refactor: use Packages for v9

aquasecurity · knqyf263 · May 21, 2024 · May 3, 2024 · May 3, 2024 · May 3, 2024
commit eca7312d2baf441b3618334c5e8dfb1a4fa24b0a
@@ -2,12 +2,12 @@
 
 import (
 	"fmt"
+	"golang.org/x/exp/maps"
 	"sort"
 	"strconv"
 	"strings"
 
 	"github.com/samber/lo"
-	"golang.org/x/exp/maps"
 	"golang.org/x/xerrors"
 	"gopkg.in/yaml.v3"
 
@@ -147,67 +147,74 @@
 
 func (p *Parser) parseV9(lockFile LockFile) ([]types.Library, []types.Dependency) {
 	resolvedLibs := make(map[string]types.Library)
-	resolvedDeps := make(map[string][]string)
+	resolvedDeps := make(map[string]types.Dependency)
 
 	directDeps := make(map[string]any)
 	for n, d := range lo.Assign(lockFile.Importers.Root.DevDependencies, lockFile.Importers.Root.Dependencies) {
-		name, version := p.parseDepPath(packageID(n, d.Version), v6VersionSep)
-		directDeps[packageID(name, version)] = struct{}{}
+		directDeps[packageID(n, d.Version)] = struct{}{}
 	}
 
-	// Check all snapshots to get a list of resolved libraries and dependencies.
+	// Check all snapshots and save with resolved versions
+	resolvedSnapshots := make(map[string][]string)
 	for depPath, snapshot := range lockFile.Snapshots {
-		// snapshots use unresolved strings
-		// e.g. `debug@4.3.4(supports-color@8.1.1):`
-		resolvedSnapshotName, resolvedSnapshotVersion := p.parseDepPath(depPath, v6VersionSep)
+		name, version := p.parseDepPath(depPath, v6VersionSep)
 
-		id := packageID(resolvedSnapshotName, resolvedSnapshotVersion)
+		var dependsOn []string
+		for depName, depVer := range lo.Assign(snapshot.OptionalDependencies, snapshot.Dependencies) {
+			resolvedDepName, resolvedDepVer := p.parseDepPath(packageID(depName, depVer), v6VersionSep)
+			id := packageID(resolvedDepName, resolvedDepVer)
+			if _, ok := lockFile.Packages[id]; ok {
+				dependsOn = append(dependsOn, id)
+			}
+		}
+		if dependsOn != nil {
+			sort.Strings(dependsOn)
+			resolvedSnapshots[packageID(name, version)] = dependsOn
+		}
+
+	}
+
+	for depPath, pkgInfo := range lockFile.Packages {
+		name, version, _ := strings.Cut(depPath, v6VersionSep)
+
+		// Remove versions for local packages/archives
+		if strings.HasPrefix(version, "file:") {
+			version = ""
+		}
+
+		if pkgInfo.Version != "" {
+			version = pkgInfo.Version
+		}
+
+		// Save lib
+		id := packageID(name, version)
 		resolvedLibs[id] = types.Library{
 			ID:           id,
-			Name:         resolvedSnapshotName,
-			Version:      resolvedSnapshotVersion,
+			Name:         name,
+			Version:      version,
 			Relationship: lo.Ternary(isDirectLib(id, directDeps), types.RelationshipDirect, types.RelationshipIndirect),
 			Dev:          true, // Mark all libs as Dev. We will update this later.
 		}
 
-		var dependsOn []string
-		for name, ver := range lo.Assign(snapshot.OptionalDependencies, snapshot.Dependencies) {
-			// Dependency can be unresolved
-			// e.g. dependencies:
-			//        debug: 4.3.4(supports-color@8.1.1)
-			snapshotID := packageID(name, ver)
-			resolvedDepName, resolvedDepVersion := p.parseDepPath(snapshotID, v6VersionSep)
-			// Don't include dependencies if `snapshots` don't contain them.
-			// e.g. `snapshots` contain optional deps.
-			// But peer deps are also marked as optional, but `snapshots` don't contain them.
-			if _, ok := lockFile.Snapshots[snapshotID]; ok {
-				dependsOn = append(dependsOn, packageID(resolvedDepName, resolvedDepVersion))
+		//Check child deps
+		if dependsOn, ok := resolvedSnapshots[id]; ok {
+			resolvedDeps[id] = types.Dependency{
+				ID:        id,
+				DependsOn: dependsOn,
 			}
 		}
-		if dependsOn != nil {
-			sort.Strings(dependsOn)
-			resolvedDeps[id] = dependsOn
-		}
 	}
 
 	// Overwrite the Dev field for root and their child dependencies.
 	for n, d := range lockFile.Importers.Root.Dependencies {
 		p.markRootLibs(packageID(n, d.Version), resolvedLibs, resolvedDeps)
 	}
 
-	deps := lo.MapToSlice(resolvedDeps, func(id string, dependsOn []string) types.Dependency {
-		return types.Dependency{
-			ID:        id,
-			DependsOn: dependsOn,
-		}
-	})
-
-	libs := maps.Values(resolvedLibs)
-	return libs, deps
+	return maps.Values(resolvedLibs), maps.Values(resolvedDeps)
 }
 
 // markRootLibs sets `Dev` to false for non dev dependency.
-func (p *Parser) markRootLibs(id string, libs map[string]types.Library, deps map[string][]string) {
+func (p *Parser) markRootLibs(id string, libs map[string]types.Library, deps map[string]types.Dependency) {
 	lib, ok := libs[id]
 	if !ok {
 		return
@@ -217,7 +224,7 @@
 	libs[id] = lib
 
 	// Update child deps
-	for _, depID := range deps[id] {
+	for _, depID := range deps[id].DependsOn {
 		p.markRootLibs(depID, libs, deps)
 	}
 	return
@@ -292,7 +299,7 @@
 	if _, err := semver.Parse(version); err != nil {
 		p.logger.Debug("Skip non-semver package", log.String("pkg_path", depPath),
 			log.String("version", version), log.Err(err))
-		return "", ""
+		return name, ""
 	}
 	return name, version
 }

@@ -8,12 +8,27 @@ importers:
 
   .:
     dependencies:
+      '@babel/parser':
+        specifier: ^7.24.5
+        version: 7.24.5
+      debug:
+        specifier: https://github.com/debug-js/debug/tarball/4.3.4
+        version: https://github.com/debug-js/debug/tarball/4.3.4
       finalhandler:
         specifier: 1.1.1
         version: 1.1.1
+      is-negative:
+        specifier: https://codeload.github.com/zkochan/is-negative/tar.gz/2fa0531ab04e300a24ef4fd7fb3a280eccb7ccc5
+        version: https://codeload.github.com/zkochan/is-negative/tar.gz/2fa0531ab04e300a24ef4fd7fb3a280eccb7ccc5
+      lodash:
+        specifier: file:foo/bar/lodash.tgz
+        version: file:foo/bar/lodash.tgz
       on-finished:
         specifier: 2.3.0
         version: 2.3.0
+      package1:
+        specifier: file:package1
+        version: file:package1
       promise:
         specifier: 8.1.0
         version: 8.1.0
@@ -27,9 +42,16 @@ importers:
 
 packages:
 
+  '@babel/helper-string-parser@7.24.1':
+    resolution: {integrity: sha512-2ofRCjnnA9y+wk8b9IAREroeUP02KHp431N2mhKniy2yKIDKpbrHv9eXwm8cBeWQYcJmzv5qKCu65P47eCF7CQ==}
+    engines: {node: '>=6.9.0'}
+
   asap@2.0.6:
     resolution: {integrity: sha512-BSHWgDSAiKs50o2Re8ppvp3seVHXSRM44cdSsT9FfNEUUZLOGWVCsiWaRPWM1Znn+mqZ1OfVZ3z3DWEzSp7hRA==}
 
+  asynckit@0.4.0:
+    resolution: {integrity: sha512-Oei9OH4tRh0YqU3GxhX79dM/mwVgvbZJaSNaRk+bshkj0S5cfHcgYakreBjrHwatXKbz+IoIdYLxrKim2MjW0Q==}
+
   debug@4.3.4:
     resolution: {integrity: sha512-PRWFHuSU3eDtQJPvnNY7Jcket1j0t5OuOsFzPPzsekD52Zl8qUfFIPEiswXqIvHWGVHOgX+7G/vCNNhehwxfkQ==}
     engines: {node: '>=6.0'}
@@ -39,6 +61,16 @@ packages:
       supports-color:
         optional: true
 
+  debug@https://github.com/debug-js/debug/tarball/4.3.4:
+    resolution: {tarball: https://github.com/debug-js/debug/tarball/4.3.4}
+    version: 4.3.4
+    engines: {node: '>=6.0'}
+    peerDependencies:
+      supports-color: '*'
+    peerDependenciesMeta:
+      supports-color:
+        optional: true
+
   ee-first@1.1.1:
     resolution: {integrity: sha512-WMwm9LhRUo+WUaRN+vRuETqG89IgZphVSNkdFgeb6sS/E4OrDIN7t48CAewSHXc6C8lefD8KKfr5vY61brQlow==}
 
@@ -53,16 +85,31 @@ packages:
     resolution: {integrity: sha512-Y1GUDo39ez4aHAw7MysnUD5JzYX+WaIj8I57kO3aEPT1fFRL4sr7mjei97FgnwhAyyzRYmQZaTHb2+9uZ1dPtg==}
     engines: {node: '>= 0.8'}
 
+  is-negative@https://codeload.github.com/zkochan/is-negative/tar.gz/2fa0531ab04e300a24ef4fd7fb3a280eccb7ccc5:
+    resolution: {tarball: https://codeload.github.com/zkochan/is-negative/tar.gz/2fa0531ab04e300a24ef4fd7fb3a280eccb7ccc5}
+    version: 2.0.1
+    engines: {node: '>=0.10.0'}
+
   jquery@3.6.0:
     resolution: {integrity: sha512-JVzAR/AjBvVt2BmYhxRCSYysDsPcssdmTFnzyLEts9qNwmjmu4JTAMYubEfwVOSwpQ1I1sKKFcxhZCI2buerfw==}
 
+  lodash@file:foo/bar/lodash.tgz:
+    resolution: {integrity: sha512-D2TlgcJ2ZQKKj4HVqOFkR+QETqRCXu+TCyxy7qH5QhxuJXCulHzBqmz4WrHA5Fs5ryY5RJYUqw2JBnbzveCtlA==, tarball: file:foo/bar/lodash.tgz}
+    version: 4.17.21
+
   ms@2.0.0:
     resolution: {integrity: sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A==}
 
+  ms@2.1.2:
+    resolution: {integrity: sha512-sGkPx+VjMtmA6MX27oA4FBFELFCZZ4S4XqeGOXCv68tT+jb3vk/RyaKWP0PTKyWtmLSM0b+adUTEvbs1PEaH2w==}
+
   on-finished@2.3.0:
     resolution: {integrity: sha512-ikqdkGAAyf/X/gPhXGvfgAytDZtDbr+bkNUJ0N9h5MI/dmdgCs3l6hoHrcUv41sRKew3jIwrp4qQDXiK99Utww==}
     engines: {node: '>= 0.8'}
 
+  package1@file:package1:
+    resolution: {directory: package1, type: directory}
+
   parseurl@1.3.3:
     resolution: {integrity: sha512-CiyeOxFT/JZyN5m0z9PfXw4SCBJ6Sygz1Dpl0wqjlhDEGGBP1GnsUVEL0p63hoG1fcj3fHynXi9NYO4nWOL+qQ==}
     engines: {node: '>= 0.8'}
@@ -80,15 +127,23 @@ packages:
 
 snapshots:
 
+  '@babel/helper-string-parser@7.24.1': {}
+
   asap@2.0.6:
     optional: true
 
+  asynckit@0.4.0: {}
+
   debug@4.3.4(supports-color@8.1.1):
     dependencies:
       ms: 2.0.0
     optionalDependencies:
       supports-color: 8.1.1
 
+  debug@https://github.com/debug-js/debug/tarball/4.3.4:
+    dependencies:
+      ms: 2.1.2
+
   ee-first@1.1.1: {}
 
   encodeurl@1.0.2: {}
@@ -107,14 +162,24 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
+  is-negative@https://codeload.github.com/zkochan/is-negative/tar.gz/2fa0531ab04e300a24ef4fd7fb3a280eccb7ccc5: {}
+
   jquery@3.6.0: {}
 
+  lodash@file:foo/bar/lodash.tgz: {}
+
   ms@2.0.0: {}
 
+  ms@2.1.2: {}
+
   on-finished@2.3.0:
     dependencies:
       ee-first: 1.1.1
 
+  package1@file:package1:
+    dependencies:
+      asynckit: 0.4.0
+
   parseurl@1.3.3: {}
 
   promise@8.1.0: