snyk 1.966.0 → 1.969.0

package/dist/cli/184.index.js

@@ -157417,29 +157417,31 @@ Object.defineProperty(exports, "phpFilesToScannedProjects", ({ enumerable: true,
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.parsePomProperties = exports.getCoordsFromPomProperties = exports.jarFilesToScannedProjects = void 0;
+exports.parsePomProperties = exports.getCoordsFromPomProperties = exports.jarFilesToScannedResults = void 0;
 const admzip = __webpack_require__(55285);
 const path = __webpack_require__(85622);
 const buffer_utils_1 = __webpack_require__(29098);
-function groupJarFingerprintsByPath(input) {
-    const jarFingerprints = Object.entries(input).map(([filePath, buffer]) => {
-        return {
+/**
+ * @param {{[fileName: string]: Buffer}} fileNameToBuffer fileName
+ * @returns {AggregatedJars}
+ */
+function groupJarFingerprintsByPath(fileNameToBuffer) {
+    const resultAggregatedByPath = {};
+    Object.keys(fileNameToBuffer).forEach((filePath) => {
+        const location = path.dirname(filePath);
+        const jarFingerprint = {
             location: filePath,
-            buffer,
+            buffer: fileNameToBuffer[filePath],
             coords: null,
             dependencies: [],
             nestedJars: [],
         };
+        resultAggregatedByPath[location] = resultAggregatedByPath[location] || [];
+        resultAggregatedByPath[location].push(jarFingerprint);
     });
-    const resultAggregatedByPath = jarFingerprints.reduce((jarsAggregatedByPath, jarFingerprint) => {
-        const location = path.dirname(jarFingerprint.location);
-        jarsAggregatedByPath[location] = jarsAggregatedByPath[location] || [];
-        jarsAggregatedByPath[location].push(jarFingerprint);
-        return jarsAggregatedByPath;
-    }, {});
     return resultAggregatedByPath;
 }
-async function jarFilesToScannedProjects(filePathToContent, targetImage, desiredLevelsOfUnpacking) {
+async function jarFilesToScannedResults(filePathToContent, targetImage, desiredLevelsOfUnpacking) {
     const mappedResult = groupJarFingerprintsByPath(filePathToContent);
     const scanResults = [];
     for (const path in mappedResult) {
@@ -157465,7 +157467,7 @@ async function jarFilesToScannedProjects(filePathToContent, targetImage, desired
     }
     return scanResults;
 }
-exports.jarFilesToScannedProjects = jarFilesToScannedProjects;
+exports.jarFilesToScannedResults = jarFilesToScannedResults;
 function getFingerprints(desiredLevelsOfUnpacking, jarBuffers) {
     const fingerprints = new Set([
         ...unpackJars(jarBuffers, desiredLevelsOfUnpacking),
@@ -157596,7 +157598,7 @@ function unpackJars(jarBuffers, desiredLevelsOfUnpacking, unpackedLevels = 0) {
         }
         if (jarInfo.nestedJars.length > 0) {
             // this is an uber/fat JAR so we need to unpack the nested JARs to
-            // analyse them for coords and further nested JARs (depth flag allowing)
+            // analyze them for coords and further nested JARs (depth flag allowing)
             fingerprints.push(...unpackJars(jarInfo.nestedJars, desiredLevelsOfUnpacking, unpackedLevels + 1));
         }
     }
@@ -157626,11 +157628,11 @@ function parsePomProperties(fileContent) {
     const fileContentLines = fileContent
         .split(/\n/)
         .filter((line) => /^(groupId|artifactId|version)=/.test(line)); // These are the only properties we are interested in
-    const coords = fileContentLines.reduce((coords, line) => {
+    const coords = {};
+    fileContentLines.forEach((line) => {
         const [key, value] = line.split("=");
         coords[key] = value.trim(); // Getting rid of EOL
-        return coords;
-    }, {});
+    });
     return coords;
 }
 exports.parsePomProperties = parsePomProperties;
@@ -158535,7 +158537,7 @@ async function analyze(targetImage, dockerfileAnalysis, imageType, imagePath, gl
     if (checkForGlobs) {
         staticAnalysisActions.push(filePatternStatic.generateExtractAction(globsToFind.include, globsToFind.exclude));
     }
-    const appScan = (0, option_utils_1.isTrue)(options["app-vulns"]);
+    const appScan = !(0, option_utils_1.isTrue)(options["exclude-app-vulns"]);
     if (appScan) {
         staticAnalysisActions.push(...[
             static_6.getNodeAppFileContentAction,
@@ -158585,7 +158587,7 @@ async function analyze(targetImage, dockerfileAnalysis, imageType, imagePath, gl
         const nodeDependenciesScanResults = await (0, applications_1.nodeFilesToScannedProjects)((0, inputs_1.getFileContent)(extractedLayers, static_6.getNodeAppFileContentAction.actionName));
         const phpDependenciesScanResults = await (0, applications_1.phpFilesToScannedProjects)((0, inputs_1.getFileContent)(extractedLayers, static_8.getPhpAppFileContentAction.actionName));
         const desiredLevelsOfUnpacking = getNestedJarsDesiredDepth(options);
-        const jarFingerprintScanResults = await (0, java_1.jarFilesToScannedProjects)((0, inputs_1.getBufferContent)(extractedLayers, static_5.getJarFileContentAction.actionName), targetImage, desiredLevelsOfUnpacking);
+        const jarFingerprintScanResults = await (0, java_1.jarFilesToScannedResults)((0, inputs_1.getBufferContent)(extractedLayers, static_5.getJarFileContentAction.actionName), targetImage, desiredLevelsOfUnpacking);
         const goModulesScanResult = await (0, go_parser_1.goModulesToScannedProjects)((0, inputs_1.getElfFileContent)(extractedLayers, go_parser_1.getGoModulesContentAction.actionName));
         applicationDependenciesScanResults.push(...nodeDependenciesScanResults, ...phpDependenciesScanResults, ...jarFingerprintScanResults, ...goModulesScanResult);
     }
@@ -160279,12 +160281,13 @@ exports.parserStrTab = parserStrTab;
 /***/ }),
 
 /***/ 12790:
-/***/ ((__unused_webpack_module, exports) => {
+/***/ ((__unused_webpack_module, exports, __webpack_require__) => {
 
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.extractModulesFromBinary = void 0;
+const varint = __webpack_require__(94676);
 /**
  * Create same output as `go version -m binary-file` does
  * @param binary
@@ -160305,90 +160308,132 @@ function prepareGoDependencies(mod) {
     }
     const [, mainModuleLine, ...versionsLines] = mod.split("\n");
     const [, name] = mainModuleLine.split("\t");
-    const modules = versionsLines.reduce((accum, curr) => {
-        // Skip If for some reason after splitting there is a empty line
-        if (!curr) {
-            return accum;
+    const modules = {};
+    versionsLines.forEach((versionLine) => {
+        if (!versionLine) {
+            return;
+        }
+        const [, name, ver] = versionLine.split("\t");
+        if (!name || !ver) {
+            return;
         }
-        const [, name, ver] = curr.split("\t");
-        // Versions in Go have trailing 'v'
+        // Versions in Go have leading 'v'
         let version = ver.substring(1);
         // In versions with hash, we only care about hash
         // v0.0.0-20200905004654-be1d3432aa8f => #be1d3432aa8f
         version = version.includes("-")
             ? `#${version.substring(version.lastIndexOf("-") + 1)}`
             : version;
-        accum[name] = version;
-        return accum;
-    }, {});
+        modules[name] = version;
+    });
     return { name, modules };
 }
 // Source
-// https://github.com/golang/go/blob/46f99ce7ea97d11b0a1a079da8dda0f51df2a2d2/src/cmd/go/internal/version/version.go#L146
+// https://github.com/golang/go/blob/master/src/debug/buildinfo/buildinfo.go#L142
 /**
  * Function finds and returns the Go version and
  * module version information in the executable binary
  * @param binary
  */
 function findVers(binary) {
+    const buildInfoMagic = "\xff Go buildinf:";
     const result = {
         version: "",
         mod: "",
     };
-    const text = dataStart(binary);
-    let data = readData(binary.body.programs, text, 64 * 1024) || Buffer.from([]);
-    for (; !data.toString("binary").startsWith("\xff Go buildinf:"); data = data.slice(32)) {
-        if (data.length < 32) {
+    // Read the first 64kB of dataAddr to find the build info blob.
+    // On some platforms, the blob will be in its own section, and DataStart
+    // returns the address of that section. On others, it's somewhere in the
+    // data segment; the linker puts it near the beginning.
+    const dataAddr = dataStart(binary);
+    let data = readData(binary.body.programs, dataAddr, 64 * 1024) || Buffer.from([]);
+    const buildInfoAlign = 16;
+    const buildInfoSize = 32;
+    while (true) {
+        const i = data.toString("binary").indexOf(buildInfoMagic);
+        if (i < 0 || data.length - i < buildInfoSize) {
             return result;
         }
-    }
+        if (i % buildInfoAlign === 0 && data.length - i >= buildInfoSize) {
+            data = data.subarray(i);
+            break;
+        }
+        data = data.subarray((i + buildInfoAlign - 1) & ~buildInfoAlign);
+    }
+    // Decode the blob.
+    // The first 14 bytes are buildInfoMagic.
+    // The next two bytes indicate pointer size in bytes (4 or 8) and endianness
+    // (0 for little, 1 for big).
+    // Two virtual addresses to Go strings follow that: runtime.buildVersion,
+    // and runtime.modinfo.
+    // On 32-bit platforms, the last 8 bytes are unused.
+    // If the endianness has the 2 bit set, then the pointers are zero
+    // and the 32-byte header is followed by varint-prefixed string data
+    // for the two string values we care about.
     const ptrSize = data[14];
-    const bigEndian = data[15] !== 0;
-    let readPtr;
-    if (ptrSize === 4) {
-        if (bigEndian) {
-            readPtr = (buffer) => buffer.readInt32BE(0);
+    if ((data[15] & 2) !== 0) {
+        data = data.subarray(32);
+        [result.version, data] = decodeString(data);
+        [result.mod, data] = decodeString(data);
+    }
+    else {
+        const bigEndian = data[15] !== 0;
+        let readPtr;
+        if (ptrSize === 4) {
+            if (bigEndian) {
+                readPtr = (buffer) => buffer.readUInt32BE(0);
+            }
+            else {
+                readPtr = (buffer) => buffer.readUInt32LE(0);
+            }
         }
         else {
-            readPtr = (buffer) => buffer.readInt32LE(0);
+            if (bigEndian) {
+                readPtr = (buffer) => Number(buffer.readBigUInt64BE());
+            }
+            else {
+                readPtr = (buffer) => Number(buffer.readBigUInt64LE());
+            }
+        }
+        // The build info blob left by the linker is identified by
+        // a 16-byte header, consisting of buildInfoMagic (14 bytes),
+        // the binary's pointer size (1 byte),
+        // and whether the binary is big endian (1 byte).
+        // Now we attempt to read info after metadata.
+        // From 16th byte to 16th + ptrSize there is a header that points
+        // to go version
+        const version = readString(binary, ptrSize, readPtr, readPtr(data.slice(16, 16 + ptrSize)));
+        if (version === "") {
+            return result;
         }
-    }
-    else {
-        if (bigEndian) {
-            readPtr = (buffer) => Number(buffer.readBigInt64BE());
+        result.version = version;
+        // Go version header was right after metadata.
+        // Modules header right after go version
+        // Read next `ptrSize` bytes, this point to the
+        // place where modules info is stored
+        const mod = readString(binary, ptrSize, readPtr, readPtr(data.slice(16 + ptrSize, 16 + 2 * ptrSize)));
+        // This verifies that what we got are actually go modules
+        // First 16 bytes are unicodes as last 16
+        // Mirrors go version source code
+        if (mod.length >= 33 && mod[mod.length - 17] === "\n") {
+            result.mod = mod.slice(16, mod.length - 16);
         }
         else {
-            readPtr = (buffer) => Number(buffer.readBigInt64LE());
-        }
-    }
-    // The build info blob left by the linker is identified by
-    // a 16-byte header, consisting of buildInfoMagic (14 bytes),
-    // the binary's pointer size (1 byte),
-    // and whether the binary is big endian (1 byte).
-    // Now we attempt to read info after metadata.
-    // From 16th byte to 16th + ptrSize there is a header that points
-    // to go version
-    const version = readString(binary, ptrSize, readPtr, readPtr(data.slice(16, 16 + ptrSize)));
-    if (version === "") {
-        return result;
-    }
-    result.version = version;
-    // Go version header was right after metadata.
-    // Modules header right after go version
-    // Read next `ptrSize` bytes, this point to the
-    // place where modules info is stored
-    const mod = readString(binary, ptrSize, readPtr, readPtr(data.slice(16 + ptrSize, 16 + 2 * ptrSize)));
-    // This verifies that what we got are actually go modules
-    // First 16 bytes are unicodes as last 16
-    // Mirrors go version source code
-    if (mod.length >= 33 && mod[mod.length - 17] === "\n") {
-        result.mod = mod.slice(16, mod.length - 16);
-    }
-    else {
-        result.mod = "";
+            result.mod = "";
+        }
     }
     return result;
 }
+function decodeString(data) {
+    const num = varint.decode(data);
+    const size = varint.decode.bytes;
+    if (size <= 0 || num >= data.length - size) {
+        return ["", Buffer.from([])];
+    }
+    const res = data.subarray(size, num + size);
+    const rest = data.subarray(num + size);
+    return [res.toString("binary"), rest];
+}
 // Source
 // https://github.com/golang/go/blob/46f99ce7ea97d11b0a1a079da8dda0f51df2a2d2/src/cmd/go/internal/version/exe.go#L105
 /**
@@ -161341,8 +161386,8 @@ async function scan(options) {
     }
     const nestedJarsDepth = options["nested-jars-depth"] || options["shaded-jars-depth"];
     if (((0, option_utils_1.isTrue)(nestedJarsDepth) || (0, option_utils_1.isNumber)(nestedJarsDepth)) &&
-        !(0, option_utils_1.isTrue)(options["app-vulns"])) {
-        throw new Error("To use --nested-jars-depth, you must also use --app-vulns");
+        (0, option_utils_1.isTrue)(options["exclude-app-vulns"])) {
+        throw new Error("To use --nested-jars-depth, you must not use --exclude-app-vulns");
     }
     if ((!(0, option_utils_1.isNumber)(nestedJarsDepth) &&
         !(0, option_utils_1.isTrue)(nestedJarsDepth) &&
@@ -243482,6 +243527,123 @@ for (name in extraFunctions) {
 
