Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix(api): lint all dependencies in package-lock #53

Merged
merged 2 commits into from Feb 3, 2020
Merged

fix(api): lint all dependencies in package-lock #53

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
dfced24
fix(api): lint all dependencies in package-lock
Jan 28, 2020
989d9a2
chore(try-catch): revert try catch changes
JamesSingleton Feb 3, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
12 changes: 6 additions & 6 deletions packages/lockfile-lint-api/__tests__/parseNpmLockfile.test.js
View file
Open in desktop
Expand Up @@ -17,8 +17,8 @@ describe('ParseLockfile Npm', () => {
expect(lockfile.type).toEqual('success')
expect(lockfile.object).toEqual(
expect.objectContaining({
'debug@4.1.1': expect.any(Object),
'ms@2.1.2': expect.any(Object)
'debug@4.1.1-031b0fadad70d901aa76ca1028682c7fc8ed370c': expect.any(Object),
'ms@2.1.2-d6934ce87f6e568c4f5d6d9f6e5c5697992e7b91': expect.any(Object)
})
)
})
Expand All @@ -35,10 +35,10 @@ describe('ParseLockfile Npm', () => {
expect(lockfile.type).toEqual('success')
expect(lockfile.object).toEqual(
expect.objectContaining({
'debug@4.1.1': expect.any(Object),
'ms@2.1.2': expect.any(Object),
'ms@2.0.0': expect.any(Object),
'escape-html@1.0.3': expect.any(Object)
'debug@4.1.1-031b0fadad70d901aa76ca1028682c7fc8ed370c': expect.any(Object),
'ms@2.1.2-d6934ce87f6e568c4f5d6d9f6e5c5697992e7b91': expect.any(Object),
'ms@2.0.0-e3988f0b9b049286d39bee2b87cda1737adf1ba7': expect.any(Object),
'escape-html@1.0.3-541618a9ecf9b6e94c9131aec4590d01a5b0e720': expect.any(Object)
})
)
})
Expand Down
3 changes: 2 additions & 1 deletion packages/lockfile-lint-api/package.json
View file
Open in desktop
Expand Up @@ -49,7 +49,8 @@
},
"dependencies": {
"@yarnpkg/lockfile": "^1.1.0",
"debug": "^4.1.1"
"debug": "^4.1.1",
"object-hash": "^2.0.1"
},
"devDependencies": {
"babel-eslint": "^10.0.1",
Expand Down
15 changes: 8 additions & 7 deletions packages/lockfile-lint-api/src/ParseLockfile.js
View file
Open in desktop
Expand Up @@ -4,6 +4,7 @@
const fs = require('fs')
const path = require('path')
const yarnLockfileParser = require('@yarnpkg/lockfile')
const hash = require('object-hash')
const {ParsingError, ERROR_MESSAGES} = require('./common/ParsingError')
const {
NO_OPTIONS,
Expand Down Expand Up @@ -124,26 +125,26 @@ class ParseLockfile {
}
}

_flattenNpmDepsTree (npmDepsTree) {
let flattenedDepTree = {}
let flattenedNestedDepsTree = {}
_flattenNpmDepsTree (npmDepsTree, npmDepMap = {}) {
for (const [depName, depMetadata] of Object.entries(npmDepsTree)) {
const depMetadataShortend = {
version: depMetadata.version,
resolved: depMetadata.resolved ? depMetadata.resolved : depMetadata.version,
resolved: depMetadata.resolved,
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@JamesSingleton can you comment why was this changed?
IIRC this was supposed to solve cases where a resolved property may not be there but a version would, for cases like local file URLs or something like this.

Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So this is due to the new URL(metadata.resolved) failing if this is a version?
I'll track back the source of this and we'll find out.

Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

From #49 (comment)

The error points to this line

      try {
        packageResolvedURL = new URL(packageMetadata.resolved)
      } catch (error) {
        throw new PackageError(packageName, error)
      }

Not sure how this is now just coming up now though. Looks like this will happen with any dependency that does not have a true URL for resolved since resolved is optional and doing new URL("1.1.1") is not a valid URL.

