snyk 1.798.0 → 1.799.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/dist/cli/989.index.js
CHANGED
|
@@ -288,7 +288,7 @@ async function traverse(path, handle) {
|
|
|
288
288
|
}
|
|
289
289
|
}
|
|
290
290
|
function isJavaArchive(path) {
|
|
291
|
-
return path.endsWith('.jar') || path.endsWith('.war');
|
|
291
|
+
return path.endsWith('.jar') || path.endsWith('.war') || path.endsWith('ear');
|
|
292
292
|
}
|
|
293
293
|
function isJvmFile(path) {
|
|
294
294
|
return path.endsWith('.java') || path.endsWith('.class');
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"989.index.js","mappings":";;;;;;;;;;;AAAa,wBAAgB,GAAa;IACxC,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;CACzB,CAAC;;;;;;;;;;AClKF,wCAAqC;AACrC,0CAAiC;AACjC,0CAAkC;AAClC,uCAA2B;AAC3B,sDAAsD;AAEtD,MAAM,QAAQ,GAAG,aAAQ,CAAC,QAAQ,CAAC;AACnC,MAAM,OAAO,GAAG,aAAQ,CAAC,OAAO,CAAC;AACjC,MAAM,IAAI,GAAG,aAAQ,CAAC,IAAI,CAAC;AAC3B,MAAM,aAAa,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC;AAcjD,MAAM,MAAM,GAAU,EAAE,CAAC;AAEzB,KAAK,UAAU,YAAY;IACzB,MAAM,OAAO,GAAY,GAAG,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1E,OAAO,CAAC,IAAI,GAAG,0BAA0B,CAAC;IAC1C,OAAO,CAAC,KAAK,EAAE,CAAC;IAEhB,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,6DAA6D;AAC9C,KAAK,UAAU,SAAS,CAAC,GAAG,IAAgB;IACzD,OAAO,CAAC,GAAG,CACT,sGAAsG,CACvG,CAAC;IAEF,MAAM,UAAU,GAAqB,IAAI,KAAK,EAAa,CAAC;IAC5D,MAAM,KAAK,GAAW,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,MAAM,YAAY,EAAE,CAAC;IAErC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE;QACxB,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,aAAa,CAAC,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;KAChD;IAED,OAAO,CAAC,IAAI,EAAE,CAAC;IAEf,MAAM,OAAO,GAAgB,IAAI,GAAG,EAAE,CAAC;IACvC,UAAU,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,EAAE;QAC/B,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,CACjC,yCAAyC,EACzC,IAAI,CACL,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC1B,IAAI,OAAO,CAAC,IAAI,IAAI,CAAC,EAAE;QACrB,OAAO,CAAC,GAAG,CAAC,6CAA6C,CAAC,CAAC;QAC3D,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;YACvB,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QAC5B,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,CAAC;;kEAEkD,CAAC,CAAC;QAEhE,aAAa,EAAE,CAAC;KACjB;IACD,OAAO,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC;AACnE,CAAC;AAtCD,4BAsCC;AAED,KAAK,UAAU,aAAa,CAC1B,OAAoB,EACpB,IAAY,EACZ,WAA6B;IAE7B,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE;QAC1C,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;QAE1C,IAAI,mCAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE;YACnC,WAAW,CAAC,IAAI,CAAC;gBACf,IAAI;gBACJ,IAAI;aACL,CAAC,CAAC;YACH,OAAO;SACR;KACF;IAED,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE;QACxB,OAAO;KACR;IAED,IAAI;QACF,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC;QAChC,MAAM,OAAO,GAAG,GAAG,CAAC,UAAU,EAAE,CAAC;QAEjC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE;YAC3B,IAAI,KAAK,CAAC,WAAW,EAAE;gBACrB,SAAS;aACV;YAED,MAAM,aAAa,CACjB,KAAK,CAAC,OAAO,EAAE,EACf,IAAI,GAAG,GAAG,GAAG,KAAK,CAAC,SAAS,EAC5B,WAAW,CACZ,CAAC;SACH;KACF;IAAC,OAAO,KAAK,EAAE;QACd,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;KACpB;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,OAAoB;IAC/C,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACtD,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AACjD,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,IAAU;IAC5B,MAAM,MAAM,GAAW,EAAE,CAAC;IAE1B,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,QAAgB,EAAE,KAAY,EAAE,EAAE;QACtD,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,IAAI,GAAG,aAAa,EAAE;YACjD,OAAO;SACR;QACD,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAU,EAAE,MAAmB;IACrD,IAAI;QACF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;QAE/B,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE;YACxB,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACpB,OAAO;SACR;QAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;QACpC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE;YAC3B,MAAM,QAAQ,GAAG,IAAI,GAAG,GAAG,GAAG,KAAK,CAAC;YACpC,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;SAClC;KACF;IAAC,OAAO,KAAK,EAAE;QACd,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;KACpB;AACH,CAAC;AAED,SAAS,aAAa,CAAC,IAAU;IAC/B,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,SAAS,CAAC,IAAU;IAC3B,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,aAAa;IACpB,MAAM,GAAG,GAAG,IAAI,KAAK,EAAS,CAAC;IAC/B,GAAG,CAAC,IAAI,GAAG,OAAO,CAAC;IAEnB,MAAM,GAAG,CAAC;AACZ,CAAC","sources":["webpack://snyk/./src/cli/commands/log4shell-hashes.ts","webpack://snyk/./src/cli/commands/log4shell.ts"],"sourcesContent":["export const vulnerableHashes: string[] = [\n 'fBTyHDn2nUU0jgEu5XBJ5A',\n 'xmC9OBzdfLaIBvKVSKbc7g',\n 'NUt//j2o6sDxLqSTFfyPmQ',\n 'xmC9OBzdfLaIBvKVSKbc7g',\n 'oTC+5gi+FbG1R4jpKTfbTg',\n 'xmC9OBzdfLaIBvKVSKbc7g',\n 'uOUpCKY40NVjHQc2a9Xr8A',\n 'xmC9OBzdfLaIBvKVSKbc7g',\n '4Vvmz4X2WmipllB5/ous7Q',\n 'vWVkVsfR4RQjHvDG6pfOUg',\n '4DIQPHWEb/z7bholX3/oTg',\n 'xmC9OBzdfLaIBvKVSKbc7g',\n 'H7sEuRs4sj0D45EAltPQ1w',\n 'BP3XAYCdF0ZcF8fmA7GyAg',\n 'U//86tIjlVCgQQZXTQudVA',\n 'gw4e9TvocE+JqXdQ/8sxZg',\n 'BP3XAYCdF0ZcF8fmA7GyAg',\n 'U//86tIjlVCgQQZXTQudVA',\n 'gw4e9TvocE+JqXdQ/8sxZg',\n 'BP3XAYCdF0ZcF8fmA7GyAg',\n 'U//86tIjlVCgQQZXTQudVA',\n 'gw4e9TvocE+JqXdQ/8sxZg',\n 'BP3XAYCdF0ZcF8fmA7GyAg',\n 'U//86tIjlVCgQQZXTQudVA',\n 'krWKtKP0VH0HJkOaXl8tqw',\n 'WCRxHWxoFi61NcxNv3SF0w',\n 'yMKfrOVkLDiRsU9R9XbOKw',\n 'krWKtKP0VH0HJkOaXl8tqw',\n 'WCRxHWxoFi61NcxNv3SF0w',\n 'yMKfrOVkLDiRsU9R9XbOKw',\n '378Ytn/c/2G236FMYcwXgQ',\n 'IfBVtiwVRT8NeXCp2ZTKtw',\n '8e87HEC9TS3elmUxSejDMQ',\n 'y6QMMJo6qLeAwNYvTLrPdw',\n 'IfBVtiwVRT8NeXCp2ZTKtw',\n '8e87HEC9TS3elmUxSejDMQ',\n 'y6QMMJo6qLeAwNYvTLrPdw',\n 'IfBVtiwVRT8NeXCp2ZTKtw',\n '8e87HEC9TS3elmUxSejDMQ',\n 'y6QMMJo6qLeAwNYvTLrPdw',\n 'IfBVtiwVRT8NeXCp2ZTKtw',\n '8e87HEC9TS3elmUxSejDMQ',\n 'lJ9a5c4V2OLQiuoPftBxkg',\n '8dYwxIkoCWpITkuVzLFioA',\n 'bnTGE5aRFbMPtWoJ7dB2rw',\n 'apRhBWBUAlHxAZqSOZMx+g',\n '8dYwxIkoCWpITkuVzLFioA',\n 'bnTGE5aRFbMPtWoJ7dB2rw',\n 'EVldHOg3IcMdjSjEWkRajA',\n 'axX0LDM6w5q6z+7rGIUqRA',\n 'xmC9OBzdfLaIBvKVSKbc7g',\n 'EVldHOg3IcMdjSjEWkRajA',\n 'axX0LDM6w5q6z+7rGIUqRA',\n 'xmC9OBzdfLaIBvKVSKbc7g',\n 'EVldHOg3IcMdjSjEWkRajA',\n 'axX0LDM6w5q6z+7rGIUqRA',\n 'xmC9OBzdfLaIBvKVSKbc7g',\n 'pqMfiTE8K6QL1Ap2zCptrg',\n 'iyJgsczmQUT2MQh2+UsWOA',\n 'TRIdDjt+4nGJdKn689895A',\n 'pqMfiTE8K6QL1Ap2zCptrg',\n 'iyJgsczmQUT2MQh2+UsWOA',\n 'TRIdDjt+4nGJdKn689895A',\n 'pqMfiTE8K6QL1Ap2zCptrg',\n 'iyJgsczmQUT2MQh2+UsWOA',\n 'TRIdDjt+4nGJdKn689895A',\n 'CfmJLv6mhLVOjRvflS+vZA',\n 'O9n0G4nOT+jMv3PkMZWlzg',\n 'G1tHtzggRx3R9OPli2N0Tg',\n 'CfmJLv6mhLVOjRvflS+vZA',\n 'O9n0G4nOT+jMv3PkMZWlzg',\n 'G1tHtzggRx3R9OPli2N0Tg',\n 'CfmJLv6mhLVOjRvflS+vZA',\n 'O9n0G4nOT+jMv3PkMZWlzg',\n 'G1tHtzggRx3R9OPli2N0Tg',\n 't87654Z07FBVp4PlKbBJuw',\n 'QVwT58hQX7BW1UDqwpty+g',\n '44Xe+Vv3qrNNcyy3/tgHUw',\n 'HzzHitFLamLd6qGdA4XliA',\n 'QVwT58hQX7BW1UDqwpty+g',\n 'PHOrfl3/GKl2tZspVXbzVQ',\n 'Vok11jPt8NBpgaOhKOBmcA',\n 'oZNwOQSj8Y+zyQqHfrXIpw',\n 'cgy4bLqsMMH9qQTGVealZg',\n 'HzzHitFLamLd6qGdA4XliA',\n 'QVwT58hQX7BW1UDqwpty+g',\n 'PHOrfl3/GKl2tZspVXbzVQ',\n 'HzzHitFLamLd6qGdA4XliA',\n 'BP3XAYCdF0ZcF8fmA7GyAg',\n 'PHOrfl3/GKl2tZspVXbzVQ',\n 'HzzHitFLamLd6qGdA4XliA',\n 'BP3XAYCdF0ZcF8fmA7GyAg',\n 'PHOrfl3/GKl2tZspVXbzVQ',\n 'jAzz6wRxVKT44W2vWiCTGQ',\n '+/pfM6tLKab91SRz7nuDTQ',\n 'FS7LPOCUrFvJ6jnWEi4oFA',\n 'zXChiI7N0xHBmQ54SGfOHg',\n 'CI3xE60kmrcr8Zt/ALhj1Q',\n '3o0BzBX9DHT+qLu2aOKJ9Q',\n '3JkBHwR+Y9zHQbWraNEW2w',\n 'Kr7CzmZeDVKaPyj/+7st0w',\n 'siQt4Gd75lFdbO+/SOfl1Q',\n 'yL2LXFqqoHo9y/V94BySZg',\n 'XFJ4IdEISn7z4D1AFE/1Mg',\n '02XkgiFBT5P+7wk6G/YH7w',\n 'txoT/V3yUWlPyhFiQAA7Ig',\n 'ATi6HBkdXHVP0OPDphwDBw',\n 'CsWz5uabp3ZWg3mOZpowsg',\n 'jTMVRLLnsgrRZt68olUNcw',\n 'zH1V7WnMX9NANbFcbt95oA',\n 'XkvKXtILlKsZu2WDbak/lg',\n 'lI3aeHWTNAp68aGOMot7fw',\n 'hiwAsuhU+cDx6NhAnSPYmQ',\n 'EQqz4+TzeAkh6O5d3jNzrQ',\n '8MQ62soq/HHGzID4UbOIGA',\n '3Q4+C0BAg+xpYYqrtQuKwA',\n 'AHnJByMGWZaPD8DkGmq8+Q',\n 'SPfzzaUwMKh+jDh9jR5CZQ',\n 'RyyOH7qg5hUg4CXCVbXRaA',\n 'VSPxRPrvK/ygijyosr7Nag',\n 'K2Pg5QY/2sz2aaHiY4Tz/Q',\n 'VHuz7S3rhW0OO713wnuWJQ',\n 'SlF3oXJ2S9pvRHK5S6F8yw',\n 'xtIzvI6c/l2mkAWdJ9n4jw',\n '+rZGJX+UWwsqfOPhw+POXw',\n 'lC9Cnqy4AV4Y2PWZls++5g',\n 'jAzz6wRxVKT44W2vWiCTGQ',\n '+/pfM6tLKab91SRz7nuDTQ',\n 'FS7LPOCUrFvJ6jnWEi4oFA',\n 'zXChiI7N0xHBmQ54SGfOHg',\n 'CI3xE60kmrcr8Zt/ALhj1Q',\n '3o0BzBX9DHT+qLu2aOKJ9Q',\n '3JkBHwR+Y9zHQbWraNEW2w',\n 'Kr7CzmZeDVKaPyj/+7st0w',\n 'siQt4Gd75lFdbO+/SOfl1Q',\n 'yL2LXFqqoHo9y/V94BySZg',\n 'XFJ4IdEISn7z4D1AFE/1Mg',\n '02XkgiFBT5P+7wk6G/YH7w',\n 'txoT/V3yUWlPyhFiQAA7Ig',\n 'ATi6HBkdXHVP0OPDphwDBw',\n 'CsWz5uabp3ZWg3mOZpowsg',\n 'jTMVRLLnsgrRZt68olUNcw',\n 'zH1V7WnMX9NANbFcbt95oA',\n 'XkvKXtILlKsZu2WDbak/lg',\n 'lI3aeHWTNAp68aGOMot7fw',\n 'hiwAsuhU+cDx6NhAnSPYmQ',\n 'EQqz4+TzeAkh6O5d3jNzrQ',\n '8MQ62soq/HHGzID4UbOIGA',\n '3Q4+C0BAg+xpYYqrtQuKwA',\n 'AHnJByMGWZaPD8DkGmq8+Q',\n 'SPfzzaUwMKh+jDh9jR5CZQ',\n 'RyyOH7qg5hUg4CXCVbXRaA',\n 'VSPxRPrvK/ygijyosr7Nag',\n 'K2Pg5QY/2sz2aaHiY4Tz/Q',\n 'VHuz7S3rhW0OO713wnuWJQ',\n 'SlF3oXJ2S9pvRHK5S6F8yw',\n 'xtIzvI6c/l2mkAWdJ9n4jw',\n '+rZGJX+UWwsqfOPhw+POXw',\n 'lC9Cnqy4AV4Y2PWZls++5g',\n 'XSU+U/qZPhIv8BIiGqSeww',\n 'YntxiBxwzUm5F4IzC78f/w',\n 'geBDOuAGAsDk0AQk0hOwqw',\n];\n","import { MethodArgs } from '../args';\nimport { promises, Stats } from 'fs';\nimport * as crypto from 'crypto';\nimport * as AdmZip from 'adm-zip';\nimport * as ora from 'ora';\nimport { vulnerableHashes } from './log4shell-hashes';\n\nconst readFile = promises.readFile;\nconst readDir = promises.readdir;\nconst stat = promises.stat;\nconst MAX_FILE_SIZE = 2 * 1024 * 1024 * 1024 - 1;\n\ntype Signature = {\n hash: string;\n path: string;\n};\ntype Path = string;\ntype FileContent = Buffer;\ntype Digest = string;\n\ninterface FileHandler {\n (filePath: string, stats: Stats): void;\n}\n\nconst errors: any[] = [];\n\nasync function startSpinner(): Promise<ora.Ora> {\n const spinner: ora.Ora = ora({ isSilent: false, stream: process.stdout });\n spinner.text = `Looking for Log4Shell...`;\n spinner.start();\n\n return spinner;\n}\n\n// eslint-disable-next-line @typescript-eslint/no-unused-vars\nexport default async function log4shell(...args: MethodArgs): Promise<void> {\n console.log(\n 'Please note this command is for already built artifacts. To test source code please use `snyk test`.',\n );\n\n const signatures: Array<Signature> = new Array<Signature>();\n const paths: Path[] = await find('.');\n const spinner = await startSpinner();\n\n for (const path of paths) {\n const content = await readFile(path);\n await handleContent(content, path, signatures);\n }\n\n spinner.stop();\n\n const results: Set<string> = new Set();\n signatures.forEach((signature) => {\n const path = signature.path.replace(\n /(.*org\\/apache\\/logging\\/log4j\\/core).*/,\n '$1',\n );\n results.add(path);\n });\n\n console.log('\\nResults:');\n if (results.size != 0) {\n console.log('A vulnerable version of log4j was detected:');\n results.forEach((path) => {\n console.log(`\\t ${path}`);\n });\n console.log(`\\n We highly recommend fixing this vulnerability. If it cannot be fixed by upgrading, see mitigation information here:\n \\t- https://security.snyk.io/vuln/SNYK-JAVA-ORGAPACHELOGGINGLOG4J-2314720\n \\t- https://snyk.io/blog/log4shell-remediation-cheat-sheet/`);\n\n exitWithError();\n }\n console.log('No known vulnerable version of log4j was detected');\n}\n\nasync function handleContent(\n content: FileContent,\n path: string,\n accumulator: Array<Signature>,\n): Promise<void> {\n if (isJvmFile(path) || isJavaArchive(path)) {\n const hash = await computeDigest(content);\n\n if (vulnerableHashes.includes(hash)) {\n accumulator.push({\n hash,\n path,\n });\n return;\n }\n }\n\n if (!isJavaArchive(path)) {\n return;\n }\n\n try {\n const zip = new AdmZip(content);\n const entries = zip.getEntries();\n\n for (const entry of entries) {\n if (entry.isDirectory) {\n continue;\n }\n\n await handleContent(\n entry.getData(),\n path + '/' + entry.entryName,\n accumulator,\n );\n }\n } catch (error) {\n errors.push(error);\n }\n}\n\nasync function computeDigest(content: FileContent): Promise<Digest> {\n const hash = crypto.createHash('md5').update(content);\n return hash.digest('base64').replace(/=/g, '');\n}\n\nasync function find(path: Path): Promise<Path[]> {\n const result: Path[] = [];\n\n await traverse(path, (filePath: string, stats: Stats) => {\n if (!stats.isFile() || stats.size > MAX_FILE_SIZE) {\n return;\n }\n result.push(filePath);\n });\n\n return result;\n}\n\nasync function traverse(path: Path, handle: FileHandler) {\n try {\n const stats = await stat(path);\n\n if (!stats.isDirectory()) {\n handle(path, stats);\n return;\n }\n\n const entries = await readDir(path);\n for (const entry of entries) {\n const absolute = path + '/' + entry;\n await traverse(absolute, handle);\n }\n } catch (error) {\n errors.push(error);\n }\n}\n\nfunction isJavaArchive(path: Path) {\n return path.endsWith('.jar') || path.endsWith('.war');\n}\n\nfunction isJvmFile(path: Path) {\n return path.endsWith('.java') || path.endsWith('.class');\n}\n\nfunction exitWithError() {\n const err = new Error() as any;\n err.code = 'VULNS';\n\n throw err;\n}\n"],"names":[],"sourceRoot":""}
|
|
1
|
+
{"version":3,"file":"989.index.js","mappings":";;;;;;;;;;;AAAa,wBAAgB,GAAa;IACxC,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;CACzB,CAAC;;;;;;;;;;AClKF,wCAAqC;AACrC,0CAAiC;AACjC,0CAAkC;AAClC,uCAA2B;AAC3B,sDAAsD;AAEtD,MAAM,QAAQ,GAAG,aAAQ,CAAC,QAAQ,CAAC;AACnC,MAAM,OAAO,GAAG,aAAQ,CAAC,OAAO,CAAC;AACjC,MAAM,IAAI,GAAG,aAAQ,CAAC,IAAI,CAAC;AAC3B,MAAM,aAAa,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC;AAcjD,MAAM,MAAM,GAAU,EAAE,CAAC;AAEzB,KAAK,UAAU,YAAY;IACzB,MAAM,OAAO,GAAY,GAAG,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1E,OAAO,CAAC,IAAI,GAAG,0BAA0B,CAAC;IAC1C,OAAO,CAAC,KAAK,EAAE,CAAC;IAEhB,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,6DAA6D;AAC9C,KAAK,UAAU,SAAS,CAAC,GAAG,IAAgB;IACzD,OAAO,CAAC,GAAG,CACT,sGAAsG,CACvG,CAAC;IAEF,MAAM,UAAU,GAAqB,IAAI,KAAK,EAAa,CAAC;IAC5D,MAAM,KAAK,GAAW,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,MAAM,YAAY,EAAE,CAAC;IAErC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE;QACxB,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,aAAa,CAAC,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;KAChD;IAED,OAAO,CAAC,IAAI,EAAE,CAAC;IAEf,MAAM,OAAO,GAAgB,IAAI,GAAG,EAAE,CAAC;IACvC,UAAU,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,EAAE;QAC/B,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,CACjC,yCAAyC,EACzC,IAAI,CACL,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC1B,IAAI,OAAO,CAAC,IAAI,IAAI,CAAC,EAAE;QACrB,OAAO,CAAC,GAAG,CAAC,6CAA6C,CAAC,CAAC;QAC3D,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;YACvB,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QAC5B,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,CAAC;;kEAEkD,CAAC,CAAC;QAEhE,aAAa,EAAE,CAAC;KACjB;IACD,OAAO,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC;AACnE,CAAC;AAtCD,4BAsCC;AAED,KAAK,UAAU,aAAa,CAC1B,OAAoB,EACpB,IAAY,EACZ,WAA6B;IAE7B,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE;QAC1C,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;QAE1C,IAAI,mCAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE;YACnC,WAAW,CAAC,IAAI,CAAC;gBACf,IAAI;gBACJ,IAAI;aACL,CAAC,CAAC;YACH,OAAO;SACR;KACF;IAED,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE;QACxB,OAAO;KACR;IAED,IAAI;QACF,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC;QAChC,MAAM,OAAO,GAAG,GAAG,CAAC,UAAU,EAAE,CAAC;QAEjC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE;YAC3B,IAAI,KAAK,CAAC,WAAW,EAAE;gBACrB,SAAS;aACV;YAED,MAAM,aAAa,CACjB,KAAK,CAAC,OAAO,EAAE,EACf,IAAI,GAAG,GAAG,GAAG,KAAK,CAAC,SAAS,EAC5B,WAAW,CACZ,CAAC;SACH;KACF;IAAC,OAAO,KAAK,EAAE;QACd,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;KACpB;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,OAAoB;IAC/C,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACtD,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AACjD,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,IAAU;IAC5B,MAAM,MAAM,GAAW,EAAE,CAAC;IAE1B,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,QAAgB,EAAE,KAAY,EAAE,EAAE;QACtD,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,IAAI,GAAG,aAAa,EAAE;YACjD,OAAO;SACR;QACD,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAU,EAAE,MAAmB;IACrD,IAAI;QACF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;QAE/B,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE;YACxB,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACpB,OAAO;SACR;QAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;QACpC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE;YAC3B,MAAM,QAAQ,GAAG,IAAI,GAAG,GAAG,GAAG,KAAK,CAAC;YACpC,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;SAClC;KACF;IAAC,OAAO,KAAK,EAAE;QACd,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;KACpB;AACH,CAAC;AAED,SAAS,aAAa,CAAC,IAAU;IAC/B,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,SAAS,CAAC,IAAU;IAC3B,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,aAAa;IACpB,MAAM,GAAG,GAAG,IAAI,KAAK,EAAS,CAAC;IAC/B,GAAG,CAAC,IAAI,GAAG,OAAO,CAAC;IAEnB,MAAM,GAAG,CAAC;AACZ,CAAC","sources":["webpack://snyk/./src/cli/commands/log4shell-hashes.ts","webpack://snyk/./src/cli/commands/log4shell.ts"],"sourcesContent":["export const vulnerableHashes: string[] = [\n 'fBTyHDn2nUU0jgEu5XBJ5A',\n 'xmC9OBzdfLaIBvKVSKbc7g',\n 'NUt//j2o6sDxLqSTFfyPmQ',\n 'xmC9OBzdfLaIBvKVSKbc7g',\n 'oTC+5gi+FbG1R4jpKTfbTg',\n 'xmC9OBzdfLaIBvKVSKbc7g',\n 'uOUpCKY40NVjHQc2a9Xr8A',\n 'xmC9OBzdfLaIBvKVSKbc7g',\n '4Vvmz4X2WmipllB5/ous7Q',\n 'vWVkVsfR4RQjHvDG6pfOUg',\n '4DIQPHWEb/z7bholX3/oTg',\n 'xmC9OBzdfLaIBvKVSKbc7g',\n 'H7sEuRs4sj0D45EAltPQ1w',\n 'BP3XAYCdF0ZcF8fmA7GyAg',\n 'U//86tIjlVCgQQZXTQudVA',\n 'gw4e9TvocE+JqXdQ/8sxZg',\n 'BP3XAYCdF0ZcF8fmA7GyAg',\n 'U//86tIjlVCgQQZXTQudVA',\n 'gw4e9TvocE+JqXdQ/8sxZg',\n 'BP3XAYCdF0ZcF8fmA7GyAg',\n 'U//86tIjlVCgQQZXTQudVA',\n 'gw4e9TvocE+JqXdQ/8sxZg',\n 'BP3XAYCdF0ZcF8fmA7GyAg',\n 'U//86tIjlVCgQQZXTQudVA',\n 'krWKtKP0VH0HJkOaXl8tqw',\n 'WCRxHWxoFi61NcxNv3SF0w',\n 'yMKfrOVkLDiRsU9R9XbOKw',\n 'krWKtKP0VH0HJkOaXl8tqw',\n 'WCRxHWxoFi61NcxNv3SF0w',\n 'yMKfrOVkLDiRsU9R9XbOKw',\n '378Ytn/c/2G236FMYcwXgQ',\n 'IfBVtiwVRT8NeXCp2ZTKtw',\n '8e87HEC9TS3elmUxSejDMQ',\n 'y6QMMJo6qLeAwNYvTLrPdw',\n 'IfBVtiwVRT8NeXCp2ZTKtw',\n '8e87HEC9TS3elmUxSejDMQ',\n 'y6QMMJo6qLeAwNYvTLrPdw',\n 'IfBVtiwVRT8NeXCp2ZTKtw',\n '8e87HEC9TS3elmUxSejDMQ',\n 'y6QMMJo6qLeAwNYvTLrPdw',\n 'IfBVtiwVRT8NeXCp2ZTKtw',\n '8e87HEC9TS3elmUxSejDMQ',\n 'lJ9a5c4V2OLQiuoPftBxkg',\n '8dYwxIkoCWpITkuVzLFioA',\n 'bnTGE5aRFbMPtWoJ7dB2rw',\n 'apRhBWBUAlHxAZqSOZMx+g',\n '8dYwxIkoCWpITkuVzLFioA',\n 'bnTGE5aRFbMPtWoJ7dB2rw',\n 'EVldHOg3IcMdjSjEWkRajA',\n 'axX0LDM6w5q6z+7rGIUqRA',\n 'xmC9OBzdfLaIBvKVSKbc7g',\n 'EVldHOg3IcMdjSjEWkRajA',\n 'axX0LDM6w5q6z+7rGIUqRA',\n 'xmC9OBzdfLaIBvKVSKbc7g',\n 'EVldHOg3IcMdjSjEWkRajA',\n 'axX0LDM6w5q6z+7rGIUqRA',\n 'xmC9OBzdfLaIBvKVSKbc7g',\n 'pqMfiTE8K6QL1Ap2zCptrg',\n 'iyJgsczmQUT2MQh2+UsWOA',\n 'TRIdDjt+4nGJdKn689895A',\n 'pqMfiTE8K6QL1Ap2zCptrg',\n 'iyJgsczmQUT2MQh2+UsWOA',\n 'TRIdDjt+4nGJdKn689895A',\n 'pqMfiTE8K6QL1Ap2zCptrg',\n 'iyJgsczmQUT2MQh2+UsWOA',\n 'TRIdDjt+4nGJdKn689895A',\n 'CfmJLv6mhLVOjRvflS+vZA',\n 'O9n0G4nOT+jMv3PkMZWlzg',\n 'G1tHtzggRx3R9OPli2N0Tg',\n 'CfmJLv6mhLVOjRvflS+vZA',\n 'O9n0G4nOT+jMv3PkMZWlzg',\n 'G1tHtzggRx3R9OPli2N0Tg',\n 'CfmJLv6mhLVOjRvflS+vZA',\n 'O9n0G4nOT+jMv3PkMZWlzg',\n 'G1tHtzggRx3R9OPli2N0Tg',\n 't87654Z07FBVp4PlKbBJuw',\n 'QVwT58hQX7BW1UDqwpty+g',\n '44Xe+Vv3qrNNcyy3/tgHUw',\n 'HzzHitFLamLd6qGdA4XliA',\n 'QVwT58hQX7BW1UDqwpty+g',\n 'PHOrfl3/GKl2tZspVXbzVQ',\n 'Vok11jPt8NBpgaOhKOBmcA',\n 'oZNwOQSj8Y+zyQqHfrXIpw',\n 'cgy4bLqsMMH9qQTGVealZg',\n 'HzzHitFLamLd6qGdA4XliA',\n 'QVwT58hQX7BW1UDqwpty+g',\n 'PHOrfl3/GKl2tZspVXbzVQ',\n 'HzzHitFLamLd6qGdA4XliA',\n 'BP3XAYCdF0ZcF8fmA7GyAg',\n 'PHOrfl3/GKl2tZspVXbzVQ',\n 'HzzHitFLamLd6qGdA4XliA',\n 'BP3XAYCdF0ZcF8fmA7GyAg',\n 'PHOrfl3/GKl2tZspVXbzVQ',\n 'jAzz6wRxVKT44W2vWiCTGQ',\n '+/pfM6tLKab91SRz7nuDTQ',\n 'FS7LPOCUrFvJ6jnWEi4oFA',\n 'zXChiI7N0xHBmQ54SGfOHg',\n 'CI3xE60kmrcr8Zt/ALhj1Q',\n '3o0BzBX9DHT+qLu2aOKJ9Q',\n '3JkBHwR+Y9zHQbWraNEW2w',\n 'Kr7CzmZeDVKaPyj/+7st0w',\n 'siQt4Gd75lFdbO+/SOfl1Q',\n 'yL2LXFqqoHo9y/V94BySZg',\n 'XFJ4IdEISn7z4D1AFE/1Mg',\n '02XkgiFBT5P+7wk6G/YH7w',\n 'txoT/V3yUWlPyhFiQAA7Ig',\n 'ATi6HBkdXHVP0OPDphwDBw',\n 'CsWz5uabp3ZWg3mOZpowsg',\n 'jTMVRLLnsgrRZt68olUNcw',\n 'zH1V7WnMX9NANbFcbt95oA',\n 'XkvKXtILlKsZu2WDbak/lg',\n 'lI3aeHWTNAp68aGOMot7fw',\n 'hiwAsuhU+cDx6NhAnSPYmQ',\n 'EQqz4+TzeAkh6O5d3jNzrQ',\n '8MQ62soq/HHGzID4UbOIGA',\n '3Q4+C0BAg+xpYYqrtQuKwA',\n 'AHnJByMGWZaPD8DkGmq8+Q',\n 'SPfzzaUwMKh+jDh9jR5CZQ',\n 'RyyOH7qg5hUg4CXCVbXRaA',\n 'VSPxRPrvK/ygijyosr7Nag',\n 'K2Pg5QY/2sz2aaHiY4Tz/Q',\n 'VHuz7S3rhW0OO713wnuWJQ',\n 'SlF3oXJ2S9pvRHK5S6F8yw',\n 'xtIzvI6c/l2mkAWdJ9n4jw',\n '+rZGJX+UWwsqfOPhw+POXw',\n 'lC9Cnqy4AV4Y2PWZls++5g',\n 'jAzz6wRxVKT44W2vWiCTGQ',\n '+/pfM6tLKab91SRz7nuDTQ',\n 'FS7LPOCUrFvJ6jnWEi4oFA',\n 'zXChiI7N0xHBmQ54SGfOHg',\n 'CI3xE60kmrcr8Zt/ALhj1Q',\n '3o0BzBX9DHT+qLu2aOKJ9Q',\n '3JkBHwR+Y9zHQbWraNEW2w',\n 'Kr7CzmZeDVKaPyj/+7st0w',\n 'siQt4Gd75lFdbO+/SOfl1Q',\n 'yL2LXFqqoHo9y/V94BySZg',\n 'XFJ4IdEISn7z4D1AFE/1Mg',\n '02XkgiFBT5P+7wk6G/YH7w',\n 'txoT/V3yUWlPyhFiQAA7Ig',\n 'ATi6HBkdXHVP0OPDphwDBw',\n 'CsWz5uabp3ZWg3mOZpowsg',\n 'jTMVRLLnsgrRZt68olUNcw',\n 'zH1V7WnMX9NANbFcbt95oA',\n 'XkvKXtILlKsZu2WDbak/lg',\n 'lI3aeHWTNAp68aGOMot7fw',\n 'hiwAsuhU+cDx6NhAnSPYmQ',\n 'EQqz4+TzeAkh6O5d3jNzrQ',\n '8MQ62soq/HHGzID4UbOIGA',\n '3Q4+C0BAg+xpYYqrtQuKwA',\n 'AHnJByMGWZaPD8DkGmq8+Q',\n 'SPfzzaUwMKh+jDh9jR5CZQ',\n 'RyyOH7qg5hUg4CXCVbXRaA',\n 'VSPxRPrvK/ygijyosr7Nag',\n 'K2Pg5QY/2sz2aaHiY4Tz/Q',\n 'VHuz7S3rhW0OO713wnuWJQ',\n 'SlF3oXJ2S9pvRHK5S6F8yw',\n 'xtIzvI6c/l2mkAWdJ9n4jw',\n '+rZGJX+UWwsqfOPhw+POXw',\n 'lC9Cnqy4AV4Y2PWZls++5g',\n 'XSU+U/qZPhIv8BIiGqSeww',\n 'YntxiBxwzUm5F4IzC78f/w',\n 'geBDOuAGAsDk0AQk0hOwqw',\n];\n","import { MethodArgs } from '../args';\nimport { promises, Stats } from 'fs';\nimport * as crypto from 'crypto';\nimport * as AdmZip from 'adm-zip';\nimport * as ora from 'ora';\nimport { vulnerableHashes } from './log4shell-hashes';\n\nconst readFile = promises.readFile;\nconst readDir = promises.readdir;\nconst stat = promises.stat;\nconst MAX_FILE_SIZE = 2 * 1024 * 1024 * 1024 - 1;\n\ntype Signature = {\n hash: string;\n path: string;\n};\ntype Path = string;\ntype FileContent = Buffer;\ntype Digest = string;\n\ninterface FileHandler {\n (filePath: string, stats: Stats): void;\n}\n\nconst errors: any[] = [];\n\nasync function startSpinner(): Promise<ora.Ora> {\n const spinner: ora.Ora = ora({ isSilent: false, stream: process.stdout });\n spinner.text = `Looking for Log4Shell...`;\n spinner.start();\n\n return spinner;\n}\n\n// eslint-disable-next-line @typescript-eslint/no-unused-vars\nexport default async function log4shell(...args: MethodArgs): Promise<void> {\n console.log(\n 'Please note this command is for already built artifacts. To test source code please use `snyk test`.',\n );\n\n const signatures: Array<Signature> = new Array<Signature>();\n const paths: Path[] = await find('.');\n const spinner = await startSpinner();\n\n for (const path of paths) {\n const content = await readFile(path);\n await handleContent(content, path, signatures);\n }\n\n spinner.stop();\n\n const results: Set<string> = new Set();\n signatures.forEach((signature) => {\n const path = signature.path.replace(\n /(.