@dshbuilds/gitlab-npm-audit-parser
Version:
NPM Audit parser for GitLab dependency scanning
3 lines (2 loc) • 127 kB
JavaScript
#!/usr/bin/env node
(()=>{var e={354:(e,t,i)=>{const{createGitLabReport:n,createLocDef:r,createScannerDef:s,createRemediation:o,createVulnDef:a,createVulnIdentifier:p,createVulnLink:d,getCWEId:c,getReportType:l}=i(988);e.exports=function(e){let t=e;/^\s*{/.test(e)||(t=e.replace(/^([^{])*{/,"{"));try{t=JSON.parse(t)}catch(e){if(Object.getPrototypeOf(e)===SyntaxError.prototype)throw new Error("Data provided is not JSON parsable. Check input format.");throw e}try{return JSON.stringify(function(e){switch(l(e)){case 2:return function(e){const t=s(2),i={lockfile:"package-lock.json",vulns:[],remediations:[]};return Object.values(e.vulnerabilities).forEach((e=>{e.via.forEach((n=>{if("object"!=typeof n)return;const s="object"==typeof e.fixAvailable?`Upgrade ${e.fixAvailable.name} to version >=${e.fixAvailable.version}`:null,c=a(`npm::advisory:${n.source||n.id}::${e.name}`,e.name,n.title,n.title,n.severity);c.scanner=t,c.location=r(i.lockfile,e.name,n.range),c.identifiers=[p("cve",n.title,n.source,n.url)],c.links=[d(n.url)],s?(c.solution=s,i.remediations.push(o(c.solution,[c.id]))):delete c.solution,i.vulns.push(c)}))})),n(i)}(e);case 1:default:return function(e){const t=s(1),i={lockfile:"package.json",vulns:[],remediations:[]},l={generateName:(e,t)=>(l[e]=l[e]||`npm::advisory:${e}::${t}`,l[e])},m=[];return e.actions.forEach((t=>{if("install"===t.action){const n=`Upgrade ${t.module} to v${t.target}.`,r=[];t.resolves.forEach((t=>{const i=l.generateName(t.id,e.advisories[t.id].module_name);r.push(i),m.push(t.id)})),i.remediations.push(o(n,r))}})),Object.entries(e.advisories).forEach((([e,n])=>{const s=c(n.cwe),h=a(l.generateName(e,n.module_name),n.module_name,n.title,n.overview,n.severity);h.scanner=t,h.location=r(i.lockfile,n.module_name,n.vulnerable_versions),h.identifiers=[p("cwe",n.cwe,n.cwe,`https://cwe.mitre.org/data/definitions/${s}.html`)],n.cves.length>0&&h.identifiers.unshift(p("cve",n.cves[0],n.cves[0],`https://nvd.nist.gov/vuln/detail/${n.cves[0]}`)),h.links=[d(`https://npmjs.com/advisories/${n.id}`)],h.solution=`Upgrade ${h.name} to`,h.solution=`${h.solution} ${n.recommendation.replace(/^(?:Please )?update to /i,"")}`,m.includes(parseInt(e,10))||i.remediations.push(o(h.solution,[h.id])),i.vulns.push(h)})),n(i)}(e)}}(t),null," ")}catch(e){throw new Error(`Internal error!\nCaused by:\n ${e.toString()}`)}}},988:(e,t,i)=>{const{createHash:n}=i(113),r=i(426).j_;function s(e){if("string"!=typeof e)throw new Error(`Parameter mixmatch: expected string, not '${typeof e}'.`);const t=e.length>0?e.charAt(0).toUpperCase():e;return e.length>1?`${t}${e.slice(1)}`:t}function o(e){const t=["Info","Unknown","Low","Medium","High","Critical"],i={moderate:t[3]};for(let i=0;i<t.length;i++)if(new RegExp(`^${t[i]}$`,"i").test(e))return s(t[i]);const n=Object.keys(i);for(let t=0;t<n.length;t++)if(new RegExp(`^${n[t]}$`,"i").test(e))return s(i[n[t]]);return null}function a(e,t){if(!Array.isArray(t))throw new Error(`parameter mixmatch. Expected string[] not '${JSON.stringify(t)}'`);return{fixes:t.map((e=>({id:e,cve:e}))),summary:e,diff:" "}}e.exports.getCWEId=e=>e.replace("CWE-",""),e.exports.getReportType=e=>parseInt(e.auditReportVersion,10)||1,e.exports.createRemediation=a,e.exports.createGitLabReport=e=>{const t={};return t.version=r.self.version,t.schema=`https://gitlab.com/gitlab-org/security-products/security-report-schemas/-/raw/v${r.self.version}/dist/dependency-scanning-report-format.json`,t.vulnerabilities=e.vulns,t.remediations=function(e){const t={};return e.forEach((e=>{const i=function(e){const t=n("sha1");return t.update(e),t.digest("hex")}(e.summary),r=e.fixes.map((e=>e.id));t[i]?t[i].ids=t[i].ids.concat(r):t[i]={summary:e.summary,ids:r}})),Object.values(t).map((e=>a(e.summary,e.ids)))}(e.remediations),t.dependency_files=[{path:e.lockfile,package_manager:"npm",dependencies:e.vulns.map((e=>e.location.dependency))}],t},e.exports.createVulnDef=(e,t,i,n,r)=>({id:e,cve:e,category:"dependency_scanning",name:t,message:i,description:n,severity:o(r),confidence:"High",scanner:null,location:null,identifiers:[],solution:null,links:[]}),e.exports.createScannerDef=e=>({id:"npm_audit_advisories",name:`NPM Audit v${e}`}),e.exports.createLocDef=(e,t,i)=>({file:e,dependency:{package:{name:t},version:i}}),e.exports.createVulnIdentifier=(e,t,i,n)=>({type:e,name:t,value:i.toString(),url:n}),e.exports.createVulnLink=e=>({url:e})},426:(e,t,i)=>{"use strict";i.d(t,{j_:()=>r}),JSON.parse('{"$schema":"http://json-schema.org/draft-07/schema#","title":"Report format for GitLab DAST","description":"This schema provides the the report format for Dynamic Application Security Testing (https://docs.gitlab.com/ee/user/application_security/dast).","definitions":{"detail_type":{"oneOf":[{"$ref":"#/definitions/named_list"},{"$ref":"#/definitions/list"},{"$ref":"#/definitions/table"},{"$ref":"#/definitions/text"},{"$ref":"#/definitions/url"},{"$ref":"#/definitions/code"},{"$ref":"#/definitions/value"},{"$ref":"#/definitions/diff"},{"$ref":"#/definitions/markdown"},{"$ref":"#/definitions/commit"},{"$ref":"#/definitions/file_location"},{"$ref":"#/definitions/module_location"}]},"text_value":{"type":"string"},"named_field":{"type":"object","required":["name"],"properties":{"name":{"$ref":"#/definitions/text_value","minLength":1},"description":{"$ref":"#/definitions/text_value"}}},"named_list":{"type":"object","description":"An object with named and typed fields","required":["type","items"],"properties":{"type":{"const":"named-list"},"items":{"type":"object","patternProperties":{"^.*$":{"allOf":[{"$ref":"#/definitions/named_field"},{"$ref":"#/definitions/detail_type"}]}}}}},"list":{"type":"object","description":"A list of typed fields","required":["type","items"],"properties":{"type":{"const":"list"},"items":{"type":"array","items":{"$ref":"#/definitions/detail_type"}}}},"table":{"type":"object","description":"A table of typed fields","required":["type","rows"],"properties":{"type":{"const":"table"},"header":{"type":"array","items":{"$ref":"#/definitions/detail_type"}},"rows":{"type":"array","items":{"type":"array","items":{"$ref":"#/definitions/detail_type"}}}}},"text":{"type":"object","description":"Raw text","required":["type","value"],"properties":{"type":{"const":"text"},"value":{"$ref":"#/definitions/text_value"}}},"url":{"type":"object","description":"A single URL","required":["type","href"],"properties":{"type":{"const":"url"},"text":{"$ref":"#/definitions/text_value"},"href":{"type":"string","minLength":1,"examples":["http://mysite.com"]}}},"code":{"type":"object","description":"A codeblock","required":["type","value"],"properties":{"type":{"const":"code"},"value":{"type":"string"},"lang":{"type":"string","description":"A programming language"}}},"value":{"type":"object","description":"A field that can store a range of types of value","required":["type","value"],"properties":{"type":{"const":"value"},"value":{"type":["number","string","boolean"]}}},"diff":{"type":"object","description":"A diff","required":["type","before","after"],"properties":{"type":{"const":"diff"},"before":{"type":"string"},"after":{"type":"string"}}},"markdown":{"type":"object","description":"GitLab flavoured markdown, see https://docs.gitlab.com/ee/user/markdown.html","required":["type","value"],"properties":{"type":{"const":"markdown"},"value":{"$ref":"#/definitions/text_value","examples":["Here is markdown `inline code` #1 [test](gitlab.com)\\n\\n"]}}},"commit":{"type":"object","description":"A commit/tag/branch within the GitLab project","required":["type","value"],"properties":{"type":{"const":"commit"},"value":{"type":"string","description":"The commit SHA","minLength":1}}},"file_location":{"type":"object","description":"A location within a file in the project","required":["type","file_name","line_start"],"properties":{"type":{"const":"file-location"},"file_name":{"type":"string","minLength":1},"line_start":{"type":"integer"},"line_end":{"type":"integer"}}},"module_location":{"type":"object","description":"A location within a binary module of the form module+relative_offset","required":["type","module_name","offset"],"properties":{"type":{"const":"module-location"},"module_name":{"type":"string","minLength":1,"examples":["compiled_binary"]},"offset":{"type":"integer","examples":[100]}}}},"self":{"version":"14.0.3"},"required":["version","vulnerabilities"],"additionalProperties":true,"properties":{"scan":{"type":"object","required":["end_time","scanned_resources","scanner","start_time","status","type"],"properties":{"end_time":{"type":"string","description":"ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan finished.","pattern":"^\\\\d{4}-\\\\d{2}-\\\\d{2}T\\\\d{2}\\\\:\\\\d{2}\\\\:\\\\d{2}$","examples":["2020-01-28T03:26:02"]},"messages":{"type":"array","items":{"type":"object","description":"Communication intended for the initiator of a scan.","required":["level","value"],"properties":{"level":{"type":"string","description":"Describes the severity of the communication. Use info to communicate normal scan behaviour; warn to communicate a potentially recoverable problem, or a partial error; fatal to communicate an issue that causes the scan to halt.","enum":["info","warn","fatal"],"examples":["info"]},"value":{"type":"string","description":"The message to communicate.","minLength":1,"examples":["Permission denied, scanning aborted"]}}}},"analyzer":{"type":"object","description":"Object defining the analyzer used to perform the scan. Analyzers typically delegate to an underlying scanner to run the scan.","required":["id","name","version","vendor"],"properties":{"id":{"type":"string","description":"Unique id that identifies the analyzer.","minLength":1,"examples":["gitlab-dast"]},"name":{"type":"string","description":"A human readable value that identifies the analyzer, not required to be unique.","minLength":1,"examples":["GitLab DAST"]},"url":{"type":"string","format":"uri","pattern":"^https?://.+","description":"A link to more information about the analyzer.","examples":["https://docs.gitlab.com/ee/user/application_security/dast"]},"vendor":{"description":"The vendor/maintainer of the analyzer.","type":"object","required":["name"],"properties":{"name":{"type":"string","description":"The name of the vendor.","minLength":1,"examples":["GitLab"]}}},"version":{"type":"string","description":"The version of the analyzer.","minLength":1,"examples":["1.0.2"]}}},"scanner":{"type":"object","description":"Object defining the scanner used to perform the scan.","required":["id","name","version","vendor"],"properties":{"id":{"type":"string","description":"Unique id that identifies the scanner.","minLength":1,"examples":["my-sast-scanner"]},"name":{"type":"string","description":"A human readable value that identifies the scanner, not required to be unique.","minLength":1,"examples":["My SAST Scanner"]},"url":{"type":"string","description":"A link to more information about the scanner.","examples":["https://scanner.url"]},"version":{"type":"string","description":"The version of the scanner.","minLength":1,"examples":["1.0.2"]},"vendor":{"description":"The vendor/maintainer of the scanner.","type":"object","required":["name"],"properties":{"name":{"type":"string","description":"The name of the vendor.","minLength":1,"examples":["GitLab"]}}}}},"start_time":{"type":"string","description":"ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan started.","pattern":"^\\\\d{4}-\\\\d{2}-\\\\d{2}T\\\\d{2}\\\\:\\\\d{2}\\\\:\\\\d{2}$","examples":["2020-02-14T16:01:59"]},"status":{"type":"string","description":"Result of the scan.","enum":["success","failure"]},"type":{"type":"string","description":"Type of the scan.","enum":["dast","api_fuzzing"]},"scanned_resources":{"type":"array","description":"The attack surface scanned by DAST.","items":{"type":"object","required":["method","url","type"],"properties":{"method":{"type":"string","minLength":1,"description":"HTTP method of the scanned resource.","examples":["GET","POST","HEAD"]},"url":{"type":"string","minLength":1,"description":"URL of the scanned resource.","examples":["http://my.site.com/a-page"]},"type":{"type":"string","minLength":1,"description":"Type of the scanned resource, for DAST, this must be \'url\'.","examples":["url"]}}}}}},"schema":{"type":"string","description":"URI pointing to the validating security report schema.","format":"uri"},"version":{"type":"string","description":"The version of the schema to which the JSON report conforms.","pattern":"^[0-9]+\\\\.