RetireJS / retire.js

scanner detecting the use of JavaScript libraries with known vulnerabilities. Can also generate an SBOM of the libraries it finds.
https://retirejs.github.io/retire.js/
Other
3.66k stars 414 forks source link

Extend AngularJS filecontent regex to match contents of 1.8.0 AngularJS #426

Closed rossturner closed 8 months ago

rossturner commented 9 months ago

retire.js is not currently recognising AngularJS 1.8.0 and potentially other versions.

The first filecontent regular expression is as follows: /\*[ \n]+AngularJS v(§§version§§)

This matches https://code.angularjs.org/1.8.0/angular.min.js because the comment at the top of the file is

/*
 AngularJS v1.8.0
 (c) 2010-2020 Google, Inc. http://angularjs.org
 License: MIT
*/

However, https://code.angularjs.org/1.8.0/angular.js has a header of

/**
 * @license AngularJS v1.8.0
 * (c) 2010-2020 Google, Inc. http://angularjs.org
 * License: MIT
 */

Which does not match against the current implementation of the regex. This PR adds an optional non-capturing group of "@license " as a prefix to cover this case.

eoftedal commented 8 months ago

Would you mind adding a test case to https://github.com/RetireJS/retire.js/blob/master/repository/testcases.json ? You can run the tests for a specific library by running: ./test-detection.js angularjs

Basically you would add something like:

"angularjs": {
    "https://code.angularjs.org/§§version§§/angular§§subversion§§.js": {
      "versions": ["1.8.0"],
      "subversions": ["", ".min"]
    }
}
eoftedal commented 8 months ago

I think your fix doesn't take into account the extra * on the second line.

rossturner commented 8 months ago

Ah good points thanks, I'll look at those

rossturner commented 8 months ago

@eoftedal Thanks for pointing out the tests that I'd missed, can confirm that the additional test cases fail for AngularJS >= 1.7.0 with the old implementation, and pass with the changes in this PR

eoftedal commented 8 months ago

Thank you for the fix!