search

lirantal / lockfile-lint

Lint an npm or yarn lockfile to analyze and detect security issues
Apache License 2.0
781 stars 35 forks source link

fix: skip validating package names outside of public registries #171

Closed lirantal closed 1 year ago

lirantal commented 1 year ago

Description

Fix #112 - when packages are used from registries outside of the public ones (like artifactory and such) then they may include a different URL convention to locate the package name.

This PR fixes lockfile-lint showing an error because it is actually unable to match the package name to the URL. The fix is to skip these cases.

In the future we may treat this different, such as by allowing to specify a flag like package-name-url-prefixes where you can write https://checkmarx.jfrog.io/artifactory/api/npm/team-npm/ so that we parse everything after that to compare the package name for a match

Types of changes

Related Issue

112

codecov-commenter commented 1 year ago

Codecov Report

Patch coverage: 100.00% and project coverage change: +0.01% :tada:

Comparison is base (c7817c6) 97.83% compared to head (3294cb1) 97.85%. Report is 1 commits behind head on main.

Additional details and impacted files ```diff @@ Coverage Diff @@ ## main #171 +/- ## ========================================== + Coverage 97.83% 97.85% +0.01% ========================================== Files 13 13 Lines 370 373 +3 Branches 84 85 +1 ========================================== + Hits 362 365 +3 Misses 8 8 ``` | [Files Changed](https://app.codecov.io/gh/lirantal/lockfile-lint/pull/171?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Liran+Tal) | Coverage Δ | | |---|---|---| | [...le-lint-api/src/validators/ValidatePackageNames.js](https://app.codecov.io/gh/lirantal/lockfile-lint/pull/171?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Liran+Tal#diff-cGFja2FnZXMvbG9ja2ZpbGUtbGludC1hcGkvc3JjL3ZhbGlkYXRvcnMvVmFsaWRhdGVQYWNrYWdlTmFtZXMuanM=) | `100.00% <100.00%> (ø)` | |

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.

baruchiro commented 1 year ago

I can't see a new version for lockfile-lint, only for lockfile-lint-api...

lirantal commented 1 year ago

Correct, because the change was only on the API level and the lockfile-lint package will resolve to the latest minor version when you install it (if you already have it installed with a lockfile when require a lockfile-lint-api update).