[0-9]+\\\\.[0-9]+$"},"vulnerabilities":{"type":"array","description":"Array of vulnerability objects.","items":{"type":"object","description":"Describes the vulnerability.","required":["category","cve","identifiers","location","scanner"],"properties":{"id":{"type":"string","description":"Unique identifier of the vulnerability. This is recommended to be a UUID.","examples":["642735a5-1425-428d-8d4e-3c854885a3c9"]},"category":{"type":"string","minLength":1,"description":"Describes where this vulnerability belongs (for example, SAST, Dependency Scanning, and so on)."},"name":{"type":"string","description":"The name of the vulnerability. This must not include the finding\'s specific information."},"message":{"type":"string","description":"A short text section that describes the vulnerability. This may include the finding\'s specific information."},"description":{"type":"string","description":"A long text section describing the vulnerability more fully."},"cve":{"type":"string","description":"(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."},"severity":{"type":"string","description":"How much the vulnerability impacts the software. Possible values are Info, Unknown, Low, Medium, High, or Critical. Note that some analyzers may not report all these possible values.","enum":["Info","Unknown","Low","Medium","High","Critical"]},"confidence":{"type":"string","description":"How reliable the vulnerability\'s assessment is. Possible values are Ignore, Unknown, Experimental, Low, Medium, High, and Confirmed. Note that some analyzers may not report all these possible values.","enum":["Ignore","Unknown","Experimental","Low","Medium","High","Confirmed"]},"solution":{"type":"string","description":"Explanation of how to fix the vulnerability."},"scanner":{"description":"Describes the scanner used to find this vulnerability.","type":"object","required":["id","name"],"properties":{"id":{"type":"string","minLength":1,"description":"The scanner\'s ID, as a snake_case string."},"name":{"type":"string","minLength":1,"description":"Human-readable name of the scanner."}}},"identifiers":{"type":"array","minItems":1,"description":"An ordered array of references that identify a vulnerability on internal or external databases. The first identifier is the Primary Identifier, which has special meaning.","items":{"type":"object","required":["type","name","value"],"properties":{"type":{"type":"string","description":"for example, cve, cwe, osvdb, usn, or an analyzer-dependent type such as gemnasium).","minLength":1},"name":{"type":"string","description":"Human-readable name of the identifier.","minLength":1},"url":{"type":"string","description":"URL of the identifier\'s documentation.","format":"uri"},"value":{"type":"string","description":"Value of the identifier, for matching purpose.","minLength":1}}}},"links":{"type":"array","description":"An array of references to external documentation or articles that describe the vulnerability.","items":{"type":"object","required":["url"],"properties":{"name":{"type":"string","description":"Name of the vulnerability details link."},"url":{"type":"string","description":"URL of the vulnerability details document.","format":"uri"}}}},"details":{"$ref":"#/definitions/named_list/properties/items"},"tracking":{"description":"Describes how this vulnerability should be tracked as the project changes.","oneOf":[{"description":"Declares that a series of items should be tracked using source-specific tracking methods.","required":["items"],"properties":{"type":{"const":"source"},"items":{"type":"array","items":{"description":"An item that should be tracked using source-specific tracking methods.","type":"object","required":["signatures"],"properties":{"file":{"type":"string","description":"Path to the file where the vulnerability is located."},"start_line":{"type":"number","description":"The first line of the file that includes the vulnerability."},"end_line":{"type":"number","description":"The last line of the file that includes the vulnerability."},"signatures":{"type":"array","description":"An array of calculated tracking signatures for this tracking item.","minItems":1,"items":{"description":"A calculated tracking signature value and metadata.","required":["algorithm","value"],"properties":{"algorithm":{"type":"string","description":"The algorithm used to generate the signature."},"value":{"type":"string","description":"The result of this signature algorithm."}}}}}}}}}],"properties":{"type":{"type":"string","description":"Each tracking type must declare its own type."}}},"flags":{"description":"Flags that can be attached to vulnerabilities.","type":"array","items":{"type":"object","description":"Informational flags identified and assigned to a vulnerability.","required":["type","origin","description"],"properties":{"type":{"type":"string","minLength":1,"description":"Result of the scan.","enum":["flagged-as-likely-false-positive"]},"origin":{"minLength":1,"description":"Tool that issued the flag.","type":"string"},"description":{"minLength":1,"description":"What the flag is about.","type":"string"}}}},"evidence":{"type":"object","properties":{"source":{"type":"object","description":"Source of evidence","required":["id","name"],"properties":{"id":{"type":"string","minLength":1,"description":"Unique source identifier","examples":["assert:LogAnalysis","assert:StatusCode"]},"name":{"type":"string","minLength":1,"description":"Source display name","examples":["Log Analysis","Status Code"]},"url":{"type":"string","description":"Link to additional information","examples":["https://docs.gitlab.com/ee/development/integrations/secure.html"]}}},"summary":{"type":"string","description":"Human readable string containing evidence of the vulnerability.","examples":["Credit card 4111111111111111 found","Server leaked information nginx/1.17.6"]},"request":{"type":"object","description":"An HTTP request.","required":["headers","method","url"],"properties":{"headers":{"type":"array","description":"HTTP headers present on the request.","items":{"type":"object","required":["name","value"],"properties":{"name":{"type":"string","minLength":1,"description":"Name of the HTTP header.","examples":["Accept","Content-Length","Content-Type"]},"value":{"type":"string","minLength":1,"description":"Value of the HTTP header.","examples":["*/*","560","application/json; charset=utf-8"]}}}},"method":{"type":"string","minLength":1,"description":"HTTP method used in the request.","examples":["GET","POST"]},"url":{"type":"string","minLength":1,"description":"URL of the request.","examples":["http://my.site.com/vulnerable-endpoint?show-credit-card"]},"body":{"type":"string","description":"Body of the request for display purposes. Body must be suitable for display (not binary), and truncated to a reasonable size.","examples":["user=jsmith&first=%27&last=smith"]}}},"response":{"type":"object","description":"An HTTP response.","required":["headers","reason_phrase","status_code"],"properties":{"headers":{"type":"array","description":"HTTP headers present on the request.","items":{"type":"object","required":["name","value"],"properties":{"name":{"type":"string","minLength":1,"description":"Name of the HTTP header.","examples":["Accept","Content-Length","Content-Type"]},"value":{"type":"string","minLength":1,"description":"Value of the HTTP header.","examples":["*/*","560","application/json; charset=utf-8"]}}}},"reason_phrase":{"type":"string","description":"HTTP reason phrase of the response.","examples":["OK","Internal Server Error"]},"status_code":{"type":"integer","description":"HTTP status code of the response.","examples":[200,500]},"body":{"type":"string","description":"Body of the response for display purposes. Body must be suitable for display (not binary), and truncated to a reasonable size.","examples":["{\\"user_id\\": 2}"]}}},"supporting_messages":{"type":"array","description":"Array of supporting http messages.","items":{"type":"object","description":"A supporting http message.","required":["name"],"properties":{"name":{"type":"string","minLength":1,"description":"Message display name.","examples":["Unmodified","Recorded"]},"request":{"type":"object","description":"An HTTP request.","required":["headers","method","url"],"properties":{"headers":{"type":"array","description":"HTTP headers present on the request.","items":{"type":"object","required":["name","value"],"properties":{"name":{"type":"string","minLength":1,"description":"Name of the HTTP header.","examples":["Accept","Content-Length","Content-Type"]},"value":{"type":"string","minLength":1,"description":"Value of the HTTP header.","examples":["*/*","560","application/json; charset=utf-8"]}}}},"method":{"type":"string","minLength":1,"description":"HTTP method used in the request.","examples":["GET","POST"]},"url":{"type":"string","minLength":1,"description":"URL of the request.","examples":["http://my.site.com/vulnerable-endpoint?show-credit-card"]},"body":{"type":"string","description":"Body of the request for display purposes. Body must be suitable for display (not binary), and truncated to a reasonable size.","examples":["user=jsmith&first=%27&last=smith"]}}},"response":{"type":"object","description":"An HTTP response.","required":["headers","reason_phrase","status_code"],"properties":{"headers":{"type":"array","description":"HTTP headers present on the request.","items":{"type":"object","required":["name","value"],"properties":{"name":{"type":"string","minLength":1,"description":"Name of the HTTP header.","examples":["Accept","Content-Length","Content-Type"]},"value":{"type":"string","minLength":1,"description":"Value of the HTTP header.","examples":["*/*","560","application/json; charset=utf-8"]}}}},"reason_phrase":{"type":"string","description":"HTTP reason phrase of the response.","examples":["OK","Internal Server Error"]},"status_code":{"type":"integer","description":"HTTP status code of the response.","examples":[200,500]},"body":{"type":"string","description":"Body of the response for display purposes. Body must be suitable for display (not binary), and truncated to a reasonable size.","examples":["{\\"user_id\\": 2}"]}}}}}}}},"location":{"type":"object","description":"Identifies the vulnerability\'s location.","properties":{"hostname":{"type":"string","description":"The protocol, domain, and port of the application where the vulnerability was found."},"method":{"type":"string","description":"The HTTP method that was used to request the URL where the vulnerability was found."},"param":{"type":"string","description":"A value provided by a vulnerability rule related to the found vulnerability. Examples include a header value, or a parameter used in a HTTP POST."},"path":{"type":"string","description":"The path of the URL where the vulnerability was found. Typically, this would start with a forward slash."}}},"assets":{"type":"array","description":"Array of build assets associated with vulnerability.","items":{"type":"object","description":"Describes an asset associated with vulnerability.","required":["type","name","url"],"properties":{"type":{"type":"string","description":"The type of asset","enum":["http_session","postman"]},"name":{"type":"string","minLength":1,"description":"Display name for asset","examples":["HTTP Messages","Postman Collection"]},"url":{"type":"string","minLength":1,"description":"Link to asset in build artifacts","examples":["https://gitlab.com/gitlab-org/security-products/dast/-/jobs/626397001/artifacts/file//output/zap_session.data"]}}}},"discovered_at":{"type":"string","description":"ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss.sss, representing when the vulnerability was discovered","pattern":"^\\\\d{4}-\\\\d{2}-\\\\d{2}T\\\\d{2}\\\\:\\\\d{2}\\\\:\\\\d{2}\\\\.\\\\d{3}$","examples":["2020-01-28T03:26:02.956"]}}}},"remediations":{"type":"array","description":"An array of objects containing information on available remediations, along with patch diffs to apply.","items":{"type":"object","required":["fixes","summary","diff"],"properties":{"fixes":{"type":"array","description":"An array of strings that represent references to vulnerabilities fixed by this remediation.","items":{"type":"object","required":["cve"],"properties":{"cve":{"type":"string","description":"(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."}}}},"summary":{"type":"string","minLength":1,"description":"An overview of how the vulnerabilities were fixed."},"diff":{"type":"string","minLength":1,"description":"A base64-encoded remediation code diff, compatible with git apply."}}}}}}'),JSON.parse('{"$schema":"http://json-schema.org/draft-07/schema#","title":"Report format for GitLab SAST","description":"This schema provides the report format for Static Application Security Testing analyzers (https://docs.gitlab.com/ee/user/application_security/sast).","definitions":{"detail_type":{"oneOf":[{"$ref":"#/definitions/named_list"},{"$ref":"#/definitions/list"},{"$ref":"#/definitions/table"},{"$ref":"#/definitions/text"},{"$ref":"#/definitions/url"},{"$ref":"#/definitions/code"},{"$ref":"#/definitions/value"},{"$ref":"#/definitions/diff"},{"$ref":"#/definitions/markdown"},{"$ref":"#/definitions/commit"},{"$ref":"#/definitions/file_location"},{"$ref":"#/definitions/module_location"}]},"text_value":{"type":"string"},"named_field":{"type":"object","required":["name"],"properties":{"name":{"$ref":"#/definitions/text_value","minLength":1},"description":{"$ref":"#/definitions/text_value"}}},"named_list":{"type":"object","description":"An object with named and typed fields","required":["type","items"],"properties":{"type":{"const":"named-list"},"items":{"type":"object","patternProperties":{"^.*$":{"allOf":[{"$ref":"#/definitions/named_field"},{"$ref":"#/definitions/detail_type"}]}}}}},"list":{"type":"object","description":"A list of typed fields","required":["type","items"],"properties":{"type":{"const":"list"},"items":{"type":"array","items":{"$ref":"#/definitions/detail_type"}}}},"table":{"type":"object","description":"A table of typed fields","required":["type","rows"],"properties":{"type":{"const":"table"},"header":{"type":"array","items":{"$ref":"#/definitions/detail_type"}},"rows":{"type":"array","items":{"type":"array","items":{"$ref":"#/definitions/detail_type"}}}}},"text":{"type":"object","description":"Raw text","required":["type","value"],"properties":{"type":{"const":"text"},"value":{"$ref":"#/definitions/text_value"}}},"url":{"type":"object","description":"A single URL","required":["type","href"],"properties":{"type":{"const":"url"},"text":{"$ref":"#/definitions/text_value"},"href":{"type":"string","minLength":1,"examples":["http://mysite.com"]}}},"code":{"type":"object","description":"A codeblock","required":["type","value"],"properties":{"type":{"const":"code"},"value":{"type":"string"},"lang":{"type":"string","description":"A programming language"}}},"value":{"type":"object","description":"A field that can store a range of types of value","required":["type","value"],"properties":{"type":{"const":"value"},"value":{"type":["number","string","boolean"]}}},"diff":{"type":"object","description":"A diff","required":["type","before","after"],"properties":{"type":{"const":"diff"},"before":{"type":"string"},"after":{"type":"string"}}},"markdown":{"type":"object","description":"GitLab flavoured markdown, see https://docs.gitlab.com/ee/user/markdown.html","required":["type","value"],"properties":{"type":{"const":"markdown"},"value":{"$ref":"#/definitions/text_value","examples":["Here is markdown `inline code` #1 [test](gitlab.com)\\n\\n"]}}},"commit":{"type":"object","description":"A commit/tag/branch within the GitLab project","required":["type","value"],"properties":{"type":{"const":"commit"},"value":{"type":"string","description":"The commit SHA","minLength":1}}},"file_location":{"type":"object","description":"A location within a file in the project","required":["type","file_name","line_start"],"properties":{"type":{"const":"file-location"},"file_name":{"type":"string","minLength":1},"line_start":{"type":"integer"},"line_end":{"type":"integer"}}},"module_location":{"type":"object","description":"A location within a binary module of the form module+relative_offset","required":["type","module_name","offset"],"properties":{"type":{"const":"module-location"},"module_name":{"type":"string","minLength":1,"examples":["compiled_binary"]},"offset":{"type":"integer","examples":[100]}}}},"self":{"version":"14.0.3"},"required":["version","vulnerabilities"],"additionalProperties":true,"properties":{"scan":{"type":"object","required":["end_time","scanner","start_time","status","type"],"properties":{"end_time":{"type":"string","description":"ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan finished.","pattern":"^\\\\d{4}-\\\\d{2}-\\\\d{2}T\\\\d{2}\\\\:\\\\d{2}\\\\:\\\\d{2}$","examples":["2020-01-28T03:26:02"]},"messages":{"type":"array","items":{"type":"object","description":"Communication intended for the initiator of a scan.","required":["level","value"],"properties":{"level":{"type":"string","description":"Describes the severity of the communication. Use info to communicate normal scan behaviour; warn to communicate a potentially recoverable problem, or a partial error; fatal to communicate an issue that causes the scan to halt.","enum":["info","warn","fatal"],"examples":["info"]},"value":{"type":"string","description":"The message to communicate.","minLength":1,"examples":["Permission denied, scanning aborted"]}}}},"analyzer":{"type":"object","description":"Object defining the analyzer used to perform the scan. Analyzers typically delegate to an underlying scanner to run the scan.","required":["id","name","version","vendor"],"properties":{"id":{"type":"string","description":"Unique id that identifies the analyzer.","minLength":1,"examples":["gitlab-dast"]},"name":{"type":"string","description":"A human readable value that identifies the analyzer, not required to be unique.","minLength":1,"examples":["GitLab DAST"]},"url":{"type":"string","format":"uri","pattern":"^https?://.+","description":"A link to more information about the analyzer.","examples":["https://docs.gitlab.com/ee/user/application_security/dast"]},"vendor":{"description":"The vendor/maintainer of the analyzer.","type":"object","required":["name"],"properties":{"name":{"type":"string","description":"The name of the vendor.","minLength":1,"examples":["GitLab"]}}},"version":{"type":"string","description":"The version of the analyzer.","minLength":1,"examples":["1.0.2"]}}},"scanner":{"type":"object","description":"Object defining the scanner used to perform the scan.","required":["id","name","version","vendor"],"properties":{"id":{"type":"string","description":"Unique id that identifies the scanner.","minLength":1,"examples":["my-sast-scanner"]},"name":{"type":"string","description":"A human readable value that identifies the scanner, not required to be unique.","minLength":1,"examples":["My SAST Scanner"]},"url":{"type":"string","description":"A link to more information about the scanner.","examples":["https://scanner.url"]},"version":{"type":"string","description":"The version of the scanner.","minLength":1,"examples":["1.0.2"]},"vendor":{"description":"The vendor/maintainer of the scanner.","type":"object","required":["name"],"properties":{"name":{"type":"string","description":"The name of the vendor.","minLength":1,"examples":["GitLab"]}}}}},"start_time":{"type":"string","description":"ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan started.","pattern":"^\\\\d{4}-\\\\d{2}-\\\\d{2}T\\\\d{2}\\\\:\\\\d{2}\\\\:\\\\d{2}$","examples":["2020-02-14T16:01:59"]},"status":{"type":"string","description":"Result of the scan.","enum":["success","failure"]},"type":{"type":"string","description":"Type of the scan.","enum":["sast"]}}},"schema":{"type":"string","description":"URI pointing to the validating security report schema.","format":"uri"},"version":{"type":"string","description":"The version of the schema to which the JSON report conforms.","pattern":"^[0-9]+\\\\.[0-9]+\\\\.[0-9]+$"},"vulnerabilities":{"type":"array","description":"Array of vulnerability objects.","items":{"type":"object","description":"Describes the vulnerability.","required":["category","cve","identifiers","location","scanner"],"properties":{"id":{"type":"string","description":"Unique identifier of the vulnerability. This is recommended to be a UUID.","examples":["642735a5-1425-428d-8d4e-3c854885a3c9"]},"category":{"type":"string","minLength":1,"description":"Describes where this vulnerability belongs (for example, SAST, Dependency Scanning, and so on)."},"name":{"type":"string","description":"The name of the vulnerability. This must not include the finding\'s specific information."},"message":{"type":"string","description":"A short text section that describes the vulnerability. This may include the finding\'s specific information."},"description":{"type":"string","description":"A long text section describing the vulnerability more fully."},"cve":{"type":"string","description":"(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."},"severity":{"type":"string","description":"How much the vulnerability impacts the software. Possible values are Info, Unknown, Low, Medium, High, or Critical. Note that some analyzers may not report all these possible values.","enum":["Info","Unknown","Low","Medium","High","Critical"]},"confidence":{"type":"string","description":"How reliable the vulnerability\'s assessment is. Possible values are Ignore, Unknown, Experimental, Low, Medium, High, and Confirmed. Note that some analyzers may not report all these possible values.","enum":["Ignore","Unknown","Experimental","Low","Medium","High","Confirmed"]},"solution":{"type":"string","description":"Explanation of how to fix the vulnerability."},"scanner":{"description":"Describes the scanner used to find this vulnerability.","type":"object","required":["id","name"],"properties":{"id":{"type":"string","minLength":1,"description":"The scanner\'s ID, as a snake_case string."},"name":{"type":"string","minLength":1,"description":"Human-readable name of the scanner."}}},"identifiers":{"type":"array","minItems":1,"description":"An ordered array of references that identify a vulnerability on internal or external databases. The first identifier is the Primary Identifier, which has special meaning.","items":{"type":"object","required":["type","name","value"],"properties":{"type":{"type":"string","description":"for example, cve, cwe, osvdb, usn, or an analyzer-dependent type such as gemnasium).","minLength":1},"name":{"type":"string","description":"Human-readable name of the identifier.","minLength":1},"url":{"type":"string","description":"URL of the identifier\'s documentation.","format":"uri"},"value":{"type":"string","description":"Value of the identifier, for matching purpose.","minLength":1}}}},"links":{"type":"array","description":"An array of references to external documentation or articles that describe the vulnerability.","items":{"type":"object","required":["url"],"properties":{"name":{"type":"string","description":"Name of the vulnerability details link."},"url":{"type":"string","description":"URL of the vulnerability details document.","format":"uri"}}}},"details":{"$ref":"#/definitions/named_list/properties/items"},"tracking":{"description":"Describes how this vulnerability should be tracked as the project changes.","oneOf":[{"description":"Declares that a series of items should be tracked using source-specific tracking methods.","required":["items"],"properties":{"type":{"const":"source"},"items":{"type":"array","items":{"description":"An item that should be tracked using source-specific tracking methods.","type":"object","required":["signatures"],"properties":{"file":{"type":"string","description":"Path to the file where the vulnerability is located."},"start_line":{"type":"number","description":"The first line of the file that includes the vulnerability."},"end_line":{"type":"number","description":"The last line of the file that includes the vulnerability."},"signatures":{"type":"array","description":"An array of calculated tracking signatures for this tracking item.","minItems":1,"items":{"description":"A calculated tracking signature value and metadata.","required":["algorithm","value"],"properties":{"algorithm":{"type":"string","description":"The algorithm used to generate the signature."},"value":{"type":"string","description":"The result of this signature algorithm."}}}}}}}}}],"properties":{"type":{"type":"string","description":"Each tracking type must declare its own type."}}},"flags":{"description":"Flags that can be attached to vulnerabilities.","type":"array","items":{"type":"object","description":"Informational flags identified and assigned to a vulnerability.","required":["type","origin","description"],"properties":{"type":{"type":"string","minLength":1,"description":"Result of the scan.","enum":["flagged-as-likely-false-positive"]},"origin":{"minLength":1,"description":"Tool that issued the flag.","type":"string"},"description":{"minLength":1,"description":"What the flag is about.","type":"string"}}}},"location":{"type":"object","description":"Identifies the vulnerability\'s location.","properties":{"file":{"type":"string","description":"Path to the file where the vulnerability is located."},"start_line":{"type":"number","description":"The first line of the code affected by the vulnerability."},"end_line":{"type":"number","description":"The last line of the code affected by the vulnerability."},"class":{"type":"string","description":"Provides the name of the class where the vulnerability is located."},"method":{"type":"string","description":"Provides the name of the method where the vulnerability is located."}}},"raw_source_code_extract":{"type":"string","description":"Provides an unsanitized excerpt of the affected source code."}}}},"remediations":{"type":"array","description":"An array of objects containing information on available remediations, along with patch diffs to apply.","items":{"type":"object","required":["fixes","summary","diff"],"properties":{"fixes":{"type":"array","description":"An array of strings that represent references to vulnerabilities fixed by this remediation.","items":{"type":"object","required":["cve"],"properties":{"cve":{"type":"string","description":"(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."}}}},"summary":{"type":"string","minLength":1,"description":"An overview of how the vulnerabilities were fixed."},"diff":{"type":"string","minLength":1,"description":"A base64-encoded remediation code diff, compatible with git apply."}}}}}}');const n=JSON.parse('{"$schema":"http://json-schema.org/draft-07/schema#","title":"Report format for GitLab Dependency Scanning","description":"This schema provides the the report format for Dependency Scanning analyzers (https://docs.gitlab.com/ee/user/application_security/dependency_scanning).","definitions":{"detail_type":{"oneOf":[{"$ref":"#/definitions/named_list"},{"$ref":"#/definitions/list"},{"$ref":"#/definitions/table"},{"$ref":"#/definitions/text"},{"$ref":"#/definitions/url"},{"$ref":"#/definitions/code"},{"$ref":"#/definitions/value"},{"$ref":"#/definitions/diff"},{"$ref":"#/definitions/markdown"},{"$ref":"#/definitions/commit"},{"$ref":"#/definitions/file_location"},{"$ref":"#/definitions/module_location"}]},"text_value":{"type":"string"},"named_field":{"type":"object","required":["name"],"properties":{"name":{"$ref":"#/definitions/text_value","minLength":1},"description":{"$ref":"#/definitions/text_value"}}},"named_list":{"type":"object","description":"An object with named and typed fields","required":["type","items"],"properties":{"type":{"const":"named-list"},"items":{"type":"object","patternProperties":{"^.*$":{"allOf":[{"$ref":"#/definitions/named_field"},{"$ref":"#/definitions/detail_type"}]}}}}},"list":{"type":"object","description":"A list of typed fields","required":["type","items"],"properties":{"type":{"const":"list"},"items":{"type":"array","items":{"$ref":"#/definitions/detail_type"}}}},"table":{"type":"object","description":"A table of typed fields","required":["type","rows"],"properties":{"type":{"const":"table"},"header":{"type":"array","items":{"$ref":"#/definitions/detail_type"}},"rows":{"type":"array","items":{"type":"array","items":{"$ref":"#/definitions/detail_type"}}}}},"text":{"type":"object","description":"Raw text","required":["type","value"],"properties":{"type":{"const":"text"},"value":{"$ref":"#/definitions/text_value"}}},"url":{"type":"object","description":"A single URL","required":["type","href"],"properties":{"type":{"const":"url"},"text":{"$ref":"#/definitions/text_value"},"href":{"type":"string","minLength":1,"examples":["http://mysite.com"]}}},"code":{"type":"object","description":"A codeblock","required":["type","value"],"properties":{"type":{"const":"code"},"value":{"type":"string"},"lang":{"type":"string","description":"A programming language"}}},"value":{"type":"object","description":"A field that can store a range of types of value","required":["type","value"],"properties":{"type":{"const":"value"},"value":{"type":["number","string","boolean"]}}},"diff":{"type":"object","description":"A diff","required":["type","before","after"],"properties":{"type":{"const":"diff"},"before":{"type":"string"},"after":{"type":"string"}}},"markdown":{"type":"object","description":"GitLab flavoured markdown, see https://docs.gitlab.com/ee/user/markdown.html","required":["type","value"],"properties":{"type":{"const":"markdown"},"value":{"$ref":"#/definitions/text_value","examples":["Here is markdown `inline code` #1 [test](gitlab.com)\\n\\n"]}}},"commit":{"type":"object","description":"A commit/tag/branch within the GitLab project","required":["type","value"],"properties":{"type":{"const":"commit"},"value":{"type":"string","description":"The commit SHA","minLength":1}}},"file_location":{"type":"object","description":"A