vulnerability.ts

import get from 'lodash.get';

import { isJsonString, trimArray, shortenNodePath } from './common';
import { color, getSeverityBgColor } from './color';
import { printExceptionReport } from './print';
import { analyzeExpiry } from './date';

import {
  NpmAuditJson,
  v7VulnerabilityVia,
  ProcessedResult,
  ProcessedReport,
  v6Advisory,
  v7Vulnerability,
  NsprcConfigs,
  NsprcFile,
  AuditLevel,
  AuditNumber,
} from 'src/types';

const MAX_PATHS_SIZE = 5;

/**
 * Converts an audit level to a numeric value
 * @param  {String} auditLevel  Audit level
 * @return {Number}             Numeric level: the higher the number, the more severe it is
 */
export function mapLevelToNumber(auditLevel: AuditLevel | string): AuditNumber {
  switch (auditLevel) {
    case 'info':
      return 0;
    case 'low':
      return 1;
    case 'moderate':
      return 2;
    case 'high':
      return 3;
    case 'critical':
      return 4;
    default:
      return 0;
  }
}

/**
 * Validate if the vulnerability should be excepted
 * @param {Object}  vulnerability   NPM v6 audit report's vulnerability
 * @param {Array}   exceptionIds    Exception IDs
 * @return {Object}                 Validation result
 */
export function validateV6Vulnerability(
  vulnerability: v6Advisory,
  exceptionIds: string[],
): { isExcepted: boolean; usedExceptionKey: string } {
  return exceptionIds.reduce(
    (acc: { isExcepted: boolean; usedExceptionKey: string }, id) => {
      // check if ID matches
      if (id === String(vulnerability.id)) {
        return { isExcepted: true, usedExceptionKey: id };
      }
      // check if any of the CVEs matches
      if (Array.isArray(vulnerability.cves) && vulnerability.cves.includes(id)) {
        return { isExcepted: true, usedExceptionKey: id };
      }
      // check if the CWE matches
      if (vulnerability.cwe === id) {
        return { isExcepted: true, usedExceptionKey: id };
      }
      // check if the URL matches
      if (vulnerability.url && vulnerability.url.includes(id)) {
        return { isExcepted: true, usedExceptionKey: id };
      }
      return acc;
    },
    {
      isExcepted: false,
      usedExceptionKey: '',
    },
  );
}

/**
 * Validate if the vulnerability should be excepted
 * @param {Object}  vulnerability   NPM v7 audit report's vulnerability
 * @param {Array}   exceptionIds    Exception IDs
 * @return {Object}                 Validation result
 */
export function validateV7Vulnerability(
  vulnerability: v7VulnerabilityVia,
  exceptionIds: string[],
): { isExcepted: boolean; usedExceptionKey: string } {
  return exceptionIds.reduce(
    (acc: { isExcepted: boolean; usedExceptionKey: string }, id) => {
      // check if ID matches
      if (id === String(vulnerability.source)) {
        return { isExcepted: true, usedExceptionKey: id };
      }
      // check if the URL matches
      if (vulnerability.url && vulnerability.url.includes(id)) {
        return { isExcepted: true, usedExceptionKey: id };
      }
      return acc;
    },
    {
      isExcepted: false,
      usedExceptionKey: '',
    },
  );
}

/**
 * Analyze the JSON string buffer
 * @param  {String} jsonBuffer      NPM Audit JSON string buffer
 * @param  {String} auditLevel      User's target audit level
 * @param  {Array} exceptionIds     Exception IDs (ID to be ignored)
 * @param  {Array} exceptionModules Exception modules (modules to be ignored)
 * @param  {Array} columnsToInclude List of columns to include in audit results
 * @return {Object}                 Processed vulnerabilities details
 */
export function processAuditJson(
  jsonBuffer = '',
  auditLevel: AuditLevel = 'info',
  exceptionIds: string[] = [],
  exceptionModules: string[] = [],
  columnsToInclude: string[] = [],
): ProcessedResult {
  if (!isJsonString(jsonBuffer)) {
    return {
      unhandledIds: [],
      vulnerabilityIds: [],
      vulnerabilityModules: [],
      unusedExceptionIds: exceptionIds,
      unusedExceptionModules: exceptionModules,
      report: [],
      failed: true,
    };
  }

  // NPM v6 uses `advisories`
  // NPM v7 uses `vulnerabilities`
  // Refer to the `test/__mocks__` folder for some sample mockups
  const { advisories, vulnerabilities }: NpmAuditJson = JSON.parse(jsonBuffer);

  // NPM v6 handling
  if (advisories) {
    return Object.values(advisories).reduce(
      (acc: ProcessedResult, cur: v6Advisory) => {
        const shouldAudit = mapLevelToNumber(cur.severity) >= mapLevelToNumber(auditLevel);
        const { isExcepted: isIdExcepted, usedExceptionKey } = validateV6Vulnerability(cur, exceptionIds);
        const isModuleExcepted = exceptionModules.includes(cur.module_name);
        const isExcepted = isIdExcepted || isModuleExcepted;

        // Record used exception ID/module
        if (isIdExcepted) {
          acc.unusedExceptionIds = acc.unusedExceptionIds.filter((id) => id !== usedExceptionKey);
        }
        if (isModuleExcepted) {
          acc.unusedExceptionModules = acc.unusedExceptionModules.filter((module) => module !== cur.module_name);
        }

        const rowData = [
          { key: 'ID', value: cur.id.toString() },
          { key: 'Module', value: cur.module_name },
          { key: 'Title', value: cur.title },
          {
            key: 'Paths',
            value: trimArray(
              cur.findings.reduce((a, c) => [...a, ...c.paths] as [], []),
              MAX_PATHS_SIZE,
            ).join('\n'),
          },
          { key: 'Severity', value: cur.severity },
          { key: 'URL', value: cur.url },
          { key: 'Ex.', value: isExcepted ? 'y' : 'n' },
        ]
          .filter(({ key }) => (columnsToInclude.length ? columnsToInclude.includes(key) : true))
          .map(({ key, value }) =>
            color(value, isExcepted ? '' : 'yellow', key === 'Severity' ? getSeverityBgColor(cur.severity) : undefined),
          );

        // Record this vulnerability into the report, and highlight it using yellow color if it's new
        acc.report.push(rowData);

        acc.vulnerabilityIds.push(cur.id.toString());
        if (!acc.vulnerabilityModules.includes(cur.module_name)) {
          acc.vulnerabilityModules.push(cur.module_name);
        }

        // Found unhandled vulnerabilities
        if (shouldAudit && !isExcepted) {
          acc.unhandledIds.push(cur.id.toString());
        }

        return acc;
      },
      {
        unhandledIds: [],
        vulnerabilityIds: [],
        vulnerabilityModules: [],
        unusedExceptionIds: exceptionIds,
        unusedExceptionModules: exceptionModules,
        report: [],
      },
    );
  }

  // NPM v7 handling
  if (vulnerabilities) {
    return Object.values(vulnerabilities).reduce(
      (acc: ProcessedResult, cur: v7Vulnerability | string) => {
        // Inside `via` array, its either the related module name or the vulnerability source object.
        get(cur, 'via', []).forEach((vul: v7VulnerabilityVia | string) => {
          // The vulnerability ID is labeled as `source`
          const id = get(vul, 'source');
          const moduleName = get(vul, 'name', '');

          // Let's skip if ID is a string (module name), and only focus on the root vulnerabilities
          if (!id || typeof id === 'string' || typeof vul === 'string') {
            return;
          }

          const shouldAudit = mapLevelToNumber(vul.severity) >= mapLevelToNumber(auditLevel);
          const { isExcepted: isIdExcepted, usedExceptionKey } = validateV7Vulnerability(vul, exceptionIds);
          const isModuleExcepted = exceptionModules.includes(moduleName);
          const isExcepted = isIdExcepted || isModuleExcepted;

          // Record used exception ID/module
          if (isIdExcepted) {
            acc.unusedExceptionIds = acc.unusedExceptionIds.filter((id) => id !== usedExceptionKey);
          }
          if (isModuleExcepted) {
            acc.unusedExceptionModules = acc.unusedExceptionModules.filter((module) => module !== moduleName);
          }

          const rowData = [
            { key: 'ID', value: String(id) },
            { key: 'Module', value: vul.name },
            { key: 'Title', value: vul.title },
            { key: 'Paths', value: trimArray(get(cur, 'nodes', []).map(shortenNodePath), MAX_PATHS_SIZE).join('\n') },
            { key: 'Severity', value: vul.severity, bgColor: getSeverityBgColor(vul.severity) },
            { key: 'URL', value: vul.url },
            { key: 'Ex.', value: isExcepted ? 'y' : 'n' },
          ]
            .filter(({ key }) => (columnsToInclude.length ? columnsToInclude.includes(key) : true))
            .map(({ key, value, bgColor }) => color(value, isExcepted ? '' : 'yellow', key === 'Severity' ? bgColor : undefined));

          // Record this vulnerability into the report, and highlight it using yellow color if it's new
          acc.report.push(rowData);

          acc.vulnerabilityIds.push(String(id));
          if (!acc.vulnerabilityModules.includes(moduleName)) {
            acc.vulnerabilityModules.push(moduleName);
          }

          // Found unhandled vulnerabilities
          if (shouldAudit && !isExcepted) {
            acc.unhandledIds.push(String(id));
          }
        });

        return acc;
      },
      {
        unhandledIds: [],
        vulnerabilityIds: [],
        vulnerabilityModules: [],
        unusedExceptionIds: exceptionIds,
        unusedExceptionModules: exceptionModules,
        report: [],
      },
    );
  }
  return {
    unhandledIds: [],
    vulnerabilityIds: [],
    vulnerabilityModules: [],
    unusedExceptionIds: exceptionIds,
    unusedExceptionModules: exceptionModules,
    report: [],
    failed: true,
  };
}

/**
 * Process all exceptions and return a list of exception IDs
 * @param  {Object | Boolean} nsprc           File content from `.nsprc`
 * @param  {Array}            cmdExceptions   Exceptions passed in via command line
 * @return {Array}                            List of found vulnerabilities
 */
export function getExceptionsIds(nsprc?: NsprcFile | boolean, cmdExceptions: string[] = []): string[] {
  // If file does not exists
  if (!nsprc || typeof nsprc !== 'object') {
    // If there are exceptions passed in from command line
    if (cmdExceptions.length) {
      // Display simple info
      console.info(`Exception IDs: ${cmdExceptions.join(', ')}`);
      return cmdExceptions;
    }

    return [];
  }

  // Process the content of the file along with the command line exceptions
  const { exceptionIds, report } = processExceptions(nsprc, cmdExceptions);

  printExceptionReport(report);

  return exceptionIds;
}

/**
 * Filter the given list in the `.nsprc` file for valid exceptions
 * @param  {Object} nsprc           The nsprc file content, contains exception info
 * @param  {Array}  cmdExceptions   Exceptions passed in via command line
 * @return {Object}                 Processed vulnerabilities details
 */
export function processExceptions(nsprc: NsprcFile, cmdExceptions: string[] = []): ProcessedReport {
  return Object.entries(nsprc).reduce(
    (acc: ProcessedReport, [id, details]: [string, string | NsprcConfigs]) => {
      const isActive = Boolean(get(details, 'active', true)); // default to true
      const notes = typeof details === 'string' ? details : get(details, 'notes', '');
      const { valid, expired, years } = analyzeExpiry(get(details, 'expiry'));

      // Color the status accordingly
      let status = color('active', 'green');
      if (expired) {
        status = color('expired', 'red');
      } else if (!valid) {
        status = color('invalid', 'red');
      } else if (!isActive) {
        status = color('inactive', 'yellow');
      }

      // Color the date accordingly
      let expiryDate = get(details, 'expiry') ? new Date(get(details, 'expiry')).toUTCString() : '';
      // If it was expired for more than 5 years ago, warn by coloring the date in red
      if (years && years <= -5) {
        expiryDate = color(expiryDate, 'red');
      } else if (years && years <= -1) {
        expiryDate = color(expiryDate, 'yellow');
      }

      acc.report.push([id, status, expiryDate, notes]);

      if (isActive && !expired) {
        acc.exceptionIds.push(id);
      }

      return acc;
    },
    {
      exceptionIds: cmdExceptions,
      report: cmdExceptions.map((id) => [String(id), color('active', 'green'), '', '']),
    },
  );
}

/**
 * Handle unused exceptions from user: console log them
 * @param {Array} unusedExceptionIds      List of unused exception IDs
 * @param {Array} unusedExceptionModules  List of unused exception module names
 */
export function handleUnusedExceptions(unusedExceptionIds: string[], unusedExceptionModules: string[]): void {
  const cleanedUnusedExceptionIds = unusedExceptionIds.filter(Boolean);
  const cleanedUnusedExceptionModules = unusedExceptionModules.filter(Boolean);
  const message = [
    cleanedUnusedExceptionIds.length &&
      `${
        cleanedUnusedExceptionIds.length
      } of the excluded vulnerabilities did not match any of the found vulnerabilities: ${cleanedUnusedExceptionIds.join(', ')}.`,
    cleanedUnusedExceptionIds.length &&
      `${cleanedUnusedExceptionIds.length > 1 ? 'They' : 'It'} can be removed from the .nsprc file or --exclude -x flags.`,
    cleanedUnusedExceptionModules.length &&
      `${
        cleanedUnusedExceptionModules.length
      } of the ignored modules did not match any of the found vulnerabilities: ${cleanedUnusedExceptionModules.join(', ')}.`,
    cleanedUnusedExceptionModules.length &&
      `${cleanedUnusedExceptionModules.length > 1 ? 'They' : 'It'} can be removed from the --module-ignore -m flags.`,
  ]
    .filter(Boolean)
    .join(' ');

  if (message) {
    console.warn(message);
  }
}