snyk 1.857.0 → 1.860.0

package/dist/cli/269.index.js

@@ -0,0 +1,724 @@
+"use strict";
+exports.id = 269;
+exports.ids = [269];
+exports.modules = {
+
+/***/ 21766:
+/***/ ((module, __unused_webpack_exports, __webpack_require__) => {
+
+
+const path = __webpack_require__(85622);
+const os = __webpack_require__(12087);
+
+const homedir = os.homedir();
+const tmpdir = os.tmpdir();
+const {env} = process;
+
+const macos = name => {
+	const library = path.join(homedir, 'Library');
+
+	return {
+		data: path.join(library, 'Application Support', name),
+		config: path.join(library, 'Preferences', name),
+		cache: path.join(library, 'Caches', name),
+		log: path.join(library, 'Logs', name),
+		temp: path.join(tmpdir, name)
+	};
+};
+
+const windows = name => {
+	const appData = env.APPDATA || path.join(homedir, 'AppData', 'Roaming');
+	const localAppData = env.LOCALAPPDATA || path.join(homedir, 'AppData', 'Local');
+
+	return {
+		// Data/config/cache/log are invented by me as Windows isn't opinionated about this
+		data: path.join(localAppData, name, 'Data'),
+		config: path.join(appData, name, 'Config'),
+		cache: path.join(localAppData, name, 'Cache'),
+		log: path.join(localAppData, name, 'Log'),
+		temp: path.join(tmpdir, name)
+	};
+};
+
+// https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html
+const linux = name => {
+	const username = path.basename(homedir);
+
+	return {
+		data: path.join(env.XDG_DATA_HOME || path.join(homedir, '.local', 'share'), name),
+		config: path.join(env.XDG_CONFIG_HOME || path.join(homedir, '.config'), name),
+		cache: path.join(env.XDG_CACHE_HOME || path.join(homedir, '.cache'), name),
+		// https://wiki.debian.org/XDGBaseDirectorySpecification#state
+		log: path.join(env.XDG_STATE_HOME || path.join(homedir, '.local', 'state'), name),
+		temp: path.join(tmpdir, username, name)
+	};
+};
+
+const envPaths = (name, options) => {
+	if (typeof name !== 'string') {
+		throw new TypeError(`Expected string, got ${typeof name}`);
+	}
+
+	options = Object.assign({suffix: 'nodejs'}, options);
+
+	if (options.suffix) {
+		// Add suffix to prevent possible conflict with native apps
+		name += `-${options.suffix}`;
+	}
+
+	if (process.platform === 'darwin') {
+		return macos(name);
+	}
+
+	if (process.platform === 'win32') {
+		return windows(name);
+	}
+
+	return linux(name);
+};
+
+module.exports = envPaths;
+// TODO: Remove this for the next major release
+module.exports.default = envPaths;
+
+
+/***/ }),
+
+/***/ 52369:
+/***/ ((__unused_webpack_module, exports) => {
+
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.processCommandArgs = void 0;
+function processCommandArgs(...args) {
+    let options = {};
+    if (typeof args[args.length - 1] === 'object') {
+        options = args.pop();
+    }
+    args = args.filter(Boolean);
+    // For repository scanning, populate with default path (cwd) if no path given
+    if (args.length === 0 && !options.docker) {
+        args.unshift(process.cwd());
+    }
+    return { options, paths: args };
