API/api.medcify.app/node_modules/snyk/dist/cli/519.index.js
2022-09-26 11:41:44 +05:30

502 lines
22 KiB
JavaScript

"use strict";
exports.id = 519;
exports.ids = [519];
exports.modules = {
/***/ 41519:
/***/ ((__unused_webpack_module, exports, __webpack_require__) => {
Object.defineProperty(exports, "__esModule", ({ value: true }));
exports.addIacDriftAnalytics = exports.performanceAnalyticsObject = exports.addIacAnalytics = void 0;
const types_1 = __webpack_require__(94820);
const analytics = __webpack_require__(82744);
const file_utils_1 = __webpack_require__(45281);
const driftctl_1 = __webpack_require__(3659);
function addIacAnalytics(formattedResults, opts) {
let totalIssuesCount = 0;
const customRulesIdsFoundInIssues = {};
let issuesFromCustomRulesCount = 0;
const projectTypeAnalytics = {};
const packageManagers = Array();
formattedResults.forEach((res) => {
var _a;
totalIssuesCount =
(totalIssuesCount || 0) + res.result.cloudConfigResults.length;
const projectType = res.packageManager;
packageManagers.push(projectType);
projectTypeAnalytics[projectType] = (_a = projectTypeAnalytics[projectType]) !== null && _a !== void 0 ? _a : {
count: 0,
};
projectTypeAnalytics[projectType]['count']++;
res.result.cloudConfigResults.forEach((policy) => {
projectTypeAnalytics[projectType][policy.severity] =
(projectTypeAnalytics[projectType][policy.severity] || 0) + 1;
if (policy.isGeneratedByCustomRule) {
issuesFromCustomRulesCount++;
customRulesIdsFoundInIssues[policy.publicId] = true;
}
});
});
const uniqueCustomRulesCount = Object.keys(customRulesIdsFoundInIssues).length;
analytics.add('packageManager', Array.from(new Set(packageManagers)));
analytics.add('iac-issues-count', totalIssuesCount);
analytics.add('iac-ignored-issues-count', opts.ignoredIssuesCount);
analytics.add('iac-type', projectTypeAnalytics);
analytics.add('iac-metrics', exports.performanceAnalyticsObject);
analytics.add('iac-test-count', formattedResults.length); // TODO: remove this once we all analytics use iac-files-count
analytics.add('iac-files-count', formattedResults.length);
analytics.add('iac-local-custom-rules', opts.rulesOrigin === types_1.RulesOrigin.Local);
analytics.add('iac-remote-custom-rules', opts.rulesOrigin === types_1.RulesOrigin.Remote);
analytics.add('iac-custom-rules-issues-count', issuesFromCustomRulesCount);
analytics.add('iac-custom-rules-checksum', file_utils_1.computeCustomRulesBundleChecksum());
analytics.add('iac-custom-rules-coverage-count', uniqueCustomRulesCount);
}
exports.addIacAnalytics = addIacAnalytics;
exports.performanceAnalyticsObject = {
[types_1.PerformanceAnalyticsKey.InitLocalCache]: null,
[types_1.PerformanceAnalyticsKey.FileLoading]: null,
[types_1.PerformanceAnalyticsKey.FileParsing]: null,
[types_1.PerformanceAnalyticsKey.FileScanning]: null,
[types_1.PerformanceAnalyticsKey.OrgSettings]: null,
[types_1.PerformanceAnalyticsKey.CustomSeverities]: null,
[types_1.PerformanceAnalyticsKey.ResultFormatting]: null,
[types_1.PerformanceAnalyticsKey.UsageTracking]: null,
[types_1.PerformanceAnalyticsKey.CacheCleanup]: null,
[types_1.PerformanceAnalyticsKey.Total]: null,
};
function addIacDriftAnalytics(analysis, options) {
analytics.add('iac-drift-coverage', analysis.coverage);
analytics.add('iac-drift-total-resources', analysis.summary.total_resources);
analytics.add('iac-drift-total-unmanaged', analysis.summary.total_unmanaged);
analytics.add('iac-drift-total-managed', analysis.summary.total_managed);
analytics.add('iac-drift-total-missing', analysis.summary.total_missing);
analytics.add('iac-drift-total-changed', analysis.summary.total_changed);
analytics.add('iac-drift-iac-source-count', analysis.summary.total_iac_source_count);
analytics.add('iac-drift-provider-name', analysis.provider_name);
analytics.add('iac-drift-provider-version', analysis.provider_version);
analytics.add('iac-drift-version', driftctl_1.driftctlVersion);
analytics.add('iac-drift-scan-duration', analysis.scan_duration);
let scope = 'all';
if (options['only-managed']) {
scope = 'managed';
}
else if (options['only-unmanaged']) {
scope = 'unmanaged';
}
analytics.add('iac-drift-scan-scope', scope);
}
exports.addIacDriftAnalytics = addIacDriftAnalytics;
/***/ }),
/***/ 45281:
/***/ ((__unused_webpack_module, exports, __webpack_require__) => {
Object.defineProperty(exports, "__esModule", ({ value: true }));
exports.makeFileAndDirectoryGenerator = exports.computeCustomRulesBundleChecksum = exports.isValidBundle = exports.extractBundle = exports.createIacDir = void 0;
const fs = __webpack_require__(35747);
const tar = __webpack_require__(97998);
const path = __webpack_require__(85622);
const crypto = __webpack_require__(76417);
const local_cache_1 = __webpack_require__(50089);
const oci_pull_1 = __webpack_require__(166);
const fs_1 = __webpack_require__(35747);
const path_1 = __webpack_require__(85622);
function hashData(s) {
const hashedData = crypto
.createHash('sha1')
.update(s)
.digest('hex');
return hashedData;
}
function createIacDir() {
// this path will be able to be customised by the user in the future
const iacPath = path.join(local_cache_1.LOCAL_POLICY_ENGINE_DIR);
try {
if (!fs.existsSync(iacPath)) {
fs.mkdirSync(iacPath, '700');
}
fs.accessSync(iacPath, fs.constants.W_OK);
}
catch {
throw new local_cache_1.FailedToInitLocalCacheError();
}
}
exports.createIacDir = createIacDir;
function extractBundle(response) {
return new Promise((resolve, reject) => {
response
.on('error', reject)
.pipe(tar.x({
C: path.join(local_cache_1.LOCAL_POLICY_ENGINE_DIR),
}))
.on('finish', resolve)
.on('error', reject);
});
}
exports.extractBundle = extractBundle;
function isValidBundle(wasmPath, dataPath) {
try {
// verify that the correct files were generated, since this is user input
return !(!fs.existsSync(wasmPath) || !fs.existsSync(dataPath));
}
catch {
return false;
}
}
exports.isValidBundle = isValidBundle;
function computeCustomRulesBundleChecksum() {
try {
const customRulesPolicyWasmPath = path.join(local_cache_1.LOCAL_POLICY_ENGINE_DIR, oci_pull_1.CUSTOM_RULES_TARBALL);
// if bundle is not configured we don't want to include the checksum
if (!fs.existsSync(customRulesPolicyWasmPath)) {
return;
}
const policyWasm = fs.readFileSync(customRulesPolicyWasmPath, 'utf8');
return hashData(policyWasm);
}
catch (err) {
return;
}
}
exports.computeCustomRulesBundleChecksum = computeCustomRulesBundleChecksum;
/**
* makeFileAndDirectoryGenerator is a generator function that helps walking the directory and file structure of this pathToScan
* @param root
* @param maxDepth? - An optional `maxDepth` argument can be provided to limit how deep in the file tree the search will go.
* @returns {Generator<object>} - a generator which yields an object with directories or paths for the path to scan
*/
// eslint-disable-next-line @typescript-eslint/explicit-module-boundary-types
function* makeFileAndDirectoryGenerator(root = '.', maxDepth) {
function* generatorHelper(pathToScan, currentDepth) {
{
yield { directory: pathToScan };
}
if (maxDepth !== currentDepth) {
for (const dirent of fs_1.readdirSync(pathToScan, { withFileTypes: true })) {
if (dirent.isDirectory() &&
fs.readdirSync(path_1.join(pathToScan, dirent.name)).length !== 0) {
yield* generatorHelper(path_1.join(pathToScan, dirent.name), currentDepth + 1);
}
else if (dirent.isFile()) {
yield {
file: {
dir: pathToScan,
fileName: path_1.join(pathToScan, dirent.name),
},
};
}
}
}
}
yield* generatorHelper(root, 0);
}
exports.makeFileAndDirectoryGenerator = makeFileAndDirectoryGenerator;
/***/ }),
/***/ 50089:
/***/ ((__unused_webpack_module, exports, __webpack_require__) => {
Object.defineProperty(exports, "__esModule", ({ value: true }));
exports.InvalidCustomRulesPath = exports.InvalidCustomRules = exports.FailedToExtractCustomRulesError = exports.FailedToDownloadRulesError = exports.FailedToInitLocalCacheError = exports.cleanLocalCache = exports.initLocalCache = exports.getLocalCachePath = exports.assertNever = exports.CUSTOM_POLICY_ENGINE_WASM_PATH = exports.LOCAL_POLICY_ENGINE_DIR = void 0;
const path = __webpack_require__(85622);
const fs = __webpack_require__(35747);
const types_1 = __webpack_require__(94820);
const rimraf = __webpack_require__(50984);
const file_utils_1 = __webpack_require__(45281);
const Debug = __webpack_require__(15158);
const errors_1 = __webpack_require__(55191);
const analytics = __webpack_require__(82744);
const error_utils_1 = __webpack_require__(36401);
const config_1 = __webpack_require__(25425);
const request_1 = __webpack_require__(1552);
const debug = Debug('iac-local-cache');
exports.LOCAL_POLICY_ENGINE_DIR = '.iac-data';
const KUBERNETES_POLICY_ENGINE_WASM_PATH = path.join(exports.LOCAL_POLICY_ENGINE_DIR, 'k8s_policy.wasm');
const KUBERNETES_POLICY_ENGINE_DATA_PATH = path.join(exports.LOCAL_POLICY_ENGINE_DIR, 'k8s_data.json');
const TERRAFORM_POLICY_ENGINE_WASM_PATH = path.join(exports.LOCAL_POLICY_ENGINE_DIR, 'tf_policy.wasm');
const TERRAFORM_POLICY_ENGINE_DATA_PATH = path.join(exports.LOCAL_POLICY_ENGINE_DIR, 'tf_data.json');
const CLOUDFORMATION_POLICY_ENGINE_WASM_PATH = path.join(exports.LOCAL_POLICY_ENGINE_DIR, 'cloudformation_policy.wasm');
const CLOUDFORMATION_POLICY_ENGINE_DATA_PATH = path.join(exports.LOCAL_POLICY_ENGINE_DIR, 'cloudformation_data.json');
const ARM_POLICY_ENGINE_WASM_PATH = path.join(exports.LOCAL_POLICY_ENGINE_DIR, 'arm_policy.wasm');
const ARM_POLICY_ENGINE_DATA_PATH = path.join(exports.LOCAL_POLICY_ENGINE_DIR, 'arm_data.json');
// NOTE: The filenames used for the custom policy bundles match those output
// by the `opa` CLI tool, which is why they are very generic.
exports.CUSTOM_POLICY_ENGINE_WASM_PATH = path.join(exports.LOCAL_POLICY_ENGINE_DIR, 'policy.wasm');
const CUSTOM_POLICY_ENGINE_DATA_PATH = path.join(exports.LOCAL_POLICY_ENGINE_DIR, 'data.json');
function assertNever(value) {
throw new Error(`Unhandled discriminated union member: ${JSON.stringify(value)}`);
}
exports.assertNever = assertNever;
function getLocalCachePath(engineType) {
switch (engineType) {
case types_1.EngineType.Kubernetes:
return [
`${process.cwd()}/${KUBERNETES_POLICY_ENGINE_WASM_PATH}`,
`${process.cwd()}/${KUBERNETES_POLICY_ENGINE_DATA_PATH}`,
];
case types_1.EngineType.Terraform:
return [
`${process.cwd()}/${TERRAFORM_POLICY_ENGINE_WASM_PATH}`,
`${process.cwd()}/${TERRAFORM_POLICY_ENGINE_DATA_PATH}`,
];
case types_1.EngineType.CloudFormation:
return [
`${process.cwd()}/${CLOUDFORMATION_POLICY_ENGINE_WASM_PATH}`,
`${process.cwd()}/${CLOUDFORMATION_POLICY_ENGINE_DATA_PATH}`,
];
case types_1.EngineType.ARM:
return [
`${process.cwd()}/${ARM_POLICY_ENGINE_WASM_PATH}`,
`${process.cwd()}/${ARM_POLICY_ENGINE_DATA_PATH}`,
];
case types_1.EngineType.Custom:
return [
`${process.cwd()}/${exports.CUSTOM_POLICY_ENGINE_WASM_PATH}`,
`${process.cwd()}/${CUSTOM_POLICY_ENGINE_DATA_PATH}`,
];
default:
assertNever(engineType);
}
}
exports.getLocalCachePath = getLocalCachePath;
async function initLocalCache({ customRulesPath, } = {}) {
try {
file_utils_1.createIacDir();
}
catch (e) {
throw new FailedToInitLocalCacheError();
}
// Attempt to extract the custom rules from the path provided.
if (customRulesPath) {
if (!fs.existsSync(customRulesPath)) {
throw new InvalidCustomRulesPath(customRulesPath);
}
try {
const response = fs.createReadStream(customRulesPath);
await file_utils_1.extractBundle(response);
}
catch (e) {
throw new FailedToExtractCustomRulesError(customRulesPath);
}
if (!file_utils_1.isValidBundle(exports.CUSTOM_POLICY_ENGINE_WASM_PATH, CUSTOM_POLICY_ENGINE_DATA_PATH)) {
throw new InvalidCustomRules(customRulesPath);
}
}
// IAC_BUNDLE_PATH is a developer setting that is not useful to most users. It
// is not a replacement for custom rules.
if (config_1.default.IAC_BUNDLE_PATH) {
const stream = fs.createReadStream(config_1.default.IAC_BUNDLE_PATH);
await file_utils_1.extractBundle(stream);
return;
}
// We extract the Snyk rules after the custom rules to ensure our files
// always overwrite whatever might be there.
try {
const BUNDLE_URL = 'https://static.snyk.io/cli/wasm/bundle.tar.gz';
const response = await request_1.streamRequest({
method: 'get',
url: BUNDLE_URL,
body: null,
headers: {},
});
await file_utils_1.extractBundle(response);
}
catch (e) {
throw new FailedToDownloadRulesError();
}
}
exports.initLocalCache = initLocalCache;
function cleanLocalCache() {
// path to delete is hardcoded for now
const iacPath = path.join(`${process.cwd()}`, exports.LOCAL_POLICY_ENGINE_DIR);
try {
// when we support Node version >= 12.10.0 , we can replace rimraf
// with the native fs.rmdirSync(path, {recursive: true})
rimraf.sync(iacPath);
}
catch (e) {
const err = new FailedToCleanLocalCacheError();
analytics.add('error-code', err.code);
debug('The local cache directory could not be deleted');
}
}
exports.cleanLocalCache = cleanLocalCache;
class FailedToInitLocalCacheError extends errors_1.CustomError {
constructor(message) {
super(message || 'Failed to initialize local cache');
this.code = types_1.IaCErrorCodes.FailedToInitLocalCacheError;
this.strCode = error_utils_1.getErrorStringCode(this.code);
this.userMessage =
'We were unable to create a local directory to store the test assets, please ensure that the current working directory is writable';
}
}
exports.FailedToInitLocalCacheError = FailedToInitLocalCacheError;
class FailedToDownloadRulesError extends errors_1.CustomError {
constructor(message) {
super(message || 'Failed to download policies');
this.code = types_1.IaCErrorCodes.FailedToDownloadRulesError;
this.strCode = error_utils_1.getErrorStringCode(this.code);
this.userMessage =
'We were unable to download the security rules, please ensure the network can access https://static.snyk.io';
}
}
exports.FailedToDownloadRulesError = FailedToDownloadRulesError;
class FailedToExtractCustomRulesError extends errors_1.CustomError {
constructor(path, message) {
super(message || 'Failed to download policies');
this.code = types_1.IaCErrorCodes.FailedToExtractCustomRulesError;
this.strCode = error_utils_1.getErrorStringCode(this.code);
this.userMessage = `We were unable to extract the rules provided at: ${path}. The provided bundle may be corrupted or invalid. Please ensure it was generated using the 'snyk-iac-rules' SDK`;
}
}
exports.FailedToExtractCustomRulesError = FailedToExtractCustomRulesError;
class InvalidCustomRules extends errors_1.CustomError {
constructor(path, message) {
super(message || 'Invalid custom rules bundle');
this.code = types_1.IaCErrorCodes.InvalidCustomRules;
this.strCode = error_utils_1.getErrorStringCode(this.code);
this.userMessage = `We were unable to extract the rules provided at: ${path}. The provided bundle does not match the required structure. Please ensure it was generated using the 'snyk-iac-rules' SDK`;
}
}
exports.InvalidCustomRules = InvalidCustomRules;
class InvalidCustomRulesPath extends errors_1.CustomError {
constructor(path, message) {
super(message || 'Invalid path to custom rules bundle');
this.code = types_1.IaCErrorCodes.InvalidCustomRulesPath;
this.strCode = error_utils_1.getErrorStringCode(this.code);
this.userMessage = `We were unable to extract the rules provided at: ${path}. The bundle at the provided path does not exist`;
}
}
exports.InvalidCustomRulesPath = InvalidCustomRulesPath;
class FailedToCleanLocalCacheError extends errors_1.CustomError {
constructor(message) {
super(message || 'Failed to clean local cache');
this.code = types_1.IaCErrorCodes.FailedToCleanLocalCacheError;
this.strCode = error_utils_1.getErrorStringCode(this.code);
this.userMessage = ''; // Not a user facing error.
}
}
/***/ }),
/***/ 166:
/***/ ((__unused_webpack_module, exports, __webpack_require__) => {
Object.defineProperty(exports, "__esModule", ({ value: true }));
exports.UnsupportedEntitlementPullError = exports.InvalidRemoteRegistryURLError = exports.InvalidManifestSchemaVersionError = exports.FailedToBuildOCIArtifactError = exports.pull = exports.extractOCIRegistryURLComponents = exports.CUSTOM_RULES_TARBALL = void 0;
const fs_1 = __webpack_require__(35747);
const path = __webpack_require__(85622);
const types_1 = __webpack_require__(94820);
const errors_1 = __webpack_require__(55191);
const error_utils_1 = __webpack_require__(36401);
const local_cache_1 = __webpack_require__(50089);
const Debug = __webpack_require__(15158);
const file_utils_1 = __webpack_require__(45281);
const debug = Debug('iac-oci-pull');
exports.CUSTOM_RULES_TARBALL = 'custom-bundle.tar.gz';
function extractOCIRegistryURLComponents(OCIRegistryURL) {
try {
const urlWithoutProtocol = OCIRegistryURL.includes('://')
? OCIRegistryURL.split('://')[1]
: OCIRegistryURL;
const firstSlashIdx = urlWithoutProtocol.indexOf('/');
const [registryHost, repoWithTag] = [
urlWithoutProtocol.substring(0, firstSlashIdx),
urlWithoutProtocol.substring(firstSlashIdx + 1),
];
const [repo, tag = 'latest'] = repoWithTag.split(':');
if (firstSlashIdx === -1 || !registryHost || !repoWithTag || !repo) {
throw new InvalidRemoteRegistryURLError(OCIRegistryURL);
}
return { registryBase: registryHost, repo, tag };
}
catch {
throw new InvalidRemoteRegistryURLError(OCIRegistryURL);
}
}
exports.extractOCIRegistryURLComponents = extractOCIRegistryURLComponents;
/**
* Downloads an OCI Artifact from a remote OCI Registry and writes it to the
* disk. The artifact here is a custom rules bundle stored in a remote registry.
* In order to do that, it calls an external docker registry v2 client to get
* the manifests, the layers and then builds the artifact. Example:
* https://github.com/opencontainers/image-spec/blob/main/manifest.md#example-image-manifest
*
* @param registry The client for accessing an OCI registry.
* @param repository The name of an OCI repository.
* @param tag The tag of an image in an OCI repository.
**/
async function pull(registry, repository, tag) {
const { schemaVersion, layers } = await registry.getManifest(repository, tag);
if (schemaVersion !== 2) {
throw new InvalidManifestSchemaVersionError(schemaVersion.toString());
}
// We assume that we will always have an artifact of a single layer
if (layers.length > 1) {
debug('There were more than one layers found in the OCI Artifact.');
}
const { blob } = await registry.getLayer(repository, layers[0].digest);
try {
const downloadPath = path.join(local_cache_1.LOCAL_POLICY_ENGINE_DIR, exports.CUSTOM_RULES_TARBALL);
file_utils_1.createIacDir();
await fs_1.promises.writeFile(downloadPath, blob);
return downloadPath;
}
catch (err) {
throw new FailedToBuildOCIArtifactError();
}
}
exports.pull = pull;
class FailedToBuildOCIArtifactError extends errors_1.CustomError {
constructor(message) {
super(message || 'Could not build OCI Artifact');
this.code = types_1.IaCErrorCodes.FailedToBuildOCIArtifactError;
this.strCode = error_utils_1.getErrorStringCode(this.code);
this.userMessage =
'We were unable to build the remote OCI Artifact locally, please ensure that the local directory is writeable.';
}
}
exports.FailedToBuildOCIArtifactError = FailedToBuildOCIArtifactError;
class InvalidManifestSchemaVersionError extends errors_1.CustomError {
constructor(message) {
super(message || 'Invalid manifest schema version');
this.code = types_1.IaCErrorCodes.InvalidRemoteRegistryURLError;
this.strCode = error_utils_1.getErrorStringCode(this.code);
this.userMessage = `Invalid manifest schema version: ${message}. We currently support Image Manifest Version 2, Schema 2`;
}
}
exports.InvalidManifestSchemaVersionError = InvalidManifestSchemaVersionError;
class InvalidRemoteRegistryURLError extends errors_1.CustomError {
constructor(url) {
super('Invalid URL for Remote Registry');
this.code = types_1.IaCErrorCodes.InvalidRemoteRegistryURLError;
this.strCode = error_utils_1.getErrorStringCode(this.code);
this.userMessage = `The provided remote registry URL${url ? `: "${url}"` : ''} is invalid. Please check it again.`;
}
}
exports.InvalidRemoteRegistryURLError = InvalidRemoteRegistryURLError;
class UnsupportedEntitlementPullError extends errors_1.CustomError {
constructor(entitlement) {
super(`OCI Pull not supported - Missing the ${entitlement} entitlement`);
this.code = types_1.IaCErrorCodes.UnsupportedEntitlementPullError;
this.strCode = error_utils_1.getErrorStringCode(this.code);
this.userMessage = `The custom rules feature is currently not supported for this org. To enable it, please contact snyk support.`;
}
}
exports.UnsupportedEntitlementPullError = UnsupportedEntitlementPullError;
/***/ })
};
;
//# sourceMappingURL=519.index.js.map