-
-
Notifications
You must be signed in to change notification settings - Fork 1.3k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
feat: add Yarn Audit analyzer #3063
Conversation
@jeremylong First time developing in this repo. Let me know if this is the right approach for this? |
Thanks for the PR - and there are things in here that will be used but I would like to see this re-structured a bit. When we add a reliance on an external tool we should put this into an entirely separate analyzer; so in this case like One of the main reasons is so we can test to see if the tool is installed and working in the DependencyCheck/core/src/main/java/org/owasp/dependencycheck/analyzer/GolangModAnalyzer.java Line 270 in 48a6bda
In this case, if no yarn.lock is in the scan then the |
@jeremylong How about this? I separated it into it's own Analyzer and moved some of the common code into It now prints the following to the user if Yarn isn't installed
|
@ssthom initial review - this looks great. really appreciate such a complete PR. I will do some testing over the weekend, merge the PR, and then publish a release. You don't have to worry about this as I'll handle it (just writing it down so I have notes); update to include:
|
Hi! |
Current branch can be found here: https://github.com/jeremylong/DependencyCheck/tree/ssthom-yarnAudit It looks like we also need to add |
@ssthom testing is finding more issues... As I'm using a newer version of node then you were in testing I'm getting the following from
|
Fixes Issue
Fixes: #2842
Fixes: #2814
Fixes: #2641
Description of Change
Updated the NodeAuditAnalyzer to be able to process the yarn.lock file. It uses
yarn audit --verbose
to get the request it sends to the Node Audit API and process that as if it was from the NPM lock file. It also uses the yarn auditgroups
param to be able to handle DependencyCheck's--nodeAuditSkipDevDependencies
paramHave test cases been added to cover the new functionality?
yes and also tested against my local yarn project