snyk-nuget-plugin
Version:
Snyk CLI NuGet plugin
162 lines • 8.01 kB
JavaScript
;
var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
if (k2 === undefined) k2 = k;
var desc = Object.getOwnPropertyDescriptor(m, k);
if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
desc = { enumerable: true, get: function() { return m[k]; } };
}
Object.defineProperty(o, k2, desc);
}) : (function(o, m, k, k2) {
if (k2 === undefined) k2 = k;
o[k2] = m[k];
}));
var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
Object.defineProperty(o, "default", { enumerable: true, value: v });
}) : function(o, v) {
o["default"] = v;
});
var __importStar = (this && this.__importStar) || (function () {
var ownKeys = function(o) {
ownKeys = Object.getOwnPropertyNames || function (o) {
var ar = [];
for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
return ar;
};
return ownKeys(o);
};
return function (mod) {
if (mod && mod.__esModule) return mod;
var result = {};
if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
__setModuleDefault(result, mod);
return result;
};
})();
var __importDefault = (this && this.__importDefault) || function (mod) {
return (mod && mod.__esModule) ? mod : { "default": mod };
};
Object.defineProperty(exports, "__esModule", { value: true });
exports.inspect = inspect;
const nugetParser = __importStar(require("./nuget-parser"));
const dotnet = __importStar(require("./nuget-parser/cli/dotnet"));
const path = __importStar(require("path"));
const paketParser = __importStar(require("snyk-paket-parser"));
const types_1 = require("./nuget-parser/types");
const errors_1 = require("./errors");
const debug_1 = __importDefault(require("debug"));
const debug = (0, debug_1.default)('snyk');
// Surface the dotnet-missing fallback to the customer at most once per process —
// inspect() runs per project, so a multi-project scan would otherwise repeat it.
let dotnetFallbackWarned = false;
function determineManifestType(filename) {
switch (true) {
case /project.json$/.test(filename): {
return types_1.ManifestType.PROJECT_JSON;
}
case /project.assets.json$/.test(filename): {
return types_1.ManifestType.DOTNET_CORE;
}
case /packages.config$/.test(filename): {
return types_1.ManifestType.PACKAGES_CONFIG;
}
case /paket.dependencies$/.test(filename): {
return types_1.ManifestType.PAKET;
}
default: {
throw new errors_1.InvalidTargetFile('Could not determine manifest type for ' + filename);
}
}
}
// Runs the dotnet-backed runtime resolution scan and shapes the result into a
// MultiProjectResult for the CLI or the SCM scanner. Requires the dotnet CLI.
async function buildRuntimeResolutionResult(root, targetFile, manifestType, options) {
const results = await nugetParser.buildDepGraphFromFiles(root, targetFile, manifestType, options['assets-project-name'], options['project-name-prefix'], options['dotnet-target-framework']);
return {
plugin: {
name: 'snyk-nuget-plugin',
targetFile,
},
scannedProjects: results.map((result) => ({
targetFile,
depGraph: result.dependencyGraph,
meta: {
targetRuntime: result.targetFramework,
},
})),
};
}
async function inspect(root, targetFile, options) {
options = options || {};
let manifestType;
try {
manifestType = determineManifestType(path.basename(targetFile || root));
}
catch (error) {
return Promise.reject(error);
}
const createPackageTree = (depTree) => {
const targetFramework = depTree.meta
? depTree.meta.targetFramework
: undefined;
delete depTree.meta;
return {
package: depTree,
plugin: {
name: 'snyk-nuget-plugin',
targetFile,
targetRuntime: targetFramework,
},
};
};
if (manifestType === types_1.ManifestType.PAKET) {
return paketParser
.buildDepTreeFromFiles(root, targetFile, path.join(path.dirname(targetFile), 'paket.lock'), options['include-dev'] || options.dev, // TODO: remove include-dev when no longer used.
options.strict)
.then(createPackageTree);
}
// Capture whether the customer explicitly requested runtime resolution before the
// implicit, server-side enablement below can set it. An explicit request is a hard
// requirement that must not be silently downgraded when dotnet is missing.
const runtimeResolutionExplicitlyRequested = !!options['dotnet-runtime-resolution'];
if (options.cliDotnetRuntimeResolutionEnabled &&
manifestType === types_1.ManifestType.DOTNET_CORE &&
options['dotnet-runtime-resolution'] === undefined) {
options['dotnet-runtime-resolution'] = true;
}
if (options['dotnet-target-framework'] &&
!options['dotnet-runtime-resolution']) {
return Promise.reject(new errors_1.CliCommandError('target framework flag is currently only supported when also scanning with runtime resolution using the `--dotnet-runtime-resolution` flag'));
}
if (options['dotnet-runtime-resolution']) {
if (manifestType !== types_1.ManifestType.DOTNET_CORE) {
return Promise.reject(new errors_1.FileNotProcessableError(`runtime resolution flag is currently only supported for: .NET versions 6 and higher, all versions of .NET Core and all versions of .NET Standard projects. Supplied project type was parsed as ${manifestType}.`));
}
// The runtime resolution flow depends on the dotnet CLI for restore, runtime
// assembly resolution and target framework parsing. When dotnet is unavailable
// (e.g. a CI step that runs after the build), fall back to the legacy scan of the
// existing project.assets.json so we don't break environments that worked before
// this flow was enabled.
if (await dotnet.isInstalled()) {
return buildRuntimeResolutionResult(root, targetFile, manifestType, options);
}
// An explicit --dotnet-runtime-resolution request cannot be honoured without dotnet.
// Fail loudly rather than silently returning a lower-fidelity legacy result.
if (runtimeResolutionExplicitlyRequested) {
return Promise.reject(new errors_1.CliCommandError('The --dotnet-runtime-resolution flag was set, but the dotnet CLI was not found on the PATH. Install the .NET SDK, or remove the flag to fall back to the legacy scan.'));
}
// Implicit (server-side) enablement: degrade to the legacy scan so we don't break
// environments that worked before runtime resolution was enabled for them.
if (!dotnetFallbackWarned) {
dotnetFallbackWarned = true;
console.warn(`\x1b[33m⚠ WARNING\x1b[0m: The dotnet CLI was not found on your PATH. Falling back to a static scan for SDK-style .NET projects — results will not include runtime dependency resolution and may be less complete. Install the .NET SDK and ensure dotnet is on your PATH for full results.`);
}
if (options['dotnet-target-framework']) {
debug('the dotnet-target-framework flag is ignored when falling back to the legacy scan.');
}
// fall through to the legacy scan below.
}
return nugetParser
.buildDepTreeFromFiles(root, targetFile, options.packagesFolder, manifestType, options['assets-project-name'], options['project-name-prefix'])
.then(createPackageTree);
}
//# sourceMappingURL=index.js.map