auditjs
Version:
Audit dependencies to identify known vulnerabilities and maintenance problems
133 lines • 4.96 kB
JavaScript
;
/*
* Copyright 2019-Present Sonatype Inc.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
var __importDefault = (this && this.__importDefault) || function (mod) {
return (mod && mod.__esModule) ? mod : { "default": mod };
};
Object.defineProperty(exports, "__esModule", { value: true });
exports.NpmList = void 0;
const path_1 = __importDefault(require("path"));
const fs_1 = __importDefault(require("fs"));
const Coordinates_1 = require("../Types/Coordinates");
const CycloneDXSbomCreator_1 = require("../CycloneDX/CycloneDXSbomCreator");
class NpmList {
constructor(devDependencies = false) {
this.devDependencies = devDependencies;
this.depsArray = [];
}
async getDepList() {
return await this.getInstalledDeps();
}
isValid() {
const nodeModulesPath = path_1.default.join(process.cwd(), 'node_modules');
return fs_1.default.existsSync(nodeModulesPath);
}
async getSbomFromCommand() {
const sbomCreator = new CycloneDXSbomCreator_1.CycloneDXSbomCreator(process.cwd(), {
devDependencies: this.devDependencies,
includeLicenseData: false,
includeBomSerialNumber: true,
spartan: true,
});
const pkgInfo = await sbomCreator.getPackageInfoFromReadInstalled();
const result = await sbomCreator.createBom(pkgInfo);
return result;
}
// turns object tree from read-installed into an array of coordinates represented node-managed deps
async getInstalledDeps() {
const sbomCreator = new CycloneDXSbomCreator_1.CycloneDXSbomCreator(process.cwd(), {
devDependencies: this.devDependencies,
includeLicenseData: false,
includeBomSerialNumber: true,
});
const data = await sbomCreator.getPackageInfoFromReadInstalled();
this.recurseObjectTree(data, this.depsArray, true);
return this.depsArray;
}
// recursive unit that traverses tree and terminates when object has no dependencies
recurseObjectTree(objectTree, list, isRootPkg = false) {
if (objectTree.extraneous && !this.devDependencies) {
return;
}
if (!isRootPkg) {
if (this.maybePushNewCoordinate(objectTree, list)) {
// NO OP
}
else {
return;
}
}
const deps = objectTree.dependencies;
if (deps) {
Object.keys(deps)
.map((x) => deps[x])
.filter((x) => typeof x !== 'string')
.map((dep) => {
const node = dep;
if (this.toPurlObjTree(node) == '' ||
list.find((x) => {
return x.toPurl() == this.toPurlObjTree(node);
})) {
return;
}
this.recurseObjectTree(node, list, false);
});
}
return;
}
maybePushNewCoordinate(pkg, list) {
if (pkg.name && pkg.name.includes('/')) {
const name = pkg.name.split('/');
if (list.find((x) => {
return x.name == name[1] && x.version == pkg.version && x.group == name[0];
})) {
return false;
}
list.push(new Coordinates_1.Coordinates(name[1], pkg.version ?? '', name[0]));
return true;
}
else if (pkg.name) {
if (list.find((x) => {
return x.name == pkg.name && x.version == pkg.version && x.group == '';
})) {
return false;
}
list.push(new Coordinates_1.Coordinates(pkg.name, pkg.version ?? '', ''));
return true;
}
return false;
}
toPurlObjTree(objectTree) {
if (objectTree.name && objectTree.name.includes('/')) {
const name = objectTree.name.split('/');
return this.toPurl(name[1], objectTree.version ?? '', name[0]);
}
else if (objectTree.name) {
return this.toPurl(objectTree.name, objectTree.version ?? '');
}
else {
return '';
}
}
toPurl(name, version, group = '') {
if (group != '') {
return `${group}/${name}/${version}`;
}
return `${name}/${version}`;
}
}
exports.NpmList = NpmList;
//# sourceMappingURL=NpmList.js.map