verdaccio-audit 10.0.2 ā 10.2.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/lib/audit.js +1 -9
- package/lib/audit.js.map +1 -1
- package/lib/types.js +4 -0
- package/package.json +7 -6
package/lib/audit.js
CHANGED
|
@@ -17,20 +17,12 @@ var _bodyParser = require("body-parser");
|
|
|
17
17
|
|
|
18
18
|
function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
|
|
19
19
|
|
|
20
|
-
function _defineProperty(obj, key, value) { if (key in obj) { Object.defineProperty(obj, key, { value: value, enumerable: true, configurable: true, writable: true }); } else { obj[key] = value; } return obj; }
|
|
21
|
-
|
|
22
20
|
// FUTURE: we should be able to overwrite this
|
|
23
21
|
const REGISTRY_DOMAIN = 'https://registry.npmjs.org';
|
|
24
22
|
exports.REGISTRY_DOMAIN = REGISTRY_DOMAIN;
|
|
25
23
|
|
|
26
24
|
class ProxyAudit {
|
|
27
25
|
constructor(config, options) {
|
|
28
|
-
_defineProperty(this, "enabled", void 0);
|
|
29
|
-
|
|
30
|
-
_defineProperty(this, "logger", void 0);
|
|
31
|
-
|
|
32
|
-
_defineProperty(this, "strict_ssl", void 0);
|
|
33
|
-
|
|
34
26
|
this.enabled = config.enabled || false;
|
|
35
27
|
this.strict_ssl = config.strict_ssl !== undefined ? config.strict_ssl : true;
|
|
36
28
|
this.logger = options.logger;
|
|
@@ -52,7 +44,7 @@ class ProxyAudit {
|
|
|
52
44
|
method: req.method
|
|
53
45
|
};
|
|
54
46
|
|
|
55
|
-
if (auth
|
|
47
|
+
if (auth !== null && auth !== void 0 && (_auth$config = auth.config) !== null && _auth$config !== void 0 && _auth$config.https_proxy) {
|
|
56
48
|
var _auth$config2;
|
|
57
49
|
|
|
58
50
|
// we should check whether this works fine after this migration
|
package/lib/audit.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"sources":["../src/audit.ts"],"names":["REGISTRY_DOMAIN","ProxyAudit","constructor","config","options","enabled","strict_ssl","undefined","logger","register_middlewares","app","auth","fetchAudit","req","res","headers","requestOptions","agent","https","Agent","rejectUnauthorized","body","JSON","stringify","method","https_proxy","Object","assign","auditEndpoint","baseUrl","route","path","debug","response","ok","status","send","json","warn","end","error","handleAudit","router","express","Router","post","limit","use"],"mappings":";;;;;;;AAAA;;AACA;;AACA;;AACA;;AACA
|
|
1
|
+
{"version":3,"sources":["../src/audit.ts"],"names":["REGISTRY_DOMAIN","ProxyAudit","constructor","config","options","enabled","strict_ssl","undefined","logger","register_middlewares","app","auth","fetchAudit","req","res","headers","requestOptions","agent","https","Agent","rejectUnauthorized","body","JSON","stringify","method","https_proxy","Object","assign","auditEndpoint","baseUrl","route","path","debug","response","ok","status","send","json","warn","end","error","handleAudit","router","express","Router","post","limit","use"],"mappings":";;;;;;;AAAA;;AACA;;AACA;;AACA;;AACA;;;;AAKA;AACO,MAAMA,eAAe,GAAG,4BAAxB;;;AAEQ,MAAMC,UAAN,CAA2D;AAKjEC,EAAAA,WAAW,CAACC,MAAD,EAAsBC,OAAtB,EAA2D;AAC3E,SAAKC,OAAL,GAAeF,MAAM,CAACE,OAAP,IAAkB,KAAjC;AACA,SAAKC,UAAL,GAAkBH,MAAM,CAACG,UAAP,KAAsBC,SAAtB,GAAkCJ,MAAM,CAACG,UAAzC,GAAsD,IAAxE;AACA,SAAKE,MAAL,GAAcJ,OAAO,CAACI,MAAtB;AACD;;AAEMC,EAAAA,oBAAoB,CAACC,GAAD,EAAWC,IAAX,EAAgD;AACzE,UAAMC,UAAU,GAAG,CAACC,GAAD,EAAeC,GAAf,KAAqE;AAAA;;AACtF,YAAMC,OAAO,GAAGF,GAAG,CAACE,OAApB;AAEAA,MAAAA,OAAO,CAAC,MAAD,CAAP,GAAkB,oBAAlB;AACAA,MAAAA,OAAO,CAAC,kBAAD,CAAP,GAA8B,iBAA9B;AAEA,UAAIC,cAAmB,GAAG;AACxBC,QAAAA,KAAK,EAAE,IAAIC,eAAMC,KAAV,CAAgB;AAAEC,UAAAA,kBAAkB,EAAE,KAAKd;AAA3B,SAAhB,CADiB;AAExBe,QAAAA,IAAI,EAAEC,IAAI,CAACC,SAAL,CAAeV,GAAG,CAACQ,IAAnB,CAFkB;AAGxBN,QAAAA,OAHwB;AAIxBS,QAAAA,MAAM,EAAEX,GAAG,CAACW;AAJY,OAA1B;;AAOA,UAAIb,IAAJ,aAAIA,IAAJ,+BAAIA,IAAI,CAAER,MAAV,yCAAI,aAAcsB,WAAlB,EAA+B;AAAA;;AAC7B;AACA;AACA,cAAMR,KAAK,GAAG,8BAAsBN,IAAtB,aAAsBA,IAAtB,wCAAsBA,IAAI,CAAER,MAA5B,kDAAsB,cAAcsB,WAApC,CAAd;AACAT,QAAAA,cAAc,GAAGU,MAAM,CAACC,MAAP,CAAc,EAAd,EAAkBX,cAAlB,EAAkC;AACjDC,UAAAA;AADiD,SAAlC,CAAjB;AAGD;;AAED,OAAC,YAAY;AACX,YAAI;AACF,gBAAMW,aAAa,GAAI,GAAE5B,eAAgB,GAAEa,GAAG,CAACgB,OAAQ,GAAEhB,GAAG,CAACiB,KAAJ,CAAUC,IAAK,EAAxE;AACA,eAAKvB,MAAL,CAAYwB,KAAZ,CAAkB,yBAAyBJ,aAA3C;AAEA,gBAAMK,QAAQ,GAAG,MAAM,wBAAML,aAAN,EAAqBZ,cAArB,CAAvB;;AAEA,cAAIiB,QAAQ,CAACC,EAAb,EAAiB;AACfpB,YAAAA,GAAG,CAACqB,MAAJ,CAAWF,QAAQ,CAACE,MAApB,EAA4BC,IAA5B,CAAiC,MAAMH,QAAQ,CAACI,IAAT,EAAvC;AACD,WAFD,MAEO;AACL,iBAAK7B,MAAL,CAAY8B,IAAZ,CAAiB,4BAA4BhB,IAAI,CAACC,SAAL,CAAe,MAAMU,QAAQ,CAACI,IAAT,EAArB,CAA7C;AACAvB,YAAAA,GAAG,CAACqB,MAAJ,CAAWF,QAAQ,CAACE,MAApB,EAA4BI,GAA5B;AACD;AACF,SAZD,CAYE,OAAOC,KAAP,EAAc;AACd,eAAKhC,MAAL,CAAY8B,IAAZ,CAAiB,4BAA4BE,KAA7C;AACA1B,UAAAA,GAAG,CAACqB,MAAJ,CAAW,GAAX,EAAgBI,GAAhB;AACD;AACF,OAjBD;AAkBD,KAxCD;;AA0CA,UAAME,WAAW,GAAG,CAAC5B,GAAD,EAAeC,GAAf,KAAuC;AACzD,UAAI,KAAKT,OAAT,EAAkB;AAChBO,QAAAA,UAAU,CAACC,GAAD,EAAMC,GAAN,CAAV;AACD,OAFD,MAEO;AACLA,QAAAA,GAAG,CAACqB,MAAJ,CAAW,GAAX,EAAgBI,GAAhB;AACD;AACF,KAND;AAQA;;;AACA,UAAMG,MAAM,GAAGC,iBAAQC,MAAR,EAAf;AACA;;;AAEAF,IAAAA,MAAM,CAACG,IAAP,CAAY,SAAZ,EAAuB,sBAAW;AAAEC,MAAAA,KAAK,EAAE;AAAT,KAAX,CAAvB,EAAsDL,WAAtD;AACAC,IAAAA,MAAM,CAACG,IAAP,CAAY,eAAZ,EAA6B,sBAAW;AAAEC,MAAAA,KAAK,EAAE;AAAT,KAAX,CAA7B,EAA4DL,WAA5D;AAEAC,IAAAA,MAAM,CAACG,IAAP,CAAY,kBAAZ,EAAgC,sBAAW;AAAEC,MAAAA,KAAK,EAAE;AAAT,KAAX,CAAhC,EAA+DL,WAA/D;AAEA/B,IAAAA,GAAG,CAACqC,GAAJ,CAAQ,oBAAR,EAA8BL,MAA9B;AACD;;AAxEuE","sourcesContent":["import https from 'https';\nimport fetch from 'node-fetch';\nimport express, { Request, Response } from 'express';\nimport createHttpsProxyAgent from 'https-proxy-agent';\nimport { json as jsonParser } from 'body-parser';\nimport { Logger, IPluginMiddleware, IBasicAuth, PluginOptions } from '@verdaccio/types';\n\nimport { ConfigAudit } from './types';\n\n// FUTURE: we should be able to overwrite this\nexport const REGISTRY_DOMAIN = 'https://registry.npmjs.org';\n\nexport default class ProxyAudit implements IPluginMiddleware<ConfigAudit> {\n public enabled: boolean;\n public logger: Logger;\n public strict_ssl: boolean;\n\n public constructor(config: ConfigAudit, options: PluginOptions<ConfigAudit>) {\n this.enabled = config.enabled || false;\n this.strict_ssl = config.strict_ssl !== undefined ? config.strict_ssl : true;\n this.logger = options.logger;\n }\n\n public register_middlewares(app: any, auth: IBasicAuth<ConfigAudit>): void {\n const fetchAudit = (req: Request, res: Response & { report_error?: Function }): void => {\n const headers = req.headers;\n\n headers['host'] = 'registry.npmjs.org';\n headers['content-encoding'] = 'gzip,deflate,br';\n\n let requestOptions: any = {\n agent: new https.Agent({ rejectUnauthorized: this.strict_ssl }),\n body: JSON.stringify(req.body),\n headers,\n method: req.method,\n };\n\n if (auth?.config?.https_proxy) {\n // we should check whether this works fine after this migration\n // please notify if anyone is having issues\n const agent = createHttpsProxyAgent(auth?.config?.https_proxy);\n requestOptions = Object.assign({}, requestOptions, {\n agent,\n });\n }\n\n (async () => {\n try {\n const auditEndpoint = `${REGISTRY_DOMAIN}${req.baseUrl}${req.route.path}`;\n this.logger.debug('fetching audit from ' + auditEndpoint);\n\n const response = await fetch(auditEndpoint, requestOptions);\n\n if (response.ok) {\n res.status(response.status).send(await response.json());\n } else {\n this.logger.warn('could not fetch audit: ' + JSON.stringify(await response.json()));\n res.status(response.status).end();\n }\n } catch (error) {\n this.logger.warn('could not fetch audit: ' + error);\n res.status(500).end();\n }\n })();\n };\n\n const handleAudit = (req: Request, res: Response): void => {\n if (this.enabled) {\n fetchAudit(req, res);\n } else {\n res.status(500).end();\n }\n };\n\n /* eslint new-cap:off */\n const router = express.Router();\n /* eslint new-cap:off */\n\n router.post('/audits', jsonParser({ limit: '10mb' }), handleAudit);\n router.post('/audits/quick', jsonParser({ limit: '10mb' }), handleAudit);\n\n router.post('/advisories/bulk', jsonParser({ limit: '10mb' }), handleAudit);\n\n app.use('/-/npm/v1/security', router);\n }\n}\n"],"file":"audit.js"}
|
package/lib/types.js
CHANGED
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "verdaccio-audit",
|
|
3
|
-
"version": "10.0
|
|
3
|
+
"version": "10.2.0",
|
|
4
4
|
"description": "Verdaccio Middleware plugin to bypass npmjs audit",
|
|
5
5
|
"keywords": [
|
|
6
6
|
"verdaccio",
|
|
@@ -28,13 +28,13 @@
|
|
|
28
28
|
"node": ">=8"
|
|
29
29
|
},
|
|
30
30
|
"dependencies": {
|
|
31
|
-
"express": "4.17.
|
|
31
|
+
"express": "4.17.2",
|
|
32
32
|
"https-proxy-agent": "5.0.0",
|
|
33
|
-
"body-parser": "1.19.
|
|
34
|
-
"node-fetch": "2.6.
|
|
33
|
+
"body-parser": "1.19.1",
|
|
34
|
+
"node-fetch": "2.6.7"
|
|
35
35
|
},
|
|
36
36
|
"devDependencies": {
|
|
37
|
-
"@verdaccio/types": "10.
|
|
37
|
+
"@verdaccio/types": "10.3.0"
|
|
38
38
|
},
|
|
39
39
|
"funding": {
|
|
40
40
|
"type": "opencollective",
|
|
@@ -48,5 +48,6 @@
|
|
|
48
48
|
"build:js": "babel src/ --out-dir lib/ --copy-files --extensions \".ts,.tsx\" --source-maps",
|
|
49
49
|
"watch": "pnpm build:js -- --watch",
|
|
50
50
|
"build": "pnpm run build:js && pnpm run build:types"
|
|
51
|
-
}
|
|
51
|
+
},
|
|
52
|
+
"readme": "# verdaccio-audit\nš”š¬ npmjs audit support for verdaccio\n\n[](https://www.npmjs.com/package/verdaccio-audit)\n[](https://snyk.io/test/github/verdaccio/verdaccio-audit?targetFile=package.json)\n[](https://opencollective.com/verdaccio)\n[](http://chat.verdaccio.org/)\n\n[](https://www.npmjs.com/package/verdaccio-audit)\n\n## Requirements\n\n* verdaccio@3.x or higher\n\n```\n npm install --global verdaccio-audit\n```\n\n## Usage\nTo enable it you need to add this to your configuration file.\n```yaml\nmiddlewares:\n audit:\n enabled: true\n strict_ssl: true # optional, defaults to true\n```\n\n### Strict SSL\n\nIn some scenarios it may be necessary to disable SSL certificate validation. Setting *strict_ssl* to false will disable these checks, but will make all connections passing through this plugin inherently insecure.\n\n## Disclaimer\n\nThis plugin is experimental and unstable. Please report any issue you found.\n\n## License\n\nMIT (http://www.opensource.org/licenses/mit-license.php)\n"
|
|
52
53
|
}
|