snyk 1.1307.0 → 1.1307.1

package/dist/cli/778.index.js

@@ -7269,19 +7269,28 @@ function captureSegment (state, start, end, checkJson) {
   }
 }
 
+function chargeMergeWork (state) {
+  state.totalMergeKeys++
+
+  if (state.maxTotalMergeKeys !== -1 && state.totalMergeKeys > state.maxTotalMergeKeys) {
+    throwError(state, 'merge keys exceeded maxTotalMergeKeys (' + state.maxTotalMergeKeys + ')')
+  }
+}
+
 function mergeMappings (state, destination, source, overridableKeys) {
   if (!common.isObject(source)) {
     throwError(state, 'cannot merge mappings; the provided source object is unacceptable')
   }
 
+  // Count the source mapping itself to bound sequences of empty mappings.
+  chargeMergeWork(state)
+
   const sourceKeys = Object.keys(source)
 
   for (let index = 0, quantity = sourceKeys.length; index < quantity; index += 1) {
     const key = sourceKeys[index]
 
-    if (state.maxTotalMergeKeys !== -1 && ++state.totalMergeKeys > state.maxTotalMergeKeys) {
-      throwError(state, 'merge keys exceeded maxTotalMergeKeys (' + state.maxTotalMergeKeys + ')')
-    }
+    chargeMergeWork(state)
 
     if (!_hasOwnProperty.call(destination, key)) {
       setProperty(destination, key, source[key])
@@ -7324,6 +7333,10 @@ function storeMappingPair (state, _result, overridableKeys, keyTag, keyNode, val
 
   if (keyTag === 'tag:yaml.org,2002:merge') {
     if (Array.isArray(valueNode)) {
+      if (valueNode.length > 100) {
+        throwError(state, 'abnormal merge sequence size')
+      }
+
       for (let index = 0, quantity = valueNode.length; index < quantity; index += 1) {
         mergeMappings(state, _result, valueNode[index], overridableKeys)
       }
@@ -144838,6 +144851,14 @@ function captureSegment(state, start, end, checkJson) {
   }
 }
 
+function chargeMergeWork(state) {
+  state.totalMergeKeys += 1;
+
+  if (state.maxTotalMergeKeys !== -1 && state.totalMergeKeys > state.maxTotalMergeKeys) {
+    throwError(state, 'merge keys exceeded maxTotalMergeKeys (' + state.maxTotalMergeKeys + ')');
+  }
+}
+
 function mergeMappings(state, destination, source, overridableKeys) {
   var sourceKeys, key, index, quantity;
 
@@ -144845,14 +144866,15 @@ function mergeMappings(state, destination, source, overridableKeys) {
     throwError(state, 'cannot merge mappings; the provided source object is unacceptable');
   }
 
+  // Count the source mapping itself to bound sequences of empty mappings.
+  chargeMergeWork(state);
+
   sourceKeys = Object.keys(source);
 
   for (index = 0, quantity = sourceKeys.length; index < quantity; index += 1) {
     key = sourceKeys[index];
 
-    if (state.maxTotalMergeKeys !== -1 && ++state.totalMergeKeys > state.maxTotalMergeKeys) {
-      throwError(state, 'merge keys exceeded maxTotalMergeKeys (' + state.maxTotalMergeKeys + ')');
-    }
+    chargeMergeWork(state);
 
     if (!_hasOwnProperty.call(destination, key)) {
       setProperty(destination, key, source[key]);
@@ -144897,6 +144919,10 @@ function storeMappingPair(state, _result, overridableKeys, keyTag, keyNode, valu
 
   if (keyTag === 'tag:yaml.org,2002:merge') {
     if (Array.isArray(valueNode)) {
+      if (valueNode.length > 100) {
+        throwError(state, 'abnormal merge sequence size');
+      }
+
       for (index = 0, quantity = valueNode.length; index < quantity; index += 1) {
         mergeMappings(state, _result, valueNode[index], overridableKeys);
       }
@@ -231409,6 +231435,105 @@ exports.extractArchive = (0, generic_archive_extractor_1.createExtractArchive)(g
 
 /***/ }),
 
+/***/ 644:
+/***/ ((__unused_webpack_module, exports, __webpack_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.parsePlatform = exports.fetchAttestationsFromRegistry = void 0;
+const docker_registry_v2_client_1 = __webpack_require__(28310);
+const Debug = __webpack_require__(6807);
+const error_utils_1 = __webpack_require__(40035);
+const layer_1 = __webpack_require__(29633);
+const debug = Debug("snyk");
+const MEDIATYPE_IN_TOTO = "application/vnd.in-toto+json";
+const PREDICATE_TYPE_ANNOTATION = "in-toto.io/predicate-type";
+const SLSA_PROVENANCE_PREFIX = "https://slsa.dev/provenance/";
+// Fetches provenance attestations for an image directly from its source registry.
+async function fetchAttestationsFromRegistry(ref) {
+    var _a;
+    const { registryBase, repo, imageReference, username, password, platform } = ref;
+    let manifest;
+    try {
+        manifest = await (0, docker_registry_v2_client_1.getAttestationManifest)(registryBase, repo, imageReference, username, password, undefined, platform);
+    }
+    catch (error) {
+        debug(`[provenance] failed to fetch attestation manifest for ${repo}@${imageReference}: ${(0, error_utils_1.getErrorMessage)(error)}`);
+        return [];
+    }
+    if (!manifest ||
+        !Array.isArray(manifest.layers) ||
+        manifest.layers.length === 0) {
+        return [];
+    }
+    const inTotoStatements = {};
+    for (const layer of manifest.layers) {
+        if (layer.mediaType !== MEDIATYPE_IN_TOTO) {
+            continue;
+        }
+        const predicateType = (_a = layer.annotations) === null || _a === void 0 ? void 0 : _a[PREDICATE_TYPE_ANNOTATION];
+        if (predicateType && !predicateType.startsWith(SLSA_PROVENANCE_PREFIX)) {
+            continue;
+        }
+        if (typeof layer.size === "number" && layer.size > layer_1.MAX_JSON_SIZE_BYTES) {
+            debug(`[provenance] skipping oversized attestation layer ${layer.digest} (${layer.size} bytes > ${layer_1.MAX_JSON_SIZE_BYTES})`);
+            continue;
+        }
+        try {
+            const blob = await (0, docker_registry_v2_client_1.getLayer)(registryBase, repo, layer.digest, username, password);
+            inTotoStatements[layer.digest] = JSON.parse(blob.toString("utf-8"));
+        }
+        catch (error) {
+            debug(`[provenance] skipping layer ${layer.digest}: ${(0, error_utils_1.getErrorMessage)(error)}`);
+        }
+    }
+    if (Object.keys(inTotoStatements).length === 0) {
+        return [];
+    }
+    if (!manifest.manifestDigest) {
+        debug(`[provenance] no descriptor digest for attestation manifest ${repo}@${imageReference}; skipping`);
+        return [];
+    }
+    const resolvedManifest = {
+        schemaVersion: String(manifest.schemaVersion),
+        mediaType: manifest.mediaType,
+        config: { digest: manifest.config.digest },
+        layers: manifest.layers.map((layer) => ({
+            digest: layer.digest,
+            mediaType: layer.mediaType,
+            size: layer.size,
+            annotations: layer.annotations,
+        })),
+    };
+    return [
+        {
+            manifestDigest: manifest.manifestDigest,
+            manifest: resolvedManifest,
+            inTotoStatements,
+        },
+    ];
+}
+exports.fetchAttestationsFromRegistry = fetchAttestationsFromRegistry;
+function parsePlatform(platform) {
+    if (!platform) {
+        return undefined;
+    }
+    const info = (0, layer_1.getOciPlatformInfoFromOptionString)(platform);
+    if (!info.os || !info.architecture) {
+        return undefined;
+    }
+    return {
+        os: info.os,
+        architecture: info.architecture,
+        variant: info.variant,
+    };
+}
+exports.parsePlatform = parsePlatform;
+//# sourceMappingURL=fetch-registry-provenance-attestations.js.map
+
+/***/ }),
+
 /***/ 98065:
 /***/ ((__unused_webpack_module, exports, __webpack_require__) => {
 
@@ -232088,7 +232213,7 @@ exports.getImageIdFromManifest = getImageIdFromManifest;
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.getManifest = exports.isImageManifest = exports.extractArchive = void 0;
+exports.getOciPlatformInfoFromOptionString = exports.getManifest = exports.isImageManifest = exports.extractArchive = exports.MAX_JSON_SIZE_BYTES = void 0;
 const Debug = __webpack_require__(6807);
 const fs_1 = __webpack_require__(57147);
 const path_1 = __webpack_require__(71017);
@@ -232106,7 +232231,7 @@ const MEDIATYPE_OCI_MANIFEST_LIST_V1 = "application/vnd.oci.image.index.v1+json"
 const MEDIATYPE_IN_TOTO = "application/vnd.in-toto+json";
 // Maximum size for JSON metadata files. Matches the limit in streamToJson.
 // Files larger than this are layer blobs, not JSON metadata.
-const MAX_JSON_SIZE_BYTES = 2 * 1024 * 1024;
+exports.MAX_JSON_SIZE_BYTES = 2 * 1024 * 1024;
 /**
  * Retrieve the products of files content from the specified oci-archive.
  *
@@ -232189,7 +232314,7 @@ async function extractMetadata(ociArchiveFilesystemPath) {
                         mainIndexFile = await (0, stream_utils_1.streamToJson)(stream);
                     }
                     else if (isBlobPath(normalizedHeaderName) &&
-                        (header.size === undefined || header.size <= MAX_JSON_SIZE_BYTES)) {
+                        (header.size === undefined || header.size <= exports.MAX_JSON_SIZE_BYTES)) {
                         // Small blob file - try to parse as JSON metadata
                         // Large files and non-blob files (oci-layout, etc.) are skipped
                         const jsonContent = await tryParseJsonMetadata(stream);
@@ -232262,7 +232387,7 @@ async function tryParseJsonMetadata(stream) {
                 }
             }
             bytes += chunk.length;
-            if (bytes <= MAX_JSON_SIZE_BYTES) {
+            if (bytes <= exports.MAX_JSON_SIZE_BYTES) {
                 chunks.push(chunk.toString("utf8"));
             }
         });
@@ -232450,6 +232575,7 @@ function getOciPlatformInfoFromOptionString(platform) {
         variant,
     };
 }
+exports.getOciPlatformInfoFromOptionString = getOciPlatformInfoFromOptionString;
 function getImageManifestInfo(manifests, platformInfo) {
     // manifests do not always have a plaform, this is the case for OCI
     // images built with Docker when no platform is specified
@@ -235598,13 +235724,19 @@ exports.extractContent = extractContent;
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.analyzeStatically = void 0;
+const Debug = __webpack_require__(6807);
 const analyzer = __webpack_require__(55269);
+const image_inspector_1 = __webpack_require__(95710);
 const dependency_tree_1 = __webpack_require__(95997);
+const error_utils_1 = __webpack_require__(40035);
 const image_1 = __webpack_require__(92748);
+const fetch_registry_provenance_attestations_1 = __webpack_require__(644);
 const oci_distribution_metadata_1 = __webpack_require__(19103);
 const option_utils_1 = __webpack_require__(48587);
 const parser_1 = __webpack_require__(45062);
 const response_builder_1 = __webpack_require__(75319);
+const types_1 = __webpack_require__(93677);
+const debug = Debug("snyk");
 async function analyzeStatically(targetImage, dockerfileAnalysis, imageType, imagePath, globsToFind, options, imageName) {
     var _a, _b;
     const totalStart = Date.now();
@@ -235620,6 +235752,24 @@ async function analyzeStatically(targetImage, dockerfileAnalysis, imageType, ima
         imageLayers: parsedAnalysisResult.imageLayers,
         packageFormat: parsedAnalysisResult.packageFormat,
     };
+    if (imageType === types_1.ImageType.Identifier &&
+        (!analysis.attestations || analysis.attestations.length === 0)) {
+        try {
+            const { hostname, imageName: repo, tag, } = (0, image_inspector_1.extractImageDetails)(targetImage);
+            analysis.attestations = await (0, fetch_registry_provenance_attestations_1.fetchAttestationsFromRegistry)({
+                registryBase: hostname,
+                repo,
+                imageReference: tag,
+                username: options.username,
+                password: options.password,
+                platform: (0, fetch_registry_provenance_attestations_1.parsePlatform)(options.platform),
+            });
+        }
+        catch (error) {
+            // Best-effort: provenance is optional; never fail the scan over it.
+            debug(`[provenance] failed to fetch attestations from registry for ${targetImage}: ${(0, error_utils_1.getErrorMessage)(error)}`);
+        }
+    }
     const excludeBaseImageVulns = (0, option_utils_1.isTrue)(options["exclude-base-image-vulns"]);
     const names = (0, image_1.getImageNames)(options, imageName);
     let ociDistributionMetadata;
@@ -236000,7 +236150,7 @@ Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.PLUGIN_VERSION = void 0;
 // This file is auto-generated during the release process.
 // Do not edit manually.
-exports.PLUGIN_VERSION = "9.19.0";
+exports.PLUGIN_VERSION = "9.20.0";
 //# sourceMappingURL=version.js.map
 
 /***/ }),
@@ -262188,19 +262338,28 @@ function captureSegment (state, start, end, checkJson) {
   }
 }
 
+function chargeMergeWork (state) {
+  state.totalMergeKeys++
+
+  if (state.maxTotalMergeKeys !== -1 && state.totalMergeKeys > state.maxTotalMergeKeys) {
+    throwError(state, 'merge keys exceeded maxTotalMergeKeys (' + state.maxTotalMergeKeys + ')')
+  }
+}
+
 function mergeMappings (state, destination, source, overridableKeys) {
   if (!common.isObject(source)) {
     throwError(state, 'cannot merge mappings; the provided source object is unacceptable')
   }
 
+  // Count the source mapping itself to bound sequences of empty mappings.
+  chargeMergeWork(state)
+
   const sourceKeys = Object.keys(source)
 
   for (let index = 0, quantity = sourceKeys.length; index < quantity; index += 1) {
     const key = sourceKeys[index]
 
-    if (state.maxTotalMergeKeys !== -1 && ++state.totalMergeKeys > state.maxTotalMergeKeys) {
-      throwError(state, 'merge keys exceeded maxTotalMergeKeys (' + state.maxTotalMergeKeys + ')')
-    }
+    chargeMergeWork(state)
 
     if (!_hasOwnProperty.call(destination, key)) {
       setProperty(destination, key, source[key])
@@ -262243,6 +262402,10 @@ function storeMappingPair (state, _result, overridableKeys, keyTag, keyNode, val
 
   if (keyTag === 'tag:yaml.org,2002:merge') {
     if (Array.isArray(valueNode)) {
+      if (valueNode.length > 100) {
+        throwError(state, 'abnormal merge sequence size')
+      }
+
       for (let index = 0, quantity = valueNode.length; index < quantity; index += 1) {
         mergeMappings(state, _result, valueNode[index], overridableKeys)
       }