239400,6 @@ function devDependenciesFrom(manifest) {
 function dependenciesFrom(manifest) {
     return Object.keys(manifest.tool.poetry.dependencies || []);
 }
-class ManifestFileNotValid extends Error {
-    constructor() {
-        super('pyproject.toml is not a valid poetry file.');
-        this.name = 'ManifestFileNotValid';
-    }
-}
-exports.ManifestFileNotValid = ManifestFileNotValid;
 //# sourceMappingURL=manifest-parser.js.map
 
 /***/ }),
@@ -239551,6 +239583,8 @@ const subProcess = __webpack_require__(9783);
 const build_dep_graph_1 = __webpack_require__(41669);
 const types_1 = __webpack_require__(62914);
 const errors_1 = __webpack_require__(99893);
+const PYTHON_3_12_REGEX = new RegExp('^Python 3.12.*');
+const UPDATED_SETUPTOOLS_VERSION = '68.0.0';
 const returnedTargetFile = (originalTargetFile) => {
     const basename = path.basename(originalTargetFile);
     switch (basename) {
@@ -239632,6 +239666,7 @@ function createAssets() {
         path.join(__dirname, '../../pysrc/pkg_resources_py3/_vendor/pyparsing.py'),
         path.join(__dirname, '../../pysrc/pkg_resources_py3/__init__.py'),
         path.join(__dirname, '../../pysrc/pkg_resources_py3/extern/__init__.py'),
+        path.join(__dirname, '../../pysrc/pkg_resources_py3_12/__init__.py'),
     ];
 }
 function writeFile(writeFilePath, contents) {
@@ -239662,6 +239697,24 @@ function dumpAllFilesInTempDir(tempDirName) {
         writeFile(writeFilePath, contents);
     });
 }
+function updateSetuptools(setuptoolsVersion, dir, pythonEnv) {
+    return tslib_1.__awaiter(this, void 0, void 0, function* () {
+        // For python 3.12, setuptools needs to be updated
+        // due to removal of some deprecated packages
+        // see: https://github.com/pypa/pip/pull/11997
+        const pythonVersion = yield subProcess.execute(`python`, ['--version'], {
+            cwd: dir,
+            env: pythonEnv,
+        });
+        if (!PYTHON_3_12_REGEX.test(pythonVersion)) {
+            return;
+        }
+        yield subProcess.execute(`pip install setuptools==${setuptoolsVersion}`, [], {
+            cwd: dir,
+            env: pythonEnv,
+        });
+    });
+}
 function inspectInstalledDeps(command, baseargs, root, targetFile, allowMissing, includeDevDeps, allowEmpty, args, projectName) {
     return tslib_1.__awaiter(this, void 0, void 0, function* () {
         const tempDirObj = tmp.dirSync({
@@ -239670,6 +239723,7 @@ function inspectInstalledDeps(command, baseargs, root, targetFile, allowMissing,
         dumpAllFilesInTempDir(tempDirObj.name);
         try {
             const pythonEnv = getPythonEnv(targetFile);
+            yield updateSetuptools(UPDATED_SETUPTOOLS_VERSION, root, pythonEnv);
             // See ../../pysrc/README.md
             const output = yield subProcess.execute(command, [
                 ...baseargs,
@@ -293298,7 +293352,7 @@ exports.CompositeError = CompositeError;
  */
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-const tslib_1 = __webpack_require__(1212);
+const tslib_1 = __webpack_require__(86139);
 tslib_1.__exportStar(__webpack_require__(83649), exports);
 tslib_1.__exportStar(__webpack_require__(68218), exports);
 tslib_1.__exportStar(__webpack_require__(60826), exports);
@@ -293484,7 +293538,7 @@ exports.JsonApi = JsonApi;
  */
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-const tslib_1 = __webpack_require__(1212);
+const tslib_1 = __webpack_require__(86139);
 tslib_1.__exportStar(__webpack_require__(40697), exports);
 //# sourceMappingURL=index.js.map
 
@@ -302410,7 +302464,7 @@ module.exports = __webpack_require__(93419).YAML
 
 /***/ }),
 
-/***/ 1212:
+/***/ 86139:
 /***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
 
 "use strict";