snyk 1.799.0 → 1.800.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/cli/989.index.js +41 -0
- package/dist/cli/989.index.js.map +1 -1
- package/package.json +2 -2
package/dist/cli/989.index.js
CHANGED
|
@@ -172,6 +172,47 @@ exports.vulnerableHashes = [
|
|
|
172
172
|
'XSU+U/qZPhIv8BIiGqSeww',
|
|
173
173
|
'YntxiBxwzUm5F4IzC78f/w',
|
|
174
174
|
'geBDOuAGAsDk0AQk0hOwqw',
|
|
175
|
+
'C1fpJhCjMxrxWn6Q+LNTnQ',
|
|
176
|
+
'uhz4+B57MccJdoVhuoq1WA',
|
|
177
|
+
'7Q4xglxv2kNCP7ODV6QrPQ',
|
|
178
|
+
'n0GSikGCAN4iMt0yblIsxw',
|
|
179
|
+
// JNDI
|
|
180
|
+
'I2XBK0p8X6XXkD3ZDKnkYw',
|
|
181
|
+
'eyz48unYUBSISt1JCHimAA',
|
|
182
|
+
'TLOgJx93wC/S3jFEpymrcA',
|
|
183
|
+
'2hlaKeNOAunkxmY84LjyQw',
|
|
184
|
+
'iFaGU1RTWaznU/GacrGCCA',
|
|
185
|
+
'jt7bsWRsGk3Wzbk9mgH0PA',
|
|
186
|
+
'/pY978Y9LfhtPU4vFgk5qw',
|
|
187
|
+
'eyz48unYUBSISt1JCHimAA',
|
|
188
|
+
'ZiEYhGxFLElz7KEFeFmtYQ',
|
|
189
|
+
'dmv2t1Wt7mc4OP35aMFQeQ',
|
|
190
|
+
'jt7bsWRsGk3Wzbk9mgH0PA',
|
|
191
|
+
'eyz48unYUBSISt1JCHimAA',
|
|
192
|
+
'ZiEYhGxFLElz7KEFeFmtYQ',
|
|
193
|
+
'c3tDD6xsrvfEhcnEfw+RBA',
|
|
194
|
+
'Ha8h2VogjPzplHBIJPRvrg',
|
|
195
|
+
'iFaGU1RTWaznU/GacrGCCA',
|
|
196
|
+
'2hlaKeNOAunkxmY84LjyQw',
|
|
197
|
+
'/pY978Y9LfhtPU4vFgk5qw',
|
|
198
|
+
'2hlaKeNOAunkxmY84LjyQw',
|
|
199
|
+
'XHJyOOdP+sKDFcNt8n73zA',
|
|
200
|
+
'RhjEvqUqTi4mk7fZGwGccQ',
|
|
201
|
+
'c3tDD6xsrvfEhcnEfw+RBA',
|
|
202
|
+
'jt7bsWRsGk3Wzbk9mgH0PA',
|
|
203
|
+
'Ysgq18HsJzpoPekoyTq76Q',
|
|
204
|
+
'c3tDD6xsrvfEhcnEfw+RBA',
|
|
205
|
+
'eyz48unYUBSISt1JCHimAA',
|
|
206
|
+
'iFaGU1RTWaznU/GacrGCCA',
|
|
207
|
+
'dmv2t1Wt7mc4OP35aMFQeQ',
|
|
208
|
+
'iFaGU1RTWaznU/GacrGCCA',
|
|
209
|
+
'dmv2t1Wt7mc4OP35aMFQeQ',
|
|
210
|
+
'c3tDD6xsrvfEhcnEfw+RBA',
|
|
211
|
+
'iFaGU1RTWaznU/GacrGCCA',
|
|
212
|
+
'iFaGU1RTWaznU/GacrGCCA',
|
|
213
|
+
'ZB/XrnbpWzXwLFX/v0MOaw',
|
|
214
|
+
'TLOgJx93wC/S3jFEpymrcA',
|
|
215
|
+
'cZs0M1ZG9Y0Moqm1zHcSow',
|
|
175
216
|
];
|
|
176
217
|
|
|
177
218
|
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"989.index.js","mappings":";;;;;;;;;;;AAAa,wBAAgB,GAAa;IACxC,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;CACzB,CAAC;;;;;;;;;;AClKF,wCAAqC;AACrC,0CAAiC;AACjC,0CAAkC;AAClC,uCAA2B;AAC3B,sDAAsD;AAEtD,MAAM,QAAQ,GAAG,aAAQ,CAAC,QAAQ,CAAC;AACnC,MAAM,OAAO,GAAG,aAAQ,CAAC,OAAO,CAAC;AACjC,MAAM,IAAI,GAAG,aAAQ,CAAC,IAAI,CAAC;AAC3B,MAAM,aAAa,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC;AAcjD,MAAM,MAAM,GAAU,EAAE,CAAC;AAEzB,KAAK,UAAU,YAAY;IACzB,MAAM,OAAO,GAAY,GAAG,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1E,OAAO,CAAC,IAAI,GAAG,0BAA0B,CAAC;IAC1C,OAAO,CAAC,KAAK,EAAE,CAAC;IAEhB,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,6DAA6D;AAC9C,KAAK,UAAU,SAAS,CAAC,GAAG,IAAgB;IACzD,OAAO,CAAC,GAAG,CACT,sGAAsG,CACvG,CAAC;IAEF,MAAM,UAAU,GAAqB,IAAI,KAAK,EAAa,CAAC;IAC5D,MAAM,KAAK,GAAW,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,MAAM,YAAY,EAAE,CAAC;IAErC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE;QACxB,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,aAAa,CAAC,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;KAChD;IAED,OAAO,CAAC,IAAI,EAAE,CAAC;IAEf,MAAM,OAAO,GAAgB,IAAI,GAAG,EAAE,CAAC;IACvC,UAAU,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,EAAE;QAC/B,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,CACjC,yCAAyC,EACzC,IAAI,CACL,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC1B,IAAI,OAAO,CAAC,IAAI,IAAI,CAAC,EAAE;QACrB,OAAO,CAAC,GAAG,CAAC,6CAA6C,CAAC,CAAC;QAC3D,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;YACvB,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QAC5B,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