auditjs
Version:
Audit dependencies to identify known vulnerabilities and maintenance problems
180 lines • 7.44 kB
JavaScript
;
/*
* Copyright (c) 2020-Present Erlend Oftedal, Steve Springett, Sonatype, Inc.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
if (k2 === undefined) k2 = k;
var desc = Object.getOwnPropertyDescriptor(m, k);
if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
desc = { enumerable: true, get: function() { return m[k]; } };
}
Object.defineProperty(o, k2, desc);
}) : (function(o, m, k, k2) {
if (k2 === undefined) k2 = k;
o[k2] = m[k];
}));
var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
Object.defineProperty(o, "default", { enumerable: true, value: v });
}) : function(o, v) {
o["default"] = v;
});
var __importStar = (this && this.__importStar) || (function () {
var ownKeys = function(o) {
ownKeys = Object.getOwnPropertyNames || function (o) {
var ar = [];
for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
return ar;
};
return ownKeys(o);
};
return function (mod) {
if (mod && mod.__esModule) return mod;
var result = {};
if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
__setModuleDefault(result, mod);
return result;
};
})();
var __importDefault = (this && this.__importDefault) || function (mod) {
return (mod && mod.__esModule) ? mod : { "default": mod };
};
Object.defineProperty(exports, "__esModule", { value: true });
exports.CycloneDXSbomCreator = void 0;
const CDX = require("@cyclonedx/cyclonedx-library");
const spdxExpressionParse = require("spdx-expression-parse");
const read_installed_1 = __importDefault(require("read-installed"));
const ssri = __importStar(require("ssri"));
const Helpers_1 = require("./Helpers/Helpers");
const Logger_1 = require("../Application/Logger/Logger");
const SPEC = CDX.Spec.Spec1dot6;
const licenseFactory = new CDX.Contrib.License.Factories.LicenseFactory(spdxExpressionParse);
const extRefFactory = new CDX.Contrib.FromNodePackageJson.Factories.ExternalReferenceFactory();
const componentBuilder = new CDX.Contrib.FromNodePackageJson.Builders.ComponentBuilder(extRefFactory, licenseFactory);
class CycloneDXSbomCreator {
constructor(path, options) {
this.path = path;
this.options = options;
}
async createBom(pkgInfo) {
const bom = new CDX.Models.Bom();
if (this.options?.includeBomSerialNumber) {
bom.serialNumber = CDX.Contrib.Bom.Utils.randomSerialNumber();
}
const seen = new Set();
this.addComponents(pkgInfo, bom.components, seen, true);
return new CDX.Serialize.XmlSerializer(new CDX.Serialize.XML.Normalize.Factory(SPEC)).serialize(bom, {
sortLists: false,
});
}
getPackageInfoFromReadInstalled(path = this.path) {
return new Promise((resolve, reject) => {
(0, read_installed_1.default)(path, { dev: this.options?.devDependencies ?? false }, (err, data) => {
if (err)
reject(err);
resolve(data);
});
});
}
addComponents(pkg, repo, seen, isRoot = false) {
if (pkg.extraneous)
return;
if (!isRoot) {
if (!pkg.name)
return;
const pkgId = this.parsePackageJsonName(pkg.name);
const group = pkgId.scope != null ? `@${pkgId.scope}` : '';
const name = pkgId.fullName;
const version = pkg.version ?? '';
const purl = (0, Helpers_1.toPurl)(name, version, group);
if (seen.has(purl))
return;
seen.add(purl);
const componentType = this.determinePackageType(pkg) === 'framework'
? CDX.Enums.ComponentType.Framework
: CDX.Enums.ComponentType.Library;
const comp = componentBuilder.makeComponent(pkg, componentType);
if (!comp)
return;
comp.name = name;
comp.group = group !== '' ? group : undefined;
comp.version = version;
comp.purl = purl;
if (this.options?.spartan) {
comp.hashes.clear();
comp.licenses.clear();
}
else {
if (!this.options?.includeLicenseData) {
comp.licenses.clear();
}
this.processHashes(pkg, comp);
}
repo.add(comp);
}
const deps = pkg.dependencies;
if (deps) {
Object.keys(deps)
.map((x) => deps[x])
.filter((x) => typeof x !== 'string')
.forEach((x) => this.addComponents(x, repo, seen, false));
}
}
processHashes(pkg, comp) {
if (pkg._shasum) {
comp.hashes.set(CDX.Enums.HashAlgorithm['SHA-1'], pkg._shasum);
}
else if (pkg._integrity) {
try {
const [alg, hex] = CDX.Contrib.FromNodePackageJson.Utils.parsePackageIntegrity(pkg._integrity);
comp.hashes.set(alg, hex);
}
catch {
// ssri fallback for multi-algorithm integrity strings
const integrity = ssri.parse(pkg._integrity);
const algMap = [
['sha512', CDX.Enums.HashAlgorithm['SHA-512']],
['sha384', CDX.Enums.HashAlgorithm['SHA-384']],
['sha256', CDX.Enums.HashAlgorithm['SHA-256']],
['sha1', CDX.Enums.HashAlgorithm['SHA-1']],
];
for (const [algo, cdxAlg] of algMap) {
if (integrity[algo]) {
comp.hashes.set(cdxAlg, Buffer.from(integrity[algo][0].digest, 'base64').toString('hex'));
break;
}
}
(0, Logger_1.logMessage)('Parsed integrity via ssri fallback', Logger_1.DEBUG, { integrity: pkg._integrity });
}
}
}
determinePackageType(pkg) {
if (pkg.keywords) {
for (const kw of pkg.keywords) {
if (kw.toLowerCase() === 'framework')
return 'framework';
}
}
return 'library';
}
parsePackageJsonName(name) {
const match = name.match(/^(?:@([^/]+)\/)?(([^.]+)(?:\.(.*))?)$/);
if (match) {
return { scope: match[1] ?? undefined, fullName: match[2] ?? match[0] };
}
return { scope: undefined, fullName: name };
}
}
exports.CycloneDXSbomCreator = CycloneDXSbomCreator;
//# sourceMappingURL=CycloneDXSbomCreator.js.map