index.js

const assert = require('assert')
const semverSatisfies = require('semver/functions/satisfies')
const { convertToCsvString } = require('./src/csv')
const bitbucket = require('./src/bitbucket')
const { getHyphenatedDate } = require('./src/date')
const docker = require('./src/docker')
const github = require('./src/github')
const nodejs = require('./src/nodejs')
const php = require('./src/php')

const homepageOfThisLibrary = 'https://github.com/silinternational/vulnerability-scanner'

/**
 * Information about a security vulnerability.
 *
 * @typedef {Object} Vulnerability
 * @property {string} detailsUrl - A URL to details about this vulnerability.
 * @property {string} ecosystem - The dependency management ecosystem of the
 *     vulnerable dependency (e.g. 'COMPOSER' or 'NPM').
 * @property {string[]} identifiers - A list of CVE or GitHub identifiers for
 *     this vulnerability.
 * @property {string} inspectedOn - The date (YYYY-MM-DD) of this inspection.
 * @property {string} packageName - The name of the vulnerable package (e.g.
 *     'jquery') or language (e.g. 'PHP', such as if using an EOL'd version of
 *     that programming language).
 * @property {string} severity - One of 'CRITICAL', 'HIGH', 'MEDIUM', or 'LOW'.
 * @property {string} summary - A summary of the vulnerability.
 * @property {string} vulnerableVersionRange - A string indicating the
 *     vulnerable version(s) of the named package or language (e.g. '7.0', or
 *     '>= 6.1.8, < 6.4.1').
 */

/**
 * Information about a security Vulnerability, including the name of the repo
 * using that vulnerable package or language.
 *
 * @typedef {Vulnerability} VulnerabilityWithRepo
 * @property {string} repo - The name of the repo, formatted as 'owner/repo'.
 */

/**
 * A specific version of a dependency (aka. package).
 *
 * @typedef {Object} Dependency
 * @property {string} name - The name of the package (e.g. 'jquery')
 * @property {string} version - The version of the package (e.g. '3.4.0')
 */

/**
 * Get the security vulnerabilities for the specified version control systems.
 *
 * If a Bitbucket workspace is specified, it will be scanned.
 *
 * If a GitHub organization is specified, it will be scanned.
 *
 * If a URL is provided where we can retrieve a CSV file of the programming
 * language versions used by various Docker images, those language versions will
 * be checked for EOL.
 *
 * @param {{
    bitbucket: { username: string?, appPassword: string?, workspace: string? },
    github: { token: string, organization: string? }
    versionsCsvUrl: string?
    }} config
 * @returns {Promise<VulnerabilityWithRepo[]>}
 */
const getSecurityVulnerabilitiesForMultiple = async config => {
  const bbConfig = config.bitbucket || {}
  const ghConfig = config.github || {}
  const versionsCsvUrl = config.versionsCsvUrl || ''
  
  assert(ghConfig.token, 'A GitHub token is required to check for vulnerabilities')
  
  assert(
    bbConfig.workspace || ghConfig.organization,
    'You must specify a GitHub organization, a Bitbucket workspace, or both'
  )
  
  const allVulnerabilities = []
  
  if (bbConfig.workspace) {
    assert(bbConfig.username, 'To scan a Bitbucket workspace, please provide a username')
    assert(bbConfig.appPassword, 'To scan a Bitbucket workspace, please provide an app password')
    
    const bbVulnerabilities = await getSecurityVulnerabilitiesForBitbucketWorkspace(
      bbConfig.username,
      bbConfig.appPassword,
      ghConfig.token,
      bbConfig.workspace,
      versionsCsvUrl
    )
    allVulnerabilities.push(...bbVulnerabilities)
  }
  
  if (ghConfig.organization) {
    const ghVulnerabilities = await getSecurityVulnerabilitiesForGitHubOrg(
      ghConfig.token,
      ghConfig.organization,
      versionsCsvUrl
    )
    allVulnerabilities.push(...ghVulnerabilities)
  }
  
  return allVulnerabilities
}

/**
 * Get the security vulnerabilities for the specified Bitbucket repo. It will
 * return an array of vulnerabilities, or `undefined` if the Bitbucket repo's
 * dependencies could not be determined.
 *
 * NOTE: The data returned about each vulnerability will include a `repo` field
 * with given repo name.
 *
 * NOTE 2: The GitHub token is needed for calls to check for published
 * security vulnerabilities.
 *
 * @param {string} bitbucketUsername - A Bitbucket username
 * @param {string} bitbucketAppPassword - A Bitbucket app password
 * @param {string} githubToken - A GitHub personal access token
 * @param {string} repo - A Bitbucket repo (formatted as "owner/library")
 * @param {string} versionsCsvUrl - (Optional:) The URL where we can retrieve a
 *     CSV file of the PHP versions used by various Docker images.
 * @returns {Promise<undefined | VulnerabilityWithRepo[]>}
 */
const getSecurityVulnerabilitiesForBitbucketRepo = async (
  bitbucketUsername,
  bitbucketAppPassword,
  githubToken,
  repo,
  versionsCsvUrl = ''
) => {
  console.log(`Looking for vulnerabilities in Bitbucket ${repo}`)
  let allVulnerabilities

  try {
    const javaScriptDependencies = await bitbucket.getJavaScriptDependenciesOfRepo(
      bitbucketUsername,
      bitbucketAppPassword,
      repo
    )
    if (javaScriptDependencies === undefined) {
      console.log('(No JavaScript dependencies found)')
    } else {
      const javaScriptVulnerabilities = await getSecurityVulnerabilitiesForJavaScriptDependencies(
        githubToken,
        javaScriptDependencies
      )
      const javaScriptVulnerabilitiesWithRepo = javaScriptVulnerabilities.map(vulnerability => addRepoName(repo, vulnerability))
      allVulnerabilities = allVulnerabilities || []
      allVulnerabilities.push(...javaScriptVulnerabilitiesWithRepo)
    }

    const phpDependencies = await bitbucket.getPhpDependenciesOfRepo(
      bitbucketUsername,
      bitbucketAppPassword,
      repo
    )
    if (phpDependencies === undefined) {
      console.log('(No PHP dependencies found)')
    } else {
      const phpVulnerabilities = await getSecurityVulnerabilitiesForPhpDependencies(
        githubToken,
        phpDependencies
      )
      const phpVulnerabilitiesWithRepo = phpVulnerabilities.map(vulnerability => addRepoName(repo, vulnerability))
      allVulnerabilities = allVulnerabilities || []
      allVulnerabilities.push(...phpVulnerabilitiesWithRepo)
    }

    if (versionsCsvUrl) {
      const nodeJsVersionVulnerabilities = await getNodeJsVersionVulnerabilitiesOfBitbucketRepo(
        bitbucketUsername,
        bitbucketAppPassword,
        repo,
        versionsCsvUrl
      )
      const nodeJsVersionVulnerabilitiesWithRepo = nodeJsVersionVulnerabilities.map(
        vulnerability => addRepoName(repo, vulnerability)
      )
      allVulnerabilities = allVulnerabilities || []
      allVulnerabilities.push(...nodeJsVersionVulnerabilitiesWithRepo)

      const phpVersionVulnerabilities = await getPhpVersionVulnerabilitiesOfBitbucketRepo(
        bitbucketUsername,
        bitbucketAppPassword,
        repo,
        versionsCsvUrl
      )
      const phpVersionVulnerabilitiesWithRepo = phpVersionVulnerabilities.map(
        vulnerability => addRepoName(repo, vulnerability)
      )
      allVulnerabilities = allVulnerabilities || []
      allVulnerabilities.push(...phpVersionVulnerabilitiesWithRepo)
    }
  } catch (error) {
    const currentDate = getHyphenatedDate()
    const failureToCheck = {
      detailsUrl: null,
      ecosystem: null,
      identifiers: [],
      inspectedOn: currentDate,
      packageName: null,
      repo,
      severity: 'HIGH',
      summary: `Failed to scan Bitbucket repo: ${error}`,
      vulnerableVersionRange: null
    }
    allVulnerabilities = allVulnerabilities || []
    allVulnerabilities.push(failureToCheck)
  }
  
  return allVulnerabilities
}

/**
 * Get a list of security vulnerabilities affecting the specified Bitbucket
 * repos.
 *
 * Only repos whose dependencies could be determined will be included.
 *
 * NOTE: The GitHub token is needed for calls to check for published security
 * vulnerabilities.
 *
 * @param {string} bitbucketUsername - A Bitbucket username
 * @param {string} bitbucketAppPassword - A Bitbucket app password
 * @param {string} githubToken - A GitHub personal access token
 * @param {string[]} repos - The list of Bitbucket repos (e.g. ["owner/library"])
 * @param {string} versionsCsvUrl - (Optional:) The URL where we can retrieve a
 *     CSV file of the PHP versions used by various Docker images.
 * @returns {Promise<undefined | VulnerabilityWithRepo[]>}
*/
const getSecurityVulnerabilitiesForBitbucketRepos = async (
  bitbucketUsername,
  bitbucketAppPassword,
  githubToken,
  repos,
  versionsCsvUrl = ''
) => {
  const results = []
  for (const repo of repos) {
    const vulnerabilities = await getSecurityVulnerabilitiesForBitbucketRepo(
      bitbucketUsername,
      bitbucketAppPassword,
      githubToken,
      repo,
      versionsCsvUrl
    )
    if (Array.isArray(vulnerabilities)) {
      results.push(...vulnerabilities)
    }
  }
  return results
}

/**
 * Get the list of security vulnerabilities affecting a given Bitbucket
 * workspace's repos.
 *
 * NOTE: The GitHub token is needed for calls to check for published security
 * vulnerabilities.
 *
 * @param {string} bitbucketUsername - A Bitbucket username
 * @param {string} bitbucketAppPassword - A Bitbucket app password
 * @param {string} githubToken - A GitHub personal access token
 * @param {string} workspace - A Bitbucket workspace (aka organization)
 * @param {string} versionsCsvUrl - (Optional:) The URL where we can retrieve a
 *     CSV file of the PHP versions used by various Docker images.
 * @returns {Promise<VulnerabilityWithRepo[]>}
 */
const getSecurityVulnerabilitiesForBitbucketWorkspace = async (
  bitbucketUsername,
  bitbucketAppPassword,
  githubToken,
  workspace,
  versionsCsvUrl = ''
) => {
  console.log(`Scanning for vulnerabilities in Bitbucket workspace ${workspace}`)
  const repos = await bitbucket.listRepos(
    bitbucketUsername,
    bitbucketAppPassword,
    workspace
  )
  return getSecurityVulnerabilitiesForBitbucketRepos(
    bitbucketUsername,
    bitbucketAppPassword,
    githubToken,
    repos,
    versionsCsvUrl
  )
}

/**
 * Get the list of vulnerabilities (if any) for the given JavaScript
 * dependency (aka. package).
 *
 * @param {string} githubToken
 * @param {Dependency} dependency
 * @returns {Promise<Vulnerability[]>}
 */
const getSecurityVulnerabilitiesForJavaScriptDependency = async (githubToken, dependency) => {
  const vulnerabilities = await github.getSecurityVulnerabilitiesForPackageUsingCache(
    githubToken,
    dependency.name,
    'NPM'
  )
  return vulnerabilities.filter(vulnerability => versionSatisfiesRange(
    dependency.version,
    vulnerability.vulnerableVersionRange
  ))
}

/**
 * Get the list of vulnerabilities (if any) for the given PHP dependency (aka.
 * package).
 *
 * @param {string} githubToken
 * @param {Dependency} dependency
 * @returns {Promise<Vulnerability[]>}
 */
const getSecurityVulnerabilitiesForPhpDependency = async (githubToken, dependency) => {
  const vulnerabilities = await github.getSecurityVulnerabilitiesForPackageUsingCache(
    githubToken,
    dependency.name,
    'COMPOSER'
  )
  return vulnerabilities.filter(vulnerability => versionSatisfiesRange(
    dependency.version,
    vulnerability.vulnerableVersionRange
  ))
}

/**
 * Whether the given version is in the given version range.
 *
 * @param {string} version - The version (e.g. '3.4.0')
 * @param {string} gitHubVulnerableVersionRange - A string indicating a version
 *     or range of versions.
 * @returns {boolean}
 */
const versionSatisfiesRange = (version, gitHubVulnerableVersionRange) => {
  /*
   * NOTE: GitHub's `vulnerableVersionRange` uses a comma to separate the two
   * version constraints of a range:
   * https://docs.github.com/en/free-pro-team@latest/graphql/reference/objects#securityvulnerability
   * 
   * However, npm's semver doesn't know what to do with that comma. Removing it
   * seems to result in a version range that npm's semver can understand.
   */
  const npmSemverRange = gitHubVulnerableVersionRange.replace(',', '')
  return semverSatisfies(version, npmSemverRange)
}

