diff --git a/.changeset/soft-buttons-bet.md b/.changeset/soft-buttons-bet.md new file mode 100644 index 00000000..668a445d --- /dev/null +++ b/.changeset/soft-buttons-bet.md @@ -0,0 +1,5 @@ +--- +"@nodesecure/scanner": minor +--- + +Add a new Extraction probe for vulnerabilities diff --git a/workspaces/scanner/src/extractors/probes/VulnerabilitiesExtractor.class.ts b/workspaces/scanner/src/extractors/probes/VulnerabilitiesExtractor.class.ts new file mode 100644 index 00000000..3fe824ec --- /dev/null +++ b/workspaces/scanner/src/extractors/probes/VulnerabilitiesExtractor.class.ts @@ -0,0 +1,35 @@ +// Import Third-party Dependencies +import type { StandardVulnerability } from "@nodesecure/vulnera"; + +// Import Internal Dependencies +import type { + PackumentProbeExtractor +} from "../payload.js"; +import type { Dependency } from "../../types.js"; + +export type VulnerabilitiesExtractorResult = { + vulnerabilities: StandardVulnerability[]; +}; + +export class VulnerabilitiesExtractor implements PackumentProbeExtractor { + level = "packument" as const; + + #vulnerabilities: StandardVulnerability[] = []; + + next( + _: string, + dependency: Dependency + ) { + const { vulnerabilities = [] } = dependency; + + this.#vulnerabilities.push( + ...vulnerabilities + ); + } + + done() { + return { + vulnerabilities: this.#vulnerabilities + }; + } +} diff --git a/workspaces/scanner/src/extractors/probes/index.ts b/workspaces/scanner/src/extractors/probes/index.ts index fbc01c08..d9771c76 100644 --- a/workspaces/scanner/src/extractors/probes/index.ts +++ b/workspaces/scanner/src/extractors/probes/index.ts @@ -2,3 +2,4 @@ export * from "./SizeExtractor.class.js"; export * from "./LicensesExtractor.class.js"; export * from "./ContactExtractor.class.js"; export * from "./WarningsExtractor.class.js"; +export * from "./VulnerabilitiesExtractor.class.js"; diff --git a/workspaces/scanner/test/extractors/payload.spec.ts b/workspaces/scanner/test/extractors/payload.spec.ts index cf349898..d790d71f 100644 --- a/workspaces/scanner/test/extractors/payload.spec.ts +++ b/workspaces/scanner/test/extractors/payload.spec.ts @@ -172,6 +172,37 @@ describe("Extractors.Probes", () => { }); }); + describe("VulnerabilitiesExtractor", () => { + it("should extract strnum warnings", () => { + const fakePayload: any = { + id: "random-id", + scannerVersion: "1.0.0", + dependencies: { + A: { + vulnerabilities: ["foo"] + }, + B: { + vulnerabilities: ["bar"] + } + } + }; + + const extractor = new Extractors.Payload( + fakePayload, + [ + new Extractors.Probes.VulnerabilitiesExtractor() + ] + ); + + const { + vulnerabilities + } = extractor.extractAndMerge(); + + assert.strictEqual(vulnerabilities.length, 2); + assert.deepEqual(vulnerabilities, ["foo", "bar"]); + }); + }); + it("should extract data with multiple extractors in once", () => { const extractor = new Extractors.Payload( expressNodesecurePayload,