verdaccio-security-filter 1.3.4 → 1.3.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/build/index.js +43 -15
  2. package/package.json +3 -2
package/build/index.js CHANGED
@@ -269,14 +269,15 @@ class SecurityFilterPlugin {
269
269
  filter_metadata(packageInfo) {
270
270
  return __awaiter(this, void 0, void 0, function* () {
271
271
  var _a, _b, _c, _d, _e, _f, _g, _h;
272
- const packageName = packageInfo.name;
272
+ let pkg = packageInfo;
273
+ const packageName = pkg.name;
273
274
  this.logger.info(`[filter_metadata] --> Processing: ${packageName}`);
274
275
  try {
275
276
  const blockResult = yield this._checkPackageBlock(packageName);
276
277
  if (blockResult.blocked) {
277
278
  this.logger.warn(`[filter_metadata] BLOCKED: ${packageName}@* - ${blockResult.reason}`);
278
279
  this.metrics.recordBlock(packageName, '*', blockResult.reason);
279
- return Object.assign(Object.assign({}, packageInfo), { versions: {}, 'dist-tags': {}, security: {
280
+ return Object.assign(Object.assign({}, pkg), { versions: {}, 'dist-tags': {}, security: {
280
281
  blocked: true,
281
282
  reason: blockResult.reason,
282
283
  plugin: {
@@ -289,7 +290,7 @@ class SecurityFilterPlugin {
289
290
  } });
290
291
  }
291
292
  if ((_a = this.config.cveCheck) === null || _a === void 0 ? void 0 : _a.enabled) {
292
- const versions = Object.keys(packageInfo.versions || {});
293
+ const versions = Object.keys(pkg.versions || {});
293
294
  const vulnerableVersions = [];
294
295
  const BATCH_SIZE = 10;
295
296
  for (let i = 0; i < versions.length; i += BATCH_SIZE) {
@@ -310,7 +311,7 @@ class SecurityFilterPlugin {
310
311
  const reason = `Package has ${vulnerableVersions.length} vulnerable version(s)`;
311
312
  this.logger.warn(`[filter_metadata] CVE BLOCKED: ${packageName} - ${reason}`);
312
313
  this.metrics.recordBlock(packageName, '*', reason);
313
- return Object.assign(Object.assign({}, packageInfo), { versions: {}, 'dist-tags': {}, security: {
314
+ return Object.assign(Object.assign({}, pkg), { versions: {}, 'dist-tags': {}, security: {
314
315
  blocked: true,
315
316
  reason,
316
317
  vulnerableVersions,
@@ -323,14 +324,14 @@ class SecurityFilterPlugin {
323
324
  }
324
325
  }
325
326
  if (this.config.licenses && this.config.licenses.allowed && this.config.licenses.allowed.length > 0) {
326
- const latestVersion = (_b = packageInfo['dist-tags']) === null || _b === void 0 ? void 0 : _b.latest;
327
- if (latestVersion && ((_c = packageInfo.versions) === null || _c === void 0 ? void 0 : _c[latestVersion])) {
328
- const versionData = packageInfo.versions[latestVersion];
327
+ const latestVersion = (_b = pkg['dist-tags']) === null || _b === void 0 ? void 0 : _b.latest;
328
+ if (latestVersion && ((_c = pkg.versions) === null || _c === void 0 ? void 0 : _c[latestVersion])) {
329
+ const versionData = pkg.versions[latestVersion];
329
330
  const licenseResult = this.licenseChecker.checkLicense(versionData);
330
331
  if (!licenseResult.allowed) {
331
332
  this.logger.warn(`[filter_metadata] LICENSE BLOCKED: ${packageName} - ${licenseResult.reason}`);
332
333
  this.metrics.recordBlock(packageName, '*', licenseResult.reason || 'License not allowed');
333
- return Object.assign(Object.assign({}, packageInfo), { versions: {}, 'dist-tags': {}, security: {
334
+ return Object.assign(Object.assign({}, pkg), { versions: {}, 'dist-tags': {}, security: {
334
335
  blocked: true,
335
336
  reason: licenseResult.reason || 'License not allowed',
336
337
  license: licenseResult.license,
@@ -344,11 +345,11 @@ class SecurityFilterPlugin {
344
345
  }
345
346
  }
346
347
  if ((_d = this.config.packageAge) === null || _d === void 0 ? void 0 : _d.enabled) {
347
- const ageResult = this.packageAgeChecker.checkPackageAge(packageInfo);
348
+ const ageResult = this.packageAgeChecker.checkPackageAge(pkg);
348
349
  if (!ageResult.allowed && !ageResult.warnOnly) {
349
350
  this.logger.warn(`[filter_metadata] AGE BLOCKED: ${packageName} - ${ageResult.reason}`);
350
351
  this.metrics.recordBlock(packageName, '*', ageResult.reason || 'Package too new');
351
- return Object.assign(Object.assign({}, packageInfo), { versions: {}, 'dist-tags': {}, security: {
352
+ return Object.assign(Object.assign({}, pkg), { versions: {}, 'dist-tags': {}, security: {
352
353
  blocked: true,
353
354
  reason: ageResult.reason || 'Package too new',
354
355
  ageDays: ageResult.ageDays,
@@ -362,11 +363,38 @@ class SecurityFilterPlugin {
362
363
  else if (!ageResult.allowed && ageResult.warnOnly) {
363
364
  this.logger.warn(`[filter_metadata] AGE WARNING: ${packageName} - ${ageResult.reason} (warn-only mode)`);
364
365
  }
366
+ if (this.config.packageAge.minVersionAgeDays) {
367
+ const filteredVersions = Object.assign({}, pkg.versions);
368
+ const removedVersions = [];
369
+ for (const version of Object.keys(filteredVersions)) {
370
+ const versionAgeResult = this.packageAgeChecker.checkVersionAge(pkg, version);
371
+ if (!versionAgeResult.allowed && !versionAgeResult.warnOnly) {
372
+ this.logger.warn(`[filter_metadata] VERSION AGE FILTERED: ${packageName}@${version} - ${versionAgeResult.reason}`);
373
+ this.metrics.recordBlock(packageName, version, versionAgeResult.reason || 'Version too new');
374
+ delete filteredVersions[version];
375
+ removedVersions.push(version);
376
+ }
377
+ else if (!versionAgeResult.allowed && versionAgeResult.warnOnly) {
378
+ this.logger.warn(`[filter_metadata] VERSION AGE WARNING: ${packageName}@${version} - ${versionAgeResult.reason} (warn-only mode)`);
379
+ }
380
+ }
381
+ if (removedVersions.length > 0) {
382
+ this.logger.info(`[filter_metadata] Removed ${removedVersions.length} too-new version(s) from ${packageName}: ${removedVersions.join(', ')}`);
383
+ const filteredDistTags = Object.assign({}, pkg['dist-tags']);
384
+ for (const [tag, tagVersion] of Object.entries(filteredDistTags)) {
385
+ if (removedVersions.includes(tagVersion)) {
386
+ delete filteredDistTags[tag];
387
+ this.logger.debug(`[filter_metadata] Removed dist-tag "${tag}" pointing to filtered version ${tagVersion}`);
388
+ }
389
+ }
390
+ pkg = Object.assign(Object.assign({}, pkg), { versions: filteredVersions, 'dist-tags': filteredDistTags });
391
+ }
392
+ }
365
393
  }
366
394
  if ((_e = this.config.authorFilter) === null || _e === void 0 ? void 0 : _e.enabled) {
367
- const latestVersion = (_f = packageInfo['dist-tags']) === null || _f === void 0 ? void 0 : _f.latest;
368
- if (latestVersion && ((_g = packageInfo.versions) === null || _g === void 0 ? void 0 : _g[latestVersion])) {
369
- const versionData = packageInfo.versions[latestVersion];
395
+ const latestVersion = (_f = pkg['dist-tags']) === null || _f === void 0 ? void 0 : _f.latest;
396
+ if (latestVersion && ((_g = pkg.versions) === null || _g === void 0 ? void 0 : _g[latestVersion])) {
397
+ const versionData = pkg.versions[latestVersion];
370
398
  const authorResult = this.authorChecker.checkAuthor(versionData);
371
399
  if (!authorResult.allowed && !this.config.authorFilter.warnOnly) {
372
400
  this.logger.warn(`[filter_metadata] AUTHOR BLOCKED: ${packageName} - ${authorResult.reason}`);
@@ -381,7 +409,7 @@ class SecurityFilterPlugin {
381
409
  authorInfo: authorResult.authorInfo,
382
410
  },
383
411
  });
384
- return Object.assign(Object.assign({}, packageInfo), { versions: {}, 'dist-tags': {}, security: {
412
+ return Object.assign(Object.assign({}, pkg), { versions: {}, 'dist-tags': {}, security: {
385
413
  blocked: true,
386
414
  reason: authorResult.reason || 'Author not allowed',
387
415
  blockedBy: authorResult.blockedBy,
@@ -399,7 +427,7 @@ class SecurityFilterPlugin {
399
427
  }
400
428
  }
401
429
  this.logger.info(`[filter_metadata] [OK] ALLOWED: ${packageName}`);
402
- return packageInfo;
430
+ return pkg;
403
431
  }
404
432
  catch (error) {
405
433
  this.logger.error(`[filter_metadata] Error processing ${packageName}: ${error.message}`);
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "verdaccio-security-filter",
3
- "version": "1.3.4",
3
+ "version": "1.3.5",
4
4
  "description": "Advanced security filter plugin for Verdaccio with version range blocking and fallback strategies",
5
5
  "main": "build/index.js",
6
6
  "types": "build/index.d.ts",
@@ -54,7 +54,8 @@
54
54
  "typescript-eslint": "^8.0.0"
55
55
  },
56
56
  "overrides": {
57
- "qs": "6.14.2"
57
+ "qs": "6.14.2",
58
+ "@cypress/request": "latest"
58
59
  },
59
60
  "author": {
60
61
  "name": "Vitaliy Ponomarenko",