location within a file in the project","required":["type","file_name","line_start"],"properties":{"type":{"const":"file-location"},"file_name":{"type":"string","minLength":1},"line_start":{"type":"integer"},"line_end":{"type":"integer"}}},"module_location":{"type":"object","description":"A location within a binary module of the form module+relative_offset","required":["type","module_name","offset"],"properties":{"type":{"const":"module-location"},"module_name":{"type":"string","minLength":1,"examples":["compiled_binary"]},"offset":{"type":"integer","examples":[100]}}}},"self":{"version":"14.0.3"},"required":["dependency_files","version","vulnerabilities"],"additionalProperties":true,"properties":{"scan":{"type":"object","required":["end_time","scanner","start_time","status","type"],"properties":{"end_time":{"type":"string","description":"ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan finished.","pattern":"^\\\\d{4}-\\\\d{2}-\\\\d{2}T\\\\d{2}\\\\:\\\\d{2}\\\\:\\\\d{2}$","examples":["2020-01-28T03:26:02"]},"messages":{"type":"array","items":{"type":"object","description":"Communication intended for the initiator of a scan.","required":["level","value"],"properties":{"level":{"type":"string","description":"Describes the severity of the communication. Use info to communicate normal scan behaviour; warn to communicate a potentially recoverable problem, or a partial error; fatal to communicate an issue that causes the scan to halt.","enum":["info","warn","fatal"],"examples":["info"]},"value":{"type":"string","description":"The message to communicate.","minLength":1,"examples":["Permission denied, scanning aborted"]}}}},"analyzer":{"type":"object","description":"Object defining the analyzer used to perform the scan. Analyzers typically delegate to an underlying scanner to run the scan.","required":["id","name","version","vendor"],"properties":{"id":{"type":"string","description":"Unique id that identifies the analyzer.","minLength":1,"examples":["gitlab-dast"]},"name":{"type":"string","description":"A human readable value that identifies the analyzer, not required to be unique.","minLength":1,"examples":["GitLab DAST"]},"url":{"type":"string","format":"uri","pattern":"^https?://.+","description":"A link to more information about the analyzer.","examples":["https://docs.gitlab.com/ee/user/application_security/dast"]},"vendor":{"description":"The vendor/maintainer of the analyzer.","type":"object","required":["name"],"properties":{"name":{"type":"string","description":"The name of the vendor.","minLength":1,"examples":["GitLab"]}}},"version":{"type":"string","description":"The version of the analyzer.","minLength":1,"examples":["1.0.2"]}}},"scanner":{"type":"object","description":"Object defining the scanner used to perform the scan.","required":["id","name","version","vendor"],"properties":{"id":{"type":"string","description":"Unique id that identifies the scanner.","minLength":1,"examples":["my-sast-scanner"]},"name":{"type":"string","description":"A human readable value that identifies the scanner, not required to be unique.","minLength":1,"examples":["My SAST Scanner"]},"url":{"type":"string","description":"A link to more information about the scanner.","examples":["https://scanner.url"]},"version":{"type":"string","description":"The version of the scanner.","minLength":1,"examples":["1.0.2"]},"vendor":{"description":"The vendor/maintainer of the scanner.","type":"object","required":["name"],"properties":{"name":{"type":"string","description":"The name of the vendor.","minLength":1,"examples":["GitLab"]}}}}},"start_time":{"type":"string","description":"ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan started.","pattern":"^\\\\d{4}-\\\\d{2}-\\\\d{2}T\\\\d{2}\\\\:\\\\d{2}\\\\:\\\\d{2}$","examples":["2020-02-14T16:01:59"]},"status":{"type":"string","description":"Result of the scan.","enum":["success","failure"]},"type":{"type":"string","description":"Type of the scan.","enum":["dependency_scanning"]}}},"schema":{"type":"string","description":"URI pointing to the validating security report schema.","format":"uri"},"version":{"type":"string","description":"The version of the schema to which the JSON report conforms.","pattern":"^[0-9]+\\\\.[0-9]+\\\\.[0-9]+$"},"vulnerabilities":{"type":"array","description":"Array of vulnerability objects.","items":{"type":"object","description":"Describes the vulnerability.","required":["category","cve","identifiers","location","scanner"],"properties":{"id":{"type":"string","description":"Unique identifier of the vulnerability. This is recommended to be a UUID.","examples":["642735a5-1425-428d-8d4e-3c854885a3c9"]},"category":{"type":"string","minLength":1,"description":"Describes where this vulnerability belongs (for example, SAST, Dependency Scanning, and so on)."},"name":{"type":"string","description":"The name of the vulnerability. This must not include the finding\'s specific information."},"message":{"type":"string","description":"A short text section that describes the vulnerability. This may include the finding\'s specific information."},"description":{"type":"string","description":"A long text section describing the vulnerability more fully."},"cve":{"type":"string","description":"(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."},"severity":{"type":"string","description":"How much the vulnerability impacts the software. Possible values are Info, Unknown, Low, Medium, High, or Critical. Note that some analyzers may not report all these possible values.","enum":["Info","Unknown","Low","Medium","High","Critical"]},"confidence":{"type":"string","description":"How reliable the vulnerability\'s assessment is. Possible values are Ignore, Unknown, Experimental, Low, Medium, High, and Confirmed. Note that some analyzers may not report all these possible values.","enum":["Ignore","Unknown","Experimental","Low","Medium","High","Confirmed"]},"solution":{"type":"string","description":"Explanation of how to fix the vulnerability."},"scanner":{"description":"Describes the scanner used to find this vulnerability.","type":"objec