+}
+exports.processCommandArgs = processCommandArgs;
+
+
+/***/ }),
+
+/***/ 26445:
+/***/ ((__unused_webpack_module, exports, __webpack_require__) => {
+
+
+var _a;
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.findDriftCtl = exports.driftctl = exports.translateExitCode = exports.parseDescribeFlags = exports.parseArgs = exports.DCTL_EXIT_CODES = exports.driftctlVersion = void 0;
+const debugLib = __webpack_require__(15158);
+const child_process = __webpack_require__(63129);
+const os = __webpack_require__(12087);
+const env_paths_1 = __webpack_require__(21766);
+const fs = __webpack_require__(35747);
+const spinner_1 = __webpack_require__(86766);
+const request_1 = __webpack_require__(52050);
+const config_1 = __webpack_require__(22541);
+const path = __webpack_require__(85622);
+const crypto = __webpack_require__(76417);
+const service_mappings_1 = __webpack_require__(16228);
+const exit_codes_1 = __webpack_require__(80079);
+const cachePath = (_a = config_1.default.CACHE_PATH) !== null && _a !== void 0 ? _a : env_paths_1.default('snyk').cache;
+const debug = debugLib('drift');
+exports.driftctlVersion = 'v0.21.0';
+exports.DCTL_EXIT_CODES = {
+    EXIT_IN_SYNC: 0,
+    EXIT_NOT_IN_SYNC: 1,
+    EXIT_ERROR: 2,
+};
+const driftctlChecksums = {
+    'driftctl_windows_386.exe': 'f7affbe0ba270b0339d0398befc686bd747a1694a4db0890ce73a2b1921521d4',
+    driftctl_darwin_amd64: '85cd7a0b5670aa0ee52181357ec891f5a84df29cf505344e403b8b9de5953d61',
+    driftctl_linux_386: '4221b4f2db65163ccfd300f90fe7cffa7bac1f806f56971ebbca5e36269aa3a4',
+    driftctl_linux_amd64: 'eb64c0d7a7094f0d741abae24c59a46db3eb76f619f177fd745efea7d468a66e',
+    driftctl_linux_arm64: 'c0c4dbfb2f5217124d3f7e1ef33b8b547fc84adf65612aca438e48e63da2f63e',
+    'driftctl_windows_arm64.exe': '9e87c2a7fecca5a2846c87d4c570b5357e892e4234d7eafa0dac5ea31142e992',
+    driftctl_darwin_arm64: '39813b4f05c034b6833508062f72bc17f1edbe2bc4db244893e75198eb013a34',
+    'driftctl_windows_arm.exe': '5d66cb4db95bfa33d4946d324c4674f10fde8370dfb5003d99242a560d8e7e1b',
+    driftctl_linux_arm: '13705de80f0de3d1a931e81947cc7a443dcec59968bafcb8ea888a4f643e5605',
+    'driftctl_windows_amd64.exe': '154afbf87a3c0d36a345ccadad8ca7f85855a1c1f8f622ce1ea46931dadafce7',
+};
+const dctlBaseUrl = 'https://github.com/snyk/driftctl/releases/download/';
+const driftctlPath = path.join(cachePath, 'driftctl_' + exports.driftctlVersion);
+var DriftctlCmd;
+(function (DriftctlCmd) {
+    DriftctlCmd["GenDriftIgnore"] = "gen-driftignore";
+})(DriftctlCmd || (DriftctlCmd = {}));
+const supportedDriftctlCommands = [DriftctlCmd.GenDriftIgnore];
+function parseArgs(commands, options) {
+    const args = commands;
+    const driftctlCommand = args[0];
+    if (!supportedDriftctlCommands.includes(driftctlCommand)) {
+        throw new Error(`Unsupported command: ${driftctlCommand}`);
+    }
+    // It is currently not possible to iterate on options and pass everything
+    // to the args since there is snyk CLI related data on it.
+    // We can try to switch the logic from a whitelist approch to a blacklist apporoach
+    // But if something change from the snyk cli options parsing sub command will fail
+    // For now it's better to keep the control on that even if mean that we'll need to update theses methods every time
+    // we make change on arguments in driftctl
+    switch (driftctlCommand) {
+        case DriftctlCmd.GenDriftIgnore:
+            args.push(...parseGenDriftIgnoreFlags(options));
+            break;
+    }
+    debug(args);
+    return args;
+}
+exports.parseArgs = parseArgs;
+const parseGenDriftIgnoreFlags = (options) => {
+    const args = [];
+    if (options.input) {
+        args.push('--input');
+        args.push(options.input);
+    }
+    if (options.output) {
+        args.push('--output');
+        args.push(options.output);
+    }
+    if (options['exclude-changed']) {
+        args.push('--exclude-changed');
+    }
+    if (options['exclude-missing']) {
+        args.push('--exclude-missing');
+    }
+    if (options['exclude-unmanaged']) {
+        args.push('--exclude-unmanaged');
+    }
+    return args;
+};
+exports.parseDescribeFlags = (options) => {
+    const args = ['scan'];
+    if (options.quiet) {
+        args.push('--quiet');
+    }
+    if (options.filter) {
+        args.push('--filter');
+        args.push(options.filter);
+    }
+    if (options.json) {
+        args.push('--output');
+        args.push('json://stdout');
+    }
+    if (options['json-file-output']) {
+        args.push('--output');
+        args.push('json://' + options['json-file-output']);
+    }
+    if (options.html) {
+        args.push('--output');
+        args.push('html://stdout');
+    }
+    if (options['html-file-output']) {
+        args.push('--output');
+        args.push('html://' + options['html-file-output']);
+    }
+    if (options.headers) {
+        args.push('--headers');
+        args.push(options.headers);
+    }
+    if (options['tfc-token']) {
+        args.push('--tfc-token');
+        args.push(options['tfc-token']);
+    }
+    if (options['tfc-endpoint']) {
+        args.push('--tfc-endpoint');
+        args.push(options['tfc-endpoint']);
+    }
+    if (options['tf-provider-version']) {
+        args.push('--tf-provider-version');
+        args.push(options['tf-provider-version']);
+    }
+    if (options.strict) {
+        args.push('--strict');
+    }
+    if (options.deep) {
+        args.push('--deep');
+    }
+    if (options.driftignore) {
+        args.push('--driftignore');
+        args.push(options.driftignore);
+    }
+    if (options['tf-lockfile']) {
+        args.push('--tf-lockfile');
+        args.push(options['tf-lockfile']);
+    }
+    let configDir = cachePath;
+    createIfNotExists(cachePath);
+    if (options['config-dir']) {
+        configDir = options['config-dir'];
+    }
+    args.push('--config-dir');
+    args.push(configDir);
+    if (options.from) {
+        const froms = options.from.split(',');
+        for (const f of froms) {
+            args.push('--from');
+            args.push(f);
+        }
+    }
+    let to = 'aws+tf';
+    if (options.to) {
+        to = options.to;
+    }
+    args.push('--to');
+    args.push(to);
+    if (options.service) {
+        const services = options.service.split(',');
+        service_mappings_1.verifyServiceMappingExists(services);
+        args.push('--ignore');
+        args.push(service_mappings_1.createIgnorePattern(services));
+    }
+    debug(args);
+    return args;
+};
+function translateExitCode(exitCode) {
+    switch (exitCode) {
+        case exports.DCTL_EXIT_CODES.EXIT_IN_SYNC:
+            return 0;
+        case exports.DCTL_EXIT_CODES.EXIT_NOT_IN_SYNC:
+            return exit_codes_1.EXIT_CODES.VULNS_FOUND;
+        case exports.DCTL_EXIT_CODES.EXIT_ERROR:
+            return exit_codes_1.EXIT_CODES.ERROR;
+        default:
+            debug('driftctl returned %d', exitCode);
+            return exit_codes_1.EXIT_CODES.ERROR;
+    }
+}
+exports.translateExitCode = translateExitCode;
+async function driftctl(args) {
+    debug('running driftctl %s ', args.join(' '));
+    const path = await findOrDownload();
+    const exitCode = await launch(path, args);
+    return translateExitCode(exitCode);
+}
+exports.driftctl = driftctl;
+async function launch(path, args) {
+    return new Promise((resolve, reject) => {
+        const child = child_process.spawn(path, args, { stdio: 'inherit' });
+        child.on('error', (error) => {
+            reject(error);
+        });
+        child.on('exit', (code) => {
+            if (code == null) {
+                //failed to find why this could happen...
+                reject(new Error('Process was terminated'));
+            }
+            else {
+                resolve(code);
+            }
+        });
+    });
+}
+async function findOrDownload() {
+    let dctl = await findDriftCtl();
+    if (dctl === '') {
+        try {
+            createIfNotExists(cachePath);
+            dctl = driftctlPath;
+            await download(driftctlUrl(), dctl);
+        }
+        catch (err) {
+            return Promise.reject(err);
+        }
+    }
+    return dctl;
+}
+async function findDriftCtl() {
+    // lookup in custom path contained in env var DRIFTCTL_PATH
+    let dctlPath = config_1.default.DRIFTCTL_PATH;
+    if (dctlPath != null) {
+        const exists = await isExe(dctlPath);
+        if (exists) {
+            debug('Found driftctl in $DRIFTCTL_PATH: %s', dctlPath);
+            return dctlPath;
+        }
+    }
+    // lookup in app cache
+    dctlPath = driftctlPath;
+    const exists = await isExe(dctlPath);
+    if (exists) {
+        debug('Found driftctl in cache: %s', dctlPath);
+        return dctlPath;
+    }
+    debug('driftctl not found');
+    return '';
+}
+exports.findDriftCtl = findDriftCtl;
+async function download(url, destination) {
+    debug('downloading driftctl into %s', destination);
+    const payload = {
+        method: 'GET',
+        url: url,
+        output: destination,
+        follow: 3,
+    };
+    await spinner_1.spinner('Downloading...');
+    return new Promise((resolve, reject) => {
+        request_1.makeRequest(payload, function (err, res, body) {
+            try {
+                if (err) {
+                    reject(new Error('Could not download driftctl from ' + url + ': ' + err));
+                    return;
+                }
+                if (res.statusCode !== 200) {
+                    reject(new Error('Could not download driftctl from ' + url + ': ' + res.statusCode));
+                    return;
+                }
+                validateChecksum(body);
+                fs.writeFileSync(destination, body);
+                debug('File saved: ' + destination);
+                fs.chmodSync(destination, 0o744);
+                resolve(true);
+            }
+            finally {
+                spinner_1.spinner.clearAll();
+            }
+        });
+    });
+}
+function validateChecksum(body) {
+    // only validate if we downloaded the official driftctl binary
+    if (config_1.default.DRIFTCTL_URL || config_1.default.DRIFTCTL_PATH) {
+        return;
+    }
+    const computedHash = crypto
+        .createHash('sha256')
+        .update(body)
+        .digest('hex');
+    const givenHash = driftctlChecksums[driftctlFileName()];
+    if (computedHash != givenHash) {
+        throw new Error('Downloaded file has inconsistent checksum...');
+    }
+}
+function driftctlFileName() {
+    let platform = 'linux';
+    switch (os.platform()) {
+        case 'darwin':
+            platform = 'darwin';
+            break;
+        case 'win32':
+            platform = 'windows';
+            break;
+    }
+    let arch = 'amd64';
+    switch (os.arch()) {
+        case 'ia32':
+        case 'x32':
+            arch = '386';
+            break;
+        case 'arm':
+            arch = 'arm';
+            break;
+        case 'arm64':
+            arch = 'arm64';
+            break;
+    }
+    let ext = '';
+    switch (os.platform()) {
+        case 'win32':
+            ext = '.exe';
+            break;
+    }
+    return `driftctl_${platform}_${arch}${ext}`;
+}
+function driftctlUrl() {
+    if (config_1.default.DRIFTCTL_URL) {
+        return config_1.default.DRIFTCTL_URL;
+    }
+    return `${dctlBaseUrl}/${exports.driftctlVersion}/${driftctlFileName()}`;
+}
+function isExe(dctlPath) {
+    return new Promise((resolve) => {
+        fs.access(dctlPath, fs.constants.X_OK, (err) => {
+            if (err) {
+                resolve(false);
+                return;
+            }
+            resolve(true);
+        });
+    });
+}
+function createIfNotExists(path) {
+    if (!fs.existsSync(path)) {
+        fs.mkdirSync(path, { recursive: true });
+    }
+}
+
+
+/***/ }),
+
+/***/ 16228:
+/***/ ((__unused_webpack_module, exports, __webpack_require__) => {
+
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.InvalidServiceError = exports.createIgnorePatternWithMap = exports.createIgnorePattern = exports.verifyServiceMappingExists = exports.services2resources = void 0;
+const errors_1 = __webpack_require__(55191);
+const types_1 = __webpack_require__(42258);
+const error_utils_1 = __webpack_require__(23872);
+exports.services2resources = new Map([
+    // Amazon
+    [
+        'aws_s3',
+        [
+            'aws_s3_bucket',
+            'aws_s3_bucket_analytics_configuration',
+            'aws_s3_bucket_inventory',
+            'aws_s3_bucket_metric',
+            'aws_s3_bucket_notification',
+            'aws_s3_bucket_policy',
+        ],
+    ],
+    [
+        'aws_ec2',
+        [
+            'aws_instance',
+            'aws_key_pair',
+            'aws_ami',
+            'aws_ebs_snapshot',
+            'aws_ebs_volume',
+            'aws_eip',
+            'aws_eip_association',
+            'aws_volume_attachment',
+            'aws_launch_configuration',
+            'aws_launch_template',
+        ],
+    ],
+    ['aws_lambda', ['aws_lambda_function', 'aws_lambda_event_source_mapping']],
+    [
+        'aws_rds',
+        [
+            'aws_db_instance',
+            'aws_db_subnet_group',
+            'aws_rds_cluster',
+            'aws_rds_cluster_endpoint',
+            'aws_rds_cluster_instance',
+        ],
+    ],
+    ['aws_route53', ['aws_route53_record', 'aws_route53_zone']],
+    [
+        'aws_iam',
+        [
+            'aws_iam_access_key',
+            'aws_iam_policy',
+            'aws_iam_policy_attachment',
+            'aws_iam_role',
+            'aws_iam_role_policy',
+            'aws_iam_role_policy_attachment',
+            'aws_iam_user',
+            'aws_iam_user_policy',
+            'aws_iam_user_policy_attachment',
+        ],
+    ],
+    [
+        'aws_vpc',
+        [
+            'aws_security_group',
+            'aws_security_group_rule',
+            'aws_subnet',
+            'aws_default_vpc',
+            'aws_vpc',
+            'aws_default_security_group',
+            'aws_route_table',
+            'aws_default_route_table',
+            'aws_route',
+            'aws_route_table_association',
+            'aws_nat_gateway',
+            'aws_internet_gateway',
+        ],
+    ],
+    [
+        'aws_api_gateway',
+        [
+            'aws_api_gateway_resource',
+            'aws_api_gateway_rest_api',
+            'aws_api_gateway_account',
+            'aws_api_gateway_api_key',
+            'aws_api_gateway_authorizer',
+            'aws_api_gateway_base_path_mapping',
+            'aws_api_gateway_domain_name',
+            'aws_api_gateway_gateway_response',
+            'aws_api_gateway_integration',
+            'aws_api_gateway_integration_response',
+            'aws_api_gateway_method',
+            'aws_api_gateway_method_response',
+            'aws_api_gateway_method_settings',
+            'aws_api_gateway_model',
+            'aws_api_gateway_request_validator',
+            'aws_api_gateway_rest_api_policy',
+            'aws_api_gateway_stage',
+            'aws_api_gateway_vpc_link',
+        ],
+    ],
+    [
+        'aws_apigatewayv2',
+        [
+            'aws_apigatewayv2_api',
+            'aws_apigatewayv2_api_mapping',
+            'aws_apigatewayv2_authorizer',
+            'aws_apigatewayv2_deployment',
+            'aws_apigatewayv2_domain_name',
+            'aws_apigatewayv2_integration',
+            'aws_apigatewayv2_integration_response',
+            'aws_apigatewayv2_model',
+            'aws_apigatewayv2_route',
+            'aws_apigatewayv2_route_response',
+            'aws_apigatewayv2_stage',
+            'aws_apigatewayv2_vpc_link',
+        ],
+    ],
+    ['aws_sqs', ['aws_sqs_queue', 'aws_sqs_queue_policy']],
+    [
+        'aws_sns',
+        ['aws_sns_topic', 'aws_sns_topic_policy', 'aws_sns_topic_subscription'],
+    ],
+    ['aws_ecr', ['aws_ecr_repository']],
+    ['aws_cloudfront', ['aws_cloudfront_distribution']],
+    ['aws_kms', ['aws_kms_key', 'aws_kms_alias']],
+    ['aws_dynamodb', ['aws_dynamodb_table']],
+    // Azure
+    ['azure_base', ['azurerm_resource_group']],
+    ['azure_compute', ['azurerm_image', 'azurerm_ssh_public_key']],
+    ['azure_storage', ['azurerm_storage_account', 'azurerm_storage_container']],
