Skip to content

Commit 894f764

Browse files
jdaltonjdalton
committed
Use alert.fix property
1 parent ad91c93 commit 894f764

File tree

5 files changed

+48
-59
lines changed

5 files changed

+48
-59
lines changed

‎src/constants.ts

+6-6
Original file line numberDiff line numberDiff line change
@@ -57,17 +57,17 @@ type IPC = Readonly<{
5757
type Constants = Remap<
5858
Omit<typeof registryConstants, 'Symbol(kInternalsSymbol)' | 'ENV' | 'IPC'> & {
5959
readonly 'Symbol(kInternalsSymbol)': Internals
60+
readonly ALERT_FIX_TYPE_CVE: 'cve'
61+
readonly ALERT_FIX_TYPE_UPGRADE: 'upgrade'
6062
readonly ALERT_TYPE_CRITICAL_CVE: 'criticalCVE'
6163
readonly ALERT_TYPE_CVE: 'cve'
6264
readonly ALERT_TYPE_MEDIUM_CVE: 'mediumCVE'
6365
readonly ALERT_TYPE_MILD_CVE: 'mildCVE'
64-
readonly ALERT_TYPE_SOCKET_UPGRADE_AVAILABLE: 'socketUpgradeAvailable'
6566
readonly API_V0_URL: 'https://api.socket.dev/v0/'
6667
readonly BINARY_LOCK_EXT: '.lockb'
6768
readonly BUN: 'bun'
6869
readonly CLI: 'cli'
6970
readonly CVE_ALERT_PROPS_FIRST_PATCHED_VERSION_IDENTIFIER: 'firstPatchedVersionIdentifier'
70-
readonly CVE_ALERT_PROPS_VULNERABLE_VERSION_RANGE: 'vulnerableVersionRange'
7171
readonly ENV: ENV
7272
readonly DIST_TYPE: 'module-sync' | 'require'
7373
readonly DRY_RUN_LABEL: '[DryRun]'
@@ -131,18 +131,18 @@ type Constants = Remap<
131131
const SOCKET = 'socket'
132132
const WITH_SENTRY = 'with-sentry'
133133

134+
const ALERT_FIX_TYPE_CVE = 'cve'
135+
const ALERT_FIX_TYPE_UPGRADE = 'upgrade'
134136
const ALERT_TYPE_CRITICAL_CVE = 'criticalCVE'
135137
const ALERT_TYPE_CVE = 'cve'
136138
const ALERT_TYPE_MEDIUM_CVE = 'mediumCVE'
137139
const ALERT_TYPE_MILD_CVE = 'mildCVE'
138-
const ALERT_TYPE_SOCKET_UPGRADE_AVAILABLE = 'socketUpgradeAvailable'
139140
const API_V0_URL = 'https://api.socket.dev/v0/'
140141
const BINARY_LOCK_EXT = '.lockb'
141142
const BUN = 'bun'
142143
const CLI = 'cli'
143144
const CVE_ALERT_PROPS_FIRST_PATCHED_VERSION_IDENTIFIER =
144145
'firstPatchedVersionIdentifier'
145-
const CVE_ALERT_PROPS_VULNERABLE_VERSION_RANGE = 'vulnerableVersionRange'
146146
const DRY_RUN_LABEL = '[DryRun]'
147147
const DRY_RUN_BAIL_TEXT = `${DRY_RUN_LABEL}: Bailing now`
148148
const INLINED_SOCKET_CLI_LEGACY_BUILD = 'INLINED_SOCKET_CLI_LEGACY_BUILD'
@@ -304,17 +304,17 @@ const lazyZshRcPath = () =>
304304

305305
const constants = createConstantsObject(
306306
{
307+
ALERT_FIX_TYPE_CVE,
308+
ALERT_FIX_TYPE_UPGRADE,
307309
ALERT_TYPE_CRITICAL_CVE,
308310
ALERT_TYPE_CVE,
309311
ALERT_TYPE_MEDIUM_CVE,
310312
ALERT_TYPE_MILD_CVE,
311-
ALERT_TYPE_SOCKET_UPGRADE_AVAILABLE,
312313
API_V0_URL,
313314
BINARY_LOCK_EXT,
314315
BUN,
315316
CLI,
316317
CVE_ALERT_PROPS_FIRST_PATCHED_VERSION_IDENTIFIER,
317-
CVE_ALERT_PROPS_VULNERABLE_VERSION_RANGE,
318318
// Lazily defined values are initialized as `undefined` to keep their key order.
319319
DIST_TYPE: undefined,
320320
DRY_RUN_LABEL,

‎src/utils/alert/artifact.ts

+1-29
Original file line numberDiff line numberDiff line change
@@ -53,10 +53,7 @@ const {
5353
ALERT_TYPE_CRITICAL_CVE,
5454
ALERT_TYPE_CVE,
5555
ALERT_TYPE_MEDIUM_CVE,
56-
ALERT_TYPE_MILD_CVE,
57-
ALERT_TYPE_SOCKET_UPGRADE_AVAILABLE,
58-
CVE_ALERT_PROPS_FIRST_PATCHED_VERSION_IDENTIFIER,
59-
CVE_ALERT_PROPS_VULNERABLE_VERSION_RANGE
56+
ALERT_TYPE_MILD_CVE
6057
} = constants
6158

6259
export function isArtifactAlertCve(
@@ -70,28 +67,3 @@ export function isArtifactAlertCve(
7067
type === ALERT_TYPE_CRITICAL_CVE
7168
)
7269
}
73-
74-
export function isArtifactAlertCveFixable(
75-
alert: CompactSocketArtifactAlert
76-
): alert is ArtifactAlertCveFixable {
77-
if (!isArtifactAlertCve(alert)) {
78-
return false
79-
}
80-
const { props } = alert
81-
return (
82-
!!props?.[CVE_ALERT_PROPS_FIRST_PATCHED_VERSION_IDENTIFIER] &&
83-
!!props?.[CVE_ALERT_PROPS_VULNERABLE_VERSION_RANGE]
84-
)
85-
}
86-
87-
export function isArtifactAlertUpgrade(
88-
alert: CompactSocketArtifactAlert
89-
): alert is ArtifactAlertUpgrade {
90-
return alert.type === ALERT_TYPE_SOCKET_UPGRADE_AVAILABLE
91-
}
92-
93-
export function isArtifactAlertFixable(
94-
alert: CompactSocketArtifactAlert
95-
): alert is ArtifactAlertCveFixable | ArtifactAlertUpgrade {
96-
return isArtifactAlertUpgrade(alert) || isArtifactAlertCveFixable(alert)
97-
}

‎src/utils/lockfile/package-lock-json.ts

+5-5
Original file line numberDiff line numberDiff line change
@@ -13,14 +13,12 @@ import { DiffAction } from '../../shadow/npm/arborist/lib/arborist/types'
1313
import { Edge } from '../../shadow/npm/arborist/lib/edge'
1414
import { getPublicToken, setupSdk } from '../../utils/sdk'
1515
import { CompactSocketArtifact } from '../alert/artifact'
16-
import {
17-
type AlertsByPkgId,
18-
addArtifactToAlertsMap
19-
} from '../socket-package-alert'
16+
import { addArtifactToAlertsMap } from '../socket-package-alert'
2017

2118
import type { Diff } from '../../shadow/npm/arborist/lib/arborist/types'
2219
import type { SafeEdge } from '../../shadow/npm/arborist/lib/edge'
2320
import type { SafeNode } from '../../shadow/npm/arborist/lib/node'
21+
import type { AlertsByPkgId } from '../socket-package-alert'
2422
import type { Spinner } from '@socketsecurity/registry/lib/spinner'
2523

2624
type Packument = Exclude<
@@ -203,6 +201,7 @@ export async function getAlertsMapFromArborist(
203201
): Promise<AlertsByPkgId> {
204202
const { include: _include, spinner } = {
205203
__proto__: null,
204+
consolidate: false,
206205
...options
207206
} as GetAlertsMapFromArboristOptions
208207

@@ -256,7 +255,8 @@ export async function getAlertsMapFromArborist(
256255
for await (const batchPackageFetchResult of socketSdk.batchPackageStream(
257256
{
258257
alerts: 'true',
259-
compact: 'true'
258+
compact: 'true',
259+
fixable: include.unfixable ? 'false' : 'true'
260260
},
261261
{
262262
components: pkgIds.map(id => ({ purl: `pkg:npm/${id}` }))

‎src/utils/lockfile/pnpm-lock-yaml.ts

+13-1
Original file line numberDiff line numberDiff line change
@@ -28,9 +28,20 @@ export async function getAlertsMapFromPnpmLockfile(
2828
): Promise<AlertsByPkgId> {
2929
const { include: _include, spinner } = {
3030
__proto__: null,
31+
consolidate: false,
3132
...options
3233
} as GetAlertsMapFromPnpmLockfileOptions
3334

35+
const include = {
36+
__proto__: null,
37+
critical: true,
38+
cve: true,
39+
existing: false,
40+
unfixable: true,
41+
upgrade: false,
42+
..._include
43+
} as AlertIncludeFilter
44+
3445
const depTypes = detectDepTypes(lockfile)
3546
const pkgIds = Object.keys(depTypes)
3647

@@ -53,7 +64,8 @@ export async function getAlertsMapFromPnpmLockfile(
5364
for await (const batchPackageFetchResult of socketSdk.batchPackageStream(
5465
{
5566
alerts: 'true',
56-
compact: 'true'
67+
compact: 'true',
68+
fixable: include.unfixable ? 'false' : 'true'
5769
},
5870
{
5971
components: pkgIds.map(id => ({ purl: `pkg:npm/${id}` }))

‎src/utils/socket-package-alert.ts

+23-18
Original file line numberDiff line numberDiff line change
@@ -6,12 +6,7 @@ import { hasOwn } from '@socketsecurity/registry/lib/objects'
66
import { resolvePackageName } from '@socketsecurity/registry/lib/packages'
77
import { naturalCompare } from '@socketsecurity/registry/lib/sorts'
88

9-
import {
10-
CompactSocketArtifact,
11-
isArtifactAlertCve,
12-
isArtifactAlertCveFixable,
13-
isArtifactAlertUpgrade
14-
} from './alert/artifact'
9+
import { CompactSocketArtifact, isArtifactAlertCve } from './alert/artifact'
1510
import { uxLookup } from './alert/rules'
1611
import { SEVERITY } from './alert/severity'
1712
import { ColorOrMarkdown } from './color-or-markdown'
@@ -34,7 +29,12 @@ export type SocketPackageAlert = {
3429

3530
export type AlertsByPkgId = Map<string, SocketPackageAlert[]>
3631

37-
const { CVE_ALERT_PROPS_FIRST_PATCHED_VERSION_IDENTIFIER, NPM } = constants
32+
const {
33+
ALERT_FIX_TYPE_CVE,
34+
ALERT_FIX_TYPE_UPGRADE,
35+
CVE_ALERT_PROPS_FIRST_PATCHED_VERSION_IDENTIFIER,
36+
NPM
37+
} = constants
3838

3939
const format = new ColorOrMarkdown(false)
4040

@@ -62,6 +62,7 @@ export async function addArtifactToAlertsMap(
6262
if (!artifact.name || !artifact.version || !artifact.alerts?.length) {
6363
return
6464
}
65+
6566
const {
6667
consolidate = false,
6768
include: _include,
@@ -70,6 +71,7 @@ export async function addArtifactToAlertsMap(
7071
__proto__: null,
7172
...options
7273
} as AddSocketArtifactAlertToAlertsMapOptions
74+
7375
const include = {
7476
__proto__: null,
7577
critical: true,
@@ -79,6 +81,7 @@ export async function addArtifactToAlertsMap(
7981
upgrade: false,
8082
..._include
8183
} as AlertIncludeFilter
84+
8285
const name = resolvePackageName(artifact)
8386
const { version } = artifact
8487
const pkgId = `${name}@${version}`
@@ -90,10 +93,11 @@ export async function addArtifactToAlertsMap(
9093
package: { name, version },
9194
alert: { type: alert.type }
9295
})
96+
const fixType = alert.fix?.type ?? ''
9397
const critical = alert.severity === SEVERITY.critical
9498
const cve = isArtifactAlertCve(alert)
95-
const fixableCve = isArtifactAlertCveFixable(alert)
96-
const fixableUpgrade = isArtifactAlertUpgrade(alert)
99+
const fixableCve = fixType === ALERT_FIX_TYPE_CVE
100+
const fixableUpgrade = fixType === ALERT_FIX_TYPE_UPGRADE
97101
const fixable = fixableCve || fixableUpgrade
98102
const upgrade = fixableUpgrade && !hasOwn(overrides, name)
99103
if (
@@ -130,11 +134,11 @@ export async function addArtifactToAlertsMap(
130134
>()
131135
const unfixableAlerts: SocketPackageAlert[] = []
132136
for (const sockPkgAlert of sockPkgAlerts) {
133-
if (isArtifactAlertCveFixable(sockPkgAlert.raw)) {
137+
const alert = sockPkgAlert.raw
138+
const fixType = alert.fix?.type ?? ''
139+
if (fixType === ALERT_FIX_TYPE_CVE) {
134140
const patchedVersion =
135-
sockPkgAlert.raw.props[
136-
CVE_ALERT_PROPS_FIRST_PATCHED_VERSION_IDENTIFIER
137-
]
141+
alert.props[CVE_ALERT_PROPS_FIRST_PATCHED_VERSION_IDENTIFIER]
138142
const patchedMajor = semver.major(patchedVersion)
139143
const oldHighest = highestForCve.get(patchedMajor)
140144
const highest = oldHighest?.version ?? '0.0.0'
@@ -144,7 +148,7 @@ export async function addArtifactToAlertsMap(
144148
version: patchedVersion
145149
})
146150
}
147-
} else if (isArtifactAlertUpgrade(sockPkgAlert.raw)) {
151+
} else if (fixType === ALERT_FIX_TYPE_UPGRADE) {
148152
const oldHighest = highestForUpgrade.get(major)
149153
const highest = oldHighest?.version ?? '0.0.0'
150154
if (semver.gt(version, highest)) {
@@ -192,12 +196,13 @@ export function getCveInfoByAlertsMap(
192196
...({ __proto__: null, ...options } as GetCveInfoByPackageOptions).exclude
193197
}
194198
let infoByPkg: CveInfoByPkgId | null = null
195-
for (const [pkgId, alerts] of alertsMap) {
199+
for (const [pkgId, sockPkgAlerts] of alertsMap) {
196200
const purlObj = PackageURL.fromString(`pkg:npm/${pkgId}`)
197201
const name = resolvePackageName(purlObj)
198-
for (const alert of alerts) {
202+
for (const sockPkgAlert of sockPkgAlerts) {
203+
const alert = sockPkgAlert.raw
199204
if (
200-
!isArtifactAlertCveFixable(alert.raw) ||
205+
alert.fix?.type !== ALERT_FIX_TYPE_CVE ||
201206
(exclude.upgrade && getManifestData(NPM, name))
202207
) {
203208
continue
@@ -211,7 +216,7 @@ export function getCveInfoByAlertsMap(
211216
infoByPkg.set(name, infos)
212217
}
213218
const { firstPatchedVersionIdentifier, vulnerableVersionRange } =
214-
alert.raw.props
219+
alert.props
215220
infos.push({
216221
firstPatchedVersionIdentifier,
217222
vulnerableVersionRange: new semver.Range(

0 commit comments

Comments
 (0)