Skip to content

Commit 72438a0

Browse files
eoftedaleoftedal
committed
Flag if insecure repository downloads was enabled in output (ref #615)
1 parent 2ab6772 commit 72438a0

11 files changed

Lines changed: 41 additions & 24 deletions

File tree

‎chrome/extension-no-func/manifest.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
"manifest_version": 3,
33
"name": "retire.js-no-func",
44
"description": "Scanning website for vulnerable js libraries. Icon by studiomx",
5-
"version": "5.4.3",
5+
"version": "5.6.0",
66
"icons": {
77
"16": "icons/icon16.png",
88
"48": "icons/icon48.png",

‎chrome/extension/manifest.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
"manifest_version": 3,
33
"name": "retire.js",
44
"description": "Scanning website for vulnerable js libraries. Icon by studiomx",
5-
"version": "5.4.3",
5+
"version": "5.6.0",
66
"icons": {
77
"16": "icons/icon16.png",
88
"48": "icons/icon48.png",

‎node/CHANGELOG.md‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,11 @@
11
# Changelog
22

3+
## [5.6.0]
4+
5+
### Improvements
6+
7+
- Report when repository certificate errors are ignored (`--insecure`): as `ignoreRepositoryCertificateErrors` in the JSON report, and as a `retirejs:ignore-repository-certificate-errors` entry under `metadata.properties` in all CycloneDX reports. The entry is only present when the option is set.
8+
39
## [5.5.0]
410

511
### Improvements

‎node/lib/retire.js‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
*/
55

66
var exports = exports || {};
7-
exports.version = '5.5.0';
7+
exports.version = '5.6.0';
88

99
function isDefined(o) {
1010
return typeof o !== 'undefined';

‎node/package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
"author": "Erlend Oftedal <erlend@oftedal.no>",
33
"name": "retire",
44
"description": "Retire is a tool for detecting use of vulnerable libraries",
5-
"version": "5.5.0",
5+
"version": "5.6.0",
66
"license": "Apache-2.0",
77
"repository": {
88
"type": "git",

‎node/src/cli.ts‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -84,6 +84,7 @@ const log = reporting.open({
8484
colors: !!prg.colors,
8585
colorwarn,
8686
jsRepo: jsrepolocation,
87+
insecure: prg.insecure,
8788
outputformat: prg.outputformat,
8889
outputpath: prg.outputpath,
8990
path: scanpath,

‎node/src/reporters/cyclonedx-1_6-json.ts‎

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -62,12 +62,18 @@ function configureCycloneDXJSONLogger(logger: Logger, writer: Writer, config: Lo
6262
const seen = new Map<string, Component>();
6363
const vulnerabilitiesCyclone = new Map<string, Vulnerability>();
6464
const includeVEX = config.outputformat === 'cyclonedxJSON1_6_VEX';
65-
const repositories = vulnerabilityRepositories(config.jsRepo);
65+
const vulnerabilityRepositoriesList = vulnerabilityRepositories(config.jsRepo);
6666
// Only attributable to a single URL when exactly one repository was used
6767
const retireSource: VulnerabilitySource = {
6868
name: 'Retire.js',
69-
url: repositories.length === 1 ? repositories[0] : undefined,
69+
url: vulnerabilityRepositoriesList.length === 1 ? vulnerabilityRepositoriesList[0] : undefined,
7070
};
71+
const properties = vulnerabilityRepositoriesList.map(
72+
(repo) => ({ name: 'retirejs:vulnerability-repository', value: repo }),
73+
);
74+
if (config.insecure) {
75+
properties.push({ name: 'retirejs:ignore-repository-certificate-errors', value: 'true' });
76+
}
7177

7278
const components = finalResults.data
7379
.filter((d) => d.results)
@@ -168,12 +174,7 @@ function configureCycloneDXJSONLogger(logger: Logger, writer: Writer, config: Lo
168174
version: retire.version,
169175
},
170176
],
171-
properties: repositories.length
172-
? repositories.map((repo) => ({
173-
name: 'retirejs:vulnerability-repository',
174-
value: repo,
175-
}))
176-
: undefined,
177+
properties: properties.length ? properties : undefined,
177178
},
178179
components: components,
179180
vulnerabilities: includeVEX ? Array.from(vulnerabilitiesCyclone.values()) : undefined,

‎node/src/reporters/cyclonedx-json.ts‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,12 @@ function configureCycloneDXJSONLogger(logger: Logger, writer: Writer, config: Lo
3939

4040
logger.close = function (callback) {
4141
const write = vulnsFound ? writer.err : writer.out;
42-
const repositories = vulnerabilityRepositories(config.jsRepo);
42+
const properties = vulnerabilityRepositories(config.jsRepo).map(
43+
(repo) => ({ name: 'retirejs:vulnerability-repository', value: repo }),
44+
);
45+
if (config.insecure) {
46+
properties.push({ name: 'retirejs:ignore-repository-certificate-errors', value: 'true' });
47+
}
4348
const seen = new Map<string, Component>();
4449
const components = finalResults.data
4550
.filter((d) => d.results)
@@ -101,12 +106,7 @@ function configureCycloneDXJSONLogger(logger: Logger, writer: Writer, config: Lo
101106
version: retire.version,
102107
},
103108
],
104-
properties: repositories.length
105-
? repositories.map((repo) => ({
106-
name: 'retirejs:vulnerability-repository',
107-
value: repo,
108-
}))
109-
: undefined,
109+
properties: properties.length ? properties : undefined,
110110
},
111111
components: components,
112112
},

‎node/src/reporters/cyclonedx.ts‎

Lines changed: 12 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -36,10 +36,17 @@ function configureCycloneDXLogger(logger: Logger, writer: Writer, config: Logger
3636

3737
logger.close = function (callback) {
3838
const write = vulnsFound ? writer.err : writer.out;
39-
const repositories = vulnerabilityRepositories(config.jsRepo)
39+
const propertyList = vulnerabilityRepositories(config.jsRepo).map((repo) => ({
40+
name: 'retirejs:vulnerability-repository',
41+
value: repo,
42+
}));
43+
if (config.insecure) {
44+
propertyList.push({ name: 'retirejs:ignore-repository-certificate-errors', value: 'true' });
45+
}
46+
const properties = propertyList
4047
.map(
41-
(repo) => `
42-
<property name="retirejs:vulnerability-repository">${escapeXml(repo)}</property>`,
48+
(property) => `
49+
<property name="${escapeXml(property.name)}">${escapeXml(property.value)}</property>`,
4350
)
4451
.join('');
4552
const seen = new Set<string>();
@@ -87,8 +94,8 @@ function configureCycloneDXLogger(logger: Logger, writer: Writer, config: Logger
8794
<name>retire.js</name>
8895
<version>${retire.version}</version>
8996
</tool>
90-
</tools>${repositories ? `
91-
<properties>${repositories}
97+
</tools>${properties ? `
98+
<properties>${properties}
9299
</properties>` : ''}
93100
</metadata>
94101
<components>${components}

‎node/src/reporters/json.ts‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ export default {
1616
errors: [] as unknown[],
1717
time: undefined as undefined | number,
1818
vulnerabilityRepositories: vulnerabilityRepositories(config.jsRepo),
19+
ignoreRepositoryCertificateErrors: config.insecure,
1920
};
2021
logger.info = finalResults.messages.push;
2122
logger.debug = config.verbose

0 commit comments

Comments
 (0)