import fs from 'node:fs' ; import { dirname , join , resolve } from 'node:path' ; import { fileURLToPath } from 'node:url' ; import { format , parse , parseAuditReport } from '../../main/ts/lockfile/v1' ; const __dirname = dirname ( fileURLToPath ( import . meta . url ) ) ; const fixtures = resolve ( __dirname , '../fixtures' ) ; describe ( 'parseReport' , ( ) => { it ( 'processes \\n-separated chunks' , ( ) => { const input = `{"type":"auditAdvisory","data":{"resolution":{"id":1693,"path":"microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss-svgo>postcss","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"8.2.1","paths":["microbundle>postcss"]},{"version":"7.0.35","paths":["microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>css-declaration-sorter>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>cssnano-util-raw-cache>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss-calc>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss-colormin>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss-convert-values>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss-discard-comments>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss-discard-duplicates>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss-discard-empty>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss-discard-overridden>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss-merge-longhand>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss-merge-longhand>stylehacks>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss-merge-rules>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss-minify-font-values>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss-minify-gradients>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss-minify-params>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss-minify-selectors>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss-normalize-charset>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss-normalize-display-values>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss-normalize-positions>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss-normalize-repeat-style>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss-normalize-string>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss-normalize-timing-functions>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss-normalize-unicode>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss-normalize-url>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss-normalize-whitespace>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss-ordered-values>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss-reduce-initial>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss-reduce-transforms>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss-svgo>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss-unique-selectors>postcss","microbundle>rollup-plugin-postcss>cssnano>postcss"]}],"id":1693,"created":"2021-05-10T15:38:31.238Z","updated":"2021-05-10T15:44:02.027Z","deleted":null,"title":"Regular Expression Denial of Service","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"postcss","cves":["CVE-2021-23368"],"vulnerable_versions":">=7.0.0 <8.2.10","patched_versions":">=8.2.10","overview":"\`postcss\` from 7.0.0 and before 8.2.10 are vulnerable to Regular Expression Denial of Service (ReDoS) during source map parsing.","recommendation":"Upgrade to version 8.2.10 or later","references":"- [CVE](https://nvd.nist.gov/vuln/detail/CVE-2021-23368)\\n- [GitHub Advisory](https://github.com/advisories/GHSA-hwj9-h5mp-3pm3)\\n","access":"public","severity":"moderate","cwe":"CWE-400","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/1693"}}}
{"type":"auditAdvisory","data":{"resolution":{"id":1693,"path":"microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss-unique-selectors>postcss","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"8.2.1","paths":["microbundle>postcss"]},{"version":"7.0.35","paths":["microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>css-declaration-sorter>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>cssnano-util-raw-cache>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss-calc>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss-colormin>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss-convert-values>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss-discard-comments>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss-discard-duplicates>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss-discard-empty>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss-discard-overridden>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss-merge-longhand>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss-merge-longhand>stylehacks>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss-merge-rules>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss-minify-font-values>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss-minify-gradients>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss-minify-params>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss-minify-selectors>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss-normalize-charset>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss-normalize-display-values>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss-normalize-positions>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss-normalize-repeat-style>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss-normalize-string>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss-normalize-timing-functions>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss-normalize-unicode>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss-normalize-url>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss-normalize-whitespace>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss-ordered-values>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss-reduce-initial>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss-reduce-transforms>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss-svgo>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss-unique-selectors>postcss","microbundle>rollup-plugin-postcss>cssnano>postcss"]}],"id":1693,"created":"2021-05-10T15:38:31.238Z","updated":"2021-05-10T15:44:02.027Z","deleted":null,"title":"Regular Expression Denial of Service","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"postcss","cves":["CVE-2021-23368"],"vulnerable_versions":">=7.0.0 <8.2.10","patched_versions":">=8.2.10","overview":"\`postcss\` from 7.0.0 and before 8.2.10 are vulnerable to Regular Expression Denial of Service (ReDoS) during source map parsing.","recommendation":"Upgrade to version 8.2.10 or later","references":"- [CVE](https://nvd.nist.gov/vuln/detail/CVE-2021-23368)\\n- [GitHub Advisory](https://github.com/advisories/GHSA-hwj9-h5mp-3pm3)\\n","access":"public","severity":"moderate","cwe":"CWE-400","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/1693"}}}
{"type":"auditAdvisory","data":{"resolution":{"id":1693,"path":"microbundle>rollup-plugin-postcss>cssnano>postcss","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"8.2.1","paths":["microbundle>postcss"]},{"version":"7.0.35","paths":["microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>css-declaration-sorter>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>cssnano-util-raw-cache>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss-calc>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss-colormin>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss-convert-values>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss-discard-comments>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss-discard-duplicates>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss-discard-empty>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss-discard-overridden>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss-merge-longhand>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss-merge-longhand>stylehacks>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss-merge-rules>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss-minify-font-values>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss-minify-gradients>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss-minify-params>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss-minify-selectors>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss-normalize-charset>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss-normalize-display-values>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss-normalize-positions>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss-normalize-repeat-style>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss-normalize-string>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss-normalize-timing-functions>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss-normalize-unicode>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss-normalize-url>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss-normalize-whitespace>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss-ordered-values>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss-reduce-initial>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss-reduce-transforms>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss-svgo>postcss","microbundle>rollup-plugin-postcss>cssnano>cssnano-preset-default>postcss-unique-selectors>postcss","microbundle>rollup-plugin-postcss>cssnano>postcss"]}],"id":1693,"created":"2021-05-10T15:38:31.238Z","updated":"2021-05-10T15:44:02.027Z","deleted":null,"title":"Regular Expression Denial of Service","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"postcss","cves":["CVE-2021-23368"],"vulnerable_versions":">=7.0.0 <8.2.10","patched_versions":">=8.2.10","overview":"\`postcss\` from 7.0.0 and before 8.2.10 are vulnerable to Regular Expression Denial of Service (ReDoS) during source map parsing.","recommendation":"Upgrade to version 8.2.10 or later","references":"- [CVE](https://nvd.nist.gov/vuln/detail/CVE-2021-23368)\\n- [GitHub Advisory](https://github.com/advisories/GHSA-hwj9-h5mp-3pm3)\\n","access":"public","severity":"moderate","cwe":"CWE-400","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/1693"}}}
{"type":"auditSummary","data":{"vulnerabilities":{"info":0,"low":0,"moderate":64,"high":0,"critical":0},"dependencies":1378,"devDependencies":0,"optionalDependencies":0,"totalDependencies":1378}}
` ; expect ( parseAuditReport ( input ) ) . toEqual ( { postcss : { module_name : 'postcss' , patched_versions : '>=8.2.10' , vulnerable_versions : '>=7.0.0 <8.2.10' , } , } ) ; } ) ; } ) ; describe ( 'reader' , ( ) => { it ( 'provides parse/format interop' , ( ) => { const contents = fs . readFileSync ( join ( fixtures , 'lockfile/v1/yarn.lock' ) , 'utf-8' ) ; expect ( format ( parse ( contents ) ) ) . toEqual ( contents ) ; } ) ; } ) ;