*org\\/apache\\/logging\\/log4j\\/core).*/,\n '$1',\n );\n results.add(path);\n });\n\n console.log('\\nResults:');\n if (results.size != 0) {\n console.log('A vulnerable version of log4j was detected:');\n results.forEach((path) => {\n console.log(`\\t ${path}`);\n });\n console.log(`\\n We highly recommend fixing this vulnerability. If it cannot be fixed by upgrading, see mitigation information here:\n \\t- https://security.snyk.io/vuln/SNYK-JAVA-ORGAPACHELOGGINGLOG4J-2314720\n \\t- https://snyk.io/blog/log4shell-remediation-cheat-sheet/`);\n\n exitWithError();\n }\n console.log('No known vulnerable version of log4j was detected');\n}\n\nasync function handleContent(\n content: FileContent,\n path: string,\n accumulator: Array<Signature>,\n): Promise<void> {\n if (isJvmFile(path) || isJavaArchive(path)) {\n const hash = await computeDigest(content);\n\n if (vulnerableHashes.includes(hash)) {\n accumulator.push({\n hash,\n path,\n });\n return;\n }\n }\n\n if (!isJavaArchive(path)) {\n return;\n }\n\n try {\n const zip = new AdmZip(content);\n const entries = zip.getEntries();\n\n for (const entry of entries) {\n if (entry.isDirectory) {\n continue;\n }\n\n await handleContent(\n entry.getData(),\n path + '/' + entry.entryName,\n accumulator,\n );\n }\n } catch (error) {\n errors.push(error);\n }\n}\n\nasync function computeDigest(content: FileContent): Promise<Digest> {\n const hash = crypto.createHash('md5').update(content);\n return hash.digest('base64').replace(/=/g, '');\n}\n\nasync function find(path: Path): Promise<Path[]> {\n const result: Path[] = [];\n\n await traverse(path, (filePath: string, stats: Stats) => {\n if (!stats.isFile() || stats.size > MAX_FILE_SIZE) {\n return;\n }\n result.push(filePath);\n });\n\n return result;\n}\n\nasync function traverse(path: Path, handle: FileHandler) {\n try {\n const stats = await stat(path);\n\n if (!stats.isDirectory()) {\n handle(path, stats);\n return;\n }\n\n const entries = await readDir(path);\n for (const entry of entries) {\n const absolute = path + '/' + entry;\n await traverse(absolute, handle);\n }\n } catch (error) {\n errors.push(error);\n }\n}\n\nfunction isJavaArchive(path: Path) {\n return path.endsWith('.jar') || path.endsWith('.war') || path.endsWith('ear');\n}\n\nfunction isJvmFile(path: Path) {\n return path.endsWith('.java') || path.endsWith('.class');\n}\n\nfunction exitWithError() {\n const err = new Error() as any;\n err.code = 'VULNS';\n\n throw err;\n}\n"],"names":[],"sourceRoot":""}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "snyk",
|
|
3
|
-
"version": "1.
|
|
3
|
+
"version": "1.799.0",
|
|
4
4
|
"description": "snyk library and cli utility",
|
|
5
5
|
"files": [
|
|
6
6
|
"help/cli-commands",
|
|
@@ -86,5 +86,5 @@
|
|
|
86
86
|
"registry": "https://registry.npmjs.org/",
|
|
87
87
|
"access": "public"
|
|
88
88
|
},
|
|
89
|
-
"gitHead": "
|
|
89
|
+
"gitHead": "52531267904792f7a9614d5c58856395d69e952e"
|
|
90
90
|
}
|