Sounds like you're saying this is a general bug unrelated to this change.
I tracked the source of using the version to a package-lock.json structure where the version field is used to specify the git URL, see here: a483115#diff-24ebf59c7b0eeb6040c5311942ef4a3eR16

Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@JamesSingleton nevermind here since we already have this discussion going on #54

integrity: depMetadata.integrity,
requires: depMetadata.requires
}
const hashedDepValues = hash(depMetadataShortend)

flattenedDepTree[`${depName}@${depMetadata.version}`] = depMetadataShortend
npmDepMap[`${depName}@${depMetadata.version}-${hashedDepValues}`] = depMetadataShortend

const nestedDepsTree = depMetadata.dependencies

if (nestedDepsTree && Object.keys(nestedDepsTree).length !== 0) {
flattenedNestedDepsTree = this._flattenNpmDepsTree(nestedDepsTree)
this._flattenNpmDepsTree(nestedDepsTree, npmDepMap)
}
}

return Object.assign({}, flattenedDepTree, flattenedNestedDepsTree)
return npmDepMap
}
}

Expand Down
11 changes: 7 additions & 4 deletions packages/lockfile-lint-api/src/validators/ValidateHost.js
View file
Open in desktop
Expand Up @@ -30,10 +30,13 @@ module.exports = class ValidateHost {
}

let packageResolvedURL = {}
try {
packageResolvedURL = new URL(packageMetadata.resolved)
} catch (error) {
throw new PackageError(packageName, error)

if (packageMetadata.resolved) {
try {
packageResolvedURL = new URL(packageMetadata.resolved)
} catch (error) {
throw new PackageError(packageName, error)
}
}

const allowedHosts = hosts.map(hostValue => {
Expand Down
11 changes: 7 additions & 4 deletions packages/lockfile-lint-api/src/validators/ValidateHttps.js
View file
Open in desktop
Expand Up @@ -26,10 +26,13 @@ module.exports = class ValidateHttps {
}

let packageResolvedURL = {}
try {
packageResolvedURL = new URL(packageMetadata.resolved)
} catch (error) {
throw new PackageError(packageName, error)

if (packageMetadata.resolved) {
try {
packageResolvedURL = new URL(packageMetadata.resolved)
} catch (error) {
throw new PackageError(packageName, error)
}
}

if (packageResolvedURL.protocol !== HTTPS_PROTOCOL) {
Expand Down
14 changes: 9 additions & 5 deletions packages/lockfile-lint-api/src/validators/ValidateScheme.js
View file
Open in desktop
Expand Up @@ -28,12 +28,16 @@ module.exports = class ValidateProtocol {
}

let packageResolvedURL = {}
try {
packageResolvedURL = new URL(packageMetadata.resolved)
} catch (error) {
throw new PackageError(packageName, error)

if (packageMetadata.resolved) {
try {
packageResolvedURL = new URL(packageMetadata.resolved)
} catch (error) {
throw new PackageError(packageName, error)
}
}
if (schemes.indexOf(packageResolvedURL.protocol) === -1) {

if (packageResolvedURL.protocol && schemes.indexOf(packageResolvedURL.protocol) === -1) {
// throw new Error(`detected invalid origin for package: ${packageName}`)
validationResult.errors.push({
message: `detected invalid scheme(s) for package: ${packageName}\n expected: ${schemes}\n actual: ${
Expand Down
2 changes: 1 addition & 1 deletion packages/lockfile-lint/__tests__/main.test.js
View file
Open in desktop
Expand Up @@ -161,7 +161,7 @@ describe('Main CLI logic', () => {
validators
})

expect(result.validatorFailures).toEqual(2)
expect(result.validatorFailures).toEqual(1)
expect(result.validatorCount).toEqual(1)
expect(result.validatorSuccesses).toEqual(0)
})
Expand Down
5 changes: 5 additions & 0 deletions yarn.lock
View file
Open in desktop
Expand Up @@ -7229,6 +7229,11 @@ object-copy@^0.1.0:
define-property "^0.2.5"
kind-of "^3.0.3"

object-hash@^2.0.1:
version "2.0.1"
resolved "https://registry.yarnpkg.com/object-hash/-/object-hash-2.0.1.tgz#cef18a0c940cc60aa27965ecf49b782cbf101d96"
integrity sha512-HgcGMooY4JC2PBt9sdUdJ6PMzpin+YtY3r/7wg0uTifP+HJWW8rammseSEHuyt0UeShI183UGssCJqm1bJR7QA==

object-keys@^1.0.12:
version "1.1.1"
resolved "https://registry.yarnpkg.com/object-keys/-/object-keys-1.1.1.tgz#1c47f272df277f3b1daf061677d9c82e2322c60e"
Expand Down