@jitesoft/gitlab-dep-convert/bin.js

Tiny converter to convert npm audit report into gitlab-ci dependency report format.

"use strict";

var _interopRequireDefault = require("@babel/runtime-corejs3/helpers/interopRequireDefault");

var _keys = _interopRequireDefault(require("@babel/runtime-corejs3/core-js/object/keys"));

var _map = _interopRequireDefault(require("@babel/runtime-corejs3/core-js/instance/map"));

var _stringify = _interopRequireDefault(require("@babel/runtime-corejs3/core-js/json/stringify"));

var _promise = _interopRequireDefault(require("@babel/runtime-corejs3/core-js/promise"));

var _fs = require("fs");

var _child_process = require("child_process");

const writeFile = _fs.promises.writeFile;
const severities = {
  info: 'Info',
  low: 'Low',
  moderate: 'Medium',
  high: 'High',
  critical: 'Critical'
}; //region Super simple ployfills.

Array.prototype.first = function (def = null) {
  return this.length > 0 ? this[0] : def;
};

Array.prototype.last = function (def = null) {
  return this.length > 0 ? this[this.length - 1] : def;
}; //endregion


const getAudit = async () => {
  return new _promise.default((resolve, reject) => {
    (0, _child_process.exec)(`cd ${process.cwd()} && npm audit --json`, async (e, stdout, stderr) => {
      return resolve(JSON.parse(stdout));
    });
  });
};

const putFile = async json => {
  await writeFile('gl-dependency-scanning-report.json', (0, _stringify.default)(json, null, 2));
};

const convertToGl = data => {
  var _context;

  const advisories = data.advisories;
  return (0, _map.default)(_context = (0, _keys.default)(advisories)).call(_context, key => {
    var _findings$0$paths$fir, _findings$, _findings$$paths$firs, _findings$0$version, _findings$2, _severities$val$sever;

    const val = advisories[key];
    const findings = (val === null || val === void 0 ? void 0 : val.findings) && val.findings.length > 0 ? val.findings : [null];
    const packageName = (_findings$0$paths$fir = (_findings$ = findings[0]) === null || _findings$ === void 0 ? void 0 : (_findings$$paths$firs = _findings$.paths.first()) === null || _findings$$paths$firs === void 0 ? void 0 : _findings$$paths$firs.split('>').last()) !== null && _findings$0$paths$fir !== void 0 ? _findings$0$paths$fir : 'Unknown';
    return {
      location: {
        dependency: {
          package: {
            name: packageName,
            version: (_findings$0$version = (_findings$2 = findings[0]) === null || _findings$2 === void 0 ? void 0 : _findings$2.version) !== null && _findings$0$version !== void 0 ? _findings$0$version : 'Unknown'
          }
        }
      },
      name: val.title,
      message: `${val === null || val === void 0 ? void 0 : val.title} in ${packageName}`,
      description: val === null || val === void 0 ? void 0 : val.overview,
      cve: (val === null || val === void 0 ? void 0 : val.cves.length) > 0 ? val === null || val === void 0 ? void 0 : val.cves[0] : null,
      cwe: val === null || val === void 0 ? void 0 : val.cwe,
      solution: val === null || val === void 0 ? void 0 : val.recommendation,
      url: val === null || val === void 0 ? void 0 : val.url,
      priority: (_severities$val$sever = severities[val === null || val === void 0 ? void 0 : val.severity]) !== null && _severities$val$sever !== void 0 ? _severities$val$sever : 'Unknown'
    };
  });
};

getAudit().then(convertToGl).then(putFile).catch(e => {
  process.stderr.write(e.message, e => {
    if (e) {
      console.error(e);
    }
  });
});