-
Notifications
You must be signed in to change notification settings - Fork 943
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Add audit script to check dependency vulnerabilities
- Loading branch information
Showing
5 changed files
with
150 additions
and
6 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,10 +1,8 @@ | ||
| { | ||
| "exceptions": [ | ||
| "https://nodesecurity.io/advisories/532", | ||
| "https://nodesecurity.io/advisories/157", | ||
| "https://nodesecurity.io/advisories/577", | ||
| "https://nodesecurity.io/advisories/654", | ||
| "https://nodesecurity.io/advisories/664", | ||
| "https://nodesecurity.io/advisories/678" | ||
| "https://npmjs.com/advisories/532", | ||
| "https://npmjs.com/advisories/577", | ||
| "https://npmjs.com/advisories/722", | ||
| "https://npmjs.com/advisories/725" | ||
| ] | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,90 @@ | ||
| // Check possible npm dependency vulnerabilities | ||
| // Usage: execute "yarn run audit" in the shell | ||
| // | ||
| // You can add exceptions through .nsprc file, which is a hidden file in root folder. | ||
| // | ||
| // Note: to use this script, you should pipe in the output of 'yarn audit --json' | ||
|
|
||
| const bfj = require('bfj'); | ||
| const fs = require('fs'); | ||
|
|
||
| const INDENT = ' '; | ||
| const isAuditAdvisory = o => o.type === 'auditAdvisory'; | ||
|
|
||
| // get an advisory or empty object | ||
| const getAdvisory = o => (!o ? {} : !o.data ? {} : !o.data.advisory ? {} : o.data.advisory); | ||
| // get a resolution or empty object | ||
| const getResolution = o => (!o ? {} : !o.data ? {} : !o.data.resolution ? {} : o.data.resolution); | ||
|
|
||
| // Read exceptions | ||
| let exceptions = []; | ||
| bfj | ||
| .parse(fs.createReadStream('.nsprc'), {}) | ||
| .then(data => { | ||
| exceptions = data.exceptions ? data.exceptions : []; | ||
| }) | ||
| .catch(error => { | ||
| console.error('Could not process .nsprc file.'); | ||
| process.exit(1); | ||
| }); | ||
|
|
||
| // Read the output of 'yarn audit --json', which should be piped in through stdin | ||
| const stdinStream = process.stdin.resume(); | ||
| let advisories = {}; | ||
| bfj | ||
| .match(stdinStream, (key, value, depth) => depth === 0, { ndjson: true }) | ||
| .on('data', object => { | ||
| if (isAuditAdvisory(object)) { | ||
| const { id, severity, title, url } = getAdvisory(object); | ||
| const { path } = getResolution(object); | ||
| const isInExceptionList = url && exceptions.includes(url); | ||
|
|
||
| if (!isInExceptionList && url && path) { | ||
| const advisory = advisories[id] ? advisories[id] : { url, severity, title }; | ||
| const paths = advisory.paths ? advisory.paths : []; | ||
| advisories[id] = { ...advisory, paths: paths.concat(path) }; | ||
| } | ||
| } | ||
| }) | ||
| .on('dataError', error => { | ||
| // A syntax error was found in the JSON | ||
| console.error( | ||
| `An error occurred while processing data. | ||
| You need to pipe the results of "yarn audit --json" to this script from shell. | ||
| Error`, | ||
| error | ||
| ); | ||
| process.exit(1); | ||
| }) | ||
| .on('error', error => { | ||
| // Some kind of operational error occurred | ||
| console.error( | ||
| `An error occurred while processing data. | ||
| You need to pipe the results of "yarn audit --json" to this script from shell. | ||
| Error`, | ||
| error | ||
| ); | ||
| process.exit(1); | ||
| }) | ||
| .on('end', error => { | ||
| const advisoryKeys = Object.keys(advisories); | ||
| if (advisoryKeys.length > 0) { | ||
| console.log('Vulneralibilities found:'); | ||
| console.log('\n----------------------------------------\n'); | ||
|
|
||
| advisoryKeys.forEach(key => { | ||
| const { title, severity, url, paths } = advisories[key]; | ||
| console.log(key, `(${title})`); | ||
| console.log('Severity:', severity); | ||
| console.log('More info:', url); | ||
| console.log('Affected dependencies:'); | ||
| paths.forEach(path => { | ||
| console.log(INDENT, path); | ||
| }); | ||
| console.log('\n----------------------------------------\n'); | ||
| }); | ||
| process.exit(1); | ||
| } else { | ||
| process.exit(); | ||
| } | ||
| }); |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters