snyk 1.848.0 → 1.849.0

package/dist/cli/562.index.js

@@ -158856,12 +158856,13 @@ const admzip = __webpack_require__(55285);
 const path = __webpack_require__(85622);
 const buffer_utils_1 = __webpack_require__(29098);
 function groupJarFingerprintsByPath(input) {
-    const jarFingerprints = Object.entries(input).map(([filePath, digest]) => {
+    const jarFingerprints = Object.entries(input).map(([filePath, buffer]) => {
         return {
             location: filePath,
-            digest,
+            buffer,
             coords: null,
             dependencies: [],
+            nestedJars: [],
         };
     });
     const resultAggregatedByPath = jarFingerprints.reduce((jarsAggregatedByPath, jarFingerprint) => {
@@ -158900,10 +158901,13 @@ async function jarFilesToScannedProjects(filePathToContent, targetImage, desired
 }
 exports.jarFilesToScannedProjects = jarFilesToScannedProjects;
 function getFingerprints(desiredLevelsOfUnpacking, jarBuffers) {
-    return unpackJars(jarBuffers, desiredLevelsOfUnpacking);
+    const fingerprints = new Set([
+        ...unpackJars(jarBuffers, desiredLevelsOfUnpacking),
+    ]);
+    return Array.from(fingerprints);
 }
 /**
- * Recursively unpacks JARs and attempts to add coords to the
+ * Unpacks a JAR and attempts to add coords to the
  * package and it's dependencies.
  *
  * JARs will always be unpacked one level more than requested
@@ -158920,12 +158924,11 @@ function getFingerprints(desiredLevelsOfUnpacking, jarBuffers) {
  * @param { number } props.desiredLevelsOfUnpacking
  * @param { number } props.requiredLevelsOfUnpacking
  * @param { number } props.unpackedLevels
- * @param { JarBuffer[] } props.jarBuffers
- * @param { JarCoords | null } props.coords
- * @param { JarCoords[] } props.dependencies
  */
-function unpackJarsTraverse({ jarBuffer, jarPath, desiredLevelsOfUnpacking, requiredLevelsOfUnpacking, unpackedLevels, jarBuffers, coords = null, dependencies = [], }) {
-    let isFatJar = false;
+function unpackJar({ jarBuffer, jarPath, desiredLevelsOfUnpacking, requiredLevelsOfUnpacking, unpackedLevels, }) {
+    const dependencies = [];
+    const nestedJars = [];
+    let coords = null;
     let zip;
     let zipEntries;
     try {
@@ -158933,17 +158936,14 @@ function unpackJarsTraverse({ jarBuffer, jarPath, desiredLevelsOfUnpacking, requ
         zipEntries = zip.getEntries();
     }
     catch (err) {
-        jarBuffers.push({
+        return {
             location: jarPath,
-            digest: jarBuffer,
-            dependencies,
+            buffer: jarBuffer,
             coords: null,
-        });
-        return jarBuffers;
+            dependencies,
+            nestedJars,
+        };
     }
-    // technically the level should be increased only if a JAR is found, but increasing here to make
-    // sure it states the level, and not counting all the jars found, regardless of level.
-    unpackedLevels = unpackedLevels + 1;
     for (const zipEntry of zipEntries) {
         // pom.properties is file describing a package or package dependency
         // using this file allows resolution of shaded jars
@@ -158953,8 +158953,8 @@ function unpackJarsTraverse({ jarBuffer, jarPath, desiredLevelsOfUnpacking, requ
             if (entryCoords) {
                 if (
                 // sometimes the path does not have the version
-                jarPath.endsWith(`${entryCoords.artifactId}-${entryCoords.version}.jar`) ||
-                    jarPath.endsWith(`${entryCoords.artifactId}.jar`)) {
+                jarPath.indexOf(`${entryCoords.artifactId}-${entryCoords.version}`) !== -1 ||
+                    jarPath.indexOf(`${entryCoords.artifactId}`) !== -1) {
                     coords = entryCoords;
                 }
                 else {
@@ -158968,33 +158968,33 @@ function unpackJarsTraverse({ jarBuffer, jarPath, desiredLevelsOfUnpacking, requ
         if (desiredLevelsOfUnpacking > 0 &&
             unpackedLevels < requiredLevelsOfUnpacking &&
             zipEntry.entryName.endsWith(".jar")) {
-            isFatJar = true;
             const entryData = zipEntry.getData();
             const entryName = zipEntry.entryName;
-            jarPath = `${jarPath}/${entryName}`;
-            unpackJarsTraverse({
-                jarBuffer: entryData,
-                jarPath,
-                desiredLevelsOfUnpacking,
-                requiredLevelsOfUnpacking,
-                unpackedLevels,
-                jarBuffers,
-                coords,
-                dependencies,
+            nestedJars.push({
+                buffer: entryData,
+                location: `${jarPath}/${entryName}`,
             });
         }
     }
-    if (!isFatJar) {
-        jarBuffers.push({
-            location: jarPath,
-            digest: jarBuffer,
-            coords,
-            dependencies,
-        });
-    }
-    return jarBuffers;
+    return {
+        location: jarPath,
+        buffer: jarBuffer,
+        coords,
+        dependencies,
+        nestedJars,
+    };
 }
-function unpackJars(jarBuffers, desiredLevelsOfUnpacking) {
+/**
+ * Manages the unpacking an array of JarBuffer objects and returns the resulting
+ * fingerprints. Recursion to required depth is handled here when the returned
+ * info from each JAR that is unpacked has nestedJars.
+ *
+ * @param {JarBuffer[]} jarBuffers
+ * @param {number} desiredLevelsOfUnpacking
+ * @param {number} unpackedLevels
+ * @returns JarFingerprint[]
+ */
+function unpackJars(jarBuffers, desiredLevelsOfUnpacking, unpackedLevels = 0) {
     // We have to unpack jars to get the pom.properties manifest which
     // we use to support shaded jars and get the package coords (if exists)
     // to reduce the dependency on maven search and support private jars.
@@ -159006,23 +159006,28 @@ function unpackJars(jarBuffers, desiredLevelsOfUnpacking) {
     // requiredLevelsOfUnpacking = implementation control variable
     const requiredLevelsOfUnpacking = desiredLevelsOfUnpacking + 1;
     const fingerprints = [];
+    // jarBuffers is the array of JARS found in the image layers;
+    // this represents the 1st "level" which we will unpack by
+    // default to analyse. Any JARs found when analysing are nested
+    // and we will keep going until we have no more nested JARs or
+    // the desired level of unpacking is met
     for (const jarBuffer of jarBuffers) {
-        const unpackedLevels = 0;
-        const jars = unpackJarsTraverse({
-            jarBuffer: jarBuffer.digest,
+        const jarInfo = unpackJar({
+            jarBuffer: jarBuffer.buffer,
             jarPath: jarBuffer.location,
+            unpackedLevels: unpackedLevels + 1,
             desiredLevelsOfUnpacking,
             requiredLevelsOfUnpacking,
-            unpackedLevels,
-            coords: null,
-            jarBuffers: [],
         });
         // if any of the coords are null for this JAR we didn't manage to get
         // anything from the JAR's pom.properties manifest, so calculate the
         // sha so maven-deps can fallback to searching maven central
-        jars.forEach((jar) => {
-            fingerprints.push(Object.assign({ location: jar.location, digest: jar.coords ? null : buffer_utils_1.bufferToSha1(jar.digest), dependencies: jar.dependencies }, jar.coords));
-        });
+        fingerprints.push(Object.assign({ location: jarInfo.location, digest: jarInfo.coords ? null : buffer_utils_1.bufferToSha1(jarInfo.buffer), dependencies: jarInfo.dependencies }, jarInfo.coords));
+        if (jarInfo.nestedJars.length > 0) {
+            // this is an uber/fat JAR so we need to unpack the nested JARs to
+            // analyse them for coords and further nested JARs (depth flag allowing)
+            fingerprints.push(...unpackJars(jarInfo.nestedJars, desiredLevelsOfUnpacking, unpackedLevels + 1));
+        }
     }
     return fingerprints;
 }
@@ -159240,7 +159245,7 @@ async function pullWithDockerBinary(docker, targetImage, saveLocation, username,
     }
 }
 async function pullFromContainerRegistry(docker, targetImage, imageSavePath, username, password) {
-    const { hostname, imageName, tag } = await extractImageDetails(targetImage);
+    const { hostname, imageName, tag } = extractImageDetails(targetImage);
     debug(`Attempting to pull: registry: ${hostname}, image: ${imageName}, tag: ${tag}`);
     await docker.pull(hostname, imageName, tag, imageSavePath, username, password);
 }
@@ -159310,7 +159315,7 @@ async function getImageArchive(targetImage, imageSavePath, username, password, p
     };
 }
 exports.getImageArchive = getImageArchive;
-async function extractImageDetails(targetImage) {
+function extractImageDetails(targetImage) {
     let remainder;
     let hostname;
     let imageName;
@@ -161058,6 +161063,10 @@ async function extractImageContent(imageType, fileSystemPath, extractActions) {
                 imageId: ociExtractor.getImageIdFromManifest(ociArchive.manifest),
                 manifestLayers: ociExtractor.getManifestLayers(ociArchive.manifest),
                 extractedLayers: layersWithLatestFileModifications(ociArchive.layers),
+                rootFsLayers: dockerExtractor.getRootFsLayersFromConfig(ociArchive.imageConfig),
+                autoDetectedUserInstructions: dockerExtractor.getDetectedLayersInfoFromConfig(ociArchive.imageConfig),
+                platform: dockerExtractor.getPlatformFromConfig(ociArchive.imageConfig),
+                imageLabels: ociArchive.imageConfig.config.Labels,
             };
         default:
             const dockerArchive = await dockerExtractor.extractArchive(fileSystemPath, extractActions);
@@ -161226,6 +161235,7 @@ async function extractArchive(ociArchiveFilesystemPath, extractActions) {
         const tarExtractor = tar_stream_1.extract();
         const layers = {};
         const manifests = {};
+        let imageConfig;
         let imageIndex;
         tarExtractor.on("entry", async (header, stream, next) => {
             if (header.type === "file") {
@@ -161252,6 +161262,9 @@ async function extractArchive(ociArchiveFilesystemPath, extractActions) {
                     if (isArchiveManifest(manifest)) {
                         manifests[digest] = manifest;
                     }
+                    else if (isImageConfigFile(manifest)) {
+                        imageConfig = manifest;
+                    }
                     if (layer !== undefined) {
                         layers[digest] = layer;
                     }
@@ -161262,7 +161275,7 @@ async function extractArchive(ociArchiveFilesystemPath, extractActions) {
         });
         tarExtractor.on("finish", () => {
             try {
-                resolve(getLayersContentAndArchiveManifest(imageIndex, manifests, layers));
+                resolve(getLayersContentAndArchiveManifest(imageIndex, manifests, imageConfig, layers));
             }
             catch (error) {
                 debug(`Error getting layers and manifest content from oci archive: '${JSON.stringify(error)}'`);
@@ -161278,22 +161291,26 @@ async function extractArchive(ociArchiveFilesystemPath, extractActions) {
     });
 }
 exports.extractArchive = extractArchive;
-function getLayersContentAndArchiveManifest(imageIndex, manifestCollection, layers) {
+function getLayersContentAndArchiveManifest(imageIndex, manifestCollection, imageConfig, layers) {
     // filter empty layers
     // get the layers content without the name
     // reverse layers order from last to first
     // get manifest file first
     const manifest = getManifest(imageIndex, manifestCollection);
     const filteredLayers = manifest.layers
-        .filter((layer) => Object.keys(layers[layer.digest]).length !== 0)
+        .filter((layer) => layers[layer.digest])
         .map((layer) => layers[layer.digest])
         .reverse();
     if (filteredLayers.length === 0) {
         throw new Error("We found no layers in the provided image");
     }
+    if (imageConfig === undefined) {
+        throw new Error("Could not find the image config in the provided image");
+    }
     return {
         layers: filteredLayers,
         manifest,
+        imageConfig,
     };
 }
 function getManifest(imageIndex, manifestCollection) {
@@ -161311,6 +161328,9 @@ function getManifest(imageIndex, manifestCollection) {
 function isArchiveManifest(manifest) {
     return (manifest !== undefined && manifest.layers && manifest.layers.length >= 0);
 }
+function isImageConfigFile(json) {
+    return json !== undefined && json.architecture && json.rootfs;
+}
 function isImageIndexFile(name) {
     return name === "index.json";
 }
@@ -162705,6 +162725,7 @@ exports.streamToJson = exports.streamToSha1 = exports.streamToSha256 = exports.s
 const crypto = __webpack_require__(76417);
 const types_1 = __webpack_require__(93677);
 const HASH_ENCODING = "hex";
+const MEGABYTE = 1 * 1024 * 1024;
 async function streamToString(stream, streamSize, encoding = "utf8") {
     const chunks = [];
     return new Promise((resolve, reject) => {
@@ -162751,9 +162772,33 @@ async function streamToSha1(stream) {
     return streamToHash(stream, types_1.HashAlgorithm.Sha1);
 }
 exports.streamToSha1 = streamToSha1;
+/**
+ * Reads up to 2 megabytes from the stream and tries to JSON.parse the result.
+ * Will reject if an error occurs from within the stream or when parsing cannot be done.
+ */
 async function streamToJson(stream) {
-    const file = await streamToString(stream);
-    return JSON.parse(file);
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        let bytes = 0;
+        stream.on("end", () => {
+            try {
+                resolve(JSON.parse(chunks.join("")));
+            }
+            catch (error) {
+                reject(error);
+            }
+        });
+        stream.on("error", (error) => reject(error));
+        stream.on("data", (chunk) => {
+            bytes += chunk.length;
+            if (bytes <= 2 * MEGABYTE) {
+                chunks.push(chunk.toString("utf8"));
+            }
+            else {
+                reject(new Error("The stream is too large to parse as JSON"));
+            }
+        });
+    });
 }
 exports.streamToJson = streamToJson;
 //# sourceMappingURL=stream-utils.js.map
@@ -170709,7 +170754,6 @@ Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.LockParserBase = void 0;
 const _cloneDeep = __webpack_require__(83465);
 const _isEmpty = __webpack_require__(99245);
-const _set = __webpack_require__(31468);
 const _toPairs = __webpack_require__(28052);
 const graphlib = __webpack_require__(39322);
 const uuid_1 = __webpack_require__(42277);
@@ -170740,7 +170784,10 @@ class LockParserBase {
         };
         const nodeVersion = (_a = manifestFile === null || manifestFile === void 0 ? void 0 : manifestFile.engines) === null || _a === void 0 ? void 0 : _a.node;
         if (nodeVersion) {
-            _set(depTree, 'meta.nodeVersion', nodeVersion);
+            if (!depTree.meta) {
+                depTree.meta = {};
+            }
+            depTree.meta.nodeVersion = nodeVersion;
         }
         // asked to process empty deps
         if (_isEmpty(manifestFile.dependencies) && !includeDev) {