,CAAC;;kEAEkD,CAAC,CAAC;QAEhE,aAAa,EAAE,CAAC;KACjB;IACD,OAAO,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC;AACnE,CAAC;AAtCD,4BAsCC;AAED,KAAK,UAAU,aAAa,CAC1B,OAAoB,EACpB,IAAY,EACZ,WAA6B;IAE7B,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE;QAC1C,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;QAE1C,IAAI,mCAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE;YACnC,WAAW,CAAC,IAAI,CAAC;gBACf,IAAI;gBACJ,IAAI;aACL,CAAC,CAAC;YACH,OAAO;SACR;KACF;IAED,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE;QACxB,OAAO;KACR;IAED,IAAI;QACF,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC;QAChC,MAAM,OAAO,GAAG,GAAG,CAAC,UAAU,EAAE,CAAC;QAEjC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE;YAC3B,IAAI,KAAK,CAAC,WAAW,EAAE;gBACrB,SAAS;aACV;YAED,MAAM,aAAa,CACjB,KAAK,CAAC,OAAO,EAAE,EACf,IAAI,GAAG,GAAG,GAAG,KAAK,CAAC,SAAS,EAC5B,WAAW,CACZ,CAAC;SACH;KACF;IAAC,OAAO,KAAK,EAAE;QACd,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;KACpB;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,OAAoB;IAC/C,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACtD,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AACjD,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,IAAU;IAC5B,MAAM,MAAM,GAAW,EAAE,CAAC;IAE1B,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,QAAgB,EAAE,KAAY,EAAE,EAAE;QACtD,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,IAAI,GAAG,aAAa,EAAE;YACjD,OAAO;SACR;QACD,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAU,EAAE,MAAmB;IACrD,IAAI;QACF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;QAE/B,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE;YACxB,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACpB,OAAO;SACR;QAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;QACpC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE;YAC3B,MAAM,QAAQ,GAAG,IAAI,GAAG,GAAG,GAAG,KAAK,CAAC;YACpC,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;SAClC;KACF;IAAC,OAAO,KAAK,EAAE;QACd,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;KACpB;AACH,CAAC;AAED,SAAS,aAAa,CAAC,IAAU;IAC/B,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,SAAS,CAAC,IAAU;IAC3B,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,aAAa;IACpB,MAAM,GAAG,GAAG,IAAI,KAAK,EAAS,CAAC;IAC/B,GAAG,CAAC,IAAI,GAAG,OAAO,CAAC;IAEnB,MAAM,GAAG,CAAC;AACZ,CAAC","sources":["webpack://snyk/./src/cli/commands/log4shell-hashes.ts","webpack://snyk/./src/cli/commands/log4shell.ts"],"sourcesContent":["export const vulnerableHashes: string[] = [\n 'fBTyHDn2nUU0jgEu5XBJ5A',\n 'xmC9OBzdfLaIBvKVSKbc7g',\n 'NUt//j2o6sDxLqSTFfyPmQ',\n 'xmC9OBzdfLaIBvKVSKbc7g',\n 'oTC+5gi+FbG1R4jpKTfbTg',\n 'xmC9OBzdfLaIBvKVSKbc7g',\n 'uOUpCKY40NVjHQc2a9Xr8A',\n 'xmC9OBzdfLaIBvKVSKbc7g',\n '4Vvmz4X2WmipllB5/ous7Q',\n 'vWVkVsfR4RQjHvDG6pfOUg',\n '4DIQPHWEb/z7bholX3/oTg',\n 'xmC9OBzdfLaIBvKVSKbc7g',\n 'H7sEuRs4sj0D45EAltPQ1w',\n 'BP3XAYCdF0ZcF8fmA7GyAg',\n 'U//86tIjlVCgQQZXTQudVA',\n 'gw4e9TvocE+JqXdQ/8sxZg',\n 'BP3XAYCdF0ZcF8fmA7GyAg',\n 'U//86tIjlVCgQQZXTQudVA',\n 'gw4e9TvocE+JqXdQ/8sxZg',\n 'BP3XAYCdF0ZcF8fmA7GyAg',\n 'U//86tIjlVCgQQZXTQudVA',\n 'gw4e9TvocE+JqXdQ/8sxZg',\n 'BP3XAYCdF0ZcF8fmA7GyAg',\n 'U//86tIjlVCgQQZXTQudVA',\n 'krWKtKP0VH0HJkOaXl8tqw',\n 'WCRxHWxoFi61NcxNv3SF0w',\n 'yMKfrOVkLDiRsU9R9XbOKw',\n 'krWKtKP0VH0HJkOaXl8tqw',\n 'WCRxHWxoFi61NcxNv3SF0w',\n 'yMKfrOVkLDiRsU9R9XbOKw',\n '378Ytn/c/2G236FMYcwXgQ',\n 'IfBVtiwVRT8NeXCp2ZTKtw',\n '8e87HEC9TS3elmUxSejDMQ',\n 'y6QMMJo6qLeAwNYvTLrPdw',\n 'IfBVtiwVRT8NeXCp2ZTKtw',\n '8e87HEC9TS3elmUxSejDMQ',\n 'y6QMMJo6qLeAwNYvTLrPdw',\n 'IfBVtiwVRT8NeXCp2ZTKtw',\n '8e87HEC9TS3elmUxSejDMQ',\n 'y6QMMJo6qLeAwNYvTLrPdw',\n 'IfBVtiwVRT8NeXCp2ZTKtw',\n '8e87HEC9TS3elmUxSejDMQ',\n 'lJ9a5c4V2OLQiuoPftBxkg',\n '8dYwxIkoCWpITkuVzLFioA',\n 'bnTGE5aRFbMPtWoJ7dB2rw',\n 'apRhBWBUAlHxAZqSOZMx+g',\n '8dYwxIkoCWpITkuVzLFioA',\n 'bnTGE5aRFbMPtWoJ7dB2rw',\n 'EVldHOg3IcMdjSjEWkRajA',\n 'axX0LDM6w5q6z+7rGIUqRA',\n 'xmC9OBzdfLaIBvKVSKbc7g',\n 'EVldHOg3IcMdjSjEWkRajA',\n 'axX0LDM6w5q6z+7rGIUqRA',\n 'xmC9OBzdfLaIBvKVSKbc7g',\n 'EVldHOg3IcMdjSjEWkRajA',\n 'axX0LDM6w5q6z+7rGIUqRA',\n 'xmC9OBzdfLaIBvKVSKbc7g',\n 'pqMfiTE8K6QL1Ap2zCptrg',\n 'iyJgsczmQUT2MQh2+UsWOA',\n 'TRIdDjt+4nGJdKn689895A',\n 'pqMfiTE8K6QL1Ap2zCptrg',\n 'iyJgsczmQUT2MQh2+UsWOA',\n 'TRIdDjt+4nGJdKn689895A',\n 'pqMfiTE8K6QL1Ap2zCptrg',\n 'iyJgsczmQUT2MQh2+UsWOA',\n 'TRIdDjt+4nGJdKn689895A',\n 'CfmJLv6mhLVOjRvflS+vZA',\n 'O9n0G4nOT+jMv3PkMZWlzg',\n 'G1tHtzggRx3R9OPli2N0Tg',\n 'CfmJLv6mhLVOjRvflS+vZA',\n 'O9n0G4nOT+jMv3PkMZWlzg',\n 'G1tHtzggRx3R9OPli2N0Tg',\n 'CfmJLv6mhLVOjRvflS+vZA',\n 'O9n0G4nOT+jMv3PkMZWlzg',\n 'G1tHtzggRx3R9OPli2N0Tg',\n 't87654Z07FBVp4PlKbBJuw',\n 'QVwT58hQX7BW1UDqwpty+g',\n '44Xe+Vv3qrNNcyy3/tgHUw',\n 'HzzHitFLamLd6qGdA4XliA',\n 'QVwT58hQX7BW1UDqwpty+g',\n 'PHOrfl3/GKl2tZspVXbzVQ',\n 'Vok11jPt8NBpgaOhKOBmcA',\n 'oZNwOQSj8Y+zyQqHfrXIpw',\n 'cgy4bLqsMMH9qQTGVealZg',\n 'HzzHitFLamLd6qGdA4XliA',\n 'QVwT58hQX7BW1UDqwpty+g',\n 'PHOrfl3/GKl2tZspVXbzVQ',\n 'HzzHitFLamLd6qGdA4XliA',\n 'BP3XAYCdF0ZcF8fmA7GyAg',\n 'PHOrfl3/GKl2tZspVXbzVQ',\n 'HzzHitFLamLd6qGdA4XliA',\n 'BP3XAYCdF0ZcF8fmA7GyAg',\n 'PHOrfl3/GKl2tZspVXbzVQ',\n 'jAzz6wRxVKT44W2vWiCTGQ',\n '+/pfM6tLKab91SRz7nuDTQ',\n 'FS7LPOCUrFvJ6jnWEi4oFA',\n 'zXChiI7N0xHBmQ54SGfOHg',\n 'CI3xE60kmrcr8Zt/ALhj1Q',\n '3o0BzBX9DHT+qLu2aOKJ9Q',\n '3JkBHwR+Y9zHQbWraNEW2w',\n 'Kr7CzmZeDVKaPyj/+7st0w',\n 'siQt4Gd75lFdbO+/SOfl1Q',\n 'yL2LXFqqoHo9y/V94BySZg',\n 'XFJ4IdEISn7z4D1AFE/1Mg',\n '02XkgiFBT5P+7wk6G/YH7w',\n 'txoT/V3yUWlPyhFiQAA7Ig',\n 'ATi6HBkdXHVP0OPDphwDBw',\n 'CsWz5uabp3ZWg3mOZpowsg',\n 'jTMVRLLnsgrRZt68olUNcw',\n 'zH1V7WnMX9NANbFcbt95oA',\n 'XkvKXtILlKsZu2WDbak/lg',\n 'lI3aeHWTNAp68aGOMot7fw',\n 'hiwAsuhU+cDx6NhAnSPYmQ',\n 'EQqz4+TzeAkh6O5d3jNzrQ',\n '8MQ62soq/HHGzID4UbOIGA',\n '3Q4+C0BAg+xpYYqrtQuKwA',\n 'AHnJByMGWZaPD8DkGmq8+Q',\n 'SPfzzaUwMKh+jDh9jR5CZQ',\n 'RyyOH7qg5hUg4CXCVbXRaA',\n 'VSPxRPrvK/ygijyosr7Nag',\n 'K2Pg5QY/2sz2aaHiY4Tz/Q',\n 'VHuz7S3rhW0OO713wnuWJQ',\n 'SlF3oXJ2S9pvRHK5S6F8yw',\n 'xtIzvI6c/l2mkAWdJ9n4jw',\n '+rZGJX+UWwsqfOPhw+POXw',\n 'lC9Cnqy4AV4Y2PWZls++5g',\n 'jAzz6wRxVKT44W2vWiCTGQ',\n '+/pfM6tLKab91SRz7nuDTQ',\n 'FS7LPOCUrFvJ6jnWEi4oFA',\n 'zXChiI7N0xHBmQ54SGfOHg',\n 'CI3xE60kmrcr8Zt/ALhj1Q',\n '3o0BzBX9DHT+qLu2aOKJ9Q',\n '3JkBHwR+Y9zHQbWraNEW2w',\n 'Kr7CzmZeDVKaPyj/+7st0w',\n 'siQt4Gd75lFdbO+/SOfl1Q',\n 'yL2LXFqqoHo9y/V94BySZg',\n 'XFJ4IdEISn7z4D1AFE/1Mg',\n '02XkgiFBT5P+7wk6G/YH7w',\n 'txoT/V3yUWlPyhFiQAA7Ig',\n 'ATi6HBkdXHVP0OPDphwDBw',\n 'CsWz5uabp3ZWg3mOZpowsg',\n 'jTMVRLLnsgrRZt68olUNcw',\n 'zH1V7WnMX9NANbFcbt95oA',\n 'XkvKXtILlKsZu2WDbak/lg',\n 'lI3aeHWTNAp68aGOMot7fw',\n 'hiwAsuhU+cDx6NhAnSPYmQ',\n 'EQqz4+TzeAkh6O5d3jNzrQ',\n '8MQ62soq/HHGzID4UbOIGA',\n '3Q4+C0BAg+xpYYqrtQuKwA',\n 'AHnJByMGWZaPD8DkGmq8+Q',\n 'SPfzzaUwMKh+jDh9jR5CZQ',\n 'RyyOH7qg5hUg4CXCVbXRaA',\n 'VSPxRPrvK/ygijyosr7Nag',\n 'K2Pg5QY/2sz2aaHiY4Tz/Q',\n 'VHuz7S3rhW0OO713wnuWJQ',\n 'SlF3oXJ2S9pvRHK5S6F8yw',\n 'xtIzvI6c/l2mkAWdJ9n4jw',\n '+rZGJX+UWwsqfOPhw+POXw',\n 'lC9Cnqy4AV4Y2PWZls++5g',\n 'XSU+U/qZPhIv8BIiGqSeww',\n 'YntxiBxwzUm5F4IzC78f/w',\n 'geBDOuAGAsDk0AQk0hOwqw',\n];\n","import { MethodArgs } from '../args';\nimport { promises, Stats } from 'fs';\nimport * as crypto from 'crypto';\nimport * as AdmZip from 'adm-zip';\nimport * as ora from 'ora';\nimport { vulnerableHashes } from './log4shell-hashes';\n\nconst readFile = promises.readFile;\nconst readDir = promises.readdir;\nconst stat = promises.stat;\nconst MAX_FILE_SIZE = 2 * 1024 * 1024 * 1024 - 1;\n\ntype Signature = {\n hash: string;\n path: string;\n};\ntype Path = string;\ntype FileContent = Buffer;\ntype Digest = string;\n\ninterface FileHandler {\n (filePath: string, stats: Stats): void;\n}\n\nconst errors: any[] = [];\n\nasync function startSpinner(): Promise<ora.Ora> {\n const spinner: ora.Ora = ora({ isSilent: false, stream: process.stdout });\n spinner.text = `Looking for Log4Shell...`;\n spinner.start();\n\n return spinner;\n}\n\n// eslint-disable-next-line @typescript-eslint/no-unused-vars\nexport default async function log4shell(...args: MethodArgs): Promise<void> {\n console.log(\n 'Please note this command is for already built artifacts. To test source code please use `snyk test`.',\n );\n\n const signatures: Array<Signature> = new Array<Signature>();\n const paths: Path[] = await find('.');\n const spinner = await startSpinner();\n\n for (const path of paths) {\n const content = await readFile(path);\n await handleContent(content, path, signatures);\n }\n\n spinner.stop();\n\n const results: Set<string> = new Set();\n signatures.forEach((signature) => {\n const path = signature.path.replace(\n /(.*org\\/apache\\/logging\\/log4j\\/core).*/,\n '$1',\n );\n results.add(path);\n });\n\n console.log('\\nResults:');\n if (results.size != 0) {\n console.log('A vulnerable version of log4j was detected:');\n results.forEach((path) => {\n console.log(`\\t ${path}`);\n });\n console.log(`\\n We highly recommend fixing this vulnerability. If it cannot be fixed by upgrading, see mitigation information here:\n \\t- https://security.snyk.io/vuln/SNYK-JAVA-ORGAPACHELOGGINGLOG4J-2314720\n \\t- https://snyk.io/blog/log4shell-remediation-cheat-sheet/`);\n\n exitWithError();\n }\n console.log('No known vulnerable version of log4j was detected');\n}\n\nasync function handleContent(\n content: FileContent,\n path: string,\n accumulator: Array<Signature>,\n): Promise<void> {\n if (isJvmFile(path) || isJavaArchive(path)) {\n const hash = await computeDigest(content);\n\n if (vulnerableHashes.includes(hash)) {\n accumulator.push({\n hash,\n path,\n });\n return;\n }\n }\n\n if (!isJavaArchive(path)) {\n return;\n }\n\n try {\n const zip = new AdmZip(content);\n const entries = zip.getEntries();\n\n for (const entry of entries) {\n if (entry.isDirectory) {\n continue;\n }\n\n await handleContent(\n entry.getData(),\n path + '/' + entry.entryName,\n accumulator,\n );\n }\n } catch (error) {\n errors.push(error);\n }\n}\n\nasync function computeDigest(content: FileContent): Promise<Digest> {\n const hash = crypto.createHash('md5').update(content);\n return hash.digest('base64').replace(/=/g, '');\n}\n\nasync function find(path: Path): Promise<Path[]> {\n const result: Path[] = [];\n\n await traverse(path, (filePath: string, stats: Stats) => {\n if (!stats.isFile() || stats.size > MAX_FILE_SIZE) {\n return;\n }\n result.push(filePath);\n });\n\n return result;\n}\n\nasync function traverse(path: Path, handle: FileHandler) {\n try {\n const stats = await stat(path);\n\n if (!stats.isDirectory()) {\n handle(path, stats);\n return;\n }\n\n const entries = await readDir(path);\n for (const entry of entries) {\n const absolute = path + '/' + entry;\n await traverse(absolute, handle);\n }\n } catch (error) {\n errors.push(error);\n }\n}\n\nfunction isJavaArchive(path: Path) {\n return path.endsWith('.jar') || path.endsWith('.war') || path.endsWith('ear');\n}\n\nfunction isJvmFile(path: Path) {\n return path.endsWith('.java') || path.endsWith('.class');\n}\n\nfunction exitWithError() {\n const err = new Error() as any;\n err.code = 'VULNS';\n\n throw err;\n}\n"],"names":[],"sourceRoot":""}