 ;
 
+/***/ }),
+
+/***/ 26988:
+/***/ ((module) => {
+
+module.exports = read
+
+var MSB = 0x80
+  , REST = 0x7F
+
+function read(buf, offset) {
+  var res    = 0
+    , offset = offset || 0
+    , shift  = 0
+    , counter = offset
+    , b
+    , l = buf.length
+
+  do {
+    if (counter >= l || shift > 49) {
+      read.bytes = 0
+      throw new RangeError('Could not decode varint')
+    }
+    b = buf[counter++]
+    res += shift < 28
+      ? (b & REST) << shift
+      : (b & REST) * Math.pow(2, shift)
+    shift += 7
+  } while (b >= MSB)
+
+  read.bytes = counter - offset
+
+  return res
+}
+
+
+/***/ }),
+
+/***/ 1312:
+/***/ ((module) => {
+
+module.exports = encode
+
+var MSB = 0x80
+  , REST = 0x7F
+  , MSBALL = ~REST
+  , INT = Math.pow(2, 31)
+
+function encode(num, out, offset) {
+  if (Number.MAX_SAFE_INTEGER && num > Number.MAX_SAFE_INTEGER) {
+    encode.bytes = 0
+    throw new RangeError('Could not encode varint')
+  }
+  out = out || []
+  offset = offset || 0
+  var oldOffset = offset
+
+  while(num >= INT) {
+    out[offset++] = (num & 0xFF) | MSB
+    num /= 128
+  }
+  while(num & MSBALL) {
+    out[offset++] = (num & 0xFF) | MSB
+    num >>>= 7
+  }
+  out[offset] = num | 0
+  
+  encode.bytes = offset - oldOffset + 1
+  
+  return out
+}
+
+
+/***/ }),
+
+/***/ 94676:
+/***/ ((module, __unused_webpack_exports, __webpack_require__) => {
+
+module.exports = {
+    encode: __webpack_require__(1312)
+  , decode: __webpack_require__(26988)
+  , encodingLength: __webpack_require__(10082)
+}
+
+
+/***/ }),
+
+/***/ 10082:
+/***/ ((module) => {
+
+
+var N1 = Math.pow(2,  7)
+var N2 = Math.pow(2, 14)
+var N3 = Math.pow(2, 21)
+var N4 = Math.pow(2, 28)
+var N5 = Math.pow(2, 35)
+var N6 = Math.pow(2, 42)
+var N7 = Math.pow(2, 49)
+var N8 = Math.pow(2, 56)
+var N9 = Math.pow(2, 63)
+
+module.exports = function (value) {
+  return (
+    value < N1 ? 1
+  : value < N2 ? 2
+  : value < N3 ? 3
+  : value < N4 ? 4
+  : value < N5 ? 5
+  : value < N6 ? 6
+  : value < N7 ? 7
+  : value < N8 ? 8
+  : value < N9 ? 9
+  :              10
+  )
+}
+
+
 /***/ }),
 
 /***/ 91674: