-
-
Notifications
You must be signed in to change notification settings - Fork 5
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Signed-off-by: Jan Kowalleck <[email protected]>
- Loading branch information
1 parent
2590a22
commit cf2e4b4
Showing
4 changed files
with
125 additions
and
6 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,107 @@ | ||
| /*! | ||
| This file is part of CycloneDX SBOM plugin for yarn. | ||
| Licensed under the Apache License, Version 2.0 (the "License"); | ||
| you may not use this file except in compliance with the License. | ||
| You may obtain a copy of the License at | ||
| http://www.apache.org/licenses/LICENSE-2.0 | ||
| Unless required by applicable law or agreed to in writing, software | ||
| distributed under the License is distributed on an "AS IS" BASIS, | ||
| WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| See the License for the specific language governing permissions and | ||
| limitations under the License. | ||
| SPDX-License-Identifier: Apache-2.0 | ||
| Copyright (c) OWASP Foundation. All Rights Reserved. | ||
| */ | ||
|
|
||
| // import submodules so to prevent load of unused not-tree-shakable dependencies - like 'AJV' | ||
| import { type Locator, structUtils } from '@yarnpkg/core' | ||
| import { gitUtils as YarnPluginGitUtils } from '@yarnpkg/plugin-git' | ||
| import { githubUtils as YarnPluginGithubUtils } from '@yarnpkg/plugin-github' | ||
|
|
||
| import { isString } from './_helpers' | ||
|
|
||
| /** | ||
| * Scope is to detect package sources. | ||
| * But unlike the actual YarnResolvers, not resolve them, but find evidence for the actually used ones. | ||
| */ | ||
| export function getPackageSource (locator: Locator): URL | string | undefined { | ||
| for (const candidate of packageSourceCandidates) { | ||
| const source = candidate(locator) | ||
| if (source !== false && source !== undefined) { | ||
| return source | ||
| } | ||
| } | ||
| return undefined | ||
| } | ||
|
|
||
| type PackageSourceCandidate = (locator: Locator) => URL | string | false | undefined | ||
|
|
||
| const packageSourceCandidates: PackageSourceCandidate[] = [ | ||
| function /* workspace */ (locator: Locator): string | false | undefined { | ||
| if (!locator.reference.startsWith('workspace:')) { | ||
| return false | ||
| } | ||
| // TODO implement | ||
| // see https://github.com/yarnpkg/berry/tree/master/packages/plugin-file | ||
| return undefined | ||
| }, | ||
| function /* npm: */ (locator: Locator): string | false | undefined { | ||
| if (!locator.reference.startsWith('npm:')) { | ||
| return false | ||
| } | ||
| // see https://github.com/yarnpkg/berry/blob/bfa6489467e0e11ee87268e01e38e4f7e8d4d4b0/packages/plugin-npm/sources/NpmHttpFetcher.ts#L51 | ||
| const { params } = structUtils.parseRange(locator.reference) | ||
| if (params !== null && isString(params.__archiveUrl)) { | ||
| return params.__archiveUrl | ||
| } | ||
| // for range and remap there are no concrete evidence how the resolution was done on install-time. | ||
| // therefore, return undefined, for now ... | ||
| return undefined | ||
| }, | ||
| function /* github */ (locator: Locator): string | false { | ||
| if (!YarnPluginGithubUtils.isGithubUrl(locator.reference)) { | ||
| return false | ||
| } | ||
| // TODO sanitize & remove secrets | ||
| return locator.reference | ||
| }, | ||
| function /* git */ (locator: Locator): string | false { | ||
| if (!YarnPluginGitUtils.isGitUrl(locator.reference)) { | ||
| return false | ||
| } | ||
| // TODO sanitize & remove secrets | ||
| return locator.reference | ||
| }, | ||
| function /* https */ (locator: Locator): URL | false | undefined { | ||
| // see https://github.com/yarnpkg/berry/blob/bfa6489467e0e11ee87268e01e38e4f7e8d4d4b0/packages/plugin-http/sources/urlUtils.ts#L9 | ||
| if (!locator.reference.startsWith('http:') && !locator.reference.startsWith('https:')) { | ||
| return false | ||
| } | ||
| try { | ||
| // TODO sanitize & remove secrets | ||
| return new URL(locator.reference) | ||
| } catch { | ||
| return undefined // invalid URL | ||
| } | ||
| }, | ||
| function /* link | portal */ (locator: Locator): false | undefined { | ||
| if (!locator.reference.startsWith('link:') && !locator.reference.startsWith('portal:')) { | ||
| return false | ||
| } | ||
| // TODO: resolve path relative to current workspace | ||
| // see https://github.com/yarnpkg/berry/tree/master/packages/plugin-link | ||
| return undefined | ||
| }, | ||
| function /* file */ (locator: Locator): false | undefined { | ||
| if (!locator.reference.startsWith('file:')) { | ||
| return false | ||
| } | ||
| // TODO: resolve path relative to current workspace | ||
| // see https://github.com/yarnpkg/berry/tree/master/packages/plugin-file | ||
| return undefined | ||
| } | ||
| ] |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters