FM / lib

/usr/lib/node_modules/npm/lib

Name	Size	Mode	Actions
auth/	-	0755	rm
config/	-	0755	rm
doctor/	-	0755	rm
install/	-	0755	rm
search/	-	0755	rm
utils/	-	0755	rm
access.js	5672	0644	edit dl rm
adduser.js	1337	0644	edit dl rm
audit.js	10811	0644	edit dl rm
bin.js	515	0644	edit dl rm
bugs.js	864	0644	edit dl rm
build.js	4545	0644	edit dl rm
cache.js	4773	0644	edit dl rm
ci.js	1341	0644	edit dl rm
completion.js	7278	0644	edit dl rm
config.js	7612	0644	edit dl rm
dedupe.js	4999	0644	edit dl rm
deprecate.js	2157	0644	edit dl rm
dist-tag.js	4204	0644	edit dl rm
docs.js	1063	0644	edit dl rm
doctor.js	4075	0644	edit dl rm
edit.js	1407	0644	edit dl rm
explore.js	1709	0644	edit dl rm
fetch-package-metadata.js	4064	0644	edit dl rm
fund.js	5026	0644	edit dl rm
get.js	235	0644	edit dl rm
help-search.js	5777	0644	edit dl rm
help.js	6507	0644	edit dl rm
hook.js	4727	0644	edit dl rm
init.js	2805	0644	edit dl rm
install-ci-test.js	486	0644	edit dl rm
install-test.js	507	0644	edit dl rm
install.js	37345	0644	edit dl rm
link.js	5739	0644	edit dl rm
logout.js	1289	0644	edit dl rm
ls.js	16480	0644	edit dl rm
npm.js	14719	0644	edit dl rm
org.js	4276	0644	edit dl rm
outdated.js	12572	0644	edit dl rm
owner.js	6754	0644	edit dl rm
pack.js	12068	0644	edit dl rm
ping.js	1141	0644	edit dl rm
prefix.js	330	0644	edit dl rm
profile.js	11401	0644	edit dl rm
prune.js	2281	0644	edit dl rm
publish.js	5264	0644	edit dl rm
rebuild.js	2143	0644	edit dl rm
repo.js	1471	0644	edit dl rm
restart.js	64	0644	edit dl rm
root.js	320	0644	edit dl rm
run-script.js	5540	0644	edit dl rm
search.js	3442	0644	edit dl rm
set.js	276	0644	edit dl rm
shrinkwrap.js	10056	0644	edit dl rm
star.js	2157	0644	edit dl rm
stars.js	1054	0644	edit dl rm
start.js	62	0644	edit dl rm
stop.js	61	0644	edit dl rm
substack.js	509	0644	edit dl rm
team.js	4724	0644	edit dl rm
test.js	374	0644	edit dl rm
token.js	6818	0644	edit dl rm
unbuild.js	4374	0644	edit dl rm
uninstall.js	2261	0644	edit dl rm
unpublish.js	3594	0644	edit dl rm
update.js	2213	0644	edit dl rm
version.js	10029	0644	edit dl rm
view.js	15473	0644	edit dl rm
visnup.js	4104	0644	edit dl rm
whoami.js	1809	0644	edit dl rm
xmas.js	1663	0644	edit dl rm

Edit: /usr/lib/node_modules/npm/lib/audit.js (10811B)

'use strict'

const Bluebird = require('bluebird')

const audit = require('./install/audit.js')
const figgyPudding = require('figgy-pudding')
const fs = require('graceful-fs')
const Installer = require('./install.js').Installer
const lockVerify = require('lock-verify')
const log = require('npmlog')
const npa = require('libnpm/parse-arg')
const npm = require('./npm.js')
const npmConfig = require('./config/figgy-config.js')
const output = require('./utils/output.js')
const parseJson = require('json-parse-better-errors')

const readFile = Bluebird.promisify(fs.readFile)

const AuditConfig = figgyPudding({
  also: {},
  'audit-level': {},
  deepArgs: 'deep-args',
  'deep-args': {},
  dev: {},
  force: {},
  'dry-run': {},
  global: {},
  json: {},
  only: {},
  parseable: {},
  prod: {},
  production: {},
  registry: {},
  runId: {}
})

module.exports = auditCmd

auditCmd.completion = function (opts, cb) {
  const argv = opts.conf.argv.remain

switch (argv[2]) {
    case 'audit':
      return cb(null, [])
    default:
      return cb(new Error(argv[2] + ' not recognized'))
  }
}

class Auditor extends Installer {
  constructor (where, dryrun, args, opts) {
    super(where, dryrun, args, opts)
    this.deepArgs = (opts && opts.deepArgs) || []
    this.runId = opts.runId || ''
    this.audit = false
  }

loadAllDepsIntoIdealTree (cb) {
    Bluebird.fromNode(cb => super.loadAllDepsIntoIdealTree(cb)).then(() => {
      if (this.deepArgs && this.deepArgs.length) {
        this.deepArgs.forEach(arg => {
          arg.reduce((acc, child, ii) => {
            if (!acc) {
              // We might not always be able to find `target` through the given
              // path. If we can't we'll just ignore it.
              return
            }
            const spec = npa(child)
            const target = (
              acc.requires.find(n => n.package.name === spec.name) ||
              acc.requires.find(
                n => audit.scrub(n.package.name, this.runId) === spec.name
              )
            )
            if (target && ii === arg.length - 1) {
              target.loaded = false
              // This kills `hasModernMeta()` and forces a re-fetch
              target.package = {
                name: spec.name,
                version: spec.fetchSpec,
                _requested: target.package._requested
              }
              delete target.fakeChild
              let parent = target.parent
              while (parent) {
                parent.loaded = false
                parent = parent.parent
              }
              target.requiredBy.forEach(par => {
                par.loaded = false
                delete par.fakeChild
              })
            }
            return target
          }, this.idealTree)
        })
        return Bluebird.fromNode(cb => super.loadAllDepsIntoIdealTree(cb))
      }
    }).nodeify(cb)
  }

// no top level lifecycles on audit
  runPreinstallTopLevelLifecycles (cb) { cb() }
  runPostinstallTopLevelLifecycles (cb) { cb() }
}

function maybeReadFile (name) {
  const file = `${npm.prefix}/${name}`
  return readFile(file)
    .then((data) => {
      try {
        return parseJson(data)
      } catch (ex) {
        ex.code = 'EJSONPARSE'
        throw ex
      }
    })
    .catch({code: 'ENOENT'}, () => null)
    .catch((ex) => {
      ex.file = file
      throw ex
    })
}

function filterEnv (action, opts) {
  const includeDev = opts.dev ||
    (!/^prod(uction)?$/.test(opts.only) && !opts.production) ||
    /^dev(elopment)?$/.test(opts.only) ||
    /^dev(elopment)?$/.test(opts.also)
  const includeProd = !/^dev(elopment)?$/.test(opts.only)
  const resolves = action.resolves.filter(({dev}) => {
    return (dev && includeDev) || (!dev && includeProd)
  })
  if (resolves.length) {
    return Object.assign({}, action, {resolves})
  }
}

function auditCmd (args, cb) {
  const opts = AuditConfig(npmConfig())
  if (opts.global) {
    const err = new Error('`npm audit` does not support testing globals')
    err.code = 'EAUDITGLOBAL'
    throw err
  }
  if (args.length && args[0] !== 'fix') {
    return cb(new Error('Invalid audit subcommand: `' + args[0] + '`\n\nUsage:\n' + auditCmd.usage))
  }
  return Bluebird.all([
    maybeReadFile('npm-shrinkwrap.json'),
    maybeReadFile('package-lock.json'),
    maybeReadFile('package.json')
  ]).spread((shrinkwrap, lockfile, pkgJson) => {
    const sw = shrinkwrap || lockfile
    if (!pkgJson) {
      const err = new Error('No package.json found: Cannot audit a project without a package.json')
      err.code = 'EAUDITNOPJSON'
      throw err
    }
    if (!sw) {
      const err = new Error('Neither npm-shrinkwrap.json nor package-lock.json found: Cannot audit a project without a lockfile')
      err.code = 'EAUDITNOLOCK'
      throw err
    } else if (shrinkwrap && lockfile) {
      log.warn('audit', 'Both npm-shrinkwrap.json and package-lock.json exist, using npm-shrinkwrap.json.')
    }
    const requires = Object.assign(
      {},
      (pkgJson && pkgJson.dependencies) || {},
      (!opts.production && pkgJson && pkgJson.devDependencies) || {}
    )
    return lockVerify(npm.prefix).then((result) => {
      if (result.status) return audit.generate(sw, requires)

const lockFile = shrinkwrap ? 'npm-shrinkwrap.json' : 'package-lock.json'
      const err = new Error(`Errors were found in your ${lockFile}, run  npm install  to fix them.\n    ` +
        result.errors.join('\n    '))
      err.code = 'ELOCKVERIFY'
      throw err
    })
  }).then((auditReport) => {
    return audit.submitForFullReport(auditReport)
  }).catch((err) => {
    if (err.statusCode >= 400) {
      let msg
      if (err.statusCode === 401) {
        msg = `Either your login credentials are invalid or your registry (${opts.registry}) does not support audit.`
      } else if (err.statusCode === 404) {
        msg = `Your configured registry (${opts.registry}) does not support audit requests.`
      } else {
        msg = `Your configured registry (${opts.registry}) may not support audit requests, or the audit endpoint may be temporarily unavailable.`
      }
      if (err.body.length) {
        msg += '\nThe server said: ' + err.body
      }
      const ne = new Error(msg)
      ne.code = 'ENOAUDIT'
      ne.wrapped = err
      throw ne
    }
    throw err
  }).then((auditResult) => {
    if (args[0] === 'fix') {
      const actions = (auditResult.actions || []).reduce((acc, action) => {
        action = filterEnv(action, opts)
        if (!action) { return acc }
        if (action.isMajor) {
          acc.major.add(`${action.module}@${action.target}`)
          action.resolves.forEach(({id, path}) => acc.majorFixes.add(`${id}::${path}`))
        } else if (action.action === 'install') {
          acc.install.add(`${action.module}@${action.target}`)
          action.resolves.forEach(({id, path}) => acc.installFixes.add(`${id}::${path}`))
        } else if (action.action === 'update') {
          const name = action.module
          const version = action.target
          action.resolves.forEach(vuln => {
            acc.updateFixes.add(`${vuln.id}::${vuln.path}`)
            const modPath = vuln.path.split('>')
            const newPath = modPath.slice(
              0, modPath.indexOf(name)
            ).concat(`${name}@${version}`)
            if (newPath.length === 1) {
              acc.install.add(newPath[0])
            } else {
              acc.update.add(newPath.join('>'))
            }
          })
        } else if (action.action === 'review') {
          action.resolves.forEach(({id, path}) => acc.review.add(`${id}::${path}`))
        }
        return acc
      }, {
        install: new Set(),
        installFixes: new Set(),
        update: new Set(),
        updateFixes: new Set(),
        major: new Set(),
        majorFixes: new Set(),
        review: new Set()
      })
      return Bluebird.try(() => {
        const installMajor = opts.force
        const installCount = actions.install.size + (installMajor ? actions.major.size : 0) + actions.update.size
        const vulnFixCount = new Set([...actions.installFixes, ...actions.updateFixes, ...(installMajor ? actions.majorFixes : [])]).size
        const metavuln = auditResult.metadata.vulnerabilities
        const total = Object.keys(metavuln).reduce((acc, key) => acc + metavuln[key], 0)
        if (installCount) {
          log.verbose(
            'audit',
            'installing',
            [...actions.install, ...(installMajor ? actions.major : []), ...actions.update]
          )
        }
        return Bluebird.fromNode(cb => {
          new Auditor(
            npm.prefix,
            !!opts['dry-run'],
            [...actions.install, ...(installMajor ? actions.major : [])],
            opts.concat({
              runId: auditResult.runId,
              deepArgs: [...actions.update].map(u => u.split('>'))
            }).toJSON()
          ).run(cb)
        }).then(() => {
          const numScanned = auditResult.metadata.totalDependencies
          if (!opts.json && !opts.parseable) {
            output(`fixed ${vulnFixCount} of ${total} vulnerabilit${total === 1 ? 'y' : 'ies'} in ${numScanned} scanned package${numScanned === 1 ? '' : 's'}`)
            if (actions.review.size) {
              output(`  ${actions.review.size} vulnerabilit${actions.review.size === 1 ? 'y' : 'ies'} required manual review and could not be updated`)
            }
            if (actions.major.size) {
              output(`  ${actions.major.size} package update${actions.major.size === 1 ? '' : 's'} for ${actions.majorFixes.size} vulnerabilit${actions.majorFixes.size === 1 ? 'y' : 'ies'} involved breaking changes`)
              if (installMajor) {
                output('  (installed due to `--force` option)')
              } else {
                output('  (use `npm audit fix --force` to install breaking changes;' +
                       ' or refer to `npm audit` for steps to fix these manually)')
              }
            }
          }
        })
      })
    } else {
      const levels = ['low', 'moderate', 'high', 'critical']
      const minLevel = levels.indexOf(opts['audit-level'])
      const vulns = levels.reduce((count, level, i) => {
        return i < minLevel ? count : count + (auditResult.metadata.vulnerabilities[level] || 0)
      }, 0)
      if (vulns > 0) process.exitCode = 1
      if (opts.parseable) {
        return audit.printParseableReport(auditResult)
      } else {
        return audit.printFullReport(auditResult)
      }
    }
  }).asCallback(cb)
}

cmd: