Press n or j to go to the next uncovered block, b, p or k for the previous block.
| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 | 27x 27x 27x 27x 27x 27x 27x 27x 27x 27x 27x 27x 27x 27x 27x 27x 27x 27x 27x 27x 27x 27x 27x 27x 27x 27x 27x 27x 27x 27x 27x 27x 27x 27x 27x 27x 27x 27x 27x 27x 27x 27x 27x 27x 27x 27x 27x 27x 27x 27x 27x 27x 27x 27x 28x 28x 28x 28x 28x 4x 28x 28x 28x 28x 518x 518x 518x 518x 105x 105x 518x 407x 407x 407x 407x 44x 407x 407x 379x 379x 407x 34x 34x 34x 28x 28x 28x 27x 34x 34x 34x 34x 34x 34x 34x 28x 28x 9x 9x 28x 25x 25x 25x 25x 25x 82x 82x 82x 82x 82x 82x 82x 82x 82x 82x 82x 82x 82x 82x 82x 82x 82x 82x 82x 82x 82x 82x 82x 82x 82x 167x 40x 40x 40x 40x 40x 167x 82x 82x 82x 82x 82x 82x 82x 82x 82x 82x 82x 82x 82x 82x 82x 82x 82x 82x 82x 65x 65x 82x 82x 82x 82x 82x 82x 82x 82x 82x 82x 82x 82x 82x 82x 82x 82x 82x 82x 82x 82x 82x 25x 25x 82x 82x 82x 25x 34x 27x 3x 3x 3x 3x 3x 3x 3x 3x 3x 3x 3x 3x 3x 3x 3x 3x 3x 3x 3x 3x 3x 3x 3x 3x 3x 3x 3x 3x 27x 51x 51x 2854x 2853x 2853x 2851x 31x 51x 51x 51x 27x 85x 85x 85x 85x 85x 85x 85x 85x 27x 27x 82x 82x 82x 82x 82x 82x 82x 82x 82x 82x 82x | 'use strict'
const chalk = require('chalk')
const semver = require('semver')
const {
COLORS,
divider
} = require('../ncm-style')
const L = console.log
const SEVERITY_RMAP = [
'NONE',
'LOW',
'MEDIUM',
'HIGH',
'CRITICAL'
]
const SEVERITY_RMAP_NPM = [
'NONE',
'LOW',
'MODERATE',
'HIGH',
'CRITICAL'
]
const W = [
40, // Module Name
12, // Risk Score
23, // License
20, // Security
23 // Score
]
const SEVERITY_COLOR = {
CRITICAL: COLORS.red,
HIGH: COLORS.orange,
MEDIUM: COLORS.yellow,
LOW: COLORS.light1,
NONE: COLORS.base
}
module.exports = {
W,
SEVERITY_RMAP,
SEVERITY_RMAP_NPM,
SEVERITY_COLOR,
severityMeter,
severityText,
severityTextLabel,
shortVulnerabilityList,
moduleList,
moduleSort
}
function filterReport (report, options) {
const out = []
if (!options.filterCompliance &&
!options.filterSecurity &&
options.filterLevel === 0
) {
return report
}
const minimumSeverity = options.filterLevel
for (const pkg of report) {
const hasComplianceFailure = pkg.scores.some(
s => s.group === 'compliance' && !s.pass
)
if (options.filterCompliance && !hasComplianceFailure) {
continue
}
if (options.filterSecurity || options.filterLevel > 0) {
if (!pkg.failures) {
continue
}
const hasSecurityFailure = pkg.failures.some(
f => f.group === 'security' &&
SEVERITY_RMAP.indexOf(f.severity) >= minimumSeverity
)
if (!hasSecurityFailure) {
continue
}
}
out.push(pkg)
}
return out
}
function moduleList (report, title, options) {
L(divider(W[0] + W[1] + W[2] + W[3] + 7, '─'))
L(chalk`{${COLORS.light1} ${title}}`)
L(divider(W[0] + W[1] + W[2] + W[3] + 7))
report = moduleSort(report)
if (options) {
report = filterReport(report, options)
if (report.length === 0) {
return
}
}
/* Module List */
L(chalk`{${COLORS.light1} Module Name${' '.repeat(W[0] - 9)}Risk${' '.repeat(W[1] - 3)}License${' '.repeat(W[2] - 6)}Security}`)
L(chalk`{${COLORS.light1} ┌──${'─'.repeat(W[0])}┬${'─'.repeat(W[1])}┬${'─'.repeat(W[2])}┬${'─'.repeat(W[3])}┐}`)
report.forEach((pkg, ind) => {
const version = String(pkg.version)
/* Module Name */
let mod = pkg.name + ' @ ' + version
let leftMod = ''
// truncate name text to fit within column
const sliceLen = W[0] - 10 - version.length
if (mod.length + 3 > W[0]) {
leftMod = mod.slice(sliceLen, mod.length)
mod = mod.slice(0, sliceLen) + '...'
}
if (pkg.published) {
let license = pkg.license &&
pkg.license.data &&
pkg.license.data.spdx
? pkg.license.data.spdx
: 'UNKNOWN'
// truncate license text to fit within column
if (license.length + 3 > W[2]) license = license.slice(0, W[2] - 4) + '…'
const licenseBadge = pkg.license && pkg.license.pass
? chalk`{${COLORS.green} ✓}`
: chalk`{${COLORS.red} X}`
/* security badge */
const vulns = [0, 0, 0, 0]
for (const { group, severity } of pkg.failures) {
if (group === 'security') {
if (severity === 'CRITICAL') vulns[3]++
if (severity === 'HIGH') vulns[2]++
if (severity === 'MEDIUM') vulns[1]++
if (severity === 'LOW') vulns[0]++
}
}
const securityBadges = [
vulns.reduce((a, b) => a + b, 0) === 0
? chalk`{${COLORS.green} ✓} 0`
: chalk`{${COLORS.red} X} `,
vulns[3] > 0 ? chalk`{${COLORS.red} ${vulns[3]}C} ` : '',
vulns[2] > 0 ? chalk`{${COLORS.orange} ${vulns[2]}H} ` : '',
vulns[1] > 0 ? chalk`{${COLORS.yellow} ${vulns[1]}M} ` : '',
vulns[0] > 0 ? chalk`{${COLORS.light1} ${vulns[0]}L} ` : ''
]
/* risk badge */
const { quantitativeScore = 0 } = pkg
const maxSeverity = quantitativeScore === 0 ? 4 : pkg.maxSeverity
const riskMeter = severityMeter(SEVERITY_RMAP[maxSeverity])
const riskLabel = severityTextLabel(SEVERITY_RMAP[maxSeverity])
const riskBadge = riskMeter + ' ' + riskLabel
const getScoreColor = quantitativeScore => quantitativeScore === 100
? COLORS.green
: quantitativeScore === 0
? COLORS.red
: COLORS.yellow
/* printing */
L(
// module label with left and right bar
chalk`{${COLORS.light1} │} ${mod} {${getScoreColor(quantitativeScore)} (${quantitativeScore})} ${' '.repeat(Math.max(W[0] - (mod.length + String(quantitativeScore).length + 3), 0))}{${COLORS.light1} │}` +
// risk badge with right bar
riskBadge + chalk`${' '.repeat(W[1] - 10 + 1)}{${COLORS.light1} │} ` +
// license badge with right bar
licenseBadge + chalk` ${license}${' '.repeat(W[2] - license.length - 3)}{${COLORS.light1} │} ` +
// security badge with right bar
securityBadges.join('') + chalk`${' '.repeat(W[3] - 2 - securityBadges.filter(x => x !== '').length * 2)}{${COLORS.light1} │}` +
`${leftMod ? `\n| ${leftMod}` : ''}`
)
} else {
/* printing */
L(
// module label with left and right bar
chalk`{${COLORS.light1} │} ${mod} ${' '.repeat(W[0] - mod.length)}{${COLORS.light1} │} ` +
// spacing with right bar
chalk`${' '.repeat(W[1] - 1)}{${COLORS.light1} │}` +
// spacing with right bar
chalk`${' '.repeat(W[2])}{${COLORS.light1} │}` +
// spacing with right bar
chalk`${' '.repeat(W[3])}{${COLORS.light1} │}`
)
}
/* Cell Divider */
if (ind === report.length - 1) {
L(chalk`{${COLORS.light1} └──${'─'.repeat(W[0])}┴${'─'.repeat(W[1])}┴${'─'.repeat(W[2])}┴${'─'.repeat(W[3])}┘}`)
}
// } else if (dividers) {
// L(chalk`{${COLORS.light1} ├──${'─'.repeat(W[0])}┼${'─'.repeat(W[1])}┼${'─'.repeat(W[2])}┼${'─'.repeat(W[3])}┤}`)
// }
})
}
function shortVulnerabilityList (report) {
const netSecurity = {
LOW: 0,
MEDIUM: 0,
HIGH: 0,
CRITICAL: 0,
AFFECTED: new Set()
}
for (const pkg of report) {
for (const failure of pkg.failures || []) {
if (failure.group === 'security') {
netSecurity[failure.severity]++
netSecurity.AFFECTED.add(pkg.name)
}
}
}
const vulnerabilityCount = netSecurity.CRITICAL + netSecurity.HIGH + netSecurity.MEDIUM + netSecurity.LOW
const securityBadge = vulnerabilityCount > 0 ? `${COLORS.red} !` : `${COLORS.green} ✓`
if (netSecurity.AFFECTED.size > 0) {
L(chalk` {${securityBadge}} ${vulnerabilityCount} security vulnerabilities found across ${netSecurity.AFFECTED.size} modules`)
} else {
L(chalk` {${securityBadge}} ${vulnerabilityCount} security vulnerabilities found`)
}
L(chalk` {${COLORS.red} C} ${netSecurity.CRITICAL} critical severity`)
L(chalk` {${COLORS.orange} H} ${netSecurity.HIGH} high severity`)
L(chalk` {${COLORS.yellow} M} ${netSecurity.MEDIUM} medium severity`)
L(chalk` {${COLORS.light1} L} ${netSecurity.LOW} low severity`)
return vulnerabilityCount
}
function moduleSort (report) {
report.sort((a, b) => {
if (a.maxSeverity > b.maxSeverity) return -1
if (b.maxSeverity > a.maxSeverity) return 1
if (a.name < b.name) return -1
if (b.name < a.name) return 1
return semver.compare(a.version, b.version)
})
return report
}
function severityMeter (severity) {
const risk = SEVERITY_RMAP.indexOf(severity)
return [
chalk`{${SEVERITY_COLOR[severity]} ${'|'.repeat(risk)}}`,
chalk`{${COLORS.base} ${'|'.repeat(4 - risk)}}`
].join('')
}
function severityText (severity) {
const formatted = severity[0].toUpperCase() + severity.slice(1).toLowerCase()
return chalk`{${SEVERITY_COLOR[severity]} ${formatted}}`
}
function severityTextLabel (severity) {
const severityLabel = {
CRITICAL: 'Crit',
HIGH: 'High',
MEDIUM: 'Med ',
LOW: 'Low ',
NONE: 'None'
}
const color = severity === 'NONE' ? COLORS.base : COLORS.light1
return chalk`{${color} ${severityLabel[severity]}}`
}
|