snyk
Version:
snyk library and cli utility
611 lines (529 loc) • 17.1 kB
JavaScript
exports.id = 383;
exports.ids = [383];
exports.modules = {
/***/ 94378:
/***/ ((module, __unused_webpack_exports, __webpack_require__) => {
try {
var util = __webpack_require__(73837);
/* istanbul ignore next */
if (typeof util.inherits !== 'function') throw '';
module.exports = util.inherits;
} catch (e) {
/* istanbul ignore next */
module.exports = __webpack_require__(35717);
}
/***/ }),
/***/ 35717:
/***/ ((module) => {
if (typeof Object.create === 'function') {
// implementation from standard node.js 'util' module
module.exports = function inherits(ctor, superCtor) {
if (superCtor) {
ctor.super_ = superCtor
ctor.prototype = Object.create(superCtor.prototype, {
constructor: {
value: ctor,
enumerable: false,
writable: true,
configurable: true
}
})
}
};
} else {
// old school shim for old browsers
module.exports = function inherits(ctor, superCtor) {
if (superCtor) {
ctor.super_ = superCtor
var TempCtor = function () {}
TempCtor.prototype = superCtor.prototype
ctor.prototype = new TempCtor()
ctor.prototype.constructor = ctor
}
}
}
/***/ }),
/***/ 50984:
/***/ ((module, __unused_webpack_exports, __webpack_require__) => {
module.exports = rimraf
rimraf.sync = rimrafSync
var assert = __webpack_require__(39491)
var path = __webpack_require__(71017)
var fs = __webpack_require__(57147)
var glob = undefined
try {
glob = __webpack_require__(12884)
} catch (_err) {
// treat glob as optional.
}
var _0666 = parseInt('666', 8)
var defaultGlobOpts = {
nosort: true,
silent: true
}
// for EMFILE handling
var timeout = 0
var isWindows = (process.platform === "win32")
function defaults (options) {
var methods = [
'unlink',
'chmod',
'stat',
'lstat',
'rmdir',
'readdir'
]
methods.forEach(function(m) {
options[m] = options[m] || fs[m]
m = m + 'Sync'
options[m] = options[m] || fs[m]
})
options.maxBusyTries = options.maxBusyTries || 3
options.emfileWait = options.emfileWait || 1000
if (options.glob === false) {
options.disableGlob = true
}
if (options.disableGlob !== true && glob === undefined) {
throw Error('glob dependency not found, set `options.disableGlob = true` if intentional')
}
options.disableGlob = options.disableGlob || false
options.glob = options.glob || defaultGlobOpts
}
function rimraf (p, options, cb) {
if (typeof options === 'function') {
cb = options
options = {}
}
assert(p, 'rimraf: missing path')
assert.equal(typeof p, 'string', 'rimraf: path should be a string')
assert.equal(typeof cb, 'function', 'rimraf: callback function required')
assert(options, 'rimraf: invalid options argument provided')
assert.equal(typeof options, 'object', 'rimraf: options should be object')
defaults(options)
var busyTries = 0
var errState = null
var n = 0
if (options.disableGlob || !glob.hasMagic(p))
return afterGlob(null, [p])
options.lstat(p, function (er, stat) {
if (!er)
return afterGlob(null, [p])
glob(p, options.glob, afterGlob)
})
function next (er) {
errState = errState || er
if (--n === 0)
cb(errState)
}
function afterGlob (er, results) {
if (er)
return cb(er)
n = results.length
if (n === 0)
return cb()
results.forEach(function (p) {
rimraf_(p, options, function CB (er) {
if (er) {
if ((er.code === "EBUSY" || er.code === "ENOTEMPTY" || er.code === "EPERM") &&
busyTries < options.maxBusyTries) {
busyTries ++
var time = busyTries * 100
// try again, with the same exact callback as this one.
return setTimeout(function () {
rimraf_(p, options, CB)
}, time)
}
// this one won't happen if graceful-fs is used.
if (er.code === "EMFILE" && timeout < options.emfileWait) {
return setTimeout(function () {
rimraf_(p, options, CB)
}, timeout ++)
}
// already gone
if (er.code === "ENOENT") er = null
}
timeout = 0
next(er)
})
})
}
}
// Two possible strategies.
