snyk 1.791.0 → 1.792.0

package/dist/cli/917.index.js

@@ -1964,6 +1964,7 @@ const format_test_error_1 = __webpack_require__(68214);
 const display_result_1 = __webpack_require__(89667);
 const analytics = __webpack_require__(82744);
 const protect_update_notification_1 = __webpack_require__(79304);
+const spotlight_vuln_notification_1 = __webpack_require__(24083);
 const debug = Debug('snyk-test');
 const SEPARATOR = '\n-------------------------------------------------------\n';
 // TODO: avoid using `as any` whenever it's possible
@@ -2145,6 +2146,10 @@ async function test(...args) {
             }
         }
         response += chalk_1.default.bold.red(summaryMessage);
+        response += os_1.EOL + os_1.EOL;
+        const foundSpotlightVulnIds = spotlight_vuln_notification_1.containsSpotlightVulnIds(results);
+        const spotlightVulnsMsg = spotlight_vuln_notification_1.notificationForSpotlightVulns(foundSpotlightVulnIds);
+        response += spotlightVulnsMsg;
         const error = new Error(response);
         // take the code of the first problem to go through error
         // translation
@@ -3085,6 +3090,73 @@ function mapIacIssue(iacIssue) {
 exports.mapIacIssue = mapIacIssue;
 
 
+/***/ }),
+
+/***/ 24083:
+/***/ ((__unused_webpack_module, exports, __webpack_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.notificationForSpotlightVulns = exports.containsSpotlightVulnIds = void 0;
+const theme = __webpack_require__(86988);
+const createDebug = __webpack_require__(15158);
+const os_1 = __webpack_require__(12087);
+const debug = createDebug('snyk-spotlight-vuln-notification');
+const spotlightVulnIds = ['SNYK-JAVA-ORGAPACHELOGGINGLOG4J-2314720'];
+function containsSpotlightVulnIds(results) {
+    try {
+        const spotlightVulnsFound = new Set();
+        for (const r of results) {
+            if (r.vulnerabilities) {
+                for (const v of r.vulnerabilities) {
+                    if (spotlightVulnIds.includes(v.id)) {
+                        spotlightVulnsFound.add(v.id);
+                    }
+                }
+            }
+        }
+        return [...spotlightVulnsFound];
+    }
+    catch (err) {
+        debug('Error in containsSpotlightVulnIds()', err);
+        return [];
+    }
+}
+exports.containsSpotlightVulnIds = containsSpotlightVulnIds;
+function notificationForSpotlightVulns(foundSpotlightVulnsIds) {
+    try {
+        if (foundSpotlightVulnsIds.length > 0) {
+            let message = '';
+            for (const vulnId of spotlightVulnIds) {
+                if (vulnId === 'SNYK-JAVA-ORGAPACHELOGGINGLOG4J-2314720') {
+                    message += theme.color.severity.critical(`${theme.icon.WARNING} WARNING: Critical severity vulnerabilities were found with Log4j!` +
+                        os_1.EOL);
+                    for (const vulnId of foundSpotlightVulnsIds) {
+                        message += `  - ${vulnId} (See https://snyk.io/vuln/${vulnId})`;
+                    }
+                    message += os_1.EOL + os_1.EOL;
+                    message +=
+                        theme.color.severity.critical(`We highly recommend fixing this vulnerability. If it cannot be fixed by upgrading, see mitigation information here:`) +
+                            os_1.EOL +
+                            '  - https://security.snyk.io/vuln/SNYK-JAVA-ORGAPACHELOGGINGLOG4J-2314720' +
+                            os_1.EOL +
+                            '  - https://snyk.io/blog/log4shell-remediation-cheat-sheet/' +
+                            os_1.EOL;
+                }
+            }
+            return message;
+        }
+        return '';
+    }
+    catch (err) {
+        debug('Error in notificationForSpotlightVulns()', err);
+        return '';
+    }
+}
+exports.notificationForSpotlightVulns = notificationForSpotlightVulns;
+
+
 /***/ }),
 
 /***/ 14784: