Close #615: Include vulnerability repos in JSON and CycloneDX output

Author: eoftedal

chrome/extension/js/generated/retire-chrome.js

@@ -10871,7 +10871,7 @@ var retirechrome = (() => {
     "../../node/lib/retire.js"(exports) {
       "use strict";
       var exports = exports || {};
-      exports.version = "5.4.3";
+      exports.version = "5.5.0";
       function isDefined(o) {
         return typeof o !== "undefined";
       }

node/lib/retire.js

@@ -4,7 +4,7 @@
  */
 
 var exports = exports || {};
-exports.version = '5.4.3';
+exports.version = '5.5.0';
 
 function isDefined(o) {
   return typeof o !== 'undefined';

node/package-lock.json

@@ -2,7 +2,7 @@
   "author": "Erlend Oftedal <erlend@oftedal.no>",
   "name": "retire",
   "description": "Retire is a tool for detecting use of vulnerable libraries",
-  "version": "5.4.3",
+  "version": "5.5.0",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",

node/package.json

@@ -36,7 +36,7 @@ const loggerOptions: LoggerOptions = {
   colors: false,
   path: '.',
   colorwarn: () => '',
-  jsRepo: 'testrepo.json',
+  jsRepo: ['testrepo.json'],
 };
 
 describe('cyclonedx-json', () => {
@@ -61,6 +61,9 @@ describe('cyclonedx-json', () => {
     assert.strictEqual(res.valid, true);
     assert.strictEqual(output.bomFormat, 'CycloneDX');
     assert.strictEqual(output.specVersion, '1.4');
+    assert.deepStrictEqual(output.metadata.properties, [
+      { name: 'retirejs:vulnerability-repository', value: 'testrepo.json' },
+    ]);
   });
 
   it('should validate report according to schema 1.6', () => {
@@ -85,6 +88,37 @@ describe('cyclonedx-json', () => {
     assert.strictEqual(output.bomFormat, 'CycloneDX');
     assert.strictEqual(output.specVersion, '1.6');
     assert.strictEqual(output.components[0].evidence.occurrences[0].location, relative);
+    assert.deepStrictEqual(output.metadata.properties, [
+      { name: 'retirejs:vulnerability-repository', value: 'testrepo.json' },
+    ]);
+  });
+
+  it('should validate VEX report according to schema 1.6', () => {
+    const data: unknown[] = [];
+    const writer: Writer = {
+      out: (a) => data.push(a),
+      err: (a) => data.push(a),
+      close: () => undefined,
+    };
+    const vexOptions: LoggerOptions = { ...loggerOptions, outputformat: 'cyclonedxJSON1_6_VEX' };
+    const logger = reporting.open(vexOptions);
+    jsonLogger1_6.configure(logger, writer, vexOptions, hash);
+    const result1 = retire.scanFileContent('/*! jQuery v1.8.1 asdasd ', repo, hash);
+    result1[0].licenses = ['MIT'];
+    logger.logVulnerableDependency({ results: result1, file: jqFile });
+    logger.close();
+    const validator = new Validator();
+    validator.addSchema(jsfSchema, 'jsf-0.82.schema.json#/definitions/signature');
+    const output = JSON.parse(data.join(''));
+    const res = validator.validate(output, jsonSchema1_6);
+    assert.strictEqual(res.valid, true, res.errors.join('\n'));
+    assert.ok(output.vulnerabilities.length > 0);
+    const vulnerability = output.vulnerabilities[0];
+    assert.deepStrictEqual(vulnerability.source, { name: 'Retire.js', url: 'testrepo.json' });
+    assert.deepStrictEqual(vulnerability.ratings[0].source, { name: 'Retire.js', url: 'testrepo.json' });
+    assert.strictEqual(vulnerability.affects[0].ref, 'pkg:npm/jquery@1.8.1');
+    assert.strictEqual(vulnerability.affects[0].versions[0].status, 'affected');
+    assert.ok(vulnerability.affects[0].versions[0].range.startsWith('vers:npm/'));
   });
 
   /*it('should validate report according to xml schema', async () => {

node/spec/tests/cyclonedx.spec.ts

@@ -83,7 +83,7 @@ const scanpath = prg.path ?? prg.jspath ?? '.';
 const log = reporting.open({
   colors: !!prg.colors,
   colorwarn,
-  jsRepo: jsrepolocation.join(', '),
+  jsRepo: jsrepolocation,
   outputformat: prg.outputformat,
   outputpath: prg.outputpath,
   path: scanpath,

node/src/cli.ts

@@ -3,7 +3,7 @@ import { ConfigurableLogger, Hasher, Logger, LoggerOptions, Writer } from '../re
 import * as retire from '../retire';
 import * as fs from 'fs';
 import { Finding, Vulnerability } from '../types';
-import { generatePURL } from './utils';
+import { generatePURL, vulnerabilityRepositories } from './utils';
 import * as path from 'path';
 import * as crypto from 'crypto';
 
@@ -38,19 +38,21 @@ function configureCycloneDXJSONLogger(logger: Logger, writer: Writer, config: Lo
       occurrences: Array<{ location: string }>;
     };
   };
+  type VulnerabilitySource = { name: string; url?: string };
   type Vulnerability = {
     id: string;
+    source: VulnerabilitySource;
     cwes: number[];
     description?: string;
     advisories: Array<{ url: string; title?: string; }>;
     references: Array<{ id: string; source: { name: string; url: string } }>;
     ratings: Array<{
-      source: string;
+      source: VulnerabilitySource;
       severity: string;
     }>;
     affects: Array<{
       ref: string;
-      range: string;
+      versions: Array<{ range: string; status: 'affected' }>;
     }>;
   };
 
@@ -60,6 +62,12 @@ function configureCycloneDXJSONLogger(logger: Logger, writer: Writer, config: Lo
     const seen = new Map<string, Component>();
     const vulnerabilitiesCyclone = new Map<string, Vulnerability>();
     const includeVEX = config.outputformat === 'cyclonedxJSON1_6_VEX';
+    const repositories = vulnerabilityRepositories(config.jsRepo);
+    // Only attributable to a single URL when exactly one repository was used
+    const retireSource: VulnerabilitySource = {
+      name: 'Retire.js',
+      url: repositories.length === 1 ? repositories[0] : undefined,
+    };
 
     const components = finalResults.data
       .filter((d) => d.results)
@@ -101,23 +109,29 @@ function configureCycloneDXJSONLogger(logger: Logger, writer: Writer, config: Lo
                   const { references, advisories } = mapUrls(vuln);
                   vulnerabilitiesCyclone.set(id, {
                     id,
+                    source: retireSource,
                     cwes: vuln.cwe.map((c) => parseInt(c.split("-")[1])),
                     description: vuln.identifiers.summary,
                     advisories: advisories,
                     references: references,
                     ratings: [
                       {
-                        source: 'Retire.js',
+                        source: retireSource,
                         severity: vuln.severity,
                       },
                     ],
                     affects: [],
                   });
                 }
-                vulnerabilitiesCyclone.get(id)!.affects.push({ 
+                vulnerabilitiesCyclone.get(id)!.affects.push({
                   ref: bomRef,
-                  // "vers:npm/1.2.3|>=2.0.0|<5.0.0"
-                  range: "vers:npm/" + (vuln.atOrAbove ? ">=" + vuln.atOrAbove + "|" : "") + "<" + vuln.below,
+                  versions: [
+                    {
+                      // "vers:npm/1.2.3|>=2.0.0|<5.0.0"
+                      range: 'vers:npm/' + (vuln.atOrAbove ? '>=' + vuln.atOrAbove + '|' : '') + '<' + vuln.below,
+                      status: 'affected',
+                    },
+                  ],
                 });
               });
             });
@@ -154,6 +168,12 @@ function configureCycloneDXJSONLogger(logger: Logger, writer: Writer, config: Lo
                 version: retire.version,
               },
             ],
+            properties: repositories.length
+              ? repositories.map((repo) => ({
+                  name: 'retirejs:vulnerability-repository',
+                  value: repo,
+                }))
+              : undefined,
           },
           components: components,
           vulnerabilities: includeVEX ? Array.from(vulnerabilitiesCyclone.values()) : undefined,

node/src/reporters/cyclonedx-1_6-json.ts

@@ -3,7 +3,7 @@ import { ConfigurableLogger, Hasher, Logger, LoggerOptions, Writer } from '../re
 import * as retire from '../retire';
 import * as fs from 'fs';
 import { Finding } from '../types';
-import { generatePURL } from './utils';
+import { generatePURL, vulnerabilityRepositories } from './utils';
 import * as path from 'path';
 import * as crypto from 'crypto';
 
@@ -39,6 +39,7 @@ function configureCycloneDXJSONLogger(logger: Logger, writer: Writer, config: Lo
 
   logger.close = function (callback) {
     const write = vulnsFound ? writer.err : writer.out;
+    const repositories = vulnerabilityRepositories(config.jsRepo);
     const seen = new Map<string, Component>();
     const components = finalResults.data
       .filter((d) => d.results)
@@ -100,6 +101,12 @@ function configureCycloneDXJSONLogger(logger: Logger, writer: Writer, config: Lo
                 version: retire.version,
               },
             ],
+            properties: repositories.length
+              ? repositories.map((repo) => ({
+                  name: 'retirejs:vulnerability-repository',
+                  value: repo,
+                }))
+              : undefined,
           },
           components: components,
         },

node/src/reporters/cyclonedx-json.ts

@@ -5,7 +5,7 @@ import { ConfigurableLogger, Hasher, Logger, LoggerOptions, Writer } from '../re
 import * as retire from '../retire';
 import * as fs from 'fs';
 import { Finding } from '../types';
-import { generatePURL } from './utils';
+import { generatePURL, vulnerabilityRepositories } from './utils';
 import * as crypto from 'crypto';
 
 function configureCycloneDXLogger(logger: Logger, writer: Writer, config: LoggerOptions, hash: Hasher) {
@@ -36,6 +36,12 @@ function configureCycloneDXLogger(logger: Logger, writer: Writer, config: Logger
 
   logger.close = function (callback) {
     const write = vulnsFound ? writer.err : writer.out;
+    const repositories = vulnerabilityRepositories(config.jsRepo)
+      .map(
+        (repo) => `
+      <property name="retirejs:vulnerability-repository">${escapeXml(repo)}</property>`,
+      )
+      .join('');
     const seen = new Set<string>();
     const components = finalResults.data
       .filter((d) => d.results.length > 0)
@@ -81,7 +87,9 @@ function configureCycloneDXLogger(logger: Logger, writer: Writer, config: Logger
             <name>retire.js</name>
             <version>${retire.version}</version>
         </tool>
-    </tools>
+    </tools>${repositories ? `
+    <properties>${repositories}
+    </properties>` : ''}
   </metadata>
   <components>${components}
   </components>
@@ -90,6 +98,14 @@ function configureCycloneDXLogger(logger: Logger, writer: Writer, config: Logger
   };
 }
 
+function escapeXml(value: string) {
+  return value
+    .replace(/&/g, '&amp;')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;');
+}
+
 function mapLicenses(licenses: string[] | undefined) {
   if (!licenses) return '';
   if (licenses.length == 0) return '';

node/src/reporters/cyclonedx.ts

@@ -3,6 +3,7 @@
 import { ConfigurableLogger } from '../reporting';
 
 import * as retire from '../retire';
+import { vulnerabilityRepositories } from './utils';
 
 export default {
   configure: (logger, writer, config) => {
@@ -14,6 +15,7 @@ export default {
       messages: [] as unknown[],
       errors: [] as unknown[],
       time: undefined as undefined | number,
+      vulnerabilityRepositories: vulnerabilityRepositories(config.jsRepo),
     };
     logger.info = finalResults.messages.push;
     logger.debug = config.verbose