// 1. Assume it's a file. unlink it, then do the dir stuff on EPERM or EISDIR
// 2. Assume it's a directory. readdir, then do the file stuff on ENOTDIR
//
// Both result in an extra syscall when you guess wrong. However, there
// are likely far more normal files in the world than directories. This
// is based on the assumption that a the average number of files per
// directory is >= 1.
//
// If anyone ever complains about this, then I guess the strategy could
// be made configurable somehow. But until then, YAGNI.
function rimraf_ (p, options, cb) {
assert(p)
assert(options)
assert(typeof cb === 'function')
// sunos lets the root user unlink directories, which is... weird.
// so we have to lstat here and make sure it's not a dir.
options.lstat(p, function (er, st) {
if (er && er.code === "ENOENT")
return cb(null)
// Windows can EPERM on stat. Life is suffering.
if (er && er.code === "EPERM" && isWindows)
fixWinEPERM(p, options, er, cb)
if (st && st.isDirectory())
return rmdir(p, options, er, cb)
options.unlink(p, function (er) {
if (er) {
if (er.code === "ENOENT")
return cb(null)
if (er.code === "EPERM")
return (isWindows)
? fixWinEPERM(p, options, er, cb)
: rmdir(p, options, er, cb)
if (er.code === "EISDIR")
return rmdir(p, options, er, cb)
}
return cb(er)
})
})
}
function fixWinEPERM (p, options, er, cb) {
assert(p)
assert(options)
assert(typeof cb === 'function')
if (er)
assert(er instanceof Error)
options.chmod(p, _0666, function (er2) {
if (er2)
cb(er2.code === "ENOENT" ? null : er)
else
options.stat(p, function(er3, stats) {
if (er3)
cb(er3.code === "ENOENT" ? null : er)
else if (stats.isDirectory())
rmdir(p, options, er, cb)
else
options.unlink(p, cb)
})
})
}
function fixWinEPERMSync (p, options, er) {
assert(p)
assert(options)
if (er)
assert(er instanceof Error)
try {
options.chmodSync(p, _0666)
} catch (er2) {
if (er2.code === "ENOENT")
return
else
throw er
}
try {
var stats = options.statSync(p)
} catch (er3) {
if (er3.code === "ENOENT")
return
else
throw er
}
if (stats.isDirectory())
rmdirSync(p, options, er)
else
options.unlinkSync(p)
}
function rmdir (p, options, originalEr, cb) {
assert(p)
assert(options)
if (originalEr)
assert(originalEr instanceof Error)
assert(typeof cb === 'function')
// try to rmdir first, and only readdir on ENOTEMPTY or EEXIST (SunOS)
// if we guessed wrong, and it's not a directory, then
// raise the original error.
options.rmdir(p, function (er) {
if (er && (er.code === "ENOTEMPTY" || er.code === "EEXIST" || er.code === "EPERM"))
rmkids(p, options, cb)
else if (er && er.code === "ENOTDIR")
cb(originalEr)
else
cb(er)
})
}
function rmkids(p, options, cb) {
assert(p)
assert(options)
assert(typeof cb === 'function')
options.readdir(p, function (er, files) {
if (er)
return cb(er)
var n = files.length
if (n === 0)
return options.rmdir(p, cb)
var errState
files.forEach(function (f) {
rimraf(path.join(p, f), options, function (er) {
if (errState)
return
if (er)
return cb(errState = er)
if (--n === 0)
options.rmdir(p, cb)
})
})
})
}
// this looks simpler, and is strictly *faster*, but will
// tie up the JavaScript thread and fail on excessively
// deep directory trees.
function rimrafSync (p, options) {
options = options || {}
defaults(options)
assert(p, 'rimraf: missing path')
assert.equal(typeof p, 'string', 'rimraf: path should be a string')
assert(options, 'rimraf: missing options')
assert.equal(typeof options, 'object', 'rimraf: options should be object')
var results
if (options.disableGlob || !glob.hasMagic(p)) {
results = [p]
} else {
try {
options.lstatSync(p)
results = [p]
} catch (er) {
results = glob.sync(p, options.glob)
}
}
if (!results.length)
return
for (var i = 0; i < results.length; i++) {
var p = results[i]
try {
var st = options.lstatSync(p)
} catch (er) {
if (er.code === "ENOENT")
return
// Windows can EPERM on stat. Life is suffering.
if (er.code === "EPERM" && isWindows)
fixWinEPERMSync(p, options, er)
}
try {
// sunos lets the root user unlink directories, which is... weird.
if (st && st.isDirectory())
rmdirSync(p, options, null)
else
options.unlinkSync(p)
} catch (er) {
if (er.code === "ENOENT")
return
if (er.code === "EPERM")
return isWindows ? fixWinEPERMSync(p, options, er) : rmdirSync(p, options, er)
if (er.code !== "EISDIR")
throw er
rmdirSync(p, options, er)
}
}
}
function rmdirSync (p, options, originalEr) {
assert(p)
assert(options)
if (originalEr)
assert(originalEr instanceof Error)
try {
options.rmdirSync(p)
} catch (er) {
if (er.code === "ENOENT")
return
if (er.code === "ENOTDIR")
throw originalEr
if (er.code === "ENOTEMPTY" || er.code === "EEXIST" || er.code === "EPERM")
rmkidsSync(p, options)
}
}
function rmkidsSync (p, options) {
assert(p)
assert(options)
options.readdirSync(p).forEach(function (f) {
rimrafSync(path.join(p, f), options)
})
// We only end up here once we got ENOTEMPTY at least once, and
// at this point, we are guaranteed to have removed all the kids.
// So, we know that it won't be ENOENT or ENOTDIR or anything else.
// try really hard to delete stuff on windows, because it has a
// PROFOUNDLY annoying habit of not closing handles promptly when
// files are deleted, resulting in spurious ENOTEMPTY errors.
var retries = isWindows ? 100 : 1
var i = 0
do {
var threw = true
try {
var ret = options.rmdirSync(p, options)
threw = false
return ret
} finally {
if (++i < retries && threw)
continue
}
} while (true)
}
/***/ }),
/***/ 70919:
/***/ ((__unused_webpack_module, exports, __webpack_require__) => {
;
Object.defineProperty(exports, "__esModule", ({ value: true }));
exports.FlagError = void 0;
const process_command_args_1 = __webpack_require__(52369);
const legacyError = __webpack_require__(79407);
const drift_1 = __webpack_require__(26445);
const errors_1 = __webpack_require__(55191);
const get_iac_org_settings_1 = __webpack_require__(11693);
const assert_iac_options_flag_1 = __webpack_require__(33111);
const config_1 = __webpack_require__(25425);
const analytics_1 = __webpack_require__(23298);
const analytics = __webpack_require__(82744);
const policy_1 = __webpack_require__(32615);
const driftctl_1 = __webpack_require__(3659);
const types_1 = __webpack_require__(94820);
const error_utils_1 = __webpack_require__(36401);
const error_catalog_nodejs_public_1 = __webpack_require__(88404);
class FlagError extends errors_1.CustomError {
constructor(flag) {
const msg = `Unsupported flag "${flag}" provided. Run snyk iac describe --help for supported flags`;
super(msg);
this.code = types_1.IaCErrorCodes.FlagError;
this.strCode = (0, error_utils_1.getErrorStringCode)(this.code);
this.userMessage = msg;
this.errorCatalog = new error_catalog_nodejs_public_1.CLI.InvalidFlagOptionError('');
}
}
exports.FlagError = FlagError;
exports["default"] = async (...args) => {
var _a, _b;
const { options } = (0, process_command_args_1.processCommandArgs)(...args);
// Ensure that this describe command can only be runned when using `snyk iac describe`
// Avoid `snyk describe` direct usage
if (options.iac != true) {
return legacyError('describe');
}
if (options['only-managed']) {
return Promise.reject(new FlagError('only-managed'));
}
// Ensure that we are allowed to run that command
// by checking the entitlement
const orgPublicId = (_a = options.org) !== null && _a !== void 0 ? _a : config_1.default.org;
const iacOrgSettings = await (0, get_iac_org_settings_1.getIacOrgSettings)(orgPublicId);
if (!((_b = iacOrgSettings.entitlements) === null || _b === void 0 ? void 0 : _b.iacDrift)) {
throw new assert_iac_options_flag_1.UnsupportedEntitlementCommandError('drift', 'iacDrift');
}
const policy = await (0, policy_1.findAndLoadPolicy)(process.cwd(), 'iac', options);
const driftIgnore = (0, drift_1.driftignoreFromPolicy)(policy);
try {
const describe = await (0, driftctl_1.runDriftCTL)({
options: { ...options, kind: 'describe' },
driftIgnore: driftIgnore,
});
process.exitCode = describe.code;
analytics.add('is-iac-drift', true);
analytics.add('iac-drift-exit-code', describe.code);
if (describe.code === driftctl_1.DCTL_EXIT_CODES.EXIT_ERROR) {
throw new Error();
}
// Parse analysis JSON and add to analytics
const analysis = (0, drift_1.parseDriftAnalysisResults)(describe.stdout);
(0, analytics_1.addIacDriftAnalytics)(analysis, options);
const output = await (0, drift_1.processAnalysis)(options, describe);
process.stdout.write(output);
}
catch (e) {
return Promise.reject(e);
}
};
/***/ }),
/***/ 8820:
/***/ ((__unused_webpack_module, exports, __webpack_require__) => {
;
Object.defineProperty(exports, "__esModule", ({ value: true }));
exports.findAndLoadPolicy = void 0;
const snykPolicyLib = __webpack_require__(13284);
const debugModule = __webpack_require__(15158);
const _1 = __webpack_require__(32615);
const analytics = __webpack_require__(82744);
const debug = debugModule('snyk');
async function findAndLoadPolicy(root, scanType, options, pkg, scannedProjectFolder) {
const isDocker = scanType === 'docker';
const isNodeProject = ['npm', 'yarn', 'pnpm'].includes(scanType);
// monitor
let policyLocations = [
options['policy-path'] || scannedProjectFolder || root,
];
if (isDocker) {
policyLocations = policyLocations.filter((loc) => loc !== root);
}
else if (isNodeProject) {
// TODO: pluckPolicies expects a package.json object to
// find and apply policies in node_modules
// TODO: fix these types, this is a hack and is not correct
policyLocations = policyLocations.concat((0, _1.pluckPolicies)(pkg));
}
debug('Potential policy locations found:', policyLocations);
analytics.add('policies', policyLocations.length);
analytics.add('policyLocations', policyLocations);
if (policyLocations.length === 0) {
return;
}
let policy;
try {
policy = await snykPolicyLib.load(policyLocations, options);
}
catch (err) {
// note: inline catch, to handle error from .load
// if the .snyk file wasn't found, it is fine
if (err.code !== 'ENOENT' && err.code !== 'ENOTDIR') {
throw err;
}
}
return policy;
}
exports.findAndLoadPolicy = findAndLoadPolicy;
/***/ }),
/***/ 32615:
/***/ ((__unused_webpack_module, exports, __webpack_require__) => {
;
Object.defineProperty(exports, "__esModule", ({ value: true }));
exports.findAndLoadPolicy = exports.pluckPolicies = void 0;
var pluck_policies_1 = __webpack_require__(68247);
Object.defineProperty(exports, "pluckPolicies", ({ enumerable: true, get: function () { return pluck_policies_1.pluckPolicies; } }));
var find_and_load_policy_1 = __webpack_require__(8820);
Object.defineProperty(exports, "findAndLoadPolicy", ({ enumerable: true, get: function () { return find_and_load_policy_1.findAndLoadPolicy; } }));
/***/ }),
/***/ 68247:
/***/ ((__unused_webpack_module, exports, __webpack_require__) => {
;
Object.defineProperty(exports, "__esModule", ({ value: true }));
exports.pluckPolicies = void 0;
const flatten = __webpack_require__(5800);
function pluckPolicies(pkg) {
if (!pkg) {
return [];
}
// eslint-disable-next-line @typescript-eslint/ban-ts-comment
// @ts-ignore: broken type
if (pkg.snyk) {
// eslint-disable-next-line @typescript-eslint/ban-ts-comment
// @ts-ignore: broken type
return pkg.snyk;
}
if (!pkg.dependencies) {
return [];
}
return flatten(Object.keys(pkg.dependencies)
.map((name) => pluckPolicies(pkg.dependencies[name]))
.filter(Boolean));
}
exports.pluckPolicies = pluckPolicies;
/***/ })
};
;
//# sourceMappingURL=383.index.js.map