+    [
+        'azure_network',
+        [
+            'azurerm_resource_group',
+            'azurerm_subnet',
+            'azurerm_public_ip',
+            'azurerm_firewall',
+            'azurerm_route',
+            'azurerm_route_table',
+            'azurerm_network_security_group',
+        ],
+    ],
+    ['azure_container', ['azurerm_container_registry']],
+    [
+        'azure_database',
+        ['azurerm_postgresql_server', 'azurerm_postgresql_database'],
+    ],
+    ['azure_loadbalancer', ['azurerm_lb', 'azurerm_lb_rule']],
+    [
+        'azure_private_dns',
+        [
+            'azurerm_private_dns_a_record',
+            'azurerm_private_dns_aaaa_record',
+            'azurerm_private_dns_cname_record',
+            'azurerm_private_dns_mx_record',
+            'azurerm_private_dns_ptr_record',
+            'azurerm_private_dns_srv_record',
+            'azurerm_private_dns_txt_record',
+            'azurerm_private_dns_zone',
+        ],
+    ],
+    // Google
+    [
+        'google_cloud_platform',
+        [
+            'google_project_iam_binding',
+            'google_project_iam_member',
+            'google_project_iam_policy',
+        ],
+    ],
+    [
+        'google_cloud_storage',
+        [
+            'google_storage_bucket',
+            'google_storage_bucket_iam_binding',
+            'google_storage_bucket_iam_member',
+            'google_storage_bucket_iam_policy',
+        ],
+    ],
+    [
+        'google_compute_engine',
+        [
+            'google_compute_address',
+            'google_compute_disk',
+            'google_compute_global_address',
+            'google_compute_firewall',
+            'google_compute_health_check',
+            'google_compute_image',
+            'google_compute_instance',
+            'google_compute_instance_group',
+            'google_compute_network',
+            'google_compute_node_group',
+            'google_compute_router',
+            'google_compute_subnetwork',
+        ],
+    ],
+    ['google_cloud_dns', ['google_dns_managed_zone']],
+    [
+        'google_cloud_bigtable',
+        ['google_bigtable_instance', 'google_bigtable_table'],
+    ],
+    [
+        'google_cloud_bigquery',
+        ['google_bigquery_table', 'google_bigquery_dataset'],
+    ],
+    ['google_cloud_functions', ['google_cloudfunctions_function']],
+    ['google_cloud_sql', ['google_sql_database_instance']],
+    ['google_cloud_run', ['google_cloud_run_service']],
+]);
+function verifyServiceMappingExists(services) {
+    if (services.length == 0) {
+        throw new InvalidServiceError('');
+    }
+    for (const s of services) {
+        if (!exports.services2resources.has(s)) {
+            throw new InvalidServiceError(`We were unable to match service "${s}". Please provide a valid service name: ${existingServiceNames()}`);
+        }
+    }
+}
+exports.verifyServiceMappingExists = verifyServiceMappingExists;
+function existingServiceNames() {
+    let res = '';
+    for (const s of exports.services2resources.keys()) {
+        res += `${s},`;
+    }
+    return res.substring(0, res.length - 1);
+}
+function createIgnorePattern(services) {
+    return createIgnorePatternWithMap(services, exports.services2resources);
+}
+exports.createIgnorePattern = createIgnorePattern;
+function createIgnorePatternWithMap(services, serviceMap) {
+    let res = '*';
+    const seenResources = new Set();
+    for (const s of services) {
+        const resourcePatterns = serviceMap.get(s);
+        for (const rp of resourcePatterns || []) {
+            // A resource might belong to multiple services, skip it if already processed
+            if (seenResources.has(rp)) {
+                continue;
+            }
+            res += `,!${rp}`;
+            seenResources.add(rp);
+        }
+    }
+    return res;
+}
+exports.createIgnorePatternWithMap = createIgnorePatternWithMap;
+class InvalidServiceError extends errors_1.CustomError {
+    constructor(msg) {
+        super(msg);
+        this.code = types_1.IaCErrorCodes.InvalidServiceError;
+        this.strCode = error_utils_1.getErrorStringCode(this.code);
+        this.userMessage = msg;
+    }
+}
+exports.InvalidServiceError = InvalidServiceError;
+
+
+/***/ })
+
+};
+;
+//# sourceMappingURL=269.index.js.map