search

RafaelGSS / is-my-node-vulnerable

package that checks if your Node.js installation is vulnerable to known security vulnerabilities
MIT License
180 stars 6 forks source link

feat: added platform validation #12

Closed UlisesGascon closed 1 year ago

UlisesGascon commented 1 year ago

Main changes

Notes

@RafaelGSS I added some additional cognitive points to the getVulnerabilityList function and it is not easy to test with the current files structure. Should I move getVulnerabilityList and getSystemEnvironment to a utility file so I can include proper Unit Tests?

Context

This PR is related to https://github.com/nodejs/security-wg/pull/912, https://github.com/nodejs/security-wg/pull/914 and close #9

UlisesGascon commented 1 year ago

I added specific tests in https://github.com/RafaelGSS/is-my-node-vulnerable/pull/12/commits/b4f87da36df91376b019c3297eebcebd9884b8ed

UlisesGascon commented 1 year ago

@RafaelGSS I updated the docs in 60fa37b. The argument platform is optional in the Github Action, and it can be specified by the user. Only when the execution is made by npx as executable the platform is provided by default os.platform().

I believe this is not a breaking change at all, so this can be the v1.3.0.

UlisesGascon commented 1 year ago

The tests are failing until https://github.com/nodejs/security-wg/pull/916 got merged as the index is using an old version of the database that used [linux, win, macos] values and not the ones compatible with os.platform() as agreed in https://github.com/nodejs/security-wg/pull/914