snyk 1.1278.0 → 1.1279.0

package/dist/cli/245.index.js

@@ -35940,6 +35940,343 @@ exports.execute = execute;
 
 /***/ }),
 
+/***/ 13173:
+/***/ ((__unused_webpack_module, exports, __webpack_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.isDigest = exports.validateDigest = void 0;
+const regexp_1 = __webpack_require__(69292);
+class InvalidDigestFormatError extends Error {
+    constructor() {
+        super('invalid digest format');
+        this.name = 'InvalidDigestFormatError';
+    }
+}
+class UnsupportedAlgorithmError extends Error {
+    constructor() {
+        super('unsupported digest algorithm');
+        this.name = 'UnsupportedAlgorithmError';
+    }
+}
+class InvalidDigestLengthError extends Error {
+    constructor() {
+        super('invalid checksum digest length');
+        this.name = 'InvalidDigestLengthError';
+    }
+}
+const algorithmsSizes = {
+    sha256: 32,
+    sha384: 48,
+    sha512: 64,
+};
+function checkDigest(digest, handleError) {
+    const indexOfColon = digest.indexOf(':');
+    if (indexOfColon < 0 ||
+        indexOfColon + 1 === digest.length ||
+        !regexp_1.anchoredDigestRegexp.test(digest)) {
+        return handleError(InvalidDigestFormatError);
+    }
+    const algorithm = digest.substring(0, indexOfColon);
+    if (!Object.hasOwnProperty.call(algorithmsSizes, algorithm)) {
+        return handleError(UnsupportedAlgorithmError);
+    }
+    if (algorithmsSizes[algorithm] * 2 !== (digest.length - indexOfColon - 1)) {
+        return handleError(InvalidDigestLengthError);
+    }
+    return true;
+}
+const validateDigest = (digest) => {
+    checkDigest(digest, (ErrorType) => {
+        throw new ErrorType();
+    });
+};
+exports.validateDigest = validateDigest;
+const isDigest = (digest) => {
+    return checkDigest(digest, () => false);
+};
+exports.isDigest = isDigest;
+//# sourceMappingURL=digest.js.map
+
+/***/ }),
+
+/***/ 3687:
+/***/ ((__unused_webpack_module, exports, __webpack_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.parseAll = exports.parseFamiliarName = exports.parseQualifiedNameOptimized = exports.parseQualifiedName = exports.Reference = void 0;
+const reference_1 = __webpack_require__(12792);
+Object.defineProperty(exports, "Reference", ({ enumerable: true, get: function () { return reference_1.Reference; } }));
+const parsers_1 = __webpack_require__(57094);
+Object.defineProperty(exports, "parseAll", ({ enumerable: true, get: function () { return parsers_1.parseAll; } }));
+Object.defineProperty(exports, "parseFamiliarName", ({ enumerable: true, get: function () { return parsers_1.parseFamiliarName; } }));
+Object.defineProperty(exports, "parseQualifiedName", ({ enumerable: true, get: function () { return parsers_1.parseQualifiedName; } }));
+Object.defineProperty(exports, "parseQualifiedNameOptimized", ({ enumerable: true, get: function () { return parsers_1.parseQualifiedNameOptimized; } }));
+//# sourceMappingURL=index.js.map
+
+/***/ }),
+
+/***/ 57094:
+/***/ ((__unused_webpack_module, exports, __webpack_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.parseAll = exports.parseFamiliarName = exports.parseQualifiedName = exports.parseQualifiedNameOptimized = void 0;
+const regexp_1 = __webpack_require__(69292);
+const digest_1 = __webpack_require__(13173);
+const reference_1 = __webpack_require__(12792);
+const NAME_MAX_LENGTH = 255;
+class InvalidReferenceFormatError extends Error {
+    constructor() {
+        super("invalid reference format");
+        this.name = "InvalidReferenceFormatError";
+    }
+}
+class NameContainsUppercaseError extends Error {
+    constructor() {
+        super("repository name must be lowercase");
+        this.name = "NameContainsUppercaseError";
+    }
+}
+class EmptyNameError extends Error {
+    constructor() {
+        super("repository name must have at least one component");
+        this.name = "EmptyNameError";
+    }
+}
+class NameTooLongError extends Error {
+    constructor() {
+        super(`repository name must not be more than ${NAME_MAX_LENGTH} characters`);
+        this.name = "NameTooLongError";
+    }
+}
+const DEFAULT_DOMAIN = "docker.io";
+const LEGACY_DEFAULT_DOMAIN = "index.docker.io";
+const OFFICIAL_REPOSITORY_NAME = "library";
+function _parseQualifiedName(regexp, name) {
+    const matches = regexp.exec(name);
+    if (!matches) {
+        if (name === "") {
+            throw new EmptyNameError();
+        }
+        if (regexp.test(name.toLowerCase())) {
+            throw new NameContainsUppercaseError();
+        }
+        throw new InvalidReferenceFormatError();
+    }
+    if (matches[1].length > NAME_MAX_LENGTH) {
+        throw new NameTooLongError();
+    }
+    let reference;
+    const nameMatch = regexp_1.anchoredNameRegexp.exec(matches[1]);
+    if (nameMatch && nameMatch.length === 3) {
+        reference = {
+            domain: nameMatch[1],
+            repository: nameMatch[2],
+        };
+    }
+    else {
+        reference = {
+            domain: "",
+            repository: matches[1],
+        };
+    }
+    reference.tag = matches[2];
+    if (matches[3]) {
+        (0, digest_1.validateDigest)(matches[3]);
+        reference.digest = matches[3];
+    }
+    return new reference_1.Reference(reference);
+}
+const parseQualifiedNameOptimized = (name) => {
+    return _parseQualifiedName(new RegExp(regexp_1.referenceRegexp), name);
+};
+exports.parseQualifiedNameOptimized = parseQualifiedNameOptimized;
+const parseQualifiedName = (name) => {
+    return _parseQualifiedName(regexp_1.referenceRegexp, name);
+};
+exports.parseQualifiedName = parseQualifiedName;
+function splitDockerDomain(name) {
+    let domain;
+    let reminder;
+    const indexOfSlash = name.indexOf("/");
+    if (indexOfSlash === -1 ||
+        !(name.lastIndexOf(".", indexOfSlash) !== -1 ||
+            name.lastIndexOf(":", indexOfSlash) !== -1 ||
+            name.startsWith("localhost/"))) {
+        domain = DEFAULT_DOMAIN;
+        reminder = name;
+    }
+    else {
+        domain = name.substring(0, indexOfSlash);
+        reminder = name.substring(indexOfSlash + 1);
+    }
+    if (domain === LEGACY_DEFAULT_DOMAIN) {
+        domain = DEFAULT_DOMAIN;
+    }
+    if (domain === DEFAULT_DOMAIN && !reminder.includes("/")) {
+        reminder = `${OFFICIAL_REPOSITORY_NAME}/${reminder}`;
+    }
+    return [domain, reminder];
+}
+const parseFamiliarName = (name, parseQualifiedNameFunc) => {
+    if (regexp_1.anchoredIdentifierRegexp.test(name)) {
+        throw new TypeError(`invalid repository name (${name}),` +
+            `cannot specify 64-byte hexadecimal strings`);
+    }
+    const [domain, remainder] = splitDockerDomain(name);
+    let remoteName;
+    const tagSeparatorIndex = remainder.indexOf(":");
+    if (tagSeparatorIndex > -1) {
+        remoteName = remainder.substring(0, tagSeparatorIndex);
+    }
+    else {
+        remoteName = remainder;
+    }
+    if (remoteName.toLowerCase() !== remoteName) {
+        throw new TypeError(`invalid reference format: repository name must be lowercase`);
+    }
+    if (parseQualifiedNameFunc) {
+        return parseQualifiedNameFunc(`${domain}/${remainder}`);
+    }
+    return parseQualifiedName(`${domain}/${remainder}`);
+};
+exports.parseFamiliarName = parseFamiliarName;
+const parseAll = (name) => {
+    if (regexp_1.anchoredIdentifierRegexp.test(name)) {
+        return new reference_1.Reference({ digest: `sha256:${name}` });
+    }
+    if ((0, digest_1.isDigest)(name)) {
+        return new reference_1.Reference({ digest: name });
+    }
+    return parseFamiliarName(name);
+};
+exports.parseAll = parseAll;
+//# sourceMappingURL=parsers.js.map
+
+/***/ }),
+
+/***/ 12792:
+/***/ ((__unused_webpack_module, exports) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.Reference = void 0;
+const typesTemplates = {
+    'digest': (ref) => `${ref.digest}`,
+    'canonical': (ref) => `${ref.repositoryUrl}@${ref.digest}`,
+    'repository': (ref) => `${ref.repositoryUrl}`,
+    'tagged': (ref) => `${ref.repositoryUrl}:${ref.tag}`,
+    'dual': (ref) => `${ref.repositoryUrl}:${ref.tag}@${ref.digest}`
+};
+class Reference {
+    get tag() {
+        return this._tag;
+    }
+    get digest() {
+        return this._digest;
+    }
+    get repository() {
+        return this._repository;
+    }
+    get domain() {
+        return this._domain;
+    }
+    get type() {
+        return this._type;
+    }
+    constructor(options) {
+        var _a, _b, _c, _d, _e, _f;
+        if (!options.repository && !options.domain) {
+            if (options.digest) {
+                this._digest = options.digest;
+                this._type = 'digest';
+            }
+            else {
+                throw new TypeError('Empty Reference');
+            }
+        }
+        else if (!options.tag) {
+            this._domain = (_a = options.domain) !== null && _a !== void 0 ? _a : '';
+            this._repository = (_b = options.repository) !== null && _b !== void 0 ? _b : '';
+            if (options.digest) {
+                this._digest = options.digest;
+                this._type = 'canonical';
+            }
+            else {
+                this._type = 'repository';
+            }
+        }
+        else if (!options.digest) {
+            this._domain = (_c = options.domain) !== null && _c !== void 0 ? _c : '';
+            this._repository = (_d = options.repository) !== null && _d !== void 0 ? _d : '';
+            this._tag = options.tag;
+            this._type = 'tagged';
+        }
+        else {
+            this._domain = (_e = options.domain) !== null && _e !== void 0 ? _e : '';
+            this._repository = (_f = options.repository) !== null && _f !== void 0 ? _f : '';
+            this._tag = options.tag;
+            this._digest = options.digest;
+            this._type = 'dual';
+        }
+    }
+    toString() {
+        return typesTemplates[this._type](this);
+    }
+    get repositoryUrl() {
+        if (this._domain && this._repository) {
+            return `${this._domain}/${this._repository}`;
+        }
+        return '';
+    }
+}
+exports.Reference = Reference;
+//# sourceMappingURL=reference.js.map
+
+/***/ }),
+
+/***/ 69292:
+/***/ ((__unused_webpack_module, exports) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.anchoredIdentifierRegexp = exports.anchoredDigestRegexp = exports.anchoredNameRegexp = exports.referenceRegexp = void 0;
+const expression = (...regexps) => new RegExp(regexps
+    .map(re => re.source)
+    .join(''));
+const group = (...regexps) => new RegExp(`(?:${expression(...regexps).source})`);
+const optional = (...regexps) => new RegExp(`${group(...regexps).source}?`);
+const repeated = (...regexps) => new RegExp(`${group(...regexps).source}+`);
+const anchored = (...regexps) => new RegExp(`^${expression(...regexps).source}$`);
+const capture = (...regexps) => new RegExp(`(${expression(...regexps).source})`);
+const alphaNumericRegexp = /[a-z0-9]+/;
+const separatorRegexp = /(?:[._]|__|[-]*)/;
+const nameComponentRegexp = expression(alphaNumericRegexp, optional(repeated(separatorRegexp, alphaNumericRegexp)));
+const domainComponentRegexp = /(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9])/;
+const domainRegexp = expression(domainComponentRegexp, optional(repeated(/\./, domainComponentRegexp)), optional(/:/, /[0-9]+/));
+const tagRegexp = /[\w][\w.-]{0,127}/;
+const digestRegexp = /[a-zA-Z][a-zA-Z0-9]*(?:[-_+.][a-zA-Z][a-zA-Z0-9]*)*[:][a-fA-F0-9]{32,}/;
+const anchoredDigestRegexp = anchored(digestRegexp);
+exports.anchoredDigestRegexp = anchoredDigestRegexp;
+const nameRegexp = expression(optional(domainRegexp, /\//), nameComponentRegexp, optional(repeated(/\//, nameComponentRegexp)));
+const anchoredNameRegexp = anchored(optional(capture(domainRegexp), /\//), capture(nameComponentRegexp, optional(repeated(/\//, nameComponentRegexp))));
+exports.anchoredNameRegexp = anchoredNameRegexp;
+const referenceRegexp = anchored(capture(nameRegexp), optional(/:/, capture(tagRegexp)), optional(/@/, capture(digestRegexp)));
+exports.referenceRegexp = referenceRegexp;
+const identifierRegexp = /[a-f0-9]{64}/;
+const anchoredIdentifierRegexp = anchored(identifierRegexp);
+exports.anchoredIdentifierRegexp = anchoredIdentifierRegexp;
+//# sourceMappingURL=regexp.js.map
+
+/***/ }),
+
 /***/ 60081:
 /***/ ((module, exports, __webpack_require__) => {
 
@@ -189443,6 +189780,13 @@ function extractHostnameFromTargetImage(targetImage) {
     if (!isImagePartOfURL(targetImage)) {
         return { hostname: defaultHostname, remainder: targetImage };
     }
+    const dockerFriendlyRegistryHostname = "docker.io/";
+    if (targetImage.startsWith(dockerFriendlyRegistryHostname)) {
+        return {
+            hostname: defaultHostname,
+            remainder: targetImage.substring(dockerFriendlyRegistryHostname.length),
+        };
+    }
     const i = targetImage.indexOf("/");
     return {
         hostname: targetImage.substring(0, i),
@@ -191806,6 +192150,72 @@ function isMainIndexFile(name) {
 
 /***/ }),
 
+/***/ 19103:
+/***/ ((__unused_webpack_module, exports, __webpack_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.constructOCIDisributionMetadata = void 0;
+const docker_reference_1 = __webpack_require__(3687);
+function constructOCIDisributionMetadata({ imageName, manifestDigest, indexDigest, }) {
+    try {
+        const ref = (0, docker_reference_1.parseAll)(imageName);
+        if (!ref.domain || !ref.repository) {
+            return;
+        }
+        const metadata = {
+            registryHost: ref.domain,
+            repository: ref.repository,
+            manifestDigest,
+            indexDigest,
+            imageTag: ref.tag,
+        };
+        if (!ociDistributionMetadataIsValid(metadata)) {
+            return;
+        }
+        return metadata;
+    }
+    catch (_a) {
+        return;
+    }
+}
+exports.constructOCIDisributionMetadata = constructOCIDisributionMetadata;
+function ociDistributionMetadataIsValid(data) {
+    // 255 byte limit is enforced by RFC 1035.
+    if (Buffer.byteLength(data.registryHost) > 255) {
+        return false;
+    }
+    // 2048 byte limit is enforced by Snyk for platform stability.
+    // Longer strings may be valid, but nothing close to this limit has been observed by Snyk at time of writing.
+    if (Buffer.byteLength(data.repository) > 2048 ||
+        !repositoryNameIsValid(data.repository)) {
+        return false;
+    }
+    if (!digestIsValid(data.manifestDigest)) {
+        return false;
+    }
+    if (data.indexDigest && !digestIsValid(data.indexDigest)) {
+        return false;
+    }
+    if (data.imageTag && !tagIsValid(data.imageTag)) {
+        return false;
+    }
+    return true;
+}
+// Regular Expression Source: OCI Distribution Spec V1
+// https://github.com/opencontainers/distribution-spec/blob/570d0262abe8ec5e59d8e3fbbd7be4bd784b200e/spec.md?plain=1#L141
+const repositoryNameIsValid = (name) => /^[a-z0-9]+((\.|_|__|-+)[a-z0-9]+)*(\/[a-z0-9]+((\.|_|__|-+)[a-z0-9]+)*)*$/.test(name);
+// Regular Expression Source: OCI Image Spec V1
+// https://github.com/opencontainers/image-spec/blob/d60099175f88c47cd379c4738d158884749ed235/descriptor.md?plain=1#L143
+const digestIsValid = (digest) => /^sha256:[a-f0-9]{64}$/.test(digest);
+// Regular Expression Source: OCI Image Spec V1
+// https://github.com/opencontainers/distribution-spec/blob/3940529fe6c0a068290b27fb3cd797cf0528bed6/spec.md?plain=1#L160
+const tagIsValid = (tag) => /^[a-zA-Z0-9_][a-zA-Z0-9._-]{0,127}$/.test(tag);
+//# sourceMappingURL=oci-distribution-metadata.js.map
+
+/***/ }),
+
 /***/ 86666:
 /***/ ((__unused_webpack_module, exports) => {
 
@@ -193456,7 +193866,7 @@ const dep_graph_1 = __webpack_require__(71479);
 // Module that provides functions to collect and build response after all
 // analyses' are done.
 const dockerfile_1 = __webpack_require__(79652);
-async function buildResponse(depsAnalysis, dockerfileAnalysis, excludeBaseImageVulns, names) {
+async function buildResponse(depsAnalysis, dockerfileAnalysis, excludeBaseImageVulns, names, ociDistributionMetadata) {
     var _a, _b;
     const deps = depsAnalysis.depTree.dependencies;
     const dockerfilePkgs = collectDockerfilePkgs(dockerfileAnalysis, deps);
@@ -193580,6 +193990,13 @@ async function buildResponse(depsAnalysis, dockerfileAnalysis, excludeBaseImageV
             additionalFacts.push(imageNamesFact);
         }
     }
+    if (ociDistributionMetadata) {
+        const metadataFact = {
+            type: "ociDistributionMetadata",
+            data: ociDistributionMetadata,
+        };
+        additionalFacts.push(metadataFact);
+    }
     const scanResults = [
         {
             facts: [depGraphFact, ...additionalFacts],
@@ -193794,10 +194211,12 @@ exports.analyzeStatically = void 0;
 const analyzer = __webpack_require__(55269);
 const dependency_tree_1 = __webpack_require__(95997);
 const image_1 = __webpack_require__(92748);
+const oci_distribution_metadata_1 = __webpack_require__(19103);
 const option_utils_1 = __webpack_require__(48587);
 const parser_1 = __webpack_require__(45062);
 const response_builder_1 = __webpack_require__(75319);
 async function analyzeStatically(targetImage, dockerfileAnalysis, imageType, imagePath, globsToFind, options, imageName) {
+    var _a;
     const staticAnalysis = await analyzer.analyzeStatically(targetImage, dockerfileAnalysis, imageType, imagePath, globsToFind, options);
     const parsedAnalysisResult = (0, parser_1.parseAnalysisResults)(targetImage, staticAnalysis);
     /** @deprecated Should try to build a dependency graph instead. */
@@ -193805,7 +194224,15 @@ async function analyzeStatically(targetImage, dockerfileAnalysis, imageType, ima
     const analysis = Object.assign(Object.assign({}, staticAnalysis), { depTree: dependenciesTree, imageId: parsedAnalysisResult.imageId, imageLayers: parsedAnalysisResult.imageLayers, packageFormat: parsedAnalysisResult.packageFormat });
     const excludeBaseImageVulns = (0, option_utils_1.isTrue)(options["exclude-base-image-vulns"]);
     const names = (0, image_1.getImageNames)(options, imageName);
-    return (0, response_builder_1.buildResponse)(analysis, dockerfileAnalysis, excludeBaseImageVulns, names);
+    let ociDistributionMetadata;
+    if (options.imageNameAndTag && ((_a = options.digests) === null || _a === void 0 ? void 0 : _a.manifest)) {
+        ociDistributionMetadata = (0, oci_distribution_metadata_1.constructOCIDisributionMetadata)({
+            imageName: options.imageNameAndTag,
+            manifestDigest: options.digests.manifest,
+            indexDigest: options.digests.index,
+        });
+    }
+    return (0, response_builder_1.buildResponse)(analysis, dockerfileAnalysis, excludeBaseImageVulns, names, ociDistributionMetadata);
 }
 exports.analyzeStatically = analyzeStatically;
 //# sourceMappingURL=static.js.map