npm-audit-report@1.0.5

PR-URL: https://github.com/npm/npm/pull/20389
Credit: @iarna
Reviewed-By: @zkat

8 files changed, 423 insertions, 0 deletions

diff --git a/node_modules/npm-audit-report/LICENSE b/node_modules/npm-audit-report/LICENSE
new file mode 100644
index 000000000..8d28acf86
--- /dev/null
+++ b/node_modules/npm-audit-report/LICENSE
@@ -0,0 +1,16 @@
+ISC License
+
+Copyright (c) npm, Inc.
+
+Permission to use, copy, modify, and/or distribute this software for
+any purpose with or without fee is hereby granted, provided that the
+above copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE COPYRIGHT HOLDER DISCLAIMS
+ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE
+COPYRIGHT HOLDER BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR
+CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
+OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
+USE OR PERFORMANCE OF THIS SOFTWARE.
diff --git a/node_modules/npm-audit-report/README.md b/node_modules/npm-audit-report/README.md
new file mode 100644
index 000000000..3cc65cf8e
--- /dev/null
+++ b/node_modules/npm-audit-report/README.md
@@ -0,0 +1,47 @@
+
+# npm audit security report
+
+Given a response from the npm security api, render it into a variety of security reports
+
+The response is an object that contains an output string (the report) and a suggested exitCode.
+```
+{
+  output: 'string that contains the security report',
+  exit: 1
+}
+```
+
+
+## Basic usage example
+
+```
+'use strict'
+const Report = require('npm-audit-report')
+
+Report(response, options, (result) => {
+  console.log(result.output)
+  process.exitCode = result.exitCode
+})
+```
+
+
+## options
+
+reporter: 
+  specify which output format you want to use (install, detail, json)
+
+severityThreshold: 
+  specifies the severity threshold for reporting. Possible values include info, low, moderate, high, critical
+
+  example: If you specify high, then only vulnerabilities with high and critical would be displayed.
+
+withColor: 
+  true || false indicates if some report elements should use colors or not
+
+withUnicode: 
+  true || false indicates if unicode characters should be used or not.
+
+
+
+
+
diff --git a/node_modules/npm-audit-report/index.js b/node_modules/npm-audit-report/index.js
new file mode 100644
index 000000000..57ca68bdf
--- /dev/null
+++ b/node_modules/npm-audit-report/index.js
@@ -0,0 +1,23 @@
+'use strict'
+
+const reporters = {
+  install: require('./reporters/install'),
+  detail: require('./reporters/detail'),
+  json: require('./reporters/json')
+}
+
+const report = function (data, options) {
+  const defaults = {
+    reporter: 'install',
+    withColor: true,
+    withUnicode: true
+  }
+
+  const config = Object.assign({}, defaults, options)
+  return new Promise((resolve, reject) => {
+    const result = reporters[config.reporter](data, config)
+    return resolve(result)
+  })
+}
+
+module.exports = report
diff --git a/node_modules/npm-audit-report/lib/utils.js b/node_modules/npm-audit-report/lib/utils.js
new file mode 100644
index 000000000..cfa85255d
--- /dev/null
+++ b/node_modules/npm-audit-report/lib/utils.js
@@ -0,0 +1,29 @@
+'use strict'
+
+const colors = require('ansicolors')
+
+const severityColors = {
+  critical: colors.magenta,
+  high: colors.red,
+  moderate: colors.yellow,
+  low: function (str) { return str }
+}
+
+const severityLabel = function (sev, withColor) {
+  if (withColor) {
+    return severityColors[sev](sev)
+  }
+  return sev
+}
+
+const color = function (value, color, withColor) {
+  if (withColor) {
+    return colors[color](value)
+  }
+  return value
+}
+
+module.exports = {
+  severityLabel: severityLabel,
+  color: color
+}
diff --git a/node_modules/npm-audit-report/package.json b/node_modules/npm-audit-report/package.json
new file mode 100644
index 000000000..35794647d
--- /dev/null
+++ b/node_modules/npm-audit-report/package.json
@@ -0,0 +1,57 @@
+{
+  "_from": "npm-audit-report@latest",
+  "_id": "npm-audit-report@1.0.5",
+  "_inBundle": false,
+  "_integrity": "sha512-xOnLCYj1wk6W5AxwPaHbvChrnVo2KYLEEZMoP3tvuK1fE13NhJa1TVxWj4Tl35+hjC6rQgaEKBWsSatbf2BXLQ==",
+  "_location": "/npm-audit-report",
+  "_phantomChildren": {},
+  "_requested": {
+    "type": "tag",
+    "registry": true,
+    "raw": "npm-audit-report@latest",
+    "name": "npm-audit-report",
+    "escapedName": "npm-audit-report",
+    "rawSpec": "latest",
+    "saveSpec": null,
+    "fetchSpec": "latest"
+  },
+  "_requiredBy": [
+    "#USER",
+    "/"
+  ],
+  "_resolved": "https://registry.npmjs.org/npm-audit-report/-/npm-audit-report-1.0.5.tgz",
+  "_shasum": "f16fa7c61459dd660913509685193148ce2cd85f",
+  "_spec": "npm-audit-report@latest",
+  "_where": "/Users/rebecca/code/npm",
+  "author": {
+    "name": "Adam Baldwin"
+  },
+  "bundleDependencies": false,
+  "dependencies": {
+    "ansicolors": "^0.3.2",
+    "ansistyles": "^0.1.3",
+    "cli-table2": "^0.2.0"
+  },
+  "deprecated": false,
+  "description": "Given a response from the npm security api, render it into a variety of security reports",
+  "devDependencies": {
+    "keyfob": "^1.0.0",
+    "standard": "^11.0.0",
+    "tap": "^11.1.1"
+  },
+  "keywords": [
+    "npm",
+    "security",
+    "report",
+    "audit"
+  ],
+  "license": "ISC",
+  "main": "index.js",
+  "name": "npm-audit-report",
+  "scripts": {
+    "lint": "standard",
+    "lint:fix": "standard --fix",
+    "test": "tap --100 test/*-test.js"
+  },
+  "version": "1.0.5"
+}
diff --git a/node_modules/npm-audit-report/reporters/detail.js b/node_modules/npm-audit-report/reporters/detail.js
new file mode 100644
index 000000000..41e0ab6a7
--- /dev/null
+++ b/node_modules/npm-audit-report/reporters/detail.js
@@ -0,0 +1,188 @@
+'use strict'
+
+const Table = require('cli-table2')
+const Utils = require('../lib/utils')
+
+const report = function (data, options) {
+  const defaults = {
+    severityThreshold: 'info'
+  }
+
+  const blankChars = {
+    'top': ' ',
+    'top-mid': ' ',
+    'top-left': ' ',
+    'top-right': ' ',
+    'bottom': ' ',
+    'bottom-mid': ' ',
+    'bottom-left': ' ',
+    'bottom-right': ' ',
+    'left': ' ',
+    'left-mid': ' ',
+    'mid': ' ',
+    'mid-mid': ' ',
+    'right': ' ',
+    'right-mid': ' ',
+    'middle': ' '
+  }
+
+  const config = Object.assign({}, defaults, options)
+
+  let output = ''
+  let exit = 0
+
+  const log = function (value) {
+    output = output + value + '\n'
+  }
+
+  const footer = function (metadata) {
+    let total = 0
+
+    const severities = Object.entries(metadata.vulnerabilities).filter((value) => {
+      total = total + value[1]
+      if (value[1] > 0) {
+        return true
+      }
+    }).map((value) => {
+      return `${value[1]} ${Utils.severityLabel(value[0], false)}`
+    }).join(' | ')
+
+    if (total > 0) {
+      exit = 1
+    }
+    if (total === 0) {
+      log(`${Utils.color('[+]', 'green', config.withColor)} no known vulnerabilities found`)
+      log(`    Packages audited: ${data.metadata.totalDependencies} (${data.metadata.devDependencies} dev, ${data.metadata.optionalDependencies} optional)`)
+    } else {
+      log(`\n${Utils.color('[!]', 'red', config.withColor)} ${total} ${total === 1 ? 'vulnerability' : 'vulnerabilities'} found - Packages audited: ${data.metadata.totalDependencies} (${data.metadata.devDependencies} dev, ${data.metadata.optionalDependencies} optional)`) 
+      log(`    Severity: ${severities}`)
+    }
+  }
+
+  const reportTitle = function () {
+    const tableOptions = {
+      colWidths: [78]
+    }
+    tableOptions.chars = blankChars
+    const table = new Table(tableOptions)
+    table.push([{
+      content: '=== npm audit security report ===',
+      vAlign: 'center',
+      hAlign: 'center'
+    }])
+    log(table.toString())
+  }
+
+  const actions = function (data, config) {
+    const date = new Date()
+    reportTitle()
+
+    if (Object.keys(data.advisories).length === 0) {
+      //log(`${Utils.color('[+]', 'green', config.withColor)} no known vulnerabilities found [${data.metadata.totalDependencies} packages audited]`)
+      return
+    } else {
+      // vulns found display a report.
+
+      let reviewFlag = false
+
+      data.actions.forEach((action) => {
+        if (action.action === 'update' || action.action === 'install') {
+          const recommendation = getRecommendation(action, config)
+          const label = action.resolves.length === 1 ? 'vulnerability' : 'vulnerabilities'
+          log(`\n\n# Run \`${recommendation.cmd}\` to resolve ${action.resolves.length} ${label}`)
+          if (recommendation.isBreaking) {
+            log(`SEMVER WARNING: Recommended action is a potentially breaking change`)
+          }
+
+          action.resolves.forEach((resolution) => {
+            const advisory = data.advisories[resolution.id]
+            const tableOptions = {
+              colWidths: [15, 62],
+              wordWrap: true
+            }
+            if (!config.withUnicode) {
+              tableOptions.chars = blankChars
+            }
+            const table = new Table(tableOptions)
+
+            table.push(
+              {[Utils.severityLabel(advisory.severity)]: advisory.title},
+              {'Package': advisory.module_name},
+              {'Dependency of': `${resolution.path.split('>')[0]} ${resolution.dev ? '[dev]' : ''}`},
+              {'Path': `${resolution.path.split('>').join(' > ')}`},
+              {'More info': `https://nodesecurity.io/advisories/${advisory.id}`}
+            )
+
+            log(table.toString())
+          })
+        }
+        if (action.action === 'review') {
+          if (!reviewFlag) {
+            const tableOptions = {
+              colWidths: [78]
+            }
+            if (!config.withUnicode) {
+              tableOptions.chars = blankChars
+            }
+            const table = new Table(tableOptions)
+            table.push([{
+              content: 'Manual Review\nSome vulnerabilities require your attention to resolve\n\nVisit https://go.npm.me/audit-guide for additional guidance',
+              vAlign: 'center',
+              hAlign: 'center'
+            }])
+            log('\n\n')
+            log(table.toString())
+          }
+          reviewFlag = true
+
+          action.resolves.forEach((resolution) => {
+            const advisory = data.advisories[resolution.id]
+            const tableOptions = {
+              colWidths: [15, 62],
+              wordWrap: true
+            }
+            if (!config.withUnicode) {
+              tableOptions.chars = blankChars
+            }
+            const table = new Table(tableOptions)
+
+            table.push(
+              {[Utils.severityLabel(advisory.severity, config.withColor)]: advisory.title},
+              {'Package': advisory.module_name},
+              {'Dependency of': `${resolution.path.split('>')[0]} ${resolution.dev ? '[dev]' : ''}`},
+              {'Path': `${resolution.path.split('>').join(' > ')}`},
+              {'More info': `https://nodesecurity.io/advisories/${advisory.id}`}
+            )
+            log(table.toString())  
+          })
+        }
+      })
+    }
+  }
+
+  actions(data, config)
+  footer(data.metadata)
+
+  return {
+    report: output,
+    exitCode: exit
+  }
+}
+
+const getRecommendation = function (action, config) {
+
+  if (action.action === 'install') {
+    return {
+      cmd: `npm install ${action.module}@${action.target}`,
+      isBreaking: action.isMajor
+    }
+  } else {
+    return {
+      cmd: `npm update ${action.module} --depth ${action.depth}`,
+      isBreaking: false
+    }
+  }
+
+}
+
+module.exports = report
diff --git a/node_modules/npm-audit-report/reporters/install.js b/node_modules/npm-audit-report/reporters/install.js
new file mode 100644
index 000000000..d0b5bcf81
--- /dev/null
+++ b/node_modules/npm-audit-report/reporters/install.js
@@ -0,0 +1,46 @@
+'use strict'
+
+const Utils = require('../lib/utils')
+
+const report = function (data, options) {
+  const defaults = {
+    severityThreshold: 'info'
+  }
+
+  const config = Object.assign({}, defaults, options)
+
+  let output = ''
+
+  const log = function (value) {
+    output = output + value + '\n'
+  }
+
+  if (Object.keys(data.advisories).length === 0) {
+    log(`${Utils.color('[+]', 'green', config.withColor)} no known vulnerabilities found [${data.metadata.totalDependencies} packages audited]`)
+    return {
+      report: output,
+      exitCode: 0
+    }
+  } else {
+    let total = 0
+
+    const severities = Object.entries(data.metadata.vulnerabilities).filter((value) => {
+      total = total + value[1]
+      if (value[1] > 0) {
+        return true
+      }
+    }).map((value) => {
+      return `${value[1]} ${Utils.severityLabel(value[0], config.withColor)}`
+    }).join(' | ')
+
+    log(`${Utils.color('[!]', 'red', config.withColor)} ${total} ${total === 1 ? 'vulnerability' : 'vulnerabilities'} found [${data.metadata.totalDependencies} packages audited]`)
+    log(`    Severity: ${severities}`)
+    log(`    Run \`npm audit\` for more detail`)
+    return {
+      report: output,
+      exitCode: 1
+    }
+  }
+}
+
+module.exports = report
diff --git a/node_modules/npm-audit-report/reporters/json.js b/node_modules/npm-audit-report/reporters/json.js
new file mode 100644
index 000000000..6bf5097ef
--- /dev/null
+++ b/node_modules/npm-audit-report/reporters/json.js
@@ -0,0 +1,17 @@
+'use strict'
+
+const report = function (data, options) {
+  const defaults = {
+    indent: 2
+  }
+
+  const config = Object.assign({}, defaults, options)
+
+  const json = JSON.stringify(data, null, config.indent)
+  return {
+    report: json,
+    exitCode: 0
+  }
+}
+
+module.exports = report