/**
 * Get the list of security vulnerabilities affecting a given GitHub organization's
 * repositories.
 *
 * @param {string} githubToken - A GitHub personal access token
 * @param {string} org - A GitHub organization's name
 * @param {string} versionsCsvUrl - (Optional:) The URL where we can retrieve a
 *     CSV file of the PHP versions used by various Docker images.
 * @returns {Promise<VulnerabilityWithRepo[]>}
 */
const getSecurityVulnerabilitiesForGitHubOrg = async (
  githubToken,
  org,
  versionsCsvUrl = ''
) => {
  console.log(`Scanning for vulnerabilities in GitHub org. ${org}`)
  const repos = await github.listRepos(githubToken, org)
  return getSecurityVulnerabilitiesForGitHubRepos(githubToken, repos, versionsCsvUrl)
}

/**
 * Get a list of security vulnerabilities affecting the specified GitHub repos.
 *
 * Only repos whose dependencies could be determined will be included.
 *
 * @param {string} githubToken - A GitHub personal access token
 * @param {string[]} repos - A list of repo names
 * @param {string} versionsCsvUrl - (Optional:) The URL where we can retrieve a
 *     CSV file of the PHP versions used by various Docker images.
 * @returns {Promise<VulnerabilityWithRepo[]>}
 */
const getSecurityVulnerabilitiesForGitHubRepos = async (
  githubToken,
  repos,
  versionsCsvUrl = ''
) => {
  const results = []
  for (const repo of repos) {
    const vulnerabilities = await getSecurityVulnerabilitiesForGitHubRepo(
      githubToken,
      repo,
      versionsCsvUrl
    )
    if (Array.isArray(vulnerabilities)) {
      results.push(...vulnerabilities)
    }
  }
  return results
}

/**
 * Get the security vulnerabilities for the specified GitHub repo. It will
 * return an array of vulnerabilities, or `undefined` if the GitHub repo's
 * dependencies could not be determined.
 *
 * NOTE: The data returned about each vulnerability will include a `repo` field
 * with given repo name.
 *
 * @param {string} githubToken - A GitHub personal access token
 * @param {string} repo - A GitHub repo (formatted as "owner/library")
 * @param {string} versionsCsvUrl - (Optional:) The URL where we can retrieve a
 *     CSV file of the PHP versions used by various Docker images.
 * @returns {Promise<undefined | VulnerabilityWithRepo[]>}
 */
const getSecurityVulnerabilitiesForGitHubRepo = async (
  githubToken,
  repo,
  versionsCsvUrl = ''
) => {
  console.log(`Looking for vulnerabilities in GitHub ${repo}`)
  let allVulnerabilities

  try {
    const javaScriptDependencies = await github.getJavaScriptDependenciesOfRepo(githubToken, repo)
    if (javaScriptDependencies === undefined) {
      console.log('(No JavaScript dependencies found)')
    } else {
      const javaScriptVulnerabilities = await getSecurityVulnerabilitiesForJavaScriptDependencies(
        githubToken,
        javaScriptDependencies
      )
      const javaScriptVulnerabilitiesWithRepo = javaScriptVulnerabilities.map(vulnerability => addRepoName(repo, vulnerability))
      allVulnerabilities = allVulnerabilities || []
      allVulnerabilities.push(...javaScriptVulnerabilitiesWithRepo)
    }

    const phpDependencies = await github.getPhpDependenciesOfRepo(githubToken, repo)
    if (phpDependencies === undefined) {
      console.log('(No PHP dependencies found)')
    } else {
      const phpVulnerabilities = await getSecurityVulnerabilitiesForPhpDependencies(
        githubToken,
        phpDependencies
      )
      const phpVulnerabilitiesWithRepo = phpVulnerabilities.map(vulnerability => addRepoName(repo, vulnerability))
      allVulnerabilities = allVulnerabilities || []
      allVulnerabilities.push(...phpVulnerabilitiesWithRepo)
    }

    if (versionsCsvUrl) {
      const nodeJsVersionVulnerabilities = await getNodeJsVersionVulnerabilitiesOfGitHubRepo(
        githubToken,
        repo,
        versionsCsvUrl
      )
      const nodeJsVersionVulnerabilitiesWithRepo = nodeJsVersionVulnerabilities.map(
        vulnerability => addRepoName(repo, vulnerability)
      )
      allVulnerabilities = allVulnerabilities || []
      allVulnerabilities.push(...nodeJsVersionVulnerabilitiesWithRepo)

      const phpVersionVulnerabilities = await getPhpVersionVulnerabilitiesOfGitHubRepo(
        githubToken,
        repo,
        versionsCsvUrl
      )
      const phpVersionVulnerabilitiesWithRepo = phpVersionVulnerabilities.map(
        vulnerability => addRepoName(repo, vulnerability)
      )
      allVulnerabilities = allVulnerabilities || []
      allVulnerabilities.push(...phpVersionVulnerabilitiesWithRepo)
    }
  } catch (error) {
    const currentDate = getHyphenatedDate()
    const failureToCheck = {
      detailsUrl: null,
      ecosystem: null,
      identifiers: [],
      inspectedOn: currentDate,
      packageName: null,
      repo,
      severity: 'HIGH',
      summary: `Failed to scan GitHub repo: ${error}`,
      vulnerableVersionRange: null
    }
    allVulnerabilities = allVulnerabilities || []
    allVulnerabilities.push(failureToCheck)
  }
  
  return allVulnerabilities
}

/**
 * Get any vulnerability related to the specified Docker image using a NodeJS
 * version that has reached End-Of-Life (EOL).
 *
 * @param dockerImage
 * @param versionsCsvUrl
 * @returns {Promise<undefined | Vulnerability>}
 */
const getNodeJsVersionEolVulnerability = async (dockerImage, versionsCsvUrl) => {
  const currentDate = getHyphenatedDate()
  const nodeJsVersion = await docker.getNodeJsVersionOfImageUsingCache(dockerImage, versionsCsvUrl)
  if (nodeJsVersion === 'NONE') {
    console.log(`(NodeJS is not used in ${dockerImage})`)
    return undefined
  } else if (nodeJsVersion === 'UNKNOWN') {
    const unknownDockerImageWarning = `No NodeJS version data found in spreadsheet for ${dockerImage}`
    console.warn(`WARNING: ${unknownDockerImageWarning}`)
    return {
      detailsUrl: homepageOfThisLibrary + '#Missing-Docker-image-values',
      ecosystem: null,
      identifiers: [],
      inspectedOn: currentDate,
      packageName: 'NodeJS',
      severity: 'LOW',
      summary: unknownDockerImageWarning,
      vulnerableVersionRange: null
    }
  }
  
  const isNodeJsVersionEOL = nodejs.isVersionEOL(nodeJsVersion, currentDate)
  if (isNodeJsVersionEOL === undefined) {
    const unknownNodeJsVersionWarning = `Unknown NodeJS version: ${nodeJsVersion}`
    console.warn(`WARNING: ${unknownNodeJsVersionWarning}`)
    return {
      detailsUrl: homepageOfThisLibrary + '#Unknown-NodeJS-versions',
      ecosystem: null,
      identifiers: [],
      inspectedOn: currentDate,
      packageName: 'NodeJS',
      severity: 'LOW',
      summary: unknownNodeJsVersionWarning,
      vulnerableVersionRange: null
    }
  } else if (isNodeJsVersionEOL === true) {
    const eolNodeJsVersionWarning = `${dockerImage} uses NodeJS ${nodeJsVersion}, which has reached End-Of-Life`
    console.log(eolNodeJsVersionWarning)
    return {
      detailsUrl: 'https://nodejs.org/en/about/releases/',
      ecosystem: null,
      identifiers: [],
      inspectedOn: currentDate,
      packageName: 'NodeJS',
      severity: 'HIGH',
      summary: eolNodeJsVersionWarning,
      vulnerableVersionRange: nodeJsVersion
    }
  }
  
  return undefined
}

/**
 * Report any use of an End-Of-Life'd (EOL'd) NodeJS version in the specified
 * Bitbucket repo.
 *
 * @param {string} bitbucketUsername - A Bitbucket username
 * @param {string} bitbucketAppPassword - A Bitbucket app password
 * @param {string} repo - A Bitbucket repo (formatted as "owner/library")
 * @param {string} versionsCsvUrl -- The URL where we can retrieve a CSV file of
 *     the NodeJS versions used by various Docker images.
 * @returns {Promise<Vulnerability[]>}
 */
const getNodeJsVersionVulnerabilitiesOfBitbucketRepo = async (
  bitbucketUsername,
  bitbucketAppPassword,
  repo,
  versionsCsvUrl
) => {
  console.log(`Checking NodeJS version(s) used in Bitbucket ${repo}`)
  
  const dockerImages = await bitbucket.getDockerBaseImagesOfRepo(
    bitbucketUsername,
    bitbucketAppPassword,
    repo
  )
  if (dockerImages.length < 1) {
    console.log(`(No Docker images specified in ${repo})`)
    return []
  }
  const vulnerabilities = await Promise.all(
    dockerImages.map(dockerImage => getNodeJsVersionEolVulnerability(dockerImage, versionsCsvUrl))
  )
  return vulnerabilities.filter(vulnerability => vulnerability !== undefined)
}

/**
 * Report any use of an End-Of-Life'd (EOL'd) NodeJS version in the specified
 * GitHub repo.
 *
 * @param {string} githubToken - A GitHub personal access token
 * @param {string} repo - A GitHub repo (formatted as "owner/library")
 * @param {string} versionsCsvUrl -- The URL where we can retrieve a CSV file of
 *     the NodeJS versions used by various Docker images.
 * @returns {Promise<Vulnerability[]>}
 */
const getNodeJsVersionVulnerabilitiesOfGitHubRepo = async (githubToken, repo, versionsCsvUrl) => {
  console.log(`Checking NodeJS version(s) used in GitHub ${repo}`)
  
  const dockerImages = await github.getDockerBaseImagesOfRepo(githubToken, repo)
  if (dockerImages.length < 1) {
    console.log(`(No Docker images specified in ${repo})`)
    return []
  }
  const vulnerabilities = await Promise.all(
    dockerImages.map(dockerImage => getNodeJsVersionEolVulnerability(dockerImage, versionsCsvUrl))
  )
  return vulnerabilities.filter(vulnerability => vulnerability !== undefined)
}

/**
 * Report any use of an End-Of-Life'd (EOL'd) PHP version in the specified
 * Bitbucket repo.
 *
 * @param {string} bitbucketUsername - A Bitbucket username
 * @param {string} bitbucketAppPassword - A Bitbucket app password
 * @param {string} repo - A Bitbucket repo (formatted as "owner/library")
 * @param {string} versionsCsvUrl -- The URL where we can retrieve a CSV file of
 *     the PHP versions used by various Docker images.
 * @returns {Promise<Vulnerability[]>}
 */
const getPhpVersionVulnerabilitiesOfBitbucketRepo = async (
  bitbucketUsername,
  bitbucketAppPassword,
  repo,
  versionsCsvUrl
) => {
  console.log(`Checking PHP version(s) used in Bitbucket ${repo}`)
  
  const dockerImages = await bitbucket.getDockerBaseImagesOfRepo(
    bitbucketUsername,
    bitbucketAppPassword,
    repo
  )
  if (dockerImages.length < 1) {
    console.log(`(No Docker images specified in ${repo})`)
    return []
  }
  const vulnerabilities = await Promise.all(
    dockerImages.map(dockerImage => getPhpVersionEolVulnerability(dockerImage, versionsCsvUrl))
  )
  return vulnerabilities.filter(vulnerability => vulnerability !== undefined)
}

/**
 * Report any use of an End-Of-Life'd (EOL'd) PHP version in the specified
 * Bitbucket repos.
 *
 * @param {string} bitbucketUsername - A Bitbucket username
 * @param {string} bitbucketAppPassword - A Bitbucket app password
 * @param {string[]} repos - The list of Bitbucket repos (e.g. ["owner/library"])
 * @param {string} versionsCsvUrl - (Optional:) The URL where we can retrieve a
 *     CSV file of the PHP versions used by various Docker images.
 * @returns {Promise<VulnerabilityWithRepo[]>}
 */
const getPhpVersionVulnerabilitiesOfBitbucketRepos = async (
  bitbucketUsername,
  bitbucketAppPassword,
  repos,
  versionsCsvUrl = ''
) => {
  const results = []
  for (const repo of repos) {
    const vulnerabilities = await getPhpVersionVulnerabilitiesOfBitbucketRepo(
      bitbucketUsername,
      bitbucketAppPassword,
      repo,
      versionsCsvUrl
    )
    const vulnerabilitiesWithRepo = vulnerabilities.map(
      vulnerability => addRepoName(repo, vulnerability)
    )
    results.push(...vulnerabilitiesWithRepo)
  }
  return results
}

/**
 * Report any use of an End-Of-Life'd (EOL'd) PHP version in the specified
 * Bitbucket workspace's repos.
 *
 * @param {string} bitbucketUsername - A Bitbucket username
 * @param {string} bitbucketAppPassword - A Bitbucket app password
 * @param {string} workspace - A Bitbucket workspace (aka organization)
 * @param {string} versionsCsvUrl - The URL where we can retrieve a CSV file of
 *     the PHP versions used by various Docker images.
 * @returns {Promise<VulnerabilityWithRepo[]>}
 */
const getPhpVersionVulnerabilitiesOfBitbucketWorkspace = async (
  bitbucketUsername,
  bitbucketAppPassword,
  workspace,
  versionsCsvUrl
) => {
  console.log(`Checking PHP version(s) used in Bitbucket workspace ${workspace}`)
  const repos = await bitbucket.listRepos(
    bitbucketUsername,
    bitbucketAppPassword,
    workspace
  )
  return getPhpVersionVulnerabilitiesOfBitbucketRepos(
    bitbucketUsername,
    bitbucketAppPassword,
    repos,
    versionsCsvUrl
  )
}

/**
 * Report any use of an End-Of-Life'd (EOL'd) PHP version in the specified
 * GitHub organization's repos.
 *
 * @param {string} githubToken - A GitHub personal access token
 * @param {string} org - A GitHub organization's name
 * @param {string} versionsCsvUrl - The URL where we can retrieve a CSV file of
 *     the PHP versions used by various Docker images.
 * @returns {Promise<VulnerabilityWithRepo[]>}
 */
const getPhpVersionVulnerabilitiesOfGitHubOrg = async (
  githubToken,
  org,
  versionsCsvUrl
) => {
  console.log(`Checking PHP version(s) used in GitHub org. ${org}`)
  const repos = await github.listRepos(githubToken, org)
  return getPhpVersionVulnerabilitiesOfGitHubRepos(githubToken, repos, versionsCsvUrl)
}

/**
 * Report any use of an End-Of-Life'd (EOL'd) PHP version in the specified
 * GitHub repo.
 *
 * @param {string} githubToken - A GitHub personal access token
 * @param {string} repo - A GitHub repo (formatted as "owner/library")
 * @param {string} versionsCsvUrl -- The URL where we can retrieve a CSV file of
 *     the PHP versions used by various Docker images.
 * @returns {Promise<Vulnerability[]>}
 */
const getPhpVersionVulnerabilitiesOfGitHubRepo = async (githubToken, repo, versionsCsvUrl) => {
  console.log(`Checking PHP version(s) used in GitHub ${repo}`)
  
  const dockerImages = await github.getDockerBaseImagesOfRepo(githubToken, repo)
  if (dockerImages.length < 1) {
    console.log(`(No Docker images specified in ${repo})`)
    return []
  }
  const vulnerabilities = await Promise.all(
    dockerImages.map(dockerImage => getPhpVersionEolVulnerability(dockerImage, versionsCsvUrl))
  )
  return vulnerabilities.filter(vulnerability => vulnerability !== undefined)
}

/**
 * Report any use of an End-Of-Life'd (EOL'd) PHP version in the specified
 * GitHub repos.
 *
 * @param {string} githubToken - A GitHub personal access token
 * @param {string[]} repos - A list of repo names
 * @param {string} versionsCsvUrl -- The URL where we can retrieve a CSV file of
 *     the PHP versions used by various Docker images.
 * @returns {Promise<VulnerabilityWithRepo[]>}
 */
const getPhpVersionVulnerabilitiesOfGitHubRepos = async (
  githubToken,
  repos,
  versionsCsvUrl
) => {
  const results = []
  for (const repo of repos) {
    const vulnerabilities = await getPhpVersionVulnerabilitiesOfGitHubRepo(
      githubToken,
      repo,
      versionsCsvUrl
    )
    const vulnerabilitiesWithRepo = vulnerabilities.map(
      vulnerability => addRepoName(repo, vulnerability)
    )
    results.push(...vulnerabilitiesWithRepo)
  }
  return results
}

/**
 * Get any vulnerability related to the specified Docker image using a PHP
 * version that has reached End-Of-Life (EOL).
 *
 * @param dockerImage
 * @param versionsCsvUrl
 * @returns {Promise<undefined | Vulnerability>}
 */
const getPhpVersionEolVulnerability = async (dockerImage, versionsCsvUrl) => {
  const currentDate = getHyphenatedDate()
  const phpVersion = await docker.getPhpVersionOfImageUsingCache(dockerImage, versionsCsvUrl)
  if (phpVersion === 'NONE') {
    console.log(`(PHP is not used in ${dockerImage})`)
    return undefined
  } else if (phpVersion === 'UNKNOWN') {
    const unknownDockerImageWarning = `No PHP version data found in spreadsheet for ${dockerImage}`
    console.warn(`WARNING: ${unknownDockerImageWarning}`)
    return {
      detailsUrl: homepageOfThisLibrary + '#Missing-Docker-image-values',
      ecosystem: null,
      identifiers: [],
      inspectedOn: currentDate,
      packageName: 'PHP',
      severity: 'LOW',
      summary: unknownDockerImageWarning,
      vulnerableVersionRange: null
    }
  }
  
  const isPhpVersionEOL = php.isVersionEOL(phpVersion, currentDate)
  if (isPhpVersionEOL === undefined) {
    const unknownPhpVersionWarning = `Unknown PHP version: ${phpVersion}`
    console.warn(`WARNING: ${unknownPhpVersionWarning}`)
    return {
      detailsUrl: homepageOfThisLibrary + '#Unknown-PHP-versions',
      ecosystem: null,
      identifiers: [],
      inspectedOn: currentDate,
      packageName: 'PHP',
      severity: 'LOW',
      summary: unknownPhpVersionWarning,
      vulnerableVersionRange: null
    }
  } else if (isPhpVersionEOL === true) {
    const eolPhpVersionWarning = `${dockerImage} uses PHP ${phpVersion}, which has reached End-Of-Life`
    console.log(eolPhpVersionWarning)
    return {
      detailsUrl: 'https://php.net/eol',
      ecosystem: null,
      identifiers: [],
      inspectedOn: currentDate,
      packageName: 'PHP',
      severity: 'HIGH',
      summary: eolPhpVersionWarning,
      vulnerableVersionRange: phpVersion
    }
  }
  
  return undefined
}

/**
 * Add the given repo name to the given Vulnerability data.
 *
 * @param {string} repo
 * @param {Vulnerability} vulnerability
 * @returns {VulnerabilityWithRepo}
 */
const addRepoName = (repo, vulnerability) => {
  // Return a new object instead of modifying the given object (which caused problems).
  return Object.assign({repo}, vulnerability)
}

/**
 * Get any published security vulnerabilities in the given list of JavaScript
 * dependencies.
 *
 * @param {string} githubToken - A GitHub personal access token
 * @param {Dependency[]} dependencies
 * @returns {Promise<Vulnerability[]>}
 */
const getSecurityVulnerabilitiesForJavaScriptDependencies = async (githubToken, dependencies) => {
  const results = []
  for (const dependency of dependencies) {
    console.log(`Checking ${dependency.name} [${dependency.version}]`)
    
    const vulnerabilities = await getSecurityVulnerabilitiesForJavaScriptDependency(
      githubToken,
      dependency
    )
    
    for (const vulnerability of vulnerabilities) {
      console.log(
        `! Found vulnerability: ${vulnerability.packageName} ${vulnerability.vulnerableVersionRange}`
      )
      results.push(vulnerability)
    }
  }
  
  return results
}

/**
 * Get any published security vulnerabilities in the given list of PHP
 * dependencies.
 *
 * @param {string} githubToken - A GitHub personal access token
 * @param {Dependency[]} dependencies
 * @returns {Promise<Vulnerability[]>}
 */
const getSecurityVulnerabilitiesForPhpDependencies = async (githubToken, dependencies) => {
  const results = []
  for (const dependency of dependencies) {
    console.log(`Checking ${dependency.name} [${dependency.version}]`)
    
    const vulnerabilities = await getSecurityVulnerabilitiesForPhpDependency(
      githubToken,
      dependency
    )
    
    for (const vulnerability of vulnerabilities) {
      console.log(
        `! Found vulnerability: ${vulnerability.packageName} ${vulnerability.vulnerableVersionRange}`
      )
      results.push(vulnerability)
    }
  }
  
  return results
}

module.exports = {
  convertToCsvString,
  getNodeJsVersionVulnerabilitiesOfBitbucketRepo,
  getNodeJsVersionVulnerabilitiesOfGitHubRepo,
  getPhpVersionVulnerabilitiesOfBitbucketRepo,
  getPhpVersionVulnerabilitiesOfBitbucketWorkspace,
  getPhpVersionVulnerabilitiesOfGitHubOrg,
  getPhpVersionVulnerabilitiesOfGitHubRepo,
  getSecurityVulnerabilitiesForBitbucketRepo,
  getSecurityVulnerabilitiesForBitbucketWorkspace,
  getSecurityVulnerabilitiesForGitHubOrg,
  getSecurityVulnerabilitiesForGitHubRepo,
  getSecurityVulnerabilitiesForMultiple,
}