@mendix/pluggable-widgets-tools
Version:
Mendix Pluggable Widgets Tools
134 lines (133 loc) • 7.95 kB
JavaScript
;
var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
if (k2 === undefined) k2 = k;
var desc = Object.getOwnPropertyDescriptor(m, k);
if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
desc = { enumerable: true, get: function() { return m[k]; } };
}
Object.defineProperty(o, k2, desc);
}) : (function(o, m, k, k2) {
if (k2 === undefined) k2 = k;
o[k2] = m[k];
}));
var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
Object.defineProperty(o, "default", { enumerable: true, value: v });
}) : function(o, v) {
o["default"] = v;
});
var __importStar = (this && this.__importStar) || (function () {
var ownKeys = function(o) {
ownKeys = Object.getOwnPropertyNames || function (o) {
var ar = [];
for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
return ar;
};
return ownKeys(o);
};
return function (mod) {
if (mod && mod.__esModule) return mod;
var result = {};
if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
__setModuleDefault(result, mod);
return result;
};
})();
var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
return new (P || (P = Promise))(function (resolve, reject) {
function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
step((generator = generator.apply(thisArg, _arguments || [])).next());
});
};
Object.defineProperty(exports, "__esModule", { value: true });
exports.auditPluggableWidgetsTools = auditPluggableWidgetsTools;
const ansi_colors_1 = require("ansi-colors");
const NpmAudit = __importStar(require("../utils/npmAudit"));
const node_util_1 = require("node:util");
const node_child_process_1 = require("node:child_process");
const semver_1 = require("semver");
const confirm_1 = require("../cli/confirm");
const node_fs_1 = require("node:fs");
const package_1 = require("../widget/package");
const pluggableWidgetsTools = "@mendix/pluggable-widgets-tools";
function auditPluggableWidgetsTools() {
return __awaiter(this, arguments, void 0, function* (fix = false) {
console.log("Checking pluggable-widgets-tools for vulnerabilities");
const report = yield NpmAudit.run();
if (!(pluggableWidgetsTools in report.vulnerabilities)) {
console.log((0, ansi_colors_1.green)("No vulnerabilities found for pluggable-widgets-tools"));
reportOtherDirectVulnerabilities(report);
return;
}
// Collect updateable, vulnerable packages installed by pwt
const vulnerabilities = NpmAudit.collectVulnerabilities(report, pluggableWidgetsTools);
const vulnerableDependencies = vulnerabilities
.map(v => v.name)
.reduce((unique, p) => (unique.includes(p) ? unique : [...unique, p]), []);
const updateable = yield Promise.all(vulnerableDependencies.map(name => report.vulnerabilities[name]).map(findSafeVersion));
// Check if PWT is vulnerable
const updateablePwt = updateable.find(p => p.name === pluggableWidgetsTools);
if (updateablePwt === null || updateablePwt === void 0 ? void 0 : updateablePwt.safeRange) {
console.log((0, ansi_colors_1.red)("Found vulnerabilities in pluggable-widgets-tools %s"), updateablePwt.vulnerableRange);
console.log((0, ansi_colors_1.bold)((0, ansi_colors_1.whiteBright)("Update @mendix/pluggable-widgets-tools to at least %s")), updateablePwt.safeRange);
return;
}
// Report vulnerable dependencies
console.log((0, ansi_colors_1.yellow)("Found %d dependencies with %d vulnerabilities"), vulnerableDependencies.length, vulnerabilities.length);
updateable.forEach(p => {
const update = p.safeRange
? (0, ansi_colors_1.green)(`${ansi_colors_1.symbols.pointerSmall} ${p.safeRange}`)
: (0, ansi_colors_1.red)(`${ansi_colors_1.symbols.cross} No update available`);
const status = p.error ? (0, ansi_colors_1.red)(p.error.message) : update;
console.log(` ${(0, ansi_colors_1.whiteBright)((0, ansi_colors_1.bold)(p.name))} ${p.vulnerableRange} ${status}`);
});
// Add overrides for updateable dependencies
if (updateable.some(p => p.safeRange) &&
(fix || (yield (0, confirm_1.confirm)("Add overrides to package.json for vulnerable packages?")))) {
console.log("Adding overrides");
const widgetPackage = yield (0, node_util_1.promisify)(node_fs_1.readFile)(package_1.path, "utf8").then(raw => JSON.parse(raw));
const overrides = updateable
.filter(p => p.safeRange)
// To avoid downgrading dependencies we only define the override for the vulnerable range.
.reduce((o, p) => (Object.assign(Object.assign({}, o), { [`${p.name}@${p.vulnerableRange}`]: p.safeRange })), {});
widgetPackage.overrides = Object.assign(Object.assign({}, widgetPackage.overrides), overrides);
yield (0, node_util_1.promisify)(node_fs_1.writeFile)(package_1.path, JSON.stringify(widgetPackage, null, 2), "utf8");
console.log("Updating dependencies");
yield (0, node_util_1.promisify)(node_child_process_1.exec)("npm install --package-lock-only && npm install"); // --package-lock-only forces the dependency tree to be re-resolved. Then run npm install to update node_modules accordingly
}
reportOtherDirectVulnerabilities(report);
});
}
function reportOtherDirectVulnerabilities(report) {
if (Object.values(report.vulnerabilities).some(p => p.isDirect && p.name != pluggableWidgetsTools)) {
console.log((0, ansi_colors_1.yellow)("Other dependencies of the widget contain vulnerabilities. Run `npm audit` for more information."));
}
}
/**
* Determines the next "safe" version for an npm package.
*
* Initially the safeRange was set to greater or equal to minimum safe version. However, this did not always work.
* Some dependencies depending on a version range lower than the vulnerable range would still resolve to unsafe versions.
* Using the ^ version range avoids this, as the version is specific enough for npm.
*/
function findSafeVersion(_a) {
return __awaiter(this, arguments, void 0, function* ({ name, range }) {
const updateablePackage = { name, vulnerableRange: range };
const escapedName = encodeURI(name); // npm package names must be usable as part of a URL
const versions = yield (0, node_util_1.promisify)(node_child_process_1.exec)(`npm show ${escapedName} versions --json`)
.then(({ stdout }) => JSON.parse(stdout))
.catch(_ => new Error("Unable to fetch available versions"));
if (versions instanceof Error) {
return Object.assign(Object.assign({}, updateablePackage), { error: versions });
}
const maxVulnerable = (0, semver_1.maxSatisfying)(versions, range);
const gtMaxVulnerable = ">" + maxVulnerable;
const minNonVulnerable = (0, semver_1.minSatisfying)(versions, gtMaxVulnerable);
if (!minNonVulnerable) {
return updateablePackage;
}
return Object.assign(Object.assign({}, updateablePackage), { safeRange: "^" + minNonVulnerable });
});
}