snyk 1.777.0 → 1.781.0

package/dist/cli/917.index.js

@@ -53,22 +53,25 @@ const types_1 = __webpack_require__(42258);
 const analytics = __webpack_require__(82744);
 const math_utils_1 = __webpack_require__(48537);
 const file_utils_1 = __webpack_require__(58486);
-function addIacAnalytics(formattedResults, ignoredIssuesCount, isLocalCustomRules) {
+function addIacAnalytics(formattedResults, ignoredIssuesCount) {
     let totalIssuesCount = 0;
     const customRulesIdsFoundInIssues = {};
     let issuesFromCustomRulesCount = 0;
-    const issuesByType = {};
+    const projectTypeAnalytics = {};
     const packageManagers = Array();
     formattedResults.forEach((res) => {
+        var _a;
         totalIssuesCount =
             (totalIssuesCount || 0) + res.result.cloudConfigResults.length;
-        const packageManagerConfig = res.packageManager;
-        packageManagers.push(packageManagerConfig);
+        const projectType = res.packageManager;
+        packageManagers.push(projectType);
+        projectTypeAnalytics[projectType] = (_a = projectTypeAnalytics[projectType]) !== null && _a !== void 0 ? _a : {
+            count: 0,
+        };
+        projectTypeAnalytics[projectType]['count']++;
         res.result.cloudConfigResults.forEach((policy) => {
-            var _a;
-            issuesByType[packageManagerConfig] = (_a = issuesByType[packageManagerConfig]) !== null && _a !== void 0 ? _a : {};
-            issuesByType[packageManagerConfig][policy.severity] =
-                (issuesByType[packageManagerConfig][policy.severity] || 0) + 1;
+            projectTypeAnalytics[projectType][policy.severity] =
+                (projectTypeAnalytics[projectType][policy.severity] || 0) + 1;
             if (policy.isGeneratedByCustomRule) {
                 issuesFromCustomRulesCount++;
                 customRulesIdsFoundInIssues[policy.publicId] = true;
@@ -79,14 +82,12 @@ function addIacAnalytics(formattedResults, ignoredIssuesCount, isLocalCustomRule
     analytics.add('packageManager', Array.from(new Set(packageManagers)));
     analytics.add('iac-issues-count', totalIssuesCount);
     analytics.add('iac-ignored-issues-count', ignoredIssuesCount);
-    analytics.add('iac-type', issuesByType);
+    analytics.add('iac-type', projectTypeAnalytics);
     analytics.add('iac-metrics', exports.performanceAnalyticsObject);
     analytics.add('iac-test-count', formattedResults.length);
     analytics.add('iac-custom-rules-issues-count', issuesFromCustomRulesCount);
     analytics.add('iac-custom-rules-issues-percentage', math_utils_1.calculatePercentage(issuesFromCustomRulesCount, totalIssuesCount));
-    if (!isLocalCustomRules) {
-        analytics.add('iac-custom-rules-checksum', file_utils_1.computeCustomRulesBundleChecksum());
-    }
+    analytics.add('iac-custom-rules-checksum', file_utils_1.computeCustomRulesBundleChecksum());
     analytics.add('iac-custom-rules-coverage-count', uniqueCustomRulesCount);
 }
 exports.addIacAnalytics = addIacAnalytics;
@@ -679,7 +680,6 @@ const analytics_1 = __webpack_require__(22716);
 const usage_tracking_1 = __webpack_require__(43156);
 const policy_1 = __webpack_require__(25476);
 const measurable_methods_1 = __webpack_require__(78272);
-const feature_flags_1 = __webpack_require__(63011);
 const assert_iac_options_flag_1 = __webpack_require__(68590);
 const user_config_1 = __webpack_require__(28137);
 const config_1 = __webpack_require__(22541);
@@ -687,26 +687,33 @@ const policy_2 = __webpack_require__(32615);
 const errors_1 = __webpack_require__(55191);
 const error_utils_1 = __webpack_require__(23872);
 const oci_pull_1 = __webpack_require__(5029);
-const unsupported_entitlement_error_1 = __webpack_require__(78673);
 const url_utils_1 = __webpack_require__(80256);
+const chalk_1 = __webpack_require__(32589);
 // this method executes the local processing engine and then formats the results to adapt with the CLI output.
