auditjs
Version:
Audit dependencies to identify known vulnerabilities and maintenance problems
159 lines • 7.28 kB
JavaScript
"use strict";
/*
* Copyright 2019-Present Sonatype Inc.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
return new (P || (P = Promise))(function (resolve, reject) {
function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
step((generator = generator.apply(thisArg, _arguments || [])).next());
});
};
var __importDefault = (this && this.__importDefault) || function (mod) {
return (mod && mod.__esModule) ? mod : { "default": mod };
};
Object.defineProperty(exports, "__esModule", { value: true });
exports.IqRequestService = void 0;
const node_fetch_1 = __importDefault(require("node-fetch"));
const RequestHelpers_1 = require("./RequestHelpers");
const Logger_1 = require("../Application/Logger/Logger");
const url_1 = require("url");
const APPLICATION_INTERNAL_ID_ENDPOINT = '/api/v2/applications?publicId=';
class IqRequestService {
constructor(user, password, host, application, stage, timeout, insecure) {
this.user = user;
this.password = password;
this.host = host;
this.application = application;
this.stage = stage;
this.timeout = timeout;
this.insecure = insecure;
this.internalId = '';
this.isInitialized = false;
this.timeoutAttempts = 0;
}
init() {
return __awaiter(this, void 0, void 0, function* () {
try {
this.internalId = yield this.getApplicationInternalId();
this.isInitialized = true;
}
catch (e) {
throw new Error(e);
}
});
}
getApplicationInternalId() {
return __awaiter(this, void 0, void 0, function* () {
const response = yield (0, node_fetch_1.default)(`${this.host}${APPLICATION_INTERNAL_ID_ENDPOINT}${this.application}`, {
method: 'get',
headers: [this.getBasicAuth(), RequestHelpers_1.RequestHelpers.getUserAgent()],
agent: RequestHelpers_1.RequestHelpers.getAgent(this.insecure),
});
if (response.ok) {
const res = yield response.json();
try {
return res.applications[0].id;
}
catch (e) {
throw new Error(`No valid ID on response from Nexus IQ, potentially check the public application ID you are using`);
}
}
else {
throw new Error('Unable to connect to IQ Server with http status ' +
response.status +
'. Check your credentials and network connectivity by hitting Nexus IQ at ' +
this.host +
' in your browser.');
}
});
}
submitToThirdPartyAPI(data) {
return __awaiter(this, void 0, void 0, function* () {
if (!this.isInitialized) {
yield this.init();
}
(0, Logger_1.logMessage)('Internal ID', Logger_1.DEBUG, { internalId: this.internalId });
const response = yield (0, node_fetch_1.default)(`${this.host}/api/v2/scan/applications/${this.internalId}/sources/auditjs?stageId=${this.stage}`, {
method: 'post',
headers: [this.getBasicAuth(), RequestHelpers_1.RequestHelpers.getUserAgent(), ['Content-Type', 'application/xml']],
body: data,
agent: RequestHelpers_1.RequestHelpers.getAgent(this.insecure),
});
if (response.ok) {
const json = yield response.json();
return json.statusUrl;
}
else {
const body = yield response.text();
(0, Logger_1.logMessage)('Response from third party API', Logger_1.DEBUG, { response: body });
throw new Error(`Unable to submit to Third Party API`);
}
});
}
asyncPollForResults(url, errorHandler, pollingFinished) {
return __awaiter(this, void 0, void 0, function* () {
(0, Logger_1.logMessage)(url, Logger_1.DEBUG);
let mergeUrl;
try {
mergeUrl = this.getURLOrMerge(url);
// https://www.youtube.com/watch?v=Pubd-spHN-0
const response = yield (0, node_fetch_1.default)(mergeUrl.href, {
method: 'get',
headers: [this.getBasicAuth(), RequestHelpers_1.RequestHelpers.getUserAgent()],
agent: RequestHelpers_1.RequestHelpers.getAgent(this.insecure),
});
const body = response.ok;
// TODO: right now I think we cover 500s and 400s the same and we'd continue polling as a result. We should likely switch
// to checking explicitly for a 404 and if we get a 500/401 or other throw an error
if (!body) {
this.timeoutAttempts += 1;
if (this.timeoutAttempts > this.timeout) {
errorHandler({
message: 'Polling attempts exceeded, please either provide a higher limit via the command line using the timeout flag, or re-examine your project and logs to see if another error happened',
});
}
setTimeout(() => this.asyncPollForResults(url, errorHandler, pollingFinished), 1000);
}
else {
const json = yield response.json();
pollingFinished(json);
}
}
catch (e) {
errorHandler({ title: e.message });
}
});
}
getURLOrMerge(url) {
try {
return new url_1.URL(url);
}
catch (e) {
(0, Logger_1.logMessage)(e.title, Logger_1.DEBUG, { message: e.message });
if (this.host.endsWith('/')) {
return new url_1.URL(this.host.concat(url));
}
return new url_1.URL(this.host.concat('/' + url));
}
}
getBasicAuth() {
return ['Authorization', 'Basic ' + Buffer.from(this.user + ':' + this.password).toString('base64')];
}
}
exports.IqRequestService = IqRequestService;
//# sourceMappingURL=IqRequestService.js.map