lirantal / lockfile-lint

Lint an npm or yarn lockfile to analyze and detect security issues
Apache License 2.0
781 stars 35 forks source link

fix(validators): skip packages with no resolved field #43

Closed richsilv closed 4 years ago

richsilv commented 4 years ago

Prevent URL-based validators (Host, Scheme or HTTPS) throwing errors when no resolved field exists for the package.

fix #42

Description

ValidateHost, ValidateHttps and ValidateScheme are updated to skip validation for any packages which don't have a resolved field in the lock-file.

Types of changes

Related Issue

https://github.com/lirantal/lockfile-lint/issues/42

Motivation and Context

Some package entries have no resolved field, for example those installed from the local filesystem. For these packages, protocol, scheme and host validation should be skipped completely as there is no external source to check, but the validators are currently trying to parse a non-existent URL which results in a validation failure.

How Has This Been Tested?

New tests added to the validateHost, validateHttps and validateScheme specs to reflect the expected behaviour; tests failed before changes, and pass afterwards.

Screenshots (if appropriate):

Checklist:

Baby-Goose-Gosling-10

codecov-io commented 4 years ago

Codecov Report

Merging #43 into master will increase coverage by 0.06%. The diff coverage is 100%.

Impacted file tree graph

@@            Coverage Diff             @@
##           master      #43      +/-   ##
==========================================
+ Coverage   97.81%   97.88%   +0.06%     
==========================================
  Files          11       11              
  Lines         183      189       +6     
  Branches       26       29       +3     
==========================================
+ Hits          179      185       +6     
  Misses          4        4
Impacted Files Coverage Δ
.../lockfile-lint-api/src/validators/ValidateHttps.js 100% <100%> (ø) :arrow_up:
...lockfile-lint-api/src/validators/ValidateScheme.js 100% <100%> (ø) :arrow_up:
...s/lockfile-lint-api/src/validators/ValidateHost.js 100% <100%> (ø) :arrow_up:

Continue to review full report at Codecov.

Legend - Click here to learn more Δ = absolute <relative> (impact), ø = not affected, ? = missing data Powered by Codecov. Last update 6c86dfc...3307c59. Read the comment docs.

lirantal commented 4 years ago

Great job Richard 👏 Thanks for sending this over, I'll go ahead and merge.

I was thinking of a possible refactor but even regardless to that, I think a documentation update could work well here to explain the change. Would you want to send a new PR to update the README with the tables for validators and include a disclaimer about this change?

richsilv commented 4 years ago

Yes, that makes sense. I'll PR later today. Thanks!