|
|
1
|
+
{"version":3,"file":"989.index.js","mappings":";;;;;;;;;;;AAAa,wBAAgB,GAAa;IACxC,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,OAAO;IACP,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;CACzB,CAAC;;;;;;;;;;AC3MF,wCAAqC;AACrC,0CAAiC;AACjC,0CAAkC;AAClC,uCAA2B;AAC3B,sDAAsD;AAEtD,MAAM,QAAQ,GAAG,aAAQ,CAAC,QAAQ,CAAC;AACnC,MAAM,OAAO,GAAG,aAAQ,CAAC,OAAO,CAAC;AACjC,MAAM,IAAI,GAAG,aAAQ,CAAC,IAAI,CAAC;AAC3B,MAAM,aAAa,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC;AAcjD,MAAM,MAAM,GAAU,EAAE,CAAC;AAEzB,KAAK,UAAU,YAAY;IACzB,MAAM,OAAO,GAAY,GAAG,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1E,OAAO,CAAC,IAAI,GAAG,0BAA0B,CAAC;IAC1C,OAAO,CAAC,KAAK,EAAE,CAAC;IAEhB,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,6DAA6D;AAC9C,KAAK,UAAU,SAAS,CAAC,GAAG,IAAgB;IACzD,OAAO,CAAC,GAAG,CACT,sGAAsG,CACvG,CAAC;IAEF,MAAM,UAAU,GAAqB,IAAI,KAAK,EAAa,CAAC;IAC5D,MAAM,KAAK,GAAW,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,MAAM,YAAY,EAAE,CAAC;IAErC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE;QACxB,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,aAAa,CAAC,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;KAChD;IAED,OAAO,CAAC,IAAI,EAAE,CAAC;IAEf,MAAM,OAAO,GAAgB,IAAI,GAAG,EAAE,CAAC;IACvC,UAAU,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,EAAE;QAC/B,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,CACjC,yCAAyC,EACzC,IAAI,CACL,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC1B,IAAI,OAAO,CAAC,IAAI,IAAI,CAAC,EAAE;QACrB,OAAO,CAAC,GAAG,CAAC,6CAA6C,CAAC,CAAC;QAC3D,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;YACvB,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QAC5B,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,CAAC;;kEAEkD,CAAC,CAAC;QAEhE,aAAa,EAAE,CAAC;KACjB;IACD,OAAO,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC;AACnE,CAAC;AAtCD,4BAsCC;AAED,KAAK,UAAU,aAAa,CAC1B,OAAoB,EACpB,IAAY,EACZ,WAA6B;IAE7B,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE;QAC1C,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;QAE1C,IAAI,mCAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE;YACnC,WAAW,CAAC,IAAI,CAAC;gBACf,IAAI;gBACJ,IAAI;aACL,CAAC,CAAC;YACH,OAAO;SACR;KACF;IAED,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE;QACxB,OAAO;KACR;IAED,IAAI;QACF,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC;QAChC,MAAM,OAAO,GAAG,GAAG,CAAC,UAAU,EAAE,CAAC;QAEjC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE;YAC3B,IAAI,KAAK,CAAC,WAAW,EAAE;gBACrB,SAAS;aACV;YAED,MAAM,aAAa,CACjB,KAAK,CAAC,OAAO,EAAE,EACf,IAAI,GAAG,GAAG,GAAG,KAAK,CAAC,SAAS,EAC5B,WAAW,CACZ,CAAC;SACH;KACF;IAAC,OAAO,KAAK,EAAE;QACd,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;KACpB;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,OAAoB;IAC/C,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACtD,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AACjD,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,IAAU;IAC5B,MAAM,MAAM,GAAW,EAAE,CAAC;IAE1B,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,QAAgB,EAAE,KAAY,EAAE,EAAE;QACtD,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,IAAI,GAAG,aAAa,EAAE;YACjD,OAAO;SACR;QACD,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAU,EAAE,MAAmB;IACrD,IAAI;QACF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;QAE/B,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE;YACxB,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACpB,OAAO;SACR;QAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;QACpC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE;YAC3B,MAAM,QAAQ,GAAG,IAAI,GAAG,GAAG,GAAG,KAAK,CAAC;YACpC,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;SAClC;KACF;IAAC,OAAO,KAAK,EAAE;QACd,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;KACpB;AACH,CAAC;AAED,SAAS,aAAa,CAAC,IAAU;IAC/B,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,SAAS,CAAC,IAAU;IAC3B,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,aAAa;IACpB,MAAM,GAAG,GAAG,IAAI,KAAK,EAAS,CAAC;IAC/B,GAAG,CAAC,IAAI,GAAG,OAAO,CAAC;IAEnB,MAAM,GAAG,CAAC;AACZ,CAAC","sources":["webpack://snyk/./src/cli/commands/log4shell-hashes.ts","webpack://snyk/./src/cli/commands/log4shell.ts"],"sourcesContent":["export const vulnerableHashes: string[] = [\n 'fBTyHDn2nUU0jgEu5XBJ5A',\n 'xmC9OBzdfLaIBvKVSKbc7g',\n 'NUt//j2o6sDxLqSTFfyPmQ',\n 'xmC9OBzdfLaIBvKVSKbc7g',\n 'oTC+5gi+FbG1R4jpKTfbTg',\n 'xmC9OBzdfLaIBvKVSKbc7g',\n 'uOUpCKY40NVjHQc2a9Xr8A',\n 'xmC9OBzdfLaIBvKVSKbc7g',\n '4Vvmz4X2WmipllB5/ous7Q',\n 'vWVkVsfR4RQjHvDG6pfOUg',\n '4DIQPHWEb/z7bholX3/oTg',\n 'xmC9OBzdfLaIBvKVSKbc7g',\n 'H7sEuRs4sj0D45EAltPQ1w',\n 'BP3XAYCdF0ZcF8fmA7GyAg',\n 'U//86tIjlVCgQQZXTQudVA',\n 'gw4e9TvocE+JqXdQ/8sxZg',\n 'BP3XAYCdF0ZcF8fmA7GyAg',\n 'U//86tIjlVCgQQZXTQudVA',\n 'gw4e9TvocE+JqXdQ/8sxZg',\n 'BP3XAYCdF0ZcF8fmA7GyAg',\n 'U//86tIjlVCgQQZXTQudVA',\n 'gw4e9TvocE+JqXdQ/8sxZg',\n 'BP3XAYCdF0ZcF8fmA7GyAg',\n 'U//86tIjlVCgQQZXTQudVA',\n 'krWKtKP0VH0HJkOaXl8tqw',\n 'WCRxHWxoFi61NcxNv3SF0w',\n 'yMKfrOVkLDiRsU9R9XbOKw',\n 'krWKtKP0VH0HJkOaXl8tqw',\n 'WCRxHWxoFi61NcxNv3SF0w',\n 'yMKfrOVkLDiRsU9R9XbOKw',\n '378Ytn/c/2G236FMYcwXgQ',\n 'IfBVtiwVRT8NeXCp2ZTKtw',\n '8e87HEC9TS3elmUxSejDMQ',\n 'y6QMMJo6qLeAwNYvTLrPdw',\n 'IfBVtiwVRT8NeXCp2ZTKtw',\n '8e87HEC9TS3elmUxSejDMQ',\n 'y6QMMJo6qLeAwNYvTLrPdw',\n 'IfBVtiwVRT8NeXCp2ZTKtw',\n '8e87HEC9TS3elmUxSejDMQ',\n 'y6QMMJo6qLeAwNYvTLrPdw',\n 'IfBVtiwVRT8NeXCp2ZTKtw',\n '8e87HEC9TS3elmUxSejDMQ',\n 'lJ9a5c4V2OLQiuoPftBxkg',\n '8dYwxIkoCWpITkuVzLFioA',\n 'bnTGE5aRFbMPtWoJ7dB2rw',\n 'apRhBWBUAlHxAZqSOZMx+g',\n '8dYwxIkoCWpITkuVzLFioA',\n 'bnTGE5aRFbMPtWoJ7dB2rw',\n 'EVldHOg3IcMdjSjEWkRajA',\n 'axX0LDM6w5q6z+7rGIUqRA',\n 'xmC9OBzdfLaIBvKVSKbc7g',\n 'EVldHOg3IcMdjSjEWkRajA',\n 'axX0LDM6w5q6z+7rGIUqRA',\n 'xmC9OBzdfLaIBvKVSKbc7g',\n 'EVldHOg3IcMdjSjEWkRajA',\n 'axX0LDM6w5q6z+7rGIUqRA',\n 'xmC9OBzdfLaIBvKVSKbc7g',\n 'pqMfiTE8K6QL1Ap2zCptrg',\n 'iyJgsczmQUT2MQh2+UsWOA',\n 'TRIdDjt+4nGJdKn689895A',\n 'pqMfiTE8K6QL1Ap2zCptrg',\n 'iyJgsczmQUT2MQh2+UsWOA',\n 'TRIdDjt+4nGJdKn689895A',\n 'pqMfiTE8K6QL1Ap2zCptrg',\n 'iyJgsczmQUT2MQh2+UsWOA',\n 'TRIdDjt+4nGJdKn689895A',\n 'CfmJLv6mhLVOjRvflS+vZA',\n 'O9n0G4nOT+jMv3PkMZWlzg',\n 'G1tHtzggRx3R9OPli2N0Tg',\n 'CfmJLv6mhLVOjRvflS+vZA',\n 'O9n0G4nOT+jMv3PkMZWlzg',\n 'G1tHtzggRx3R9OPli2N0Tg',\n 'CfmJLv6mhLVOjRvflS+vZA',\n 'O9n0G4nOT+jMv3PkMZWlzg',\n 'G1tHtzggRx3R9OPli2N0Tg',\n 't87654Z07FBVp4PlKbBJuw',\n 'QVwT58hQX7BW1UDqwpty+g',\n '44Xe+Vv3qrNNcyy3/tgHUw',\n 'HzzHitFLamLd6qGdA4XliA',\n 'QVwT58hQX7BW1UDqwpty+g',\n 'PHOrfl3/GKl2tZspVXbzVQ',\n 'Vok11jPt8NBpgaOhKOBmcA',\n 'oZNwOQSj8Y+zyQqHfrXIpw',\n 'cgy4bLqsMMH9qQTGVealZg',\n 'HzzHitFLamLd6qGdA4XliA',\n 'QVwT58hQX7BW1UDqwpty+g',\n 'PHOrfl3/GKl2tZspVXbzVQ',\n 'HzzHitFLamLd6qGdA4XliA',\n 'BP3XAYCdF0ZcF8fmA7GyAg',\n 'PHOrfl3/GKl2tZspVXbzVQ',\n 'HzzHitFLamLd6qGdA4XliA',\n 'BP3XAYCdF0ZcF8fmA7GyAg',\n 'PHOrfl3/GKl2tZspVXbzVQ',\n 'jAzz6wRxVKT44W2vWiCTGQ',\n '+/pfM6tLKab91SRz7nuDTQ',\n 'FS7LPOCUrFvJ6jnWEi4oFA',\n 'zXChiI7N0xHBmQ54SGfOHg',\n 'CI3xE60kmrcr8Zt/ALhj1Q',\n '3o0BzBX9DHT+qLu2aOKJ9Q',\n '3JkBHwR+Y9zHQbWraNEW2w',\n 'Kr7CzmZeDVKaPyj/+7st0w',\n 'siQt4Gd75lFdbO+/SOfl1Q',\n 'yL2LXFqqoHo9y/V94BySZg',\n 'XFJ4IdEISn7z4D1AFE/1Mg',\n '02XkgiFBT5P+7wk6G/YH7w',\n 'txoT/V3yUWlPyhFiQAA7Ig',\n 'ATi6HBkdXHVP0OPDphwDBw',\n 'CsWz5uabp3ZWg3mOZpowsg',\n 'jTMVRLLnsgrRZt68olUNcw',\n 'zH1V7WnMX9NANbFcbt95oA',\n 'XkvKXtILlKsZu2WDbak/lg',\n 'lI3aeHWTNAp68aGOMot7fw',\n 'hiwAsuhU+cDx6NhAnSPYmQ',\n 'EQqz4+TzeAkh6O5d3jNzrQ',\n '8MQ62soq/HHGzID4UbOIGA',\n '3Q4+C0BAg+xpYYqrtQuKwA',\n 'AHnJByMGWZaPD8DkGmq8+Q',\n 'SPfzzaUwMKh+jDh9jR5CZQ',\n 'RyyOH7qg5hUg4CXCVbXRaA',\n 'VSPxRPrvK/ygijyosr7Nag',\n 'K2Pg5QY/2sz2aaHiY4Tz/Q',\n 'VHuz7S3rhW0OO713wnuWJQ',\n 'SlF3oXJ2S9pvRHK5S6F8yw',\n 'xtIzvI6c/l2mkAWdJ9n4jw',\n '+rZGJX+UWwsqfOPhw+POXw',\n 'lC9Cnqy4AV4Y2PWZls++5g',\n 'jAzz6wRxVKT44W2vWiCTGQ',\n '+/pfM6tLKab91SRz7nuDTQ',\n 'FS7LPOCUrFvJ6jnWEi4oFA',\n 'zXChiI7N0xHBmQ54SGfOHg',\n 'CI3xE60kmrcr8Zt/ALhj1Q',\n '3o0BzBX9DHT+qLu2aOKJ9Q',\n '3JkBHwR+Y9zHQbWraNEW2w',\n 'Kr7CzmZeDVKaPyj/+7st0w',\n 'siQt4Gd75lFdbO+/SOfl1Q',\n 'yL2LXFqqoHo9y/V94BySZg',\n 'XFJ4IdEISn7z4D1AFE/1Mg',\n '02XkgiFBT5P+7wk6G/YH7w',\n 'txoT/V3yUWlPyhFiQAA7Ig',\n 'ATi6HBkdXHVP0OPDphwDBw',\n 'CsWz5uabp3ZWg3mOZpowsg',\n 'jTMVRLLnsgrRZt68olUNcw',\n 'zH1V7WnMX9NANbFcbt95oA',\n 'XkvKXtILlKsZu2WDbak/lg',\n 'lI3aeHWTNAp68aGOMot7fw',\n 'hiwAsuhU+cDx6NhAnSPYmQ',\n 'EQqz4+TzeAkh6O5d3jNzrQ',\n '8MQ62soq/HHGzID4UbOIGA',\n '3Q4+C0BAg+xpYYqrtQuKwA',\n 'AHnJByMGWZaPD8DkGmq8+Q',\n 'SPfzzaUwMKh+jDh9jR5CZQ',\n 'RyyOH7qg5hUg4CXCVbXRaA',\n 'VSPxRPrvK/ygijyosr7Nag',\n 'K2Pg5QY/2sz2aaHiY4Tz/Q',\n 'VHuz7S3rhW0OO713wnuWJQ',\n 'SlF3oXJ2S9pvRHK5S6F8yw',\n 'xtIzvI6c/l2mkAWdJ9n4jw',\n '+rZGJX+UWwsqfOPhw+POXw',\n 'lC9Cnqy4AV4Y2PWZls++5g',\n 'XSU+U/qZPhIv8BIiGqSeww',\n 'YntxiBxwzUm5F4IzC78f/w',\n 'geBDOuAGAsDk0AQk0hOwqw',\n 'C1fpJhCjMxrxWn6Q+LNTnQ',\n 'uhz4+B57MccJdoVhuoq1WA',\n '7Q4xglxv2kNCP7ODV6QrPQ',\n 'n0GSikGCAN4iMt0yblIsxw',\n // JNDI\n 'I2XBK0p8X6XXkD3ZDKnkYw',\n 'eyz48unYUBSISt1JCHimAA',\n 'TLOgJx93wC/S3jFEpymrcA',\n '2hlaKeNOAunkxmY84LjyQw',\n 'iFaGU1RTWaznU/GacrGCCA',\n 'jt7bsWRsGk3Wzbk9mgH0PA',\n '/pY978Y9LfhtPU4vFgk5qw',\n 'eyz48unYUBSISt1JCHimAA',\n 'ZiEYhGxFLElz7KEFeFmtYQ',\n 'dmv2t1Wt7mc4OP35aMFQeQ',\n 'jt7bsWRsGk3Wzbk9mgH0PA',\n 'eyz48unYUBSISt1JCHimAA',\n 'ZiEYhGxFLElz7KEFeFmtYQ',\n 'c3tDD6xsrvfEhcnEfw+RBA',\n 'Ha8h2VogjPzplHBIJPRvrg',\n 'iFaGU1RTWaznU/GacrGCCA',\n '2hlaKeNOAunkxmY84LjyQw',\n '/pY978Y9LfhtPU4vFgk5qw',\n '2hlaKeNOAunkxmY84LjyQw',\n 'XHJyOOdP+sKDFcNt8n73zA',\n 'RhjEvqUqTi4mk7fZGwGccQ',\n 'c3tDD6xsrvfEhcnEfw+RBA',\n 'jt7bsWRsGk3Wzbk9mgH0PA',\n 'Ysgq18HsJzpoPekoyTq76Q',\n 'c3tDD6xsrvfEhcnEfw+RBA',\n 'eyz48unYUBSISt1JCHimAA',\n 'iFaGU1RTWaznU/GacrGCCA',\n 'dmv2t1Wt7mc4OP35aMFQeQ',\n 'iFaGU1RTWaznU/GacrGCCA',\n 'dmv2t1Wt7mc4OP35aMFQeQ',\n 'c3tDD6xsrvfEhcnEfw+RBA',\n 'iFaGU1RTWaznU/GacrGCCA',\n 'iFaGU1RTWaznU/GacrGCCA',\n 'ZB/XrnbpWzXwLFX/v0MOaw',\n 'TLOgJx93wC/S3jFEpymrcA',\n 'cZs0M1ZG9Y0Moqm1zHcSow',\n];\n","import { MethodArgs } from '../args';\nimport { promises, Stats } from 'fs';\nimport * as crypto from 'crypto';\nimport * as AdmZip from 'adm-zip';\nimport * as ora from 'ora';\nimport { vulnerableHashes } from './log4shell-hashes';\n\nconst readFile = promises.readFile;\nconst readDir = promises.readdir;\nconst stat = promises.stat;\nconst MAX_FILE_SIZE = 2 * 1024 * 1024 * 1024 - 1;\n\ntype Signature = {\n hash: string;\n path: string;\n};\ntype Path = string;\ntype FileContent = Buffer;\ntype Digest = string;\n\ninterface FileHandler {\n (filePath: string, stats: Stats): void;\n}\n\nconst errors: any[] = [];\n\nasync function startSpinner(): Promise<ora.Ora> {\n const spinner: ora.Ora = ora({ isSilent: false, stream: process.stdout });\n spinner.text = `Looking for Log4Shell...`;\n spinner.start();\n\n return spinner;\n}\n\n// eslint-disable-next-line @typescript-eslint/no-unused-vars\nexport default async function log4shell(...args: MethodArgs): Promise<void> {\n console.log(\n 'Please note this command is for already built artifacts. To test source code please use `snyk test`.',\n );\n\n const signatures: Array<Signature> = new Array<Signature>();\n const paths: Path[] = await find('.');\n const spinner = await startSpinner();\n\n for (const path of paths) {\n const content = await readFile(path);\n await handleContent(content, path, signatures);\n }\n\n spinner.stop();\n\n const results: Set<string> = new Set();\n signatures.forEach((signature) => {\n const path = signature.path.replace(\n /(.*org\\/apache\\/logging\\/log4j\\/core).*/,\n '$1',\n );\n results.add(path);\n });\n\n console.log('\\nResults:');\n if (results.size != 0) {\n console.log('A vulnerable version of log4j was detected:');\n results.forEach((path) => {\n console.log(`\\t ${path}`);\n });\n console.log(`\\n We highly recommend fixing this vulnerability. If it cannot be fixed by upgrading, see mitigation information here:\n \\t- https://security.snyk.io/vuln/SNYK-JAVA-ORGAPACHELOGGINGLOG4J-2314720\n \\t- https://snyk.io/blog/log4shell-remediation-cheat-sheet/`);\n\n exitWithError();\n }\n console.log('No known vulnerable version of log4j was detected');\n}\n\nasync function handleContent(\n content: FileContent,\n path: string,\n accumulator: Array<Signature>,\n): Promise<void> {\n if (isJvmFile(path) || isJavaArchive(path)) {\n const hash = await computeDigest(content);\n\n if (vulnerableHashes.includes(hash)) {\n accumulator.push({\n hash,\n path,\n });\n return;\n }\n }\n\n if (!isJavaArchive(path)) {\n return;\n }\n\n try {\n const zip = new AdmZip(content);\n const entries = zip.getEntries();\n\n for (const entry of entries) {\n if (entry.isDirectory) {\n continue;\n }\n\n await handleContent(\n entry.getData(),\n path + '/' + entry.entryName,\n accumulator,\n );\n }\n } catch (error) {\n errors.push(error);\n }\n}\n\nasync function computeDigest(content: FileContent): Promise<Digest> {\n const hash = crypto.createHash('md5').update(content);\n return hash.digest('base64').replace(/=/g, '');\n}\n\nasync function find(path: Path): Promise<Path[]> {\n const result: Path[] = [];\n\n await traverse(path, (filePath: string, stats: Stats) => {\n if (!stats.isFile() || stats.size > MAX_FILE_SIZE) {\n return;\n }\n result.push(filePath);\n });\n\n return result;\n}\n\nasync function traverse(path: Path, handle: FileHandler) {\n try {\n const stats = await stat(path);\n\n if (!stats.isDirectory()) {\n handle(path, stats);\n return;\n }\n\n const entries = await readDir(path);\n for (const entry of entries) {\n const absolute = path + '/' + entry;\n await traverse(absolute, handle);\n }\n } catch (error) {\n errors.push(error);\n }\n}\n\nfunction isJavaArchive(path: Path) {\n return path.endsWith('.jar') || path.endsWith('.war') || path.endsWith('ear');\n}\n\nfunction isJvmFile(path: Path) {\n return path.endsWith('.java') || path.endsWith('.class');\n}\n\nfunction exitWithError() {\n const err = new Error() as any;\n err.code = 'VULNS';\n\n throw err;\n}\n"],"names":[],"sourceRoot":""}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "snyk",
|
|
3
|
-
"version": "1.
|
|
3
|
+
"version": "1.800.0",
|
|
4
4
|
"description": "snyk library and cli utility",
|
|
5
5
|
"files": [
|
|
6
6
|
"help/cli-commands",
|
|
@@ -86,5 +86,5 @@
|
|
|
86
86
|
"registry": "https://registry.npmjs.org/",
|
|
87
87
|
"access": "public"
|
|
88
88
|
},
|
|
89
|
-
"gitHead": "
|
|
89
|
+
"gitHead": "9b71082ca1c7aaa7c6aed1a645618318db631c2f"
|
|
90
90
|
}
|