snyk 1.799.0 → 1.803.0

package/dist/cli/727.index.js

@@ -15249,10 +15249,12 @@ exports.getLayer = getLayer;
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.getManifest = void 0;
+exports.computeDigest = exports.getManifest = void 0;
 const registry_call_1 = __webpack_require__(15271);
 const contentTypes = __webpack_require__(42625);
 const needle_1 = __webpack_require__(48360);
+const crypto_1 = __webpack_require__(76417);
+const digestRegex = /^sha256:[a-f0-9]{64}$/i;
 /**
  * A request to get image manifest by tag or digest
  * @param registryBase the hostname (and optionally base path) from which to get the manifest.
@@ -15265,20 +15267,55 @@ const needle_1 = __webpack_require__(48360);
  *                 Defaults to linux/amd64. In case the requested manifest platform is not found an error is thrown.
  * @returns
  */
-async function getManifest(registryBase, repo, tag, username, password, options = {}, platform) {
+async function getManifest(registryBase, repo, imageReference, username, password, options = {}, platform) {
     var _a;
     const accept = (_a = options.acceptManifest) !== null && _a !== void 0 ? _a : `${contentTypes.MANIFEST_V2}, ${contentTypes.MANIFEST_LIST_V2}`;
-    const endpoint = `/${repo}/manifests/${tag}`;
-    const manifestResponse = await registry_call_1.registryV2Call(registryBase, endpoint, accept, username, password, options);
+    const endpoint = `/${repo}/manifests/${imageReference}`;
+    let manifestResponse = await registry_call_1.registryV2Call(registryBase, endpoint, accept, username, password, options);
     const contentType = manifestResponse.headers["content-type"];
+    let indexDigest;
+    let manifestDigest;
     if (contentType === contentTypes.MANIFEST_LIST_V2) {
-        const manifestDigest = getManifestDigestByPlatform(manifestResponse, platform);
-        // calling getManifest recursively is safe here, since we got a list of actual manifests (and not a list of manifest-lists)
-        return await getManifest(registryBase, repo, manifestDigest, username, password, options, platform);
+        indexDigest = computeDigest(manifestResponse.body);
+        manifestDigest = getManifestDigestByPlatform(manifestResponse, platform);
+        // need to call again with actual manifest (and not a list of manifest-lists)
+        const endpoint = `/${repo}/manifests/${manifestDigest}`;
+        manifestResponse = await registry_call_1.registryV2Call(registryBase, endpoint, accept, username, password, options);
+    }
+    const dockerContentDigest = manifestResponse.headers["Docker-Content-Digest"];
+    switch (true) {
+        case manifestDigest != undefined:
+            break;
+        case isManifestDigest(imageReference):
+            manifestDigest = imageReference;
+            break;
+        case isManifestDigest(dockerContentDigest):
+            manifestDigest = dockerContentDigest;
+            break;
+        default:
+            manifestDigest = computeDigest(manifestResponse.body);
     }
-    return needle_1.parseResponseBody(manifestResponse);
+    const parsedBody = needle_1.parseResponseBody(manifestResponse);
+    return Object.assign(Object.assign({}, parsedBody), { indexDigest, manifestDigest });
 }
 exports.getManifest = getManifest;
+function isManifestDigest(imageReference) {
+    return digestRegex.test(imageReference);
+}
+function computeDigest(body) {
+    if (!body) {
+        return undefined;
+    }
+    if (typeof body !== "string") {
+        body = JSON.stringify(body);
+    }
+    const hexDigest = crypto_1.createHash("sha256")
+        .update(body)
+        .digest("hex")
+        .toLowerCase();
+    return `sha256:${hexDigest}`;
+}
+exports.computeDigest = computeDigest;
 function getManifestDigestByPlatform(manifestResponse, platform) {
     const defaultPlatform = {
         os: "linux",
@@ -15471,7 +15508,7 @@ class NeedleWrapperException extends Error {
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.buildUnauthenticatedV2RequestConfig = exports.parseChallengeHeaders = exports.getToken = exports.paginatedV2Call = exports.registryCall = exports.registryV2Call = void 0;
-const parseLink = __webpack_require__(28490);
+const parseLink = __webpack_require__(54336);
 const url = __webpack_require__(78835);
 const needle_1 = __webpack_require__(48360);
 const BEARER_REALM = "Bearer realm";
@@ -15721,6 +15758,86 @@ function assertFullUrl(redirectLocation, originalLocation) {
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 //# sourceMappingURL=types.js.map
 
+/***/ }),
+
+/***/ 54336:
+/***/ ((module, __unused_webpack_exports, __webpack_require__) => {
+
+"use strict";
+
+
+var qs = __webpack_require__(71191)
+  , url = __webpack_require__(78835)
+  , xtend = __webpack_require__(47529);
+
+const PARSE_LINK_HEADER_MAXLEN = parseInt(process.env.PARSE_LINK_HEADER_MAXLEN) || 2000;
+const PARSE_LINK_HEADER_THROW_ON_MAXLEN_EXCEEDED = process.env.PARSE_LINK_HEADER_THROW_ON_MAXLEN_EXCEEDED != null
+
+function hasRel(x) {
+  return x && x.rel;
+}
+
+function intoRels (acc, x) {
+  function splitRel (rel) {
+    acc[rel] = xtend(x, { rel: rel });
+  }
+
+  x.rel.split(/\s+/).forEach(splitRel);
+
+  return acc;
+}
+
+function createObjects (acc, p) {
+  // rel="next" => 1: rel 2: next
+  var m = p.match(/\s*(.+)\s*=\s*"?([^"]+)"?/)
+  if (m) acc[m[1]] = m[2];
+  return acc;
+}
+
+function parseLink(link) {
+  try {
+    var m         =  link.match(/<?([^>]*)>(.*)/)
+      , linkUrl   =  m[1]
+      , parts     =  m[2].split(';')
+      , parsedUrl =  url.parse(linkUrl)
+      , qry       =  qs.parse(parsedUrl.query);
+
+    parts.shift();
+
+    var info = parts
+      .reduce(createObjects, {});
+    
+    info = xtend(qry, info);
+    info.url = linkUrl;
+    return info;
+  } catch (e) {
+    return null;
+  }
+}
+
+function checkHeader(linkHeader){
+  if (!linkHeader) return false;
+
+  if (linkHeader.length > PARSE_LINK_HEADER_MAXLEN) {
+    if (PARSE_LINK_HEADER_THROW_ON_MAXLEN_EXCEEDED) {
+      throw new Error('Input string too long, it should be under ' + PARSE_LINK_HEADER_MAXLEN + ' characters.');
+    } else {
+        return false;
+      }
+  }
+  return true;
+}
+
+module.exports = function (linkHeader) {
+  if (!checkHeader(linkHeader)) return null;
+
+  return linkHeader.split(/,\s*</)
+   .map(parseLink)
+   .filter(hasRel)
+   .reduce(intoRels, {});
+};
+
+
 /***/ }),
 
 /***/ 8381:
@@ -152247,70 +152364,6 @@ module.exports = pTry;
 module.exports.default = pTry;
 
 
-/***/ }),
-
-/***/ 28490:
-/***/ ((module, __unused_webpack_exports, __webpack_require__) => {
-
-"use strict";
-
-
-var qs = __webpack_require__(71191)
-  , url = __webpack_require__(78835)
-  , xtend = __webpack_require__(47529);
-
-function hasRel(x) {
-  return x && x.rel;
-}
-
-function intoRels (acc, x) {
-  function splitRel (rel) {
-    acc[rel] = xtend(x, { rel: rel });
-  }
-
-  x.rel.split(/\s+/).forEach(splitRel);
-
-  return acc;
-}
-
-function createObjects (acc, p) {
-  // rel="next" => 1: rel 2: next
-  var m = p.match(/\s*(.+)\s*=\s*"?([^"]+)"?/)
-  if (m) acc[m[1]] = m[2];
-  return acc;
-}
-
-function parseLink(link) {
-  try {
-    var m         =  link.match(/<?([^>]*)>(.*)/)
-      , linkUrl   =  m[1]
-      , parts     =  m[2].split(';')
-      , parsedUrl =  url.parse(linkUrl)
-      , qry       =  qs.parse(parsedUrl.query);
-
-    parts.shift();
-
-    var info = parts
-      .reduce(createObjects, {});
-    
-    info = xtend(qry, info);
-    info.url = linkUrl;
-    return info;
-  } catch (e) {
-    return null;
-  }
-}
-
-module.exports = function (linkHeader) {
-  if (!linkHeader) return null;
-
-  return linkHeader.split(/,\s*</)
-   .map(parseLink)
-   .filter(hasRel)
-   .reduce(intoRels, {});
-};
-
-
 /***/ }),
 
 /***/ 64095:
@@ -170890,12 +170943,9 @@ async function analyze(targetImage, dockerfileAnalysis, imageType, imagePath, gl
 exports.analyze = analyze;
 function getNestedJarsDesiredDepth(options) {
     const nestedJarsOption = options["nested-jars-depth"] || options["shaded-jars-depth"];
-    let nestedJarsDepth = 0;
+    let nestedJarsDepth = 1;
     const depthNumber = Number(nestedJarsOption);
-    if (isNaN(depthNumber)) {
-        nestedJarsDepth = option_utils_1.isTrue(nestedJarsOption) ? 1 : 0;
-    }
-    else {
+    if (!isNaN(depthNumber) && depthNumber >= 0) {
         nestedJarsDepth = depthNumber;
     }
     return nestedJarsDepth;
@@ -173565,10 +173615,11 @@ async function scan(options) {
         !option_utils_1.isTrue(options["app-vulns"])) {
         throw new Error("To use --nested-jars-depth, you must also use --app-vulns");
     }
-    if (!option_utils_1.isNumber(nestedJarsDepth) &&
+    if ((!option_utils_1.isNumber(nestedJarsDepth) &&
         !option_utils_1.isTrue(nestedJarsDepth) &&
-        typeof nestedJarsDepth !== "undefined") {
-        throw new Error("--nested-jars-depth accepts only numbers");
+        typeof nestedJarsDepth !== "undefined") ||
+        Number(nestedJarsDepth) < 0) {
+        throw new Error("--nested-jars-depth accepts only numbers bigger than or equal to 0");
     }
     const targetImage = appendLatestTagIfMissing(options.path);
     const dockerfilePath = options.file;