fix: Fix several issues on NPM Audit reporting #5546
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
… in NPM audit results Fixes #5419
fixes issue #5547
This was
linked to
issues
Mar 8, 2023
|
@jeremylong As this update changes the Advisory it will trigger errors logged by the node-audit cache when a report is found in cache for an npm-package that was stored by a previous release. The cache will in that case return null and a new npm audit report will be requested and stored in the cache, but the first time for each such package the log will contain an exception stacktrace. Not quite sure whether we should us a minor or a major revision for this case (scan runs fine, but log appears to indicate errors due to the mismatch on serialVersionUid) I do think it requires an explicit mention in the release-notes to try and avoid bug-reports. |
|
And given this required serialization mismatch issue I'm wondering whether we should obtain more info from the NPM audit report into the advisory as well.... I see the CVEs, CWEs and a CVSS v3.1 score in there... maybe take the opportunity to improve on those as well before we integrate this? |
|
e.g.
"cves": [
"CVE-2020-7788"
],
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 7.3,
"vectorString": "CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:L\/I:L\/A:L"
},
In the case of |
aikebah
changed the title
aikebah
changed the title
The existing code tried to retrieve cwe as a string, but in the NPM Audit report it is an array. This commit parses the array and adds each CWE Fixes issue #5551
|
I'll definitely add notes about the exception linking back to this entry. I'm fine either way if you want to incorporate more data from the API. I was planning on releasing the next version this weekend. |
|
@jeremylong that schedule matches nicely with my polishing up the final modifications - addition of the CVSS v3 score to NPM that I hope to finish tonight |
jeremylong
approved these changes
Mar 18, 2023
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes Issue #5419
Description of Change
id, since as experienced by users theidreturned is not stable over time.Have test cases been added to cover the new functionality?
no