@jitesoft/audit-for-gitlab
Version:
Minimal application to convert npm audit report into gitlab-ci vulnerability report format.
181 lines (179 loc) • 6.65 kB
JavaScript
;
var _Object$defineProperty = require("@babel/runtime-corejs3/core-js/object/define-property");
var _interopRequireDefault = require("@babel/runtime-corejs3/helpers/interopRequireDefault").default;
_Object$defineProperty(exports, "__esModule", {
value: true
});
exports.default = void 0;
var _weakMap = _interopRequireDefault(require("@babel/runtime-corejs3/core-js/weak-map"));
var _weakSet = _interopRequireDefault(require("@babel/runtime-corejs3/core-js/weak-set"));
var _map = _interopRequireDefault(require("@babel/runtime-corejs3/core-js/instance/map"));
var _parseInt2 = _interopRequireDefault(require("@babel/runtime-corejs3/core-js/parse-int"));
var _classPrivateMethodInitSpec2 = _interopRequireDefault(require("@babel/runtime-corejs3/helpers/classPrivateMethodInitSpec"));
var _classPrivateFieldInitSpec2 = _interopRequireDefault(require("@babel/runtime-corejs3/helpers/classPrivateFieldInitSpec"));
var _classStaticPrivateFieldSpecGet2 = _interopRequireDefault(require("@babel/runtime-corejs3/helpers/classStaticPrivateFieldSpecGet"));
var _classPrivateFieldGet2 = _interopRequireDefault(require("@babel/runtime-corejs3/helpers/classPrivateFieldGet"));
var _classPrivateMethodGet2 = _interopRequireDefault(require("@babel/runtime-corejs3/helpers/classPrivateMethodGet"));
var _classPrivateFieldSet2 = _interopRequireDefault(require("@babel/runtime-corejs3/helpers/classPrivateFieldSet"));
var _crypto = require("crypto");
var _cwe = _interopRequireDefault(require("./cwe.json"));
var _Util = require("./Util");
var _class;
var _scanner = /*#__PURE__*/new _weakMap.default();
var _startTime = /*#__PURE__*/new _weakMap.default();
var _version = /*#__PURE__*/new _weakMap.default();
var _npmVersion = /*#__PURE__*/new _weakMap.default();
var _createVulnerability = /*#__PURE__*/new _weakSet.default();
class GitLabAnalyzer {
constructor(scannerData, startTime, version, npmVersion) {
/**
* Create a single vulnerability.
*
* @param {IEntry} vuln
* @param {IVia} via
* @return {Object|null}
*/
(0, _classPrivateMethodInitSpec2.default)(this, _createVulnerability);
(0, _classPrivateFieldInitSpec2.default)(this, _scanner, {
writable: true,
value: void 0
});
(0, _classPrivateFieldInitSpec2.default)(this, _startTime, {
writable: true,
value: void 0
});
(0, _classPrivateFieldInitSpec2.default)(this, _version, {
writable: true,
value: void 0
});
(0, _classPrivateFieldInitSpec2.default)(this, _npmVersion, {
writable: true,
value: void 0
});
(0, _classPrivateFieldSet2.default)(this, _scanner, scannerData);
(0, _classPrivateFieldSet2.default)(this, _startTime, startTime);
(0, _classPrivateFieldSet2.default)(this, _version, version);
(0, _classPrivateFieldSet2.default)(this, _npmVersion, npmVersion);
}
/**
* Convert NPMJS audit report into a GitLab dependency scan report.
*
* @param vulnerabilities {object}
* @param packageData {object}
* @param packageLockDependencies {object}
* @returns {Promise<object>}
*/
async convert(vulnerabilities, packageData, packageLockDependencies) {
const vulns = [];
for (const vuln in vulnerabilities) {
if ((0, _Util.hasOwn)(vulnerabilities, vuln)) {
const obj = vulnerabilities[vuln];
const via = obj.via.shift();
if (typeof via !== 'object') {
continue; // TODO, fix this
}
const result = (0, _classPrivateMethodGet2.default)(this, _createVulnerability, _createVulnerability2).call(this, obj, via);
if (result !== null) {
vulns.push(result);
}
}
}
return {
version: '15.0.2',
scan: {
analyzer: {
version: (0, _classPrivateFieldGet2.default)(this, _version),
...(0, _classPrivateFieldGet2.default)(this, _scanner)
},
scanner: {
id: 'npmjs_audit',
version: (0, _classPrivateFieldGet2.default)(this, _npmVersion),
name: 'npmjs',
url: 'https://npmjs.com',
vendor: {
name: 'npmjs'
}
},
type: 'dependency_scanning',
start_time: (0, _classPrivateFieldGet2.default)(this, _startTime).toISOString().split('.').shift(),
end_time: new Date().toISOString().split('.').shift(),
status: 'success'
},
dependency_files: [{
path: 'package-lock.json',
package_manager: 'npm',
dependencies: packageLockDependencies
}],
vulnerabilities: vulns
};
}
}
exports.default = GitLabAnalyzer;
_class = GitLabAnalyzer;
function _createVulnerability2(vuln, via) {
var _context;
const packageName = vuln.name;
const identifiers = (0, _map.default)(_context = via.cwe ?? []).call(_context, cwe => ({
type: 'cwe',
name: cwe,
value: `${cwe}-${packageName}`,
url: `https://cwe.mitre.org/data/definitions/${cwe.replace('CWE-', '')}.html`
}));
if (identifiers.length === 0) {
return null;
}
let solution = [];
if (vuln.fixAvailable) {
if (vuln.fixAvailable === true) {
solution = [`Update package ${packageName} to version outside of range ${vuln.range}`];
} else {
solution = [`Update package ${vuln.fixAvailable.name} to version ${vuln.fixAvailable.version}`];
}
}
const cweNumber = (0, _parseInt2.default)(identifiers[0].name.replace('CWE-', ''));
let cweData = {
name: `${identifiers[0].name} (in ${packageName})`,
description: ''
};
if (cweNumber in _cwe.default) {
if ((0, _Util.hasOwn)(_cwe.default, cweNumber)) {
cweData = {
name: _cwe.default[cweNumber].name,
description: _cwe.default[cweNumber].description
};
cweData.name = `${cweData.name} (in ${packageName})`;
}
}
return {
id: (0, _crypto.randomUUID)(),
name: cweData.name,
description: cweData.description,
severity: (0, _Util.hasOwn)((0, _classStaticPrivateFieldSpecGet2.default)(_class, _class, _severities), vuln.severity) ? (0, _classStaticPrivateFieldSpecGet2.default)(_class, _class, _severities)[vuln.severity] : 'Unknown',
links: [{
url: via.url
}],
location: {
file: 'package-lock.json',
dependency: {
package: {
name: packageName,
direct: vuln.isDirect,
dependency_path: vuln.nodes
},
version: vuln.range
}
},
identifiers,
remediations: solution
};
}
var _severities = {
writable: true,
value: {
info: 'Info',
low: 'Low',
moderate: 'Medium',
high: 'High',
critical: 'Critical'
}
};