 // this flow is the default GA flow for IAC scanning.
 async function test(pathToScan, options) {
-    var _a;
+    var _a, _b, _c;
     try {
         let customRulesPath;
         const orgPublicId = (_a = options.org) !== null && _a !== void 0 ? _a : config_1.default.org;
         const iacOrgSettings = await measurable_methods_1.getIacOrgSettings(orgPublicId);
         if (options.rules) {
-            await assertRulesFlagAvailable(orgPublicId, iacOrgSettings);
+            if (!((_b = iacOrgSettings.entitlements) === null || _b === void 0 ? void 0 : _b.iacCustomRulesEntitlement)) {
+                throw new assert_iac_options_flag_1.UnsupportedEntitlementFlagError('rules', 'iacCustomRulesEntitlement');
+            }
             customRulesPath = options.rules;
         }
         const isOCIRegistryURLProvided = checkOCIRegistryURLProvided(iacOrgSettings);
+        if (isOCIRegistryURLProvided || customRulesPath) {
+            console.log(chalk_1.default.hex('#ff9b00')('Using custom rules to generate misconfigurations.'));
+        }
         if (isOCIRegistryURLProvided && customRulesPath) {
             throw new FailedToExecuteCustomRulesError();
         }
         if (isOCIRegistryURLProvided) {
-            await assertPullAvailable(orgPublicId, iacOrgSettings);
+            if (!((_c = iacOrgSettings.entitlements) === null || _c === void 0 ? void 0 : _c.iacCustomRulesEntitlement)) {
+                throw new oci_pull_1.UnsupportedEntitlementPullError('iacCustomRulesEntitlement');
+            }
             await pullIaCCustomRules(iacOrgSettings);
         }
         else {
@@ -736,7 +743,7 @@ async function test(pathToScan, options) {
             // If something has gone wrong, err on the side of allowing the user to
             // run their tests by squashing the error.
         }
-        analytics_1.addIacAnalytics(filteredIssues, ignoreCount, !!customRulesPath);
+        analytics_1.addIacAnalytics(filteredIssues, ignoreCount);
         // TODO: add support for proper typing of old TestResult interface.
         return {
             results: filteredIssues,
@@ -829,7 +836,7 @@ async function pullIaCCustomRules(iacOrgSettings) {
             throw new FailedToPullCustomBundleError('There was an authentication error. Incorrect credentials provided.');
         }
         else if (err.statusCode === 404) {
-            throw new FailedToPullCustomBundleError('The remote repository could not be found. Please check the provided URL.');
+            throw new FailedToPullCustomBundleError('The remote repository could not be found. Please check the provided registry URL.');
         }
         else if (err instanceof oci_pull_1.InvalidManifestSchemaVersionError) {
             throw new FailedToPullCustomBundleError(err.message);
@@ -846,62 +853,15 @@ async function pullIaCCustomRules(iacOrgSettings) {
     }
 }
 exports.pullIaCCustomRules = pullIaCCustomRules;
-/**
- * Asserts the custom-rules feature is available for the provided org.
- */
-async function assertCustomRulesAvailable(orgPublicId, iacOrgSettings) {
-    var _a;
-    const isCustomRulesEnabled = !!(await feature_flags_1.isFeatureFlagSupportedForOrg('iacCustomRules', orgPublicId)).ok;
-    if (!isCustomRulesEnabled) {
-        throw new errors_1.UnsupportedFeatureFlagError('iacCustomRules');
-    }
-    const isEntitledToCustomRules = !!((_a = iacOrgSettings.entitlements) === null || _a === void 0 ? void 0 : _a.iacCustomRulesEntitlement);
-    if (!isEntitledToCustomRules) {
-        throw new unsupported_entitlement_error_1.UnsupportedEntitlementError('iacCustomRulesEntitlement');
-    }
-}
-/**
- * Asserts the --rules flag is available for the provided org.
- */
-async function assertRulesFlagAvailable(orgPublicId, iacOrgSettings) {
-    try {
-        await assertCustomRulesAvailable(orgPublicId, iacOrgSettings);
-    }
-    catch (err) {
-        if (err instanceof unsupported_entitlement_error_1.UnsupportedEntitlementError) {
-            throw new assert_iac_options_flag_1.UnsupportedEntitlementFlagError('rules', err.entitlement);
-        }
-        else if (err instanceof errors_1.UnsupportedFeatureFlagError) {
-            throw new assert_iac_options_flag_1.FlagError('rules', err.featureFlag);
-        }
-        else {
-            throw err;
-        }
-    }
-}
-/**
- * Asserts the feature custom-rules bundles pulling feature is available for the provided org.
- */
-async function assertPullAvailable(orgPublicId, iacOrgSettings) {
-    try {
-        await assertCustomRulesAvailable(orgPublicId, iacOrgSettings);
-    }
-    catch (err) {
-        if (err instanceof unsupported_entitlement_error_1.UnsupportedEntitlementError) {
-            throw new oci_pull_1.UnsupportedEntitlementPullError(err.entitlement);
-        }
-        else if (err instanceof errors_1.UnsupportedFeatureFlagError) {
-            throw new oci_pull_1.UnsupportedFeatureFlagPullError(err.featureFlag);
-        }
-    }
-}
 class FailedToPullCustomBundleError extends errors_1.CustomError {
     constructor(message) {
         super(message || 'Could not pull custom bundle');
         this.code = types_1.IaCErrorCodes.FailedToPullCustomBundleError;
         this.strCode = error_utils_1.getErrorStringCode(this.code);
-        this.userMessage = `${message ? message + ' ' : ''}
-    We were unable to download the custom bundle to the disk. Please ensure access to the remote Registry and validate you have provided all the right parameters.`;
+        this.userMessage =
+            `${message ? message + ' ' : ''}` +
+                '\nWe were unable to download the custom bundle to the disk. Please ensure access to the remote Registry and validate you have provided all the right parameters.' +
+                '\nSee documentation on troubleshooting: https://docs.snyk.io/products/snyk-infrastructure-as-code/custom-rules/use-IaC-custom-rules-with-CLI/using-a-remote-custom-rules-bundle#troubleshooting';
     }
 }
 exports.FailedToPullCustomBundleError = FailedToPullCustomBundleError;
@@ -1188,7 +1148,7 @@ exports.pull = measurableOciPull;
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.UnsupportedEntitlementPullError = exports.UnsupportedFeatureFlagPullError = exports.InvalidRemoteRegistryURLError = exports.InvalidManifestSchemaVersionError = exports.FailedToBuildOCIArtifactError = exports.pull = exports.extractOCIRegistryURLComponents = exports.CUSTOM_RULES_TARBALL = void 0;
+exports.UnsupportedEntitlementPullError = exports.InvalidRemoteRegistryURLError = exports.InvalidManifestSchemaVersionError = exports.FailedToBuildOCIArtifactError = exports.pull = exports.extractOCIRegistryURLComponents = exports.CUSTOM_RULES_TARBALL = void 0;
 const registryClient = __webpack_require__(28310);
 const fs_1 = __webpack_require__(35747);
 const path = __webpack_require__(85622);
@@ -1286,15 +1246,6 @@ class InvalidRemoteRegistryURLError extends errors_1.CustomError {
     }
 }
 exports.InvalidRemoteRegistryURLError = InvalidRemoteRegistryURLError;
-class UnsupportedFeatureFlagPullError extends errors_1.CustomError {
-    constructor(featureFlag) {
-        super('OCI Pull not supported - Missing the ${featureFlag} feature flag');
-        this.code = types_1.IaCErrorCodes.UnsupportedFeatureFlagPullError;
-        this.strCode = error_utils_1.getErrorStringCode(this.code);
-        this.userMessage = `The custom rules feature is not supported for this org - The feature flag '${featureFlag}' is not currently enabled. It can be enabled via Snyk Preview, if you are on the Enterprise Plan.`;
-    }
-}
-exports.UnsupportedFeatureFlagPullError = UnsupportedFeatureFlagPullError;
 class UnsupportedEntitlementPullError extends errors_1.CustomError {
     constructor(entitlement) {
         super(`OCI Pull not supported - Missing the ${entitlement} entitlement`);
@@ -1740,7 +1691,9 @@ function formatScanResult(scanResult, meta, options) {
             },
             severity: policy.severity,
             lineNumber,
-            documentation: `https://snyk.io/security-rules/${policy.publicId}`,
+            documentation: !isGeneratedByCustomRule
+                ? `https://snyk.io/security-rules/${policy.publicId}`
+                : undefined,
             isGeneratedByCustomRule,
         };
     });
@@ -1987,6 +1940,7 @@ exports.test = test;
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 const Debug = __webpack_require__(15158);
+const os_1 = __webpack_require__(12087);
 const cloneDeep = __webpack_require__(83465);
 const assign = __webpack_require__(31730);
 const chalk_1 = __webpack_require__(32589);
@@ -2007,6 +1961,8 @@ const set_default_test_options_1 = __webpack_require__(13285);
 const process_command_args_1 = __webpack_require__(52369);
 const format_test_error_1 = __webpack_require__(68214);
 const display_result_1 = __webpack_require__(89667);
+const analytics = __webpack_require__(82744);
+const protect_update_notification_1 = __webpack_require__(79304);
 const debug = Debug('snyk-test');
 const SEPARATOR = '\n-------------------------------------------------------\n';
 // TODO: avoid using `as any` whenever it's possible
@@ -2015,6 +1971,8 @@ async function test(...args) {
     const options = set_default_test_options_1.setDefaultTestOptions(originalOptions);
     validate_test_options_1.validateTestOptions(options);
     validate_credentials_1.validateCredentials(options);
+    const packageJsonPathsWithSnykDepForProtect = protect_update_notification_1.getPackageJsonPathsContainingSnykDependency(options.file, paths);
+    analytics.add('upgradable-snyk-protect-paths', packageJsonPathsWithSnykDepForProtect.length);
     // Handles no image arg provided to the container command until
     // a validation interface is implemented in the docker plugin.
     if (options.docker && paths.length === 0) {
@@ -2180,6 +2138,8 @@ async function test(...args) {
             if (!fail) {
                 // return here to prevent throwing failure
                 response += chalk_1.default.bold.green(summaryMessage);
+                response += os_1.EOL + os_1.EOL;
+                response += protect_update_notification_1.getProtectUpgradeWarningForPaths(packageJsonPathsWithSnykDepForProtect);
                 return types_1.TestCommandResult.createHumanReadableTestCommandResult(response, stringifiedJsonData, stringifiedSarifData);
             }
         }
@@ -2196,6 +2156,8 @@ async function test(...args) {
         throw error;
     }
     response += chalk_1.default.bold.green(summaryMessage);
+    response += os_1.EOL + os_1.EOL;
+    response += protect_update_notification_1.getProtectUpgradeWarningForPaths(packageJsonPathsWithSnykDepForProtect);
     return types_1.TestCommandResult.createHumanReadableTestCommandResult(response, stringifiedJsonData, stringifiedSarifData);
 }
 exports.default = test;
@@ -2358,28 +2320,6 @@ FailOnError.ERROR_MESSAGE = 'Invalid fail on argument, please use one of: ' +
     Object.keys(common_1.FAIL_ON).join(' | ');
 
 
-/***/ }),
-
-/***/ 78673:
-/***/ ((__unused_webpack_module, exports, __webpack_require__) => {
-
-"use strict";
-
-Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.UnsupportedEntitlementError = void 0;
-const custom_error_1 = __webpack_require__(17188);
-class UnsupportedEntitlementError extends custom_error_1.CustomError {
-    constructor(entitlement, userMessage = `This feature is currently not enabled for your org. To enable it, please contact snyk support.`) {
-        super('Unsupported feature - Missing the ${entitlementName} entitlement');
-        this.entitlement = entitlement;
-        this.code = UnsupportedEntitlementError.ERROR_CODE;
-        this.userMessage = userMessage;
-    }
-}
-exports.UnsupportedEntitlementError = UnsupportedEntitlementError;
-UnsupportedEntitlementError.ERROR_CODE = 403;
-
-
 /***/ }),
 
 /***/ 9401:
@@ -2996,6 +2936,110 @@ function metadataForVuln(vuln) {
 }
 
 
+/***/ }),
+
+/***/ 79304:
+/***/ ((__unused_webpack_module, exports, __webpack_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.getPackageJsonPathsContainingSnykDependency = exports.checkPackageJsonForSnykDependency = exports.packageJsonFileExistsInDirectory = exports.getProtectUpgradeWarningForPaths = void 0;
+const os_1 = __webpack_require__(12087);
+const theme = __webpack_require__(86988);
+const fs = __webpack_require__(35747);
+const path = __webpack_require__(85622);
+const createDebug = __webpack_require__(15158);
+const debug = createDebug('snyk-protect-update-notification');
+function getProtectUpgradeWarningForPaths(packageJsonPaths) {
+    try {
+        if ((packageJsonPaths === null || packageJsonPaths === void 0 ? void 0 : packageJsonPaths.length) > 0) {
+            let message = theme.color.status.warn(`${theme.icon.WARNING} WARNING: It looks like you have the \`snyk\` dependency in the \`package.json\` file(s) at the following path(s):` +
+                os_1.EOL);
+            packageJsonPaths.forEach((p) => {
+                message += theme.color.status.warn(`  - ${p}` + os_1.EOL);
+            });
+            const githubReadmeUrlShort = 'https://snyk.co/ud1cR'; // https://github.com/snyk/snyk/tree/master/packages/snyk-protect#migrating-from-snyk-protect-to-snykprotect
+            message += theme.color.status.warn(`For more information and migration instructions, see ${githubReadmeUrlShort}` +
+                os_1.EOL);
+            return message;
+        }
+        else {
+            return '';
+        }
+    }
+    catch (e) {
+        debug('Error in getProtectUpgradeWarningForPaths()', e);
+        return '';
+    }
+}
+exports.getProtectUpgradeWarningForPaths = getProtectUpgradeWarningForPaths;
+function packageJsonFileExistsInDirectory(directoryPath) {
+    try {
+        const packageJsonPath = path.resolve(directoryPath, 'package.json');
+        const fileExists = fs.existsSync(packageJsonPath);
+        return fileExists;
+    }
+    catch (e) {
+        debug('Error in packageJsonFileExistsInDirectory()', e);
+        return false;
+    }
+}
+exports.packageJsonFileExistsInDirectory = packageJsonFileExistsInDirectory;
+function checkPackageJsonForSnykDependency(packageJsonPath) {
+    try {
+        const fileExists = fs.existsSync(packageJsonPath);
+        if (fileExists) {
+            const packageJson = fs.readFileSync(packageJsonPath, 'utf8');
+            const packageJsonObject = JSON.parse(packageJson);
+            const snykDependency = packageJsonObject.dependencies['snyk'];
+            if (snykDependency) {
+                return true;
+            }
+        }
+    }
+    catch (e) {
+        debug('Error in checkPackageJsonForSnykDependency()', e);
+    }
+    return false;
+}
+exports.checkPackageJsonForSnykDependency = checkPackageJsonForSnykDependency;
+function getPackageJsonPathsContainingSnykDependency(fileOption, paths) {
+    const packageJsonPathsWithSnykDepForProtect = [];
+    try {
+        if (fileOption) {
+            if (fileOption.endsWith('package.json') ||
+                fileOption.endsWith('package-lock.json')) {
+                const directoryWithPackageJson = path.dirname(fileOption);
+                if (packageJsonFileExistsInDirectory(directoryWithPackageJson)) {
+                    const packageJsonPath = path.resolve(directoryWithPackageJson, 'package.json');
+                    const packageJsonContainsSnykDep = checkPackageJsonForSnykDependency(packageJsonPath);
+                    if (packageJsonContainsSnykDep) {
+                        packageJsonPathsWithSnykDepForProtect.push(packageJsonPath);
+                    }
+                }
+            }
+        }
+        else {
+            paths.forEach((testPath) => {
+                if (packageJsonFileExistsInDirectory(testPath)) {
+                    const packageJsonPath = path.resolve(testPath, 'package.json');
+                    const packageJsonContainsSnykDep = checkPackageJsonForSnykDependency(packageJsonPath);
+                    if (packageJsonContainsSnykDep) {
+                        packageJsonPathsWithSnykDepForProtect.push(packageJsonPath);
+                    }
+                }
+            });
+        }
+    }
+    catch (e) {
+        debug('Error in getPackageJsonPathsContainingSnykDependency()', e);
+    }
+    return packageJsonPathsWithSnykDepForProtect;
+}
+exports.getPackageJsonPathsContainingSnykDependency = getPackageJsonPathsContainingSnykDependency;
+
+
 /***/ }),
 
 /***/ 46816: