lirantal / lockfile-lint

Lint an npm or yarn lockfile to analyze and detect security issues
Apache License 2.0
781 stars 35 forks source link

#9 More verbose error messages: include package name #13

Closed emimuresan closed 4 years ago

emimuresan commented 4 years ago

Description

Provide more verbose information - which includes the package name - on errors encountered during validation. In order to solve this I created a custom error type called PackageError which prints out the package name as well as the original error message and stacktrace. It is used in validators.

Types of changes

Related Issue

9

Motivation and Context

More informative error message.

How Has This Been Tested?

Added a test-case for each validator. Based on mocked packages containing a bad url these test cases assert that PackageError was thrown.

Screenshots (if appropriate):

Example output:

$ lockfile-lint -p bad-yarn.lock --allowed-hosts yarn --validate-https -t yarn
ABORTING lockfile lint process due to error exceptions 

Encountered error Invalid URL: /registry.yarnpkg.com/debug/-/debug-4.1.1.tgz#3b72260255109c6b589cee050f1d516139664791 in package: "debug@^4.1.1" 

TypeError [ERR_INVALID_URL]: Invalid URL: /registry.yarnpkg.com/debug/-/debug-4.1.1.tgz#3b72260255109c6b589cee050f1d516139664791
    at onParseError (internal/url.js:241:17)
    at new URL (internal/url.js:319:5)
    at ValidateHost.validate ...

error: command failed with exit code 1

Checklist:

cat

codecov-io commented 4 years ago

Codecov Report

Merging #13 into master will increase coverage by 0.48%. The diff coverage is 100%.

Impacted file tree graph

@@            Coverage Diff            @@
##           master     #13      +/-   ##
=========================================
+ Coverage   95.62%   96.1%   +0.48%     
=========================================
  Files           8       9       +1     
  Lines         137     154      +17     
  Branches       20      21       +1     
=========================================
+ Hits          131     148      +17     
  Misses          6       6
Impacted Files Coverage Δ
...kages/lockfile-lint-api/src/common/PackageError.js 100% <100%> (ø)
.../lockfile-lint-api/src/validators/ValidateHttps.js 100% <100%> (ø) :arrow_up:
...lockfile-lint-api/src/validators/ValidateScheme.js 94.73% <100%> (+1.4%) :arrow_up:
...s/lockfile-lint-api/src/validators/ValidateHost.js 100% <100%> (ø) :arrow_up:

Continue to review full report at Codecov.

Legend - Click here to learn more Δ = absolute <relative> (impact), ø = not affected, ? = missing data Powered by Codecov. Last update 76a5b3c...ffd5291. Read the comment docs.

lirantal commented 4 years ago

Great job @emimuresan, looks fantastic! ✨ I will merge this in and also open a couple more issues that reviewing this brought up and you're welcome to give them a stab as well if you'd like.