auditjs/bin/Munchers/NpmList.js

Audit dependencies to identify known vulnerabilities and maintenance problems

"use strict";
/*
 * Copyright 2019-Present Sonatype Inc.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
    return new (P || (P = Promise))(function (resolve, reject) {
        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
        step((generator = generator.apply(thisArg, _arguments || [])).next());
    });
};
var __importDefault = (this && this.__importDefault) || function (mod) {
    return (mod && mod.__esModule) ? mod : { "default": mod };
};
Object.defineProperty(exports, "__esModule", { value: true });
exports.NpmList = void 0;
const path_1 = __importDefault(require("path"));
const fs_1 = __importDefault(require("fs"));
const Coordinates_1 = require("../Types/Coordinates");
const CycloneDXSbomCreator_1 = require("../CycloneDX/CycloneDXSbomCreator");
class NpmList {
    constructor(devDependencies = false) {
        this.devDependencies = devDependencies;
        this.depsArray = [];
    }
    getDepList() {
        return __awaiter(this, void 0, void 0, function* () {
            return yield this.getInstalledDeps();
        });
    }
    isValid() {
        const nodeModulesPath = path_1.default.join(process.cwd(), 'node_modules');
        return fs_1.default.existsSync(nodeModulesPath);
    }
    getSbomFromCommand() {
        return __awaiter(this, void 0, void 0, function* () {
            const sbomCreator = new CycloneDXSbomCreator_1.CycloneDXSbomCreator(process.cwd(), {
                devDependencies: this.devDependencies,
                includeLicenseData: false,
                includeBomSerialNumber: true,
                spartan: true,
            });
            const pkgInfo = yield sbomCreator.getPackageInfoFromReadInstalled();
            const result = yield sbomCreator.createBom(pkgInfo);
            return result;
        });
    }
    // turns object tree from read-installed into an array of coordinates represented node-managed deps
    getInstalledDeps() {
        return __awaiter(this, void 0, void 0, function* () {
            const sbomCreator = new CycloneDXSbomCreator_1.CycloneDXSbomCreator(process.cwd(), {
                devDependencies: this.devDependencies,
                includeLicenseData: false,
                includeBomSerialNumber: true,
            });
            const data = yield sbomCreator.getPackageInfoFromReadInstalled();
            this.recurseObjectTree(data, this.depsArray, true);
            return this.depsArray;
        });
    }
    // recursive unit that traverses tree and terminates when object has no dependencies
    recurseObjectTree(objectTree, list, isRootPkg = false) {
        if (objectTree.extraneous && !this.devDependencies) {
            return;
        }
        if (!isRootPkg) {
            if (this.maybePushNewCoordinate(objectTree, list)) {
                // NO OP
            }
            else {
                return;
            }
        }
        if (objectTree.dependencies) {
            Object.keys(objectTree.dependencies)
                .map((x) => objectTree.dependencies[x])
                .filter((x) => typeof x !== 'string')
                .map((dep) => {
                if (this.toPurlObjTree(dep) == '' ||
                    list.find((x) => {
                        return x.toPurl() == this.toPurlObjTree(dep);
                    })) {
                    return;
                }
                this.recurseObjectTree(dep, list, false);
            });
        }
        return;
    }
    maybePushNewCoordinate(pkg, list) {
        if (pkg.name && pkg.name.includes('/')) {
            const name = pkg.name.split('/');
            if (list.find((x) => {
                return x.name == name[1] && x.version == pkg.version && x.group == name[0];
            })) {
                return false;
            }
            list.push(new Coordinates_1.Coordinates(name[1], pkg.version, name[0]));
            return true;
        }
        else if (pkg.name) {
            if (list.find((x) => {
                return x.name == pkg.name && x.version == pkg.version && x.group == '';
            })) {
                return false;
            }
            list.push(new Coordinates_1.Coordinates(pkg.name, pkg.version, ''));
            return true;
        }
        return false;
    }
    toPurlObjTree(objectTree) {
        if (objectTree.name && objectTree.name.includes('/')) {
            const name = objectTree.name.split('/');
            return this.toPurl(name[1], objectTree.version, name[0]);
        }
        else if (objectTree.name) {
            return this.toPurl(objectTree.name, objectTree.version);
        }
        else {
            return '';
        }
    }
    toPurl(name, version, group = '') {
        if (group != '') {
            return `${group}/${name}/${version}`;
        }
        return `${name}/${version}`;
    }
}
exports.NpmList = NpmList;
//# sourceMappingURL=NpmList.js.map