snyk 1.765.0 → 1.766.0

package/dist/cli/64.index.js

@@ -207592,9 +207592,19 @@ async function fetchNugetInformationFromPackages(flattenedPackageList, targetFra
     // begin collecting information from .nuget files on installed packages
     debug('Trying to analyze .nuspec files');
     for (const name of Object.keys(flattenedPackageList)) {
-        const dep = flattenedPackageList[name];
-        debug('...' + name);
-        nugetPackageInformation.push(await nuspec_parser_1.parseNuspec(dep, targetFramework));
+        try {
+            const dep = flattenedPackageList[name];
+            debug('...' + name);
+            const resolved = await nuspec_parser_1.parseNuspec(dep, targetFramework);
+            nugetPackageInformation.push(resolved);
+        }
+        catch (e) {
+            debug('Failed parsing nuspec file');
+            debug(e);
+            //log but make sure to rethrow the error
+            //why? if we cannot parse nuspec file, we got nothing to do!
+            throw e;
+        }
     }
     return nugetPackageInformation;
 }
@@ -207826,7 +207836,7 @@ exports.getMinimumTargetFrameworkFromPackagesConfig = getMinimumTargetFrameworkF
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.parseNuspec = void 0;
+exports._parsedNuspec = exports.parseNuspec = void 0;
 const JSZip = __webpack_require__(9576);
 const fs = __webpack_require__(35747);
 const path = __webpack_require__(85622);
@@ -207835,61 +207845,113 @@ const debugModule = __webpack_require__(15158);
 const debug = debugModule('snyk');
 const targetFrameworkRegex = /([.a-zA-Z]+)([.0-9]+)/;
 async function parseNuspec(dep, targetFramework) {
-    return Promise.resolve()
-        .then(() => {
-        const nupkgPath = path.resolve(dep.path, dep.name + '.' + dep.version + '.nupkg');
-        const nupkgData = fs.readFileSync(nupkgPath);
-        return JSZip.loadAsync(nupkgData);
-    })
-        .then(nuspecZipData => {
-        const nuspecFiles = Object.keys(nuspecZipData.files).filter(file => {
-            return path.extname(file) === '.nuspec';
-        });
-        return nuspecZipData.files[nuspecFiles[0]].async('text');
-    })
-        .then(nuspecContent => {
-        return new Promise((resolve, reject) => {
-            parseXML.parseString(nuspecContent, (err, result) => {
-                if (err) {
-                    return reject(err);
-                }
-                let ownDeps = [];
-                // We are only going to check the first targetFramework we encounter
-                // in the future we may want to support multiple, but only once
-                // we have dependency version conflict resolution implemented
-                result.package.metadata.forEach(metadata => {
-                    metadata.dependencies.forEach(rawDependency => {
-                        // Find and add target framework version specific dependencies
-                        const depsForTargetFramework = extractDepsForTargetFramework(rawDependency, targetFramework);
-                        if (depsForTargetFramework && depsForTargetFramework.group) {
-                            ownDeps = ownDeps.concat(extractDepsFromRaw(depsForTargetFramework.group.dependency));
-                        }
-                        // Find all groups with no targetFramework attribute
-                        // add their deps
-                        const depsFromPlainGroups = extractDepsForPlainGroups(rawDependency);
-                        if (depsFromPlainGroups) {
-                            depsFromPlainGroups.forEach(depGroup => {
-                                ownDeps = ownDeps.concat(extractDepsFromRaw(depGroup.dependency));
-                            });
-                        }
-                        // Add the default dependencies
-                        ownDeps = ownDeps.concat(extractDepsFromRaw(rawDependency.dependency));
-                    });
-                });
-                return resolve({
-                    children: ownDeps,
-                    name: dep.name,
-                });
-            });
-        });
-    })
-        .catch(err => {
-        // parsing problems are coerced into an empty nuspec
-        debug('Error parsing dependency', JSON.stringify(dep), err);
+    //precaution
+    if (!dep) {
+        throw new Error('expected DependencyInfo parameter to have value but found it undefined');
+    }
+    //another precaution
+    if (!targetFramework) {
+        throw new Error('expected TargetFramework parameter to have value but found it undefined');
+    }
+    const nuspecContent = await loadNuspecFromAsync(dep);
+    if (nuspecContent === null) {
+        debug('failed to load nuspec content');
         return null;
-    });
+    }
+    return await _parsedNuspec(nuspecContent, targetFramework, dep.name);
 }
 exports.parseNuspec = parseNuspec;
+async function loadNuspecFromAsync(dep) {
+    const nupkgPath = path.resolve(dep.path, dep.name + '.' + dep.version + '.nupkg');
+    let nupkgData;
+    try {
+        nupkgData = fs.readFileSync(nupkgPath);
+    }
+    catch (err) {
+        if (err.code == 'ENOENT') {
+            debug('No nupkg file found at ' + nupkgPath);
+            return null; //this is needed not to break existing code flow
+        }
+        else {
+            throw err;
+        }
+    }
+    const nuspecZipData = await JSZip.loadAsync(nupkgData);
+    const nuspecFile = Object.keys(nuspecZipData.files).find(file => {
+        return path.extname(file) === '.nuspec';
+    });
+    if (!nuspecFile) {
+        throw new Error('`failed to read nupkg file from: ${nupkgPath}`');
+    }
+    if (!nuspecZipData) {
+        throw new Error(`failed to open nupkg file as an archive from: ${nupkgPath}`);
+    }
+    return await nuspecZipData.files[nuspecFile].async('text');
+}
+//this is exported for testing, but should not executed directly. Hence the '_' in the name.
+async function _parsedNuspec(nuspecContent, targetFramework, depName) {
+    var _a;
+    const parsedNuspec = await parseXML.parseStringPromise(nuspecContent);
+    let ownDeps = [];
+    //note: this will throw if assertion fails
+    assertNuspecSchema(parsedNuspec);
+    for (const metadata of parsedNuspec.package.metadata) {
+        (_a = metadata.dependencies) === null || _a === void 0 ? void 0 : _a.forEach(rawDependency => {
+            // Find and add target framework version specific dependencies
+            const depsForTargetFramework = extractDepsForTargetFramework(rawDependency, targetFramework);
+            if (depsForTargetFramework && depsForTargetFramework.group) {
+                ownDeps = ownDeps.concat(extractDepsFromRaw(depsForTargetFramework.group.dependency));
+            }
+            // Find all groups with no targetFramework attribute
+            // add their deps
+            const depsFromPlainGroups = extractDepsForPlainGroups(rawDependency);
+            if (depsFromPlainGroups) {
+                depsFromPlainGroups.forEach(depGroup => {
+                    ownDeps = ownDeps.concat(extractDepsFromRaw(depGroup.dependency));
+                });
+            }
+            // Add the default dependencies
+            ownDeps = ownDeps.concat(extractDepsFromRaw(rawDependency.dependency));
+        });
+    }
+    return {
+        children: ownDeps,
+        name: depName,
+    };
+}
+exports._parsedNuspec = _parsedNuspec;
+function assertNuspecSchema(parsedNuspec) {
+    var _a;
+    if (!((_a = parsedNuspec.package) === null || _a === void 0 ? void 0 : _a.metadata)) {
+        throw new Error('This is an invalid nuspec file. Package or Metadata xml section is missing. This is a required element. See https://docs.microsoft.com/en-us/nuget/reference/nuspec');
+    }
+    //just in case, this should *not* happen
+    if (!Array.isArray(parsedNuspec.package.metadata)) {
+        throw new Error('This is an invalid nuspec file; the metadata tag is supposed to be a collection of objects but it is not!');
+    }
+    for (const metadata of parsedNuspec.package.metadata) {
+        //just in case, this shouldn't happen as this would indicate invalid/malformed nuspec file
+        if (metadata == null || typeof metadata !== 'object') {
+            throw new Error('Expected elements in a "metadata" tag to be objects, but they were ' +
+                typeof metadata +
+                ', this is not supposed to happen and is likely due to malformed nuspec file.');
+        }
+        if (metadata.dependencies) {
+            //just in case, error would indicate malformed nuspec
+            if (!Array.isArray(metadata.dependencies)) {
+                throw new Error('Expected that "dependencies" tag would be an array but it isn\'t. This is not supposed to happen and is likely due to malformed nuspec file!');
+            }
+            for (const rawDependency of metadata.dependencies) {
+                //just in case, shouldn't happen as this would indicate malformed nuspec format
+                if (typeof rawDependency !== 'object') {
+                    throw new Error('Unexpected dependency value. Expected it to be object but it was ' +
+                        typeof rawDependency +
+                        ', this is likely a malformed nuspec');
+                }
+            }
+        }
+    }
+}
 function extractDepsForPlainGroups(rawDependency) {
     if (!rawDependency.group) {
         return [];