Skip to content

Commit 7ca656d

Browse files
sneaky-potatoDmitriyLewen
sneaky-potato
and
DmitriyLewen
authored
feat(nodejs): add a bun.lock analyzer (#8897)
Co-authored-by: DmitriyLewen <[email protected]>
1 parent 8939451 commit 7ca656d

File tree

22 files changed

+1312
-4
lines changed

22 files changed

+1312
-4
lines changed

‎docs/docs/coverage/language/index.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@ On the other hand, when the target is a post-build artifact, like a container im
3131
| [Node.js](nodejs.md) | package-lock.json | - | - | ✅ | ✅ |
3232
| | yarn.lock | - | - | ✅ | ✅ |
3333
| | pnpm-lock.yaml | - | - | ✅ | ✅ |
34+
| | bun.lock | - | - | ✅ | ✅ |
3435
| | package.json | ✅ | ✅ | - | - |
3536
| [.NET](dotnet.md) | packages.lock.json | ✅ | ✅ | ✅ | ✅ |
3637
| | packages.config | ✅ | ✅ | ✅ | ✅ |

‎docs/docs/coverage/language/nodejs.md

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ The following table provides an outline of the features Trivy offers.
1818
| npm | package-lock.json | ✓ | [Excluded](#npm) | ✓ | ✓ |
1919
| Yarn | yarn.lock | ✓ | [Excluded](#yarn) | ✓ | ✓ |
2020
| pnpm | pnpm-lock.yaml | ✓ | [Excluded](#lock-file-v9-version) | ✓ | - |
21-
| Bun | yarn.lock | ✓ | [Excluded](#yarn) | ✓ | ✓ |
21+
| Bun | bun.lock | ✓ | [Excluded](#bun) | ✓ | ✓ |
2222

2323
In addition, Trivy scans installed packages with `package.json`.
2424

@@ -72,7 +72,13 @@ To identify licenses, you need to download dependencies to `node_modules` before
7272
Trivy supports `Dev` field for `pnpm-lock.yaml` v9 or later. Use the `--include-dev-deps` flag to include the developer's dependencies in the result.
7373

7474
### Bun
75-
Trivy supports scanning `yarn.lock` files generated by [Bun](https://bun.sh/docs/install/lockfile#how-do-i-inspect-bun-s-lockfile). You can use the command `bun install -y` to generate a Yarn-compatible `yarn.lock`.
75+
Trivy also supports scanning `bun.lock` file generated by [Bun](https://bun.sh/blog/bun-lock-text-lockfile).
76+
You can use Bun v1.2 which uses this file as default or use `bun install --save-text-lockfile` in Bun v1.1.39 to generate it.
77+
78+
For previous Bun versions you can use the command `bun install -y` to generate a Yarn-compatible `yarn.lock` and then scan it with Trivy.
79+
80+
#### Development dependencies
81+
`bun.lock` contains information about package groups, such as production and development dependencies. By default, Trivy doesn't report development dependencies. Use the `--include-dev-deps` flag to include them.
7682

7783
!!! note
7884
`bun.lockb` is not supported.

‎integration/repo_test.go

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -145,6 +145,15 @@ func TestRepository(t *testing.T) {
145145
},
146146
golden: "testdata/pnpm.json.golden",
147147
},
148+
{
149+
name: "bun",
150+
args: args{
151+
scanner: types.VulnerabilityScanner,
152+
input: "testdata/fixtures/repo/bun",
153+
listAllPkgs: true,
154+
},
155+
golden: "testdata/bun.json.golden",
156+
},
148157
{
149158
name: "pip",
150159
args: args{

‎integration/testdata/bun.json.golden

Lines changed: 196 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,196 @@
1+
{
2+
"SchemaVersion": 2,
3+
"CreatedAt": "2021-08-25T12:20:30.000000005Z",
4+
"ArtifactName": "testdata/fixtures/repo/bun",
5+
"ArtifactType": "repository",
6+
"Metadata": {
7+
"ImageConfig": {
8+
"architecture": "",
9+
"created": "0001-01-01T00:00:00Z",
10+
"os": "",
11+
"rootfs": {
12+
"type": "",
13+
"diff_ids": null
14+
},
15+
"config": {}
16+
}
17+
},
18+
"Results": [
19+
{
20+
"Target": "bun.lock",
21+
"Class": "lang-pkgs",
22+
"Type": "bun",
23+
"Packages": [
24+
{
25+
"ID": "[email protected]",
26+
"Name": "jquery",
27+
"Identifier": {
28+
"PURL": "pkg:npm/[email protected]",
29+
"UID": "996607b7a767641"
30+
},
31+
"Version": "3.3.1",
32+
"Relationship": "direct",
33+
"Layer": {},
34+
"Locations": [
35+
{
36+
"StartLine": 24,
37+
"EndLine": 24
38+
}
39+
]
40+
},
41+
{
42+
"ID": "[email protected]",
43+
"Name": "typescript",
44+
"Identifier": {
45+
"PURL": "pkg:npm/[email protected]",
46+
"UID": "dc420153a1d93546"
47+
},
48+
"Version": "5.8.3",
49+
"Relationship": "direct",
50+
"Layer": {},
51+
"Locations": [
52+
{
53+
"StartLine": 26,
54+
"EndLine": 26
55+
}
56+
]
57+
}
58+
],
59+
"Vulnerabilities": [
60+
{
61+
"VulnerabilityID": "CVE-2019-11358",
62+
"PkgID": "[email protected]",
63+
"PkgName": "jquery",
64+
"PkgIdentifier": {
65+
"PURL": "pkg:npm/[email protected]",
66+
"UID": "996607b7a767641"
67+
},
68+
"InstalledVersion": "3.3.1",
69+
"FixedVersion": "3.4.0",
70+
"Status": "fixed",
71+
"Layer": {},
72+
"SeveritySource": "ghsa",
73+
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-11358",
74+
"DataSource": {
75+
"ID": "ghsa",
76+
"Name": "GitHub Security Advisory Npm",
77+
"URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm"
78+
},
79+
"Title": "jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection",
80+
"Description": "jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.",
81+
"Severity": "MEDIUM",
82+
"CweIDs": [
83+
"CWE-79"
84+
],
85+
"VendorSeverity": {
86+
"alma": 2,
87+
"amazon": 2,
88+
"arch-linux": 2,
89+
"ghsa": 2,
90+
"nodejs-security-wg": 2,
91+
"nvd": 2,
92+
"oracle-oval": 2,
93+
"redhat": 2,
94+
"ruby-advisory-db": 2,
95+
"ubuntu": 1
96+
},
97+
"CVSS": {
98+
"nvd": {
99+
"V2Vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
100+
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
101+
"V2Score": 4.3,
102+
"V3Score": 6.1
103+
},
104+
"redhat": {
105+
"V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
106+
"V3Score": 5.6
107+
}
108+
},
109+
"References": [
110+
"http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00006.html",
111+
"http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00025.html",
112+
"http://packetstormsecurity.com/files/152787/dotCMS-5.1.1-Vulnerable-Dependencies.html",
113+
"http://packetstormsecurity.com/files/153237/RetireJS-CORS-Issue-Script-Execution.html",
114+
"http://packetstormsecurity.com/files/156743/OctoberCMS-Insecure-Dependencies.html",
115+
"http://seclists.org/fulldisclosure/2019/May/10",
116+
"http://seclists.org/fulldisclosure/2019/May/11",
117+
"http://seclists.org/fulldisclosure/2019/May/13",
118+
"http://www.openwall.com/lists/oss-security/2019/06/03/2",
119+
"http://www.securityfocus.com/bid/108023",
120+
"https://access.redhat.com/errata/RHBA-2019:1570",
121+
"https://access.redhat.com/errata/RHSA-2019:1456",
122+
"https://access.redhat.com/errata/RHSA-2019:2587",
123+
"https://access.redhat.com/errata/RHSA-2019:3023",
124+
"https://access.redhat.com/errata/RHSA-2019:3024",
125+
"https://access.redhat.com/security/cve/CVE-2019-11358",
126+
"https://backdropcms.org/security/backdrop-sa-core-2019-009",
127+
"https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/",
128+
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11358",
129+
"https://github.com/DanielRuf/snyk-js-jquery-174006?files=1",
130+
"https://github.com/advisories/GHSA-6c3j-c64m-qhgq",
131+
"https://github.com/jquery/jquery/commit/753d591aea698e57d6db58c9f722cd0808619b1b",
132+
"https://github.com/jquery/jquery/pull/4333",
133+
"https://github.com/rails/jquery-rails/blob/master/CHANGELOG.md#434",
134+
"https://hackerone.com/reports/454365",
135+
"https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44601",
136+
"https://linux.oracle.com/cve/CVE-2019-11358.html",
137+
"https://linux.oracle.com/errata/ELSA-2020-4847.html",
138+
"https://lists.apache.org/thread.html/08720ef215ee7ab3386c05a1a90a7d1c852bf0706f176a7816bf65fc@%3Ccommits.airflow.apache.org%3E",
139+
"https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E",
140+
"https://lists.apache.org/thread.html/5928aa293e39d248266472210c50f176cac1535220f2486e6a7fa844@%3Ccommits.airflow.apache.org%3E",
141+
"https://lists.apache.org/thread.html/6097cdbd6f0a337bedd9bb5cc441b2d525ff002a96531de367e4259f@%3Ccommits.airflow.apache.org%3E",
142+
"https://lists.apache.org/thread.html/88fb0362fd40e5b605ea8149f63241537b8b6fb5bfa315391fc5cbb7@%3Ccommits.airflow.apache.org%3E",
143+
"https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E",
144+
"https://lists.apache.org/thread.html/b736d0784cf02f5a30fbb4c5902762a15ad6d47e17e2c5a17b7d6205@%3Ccommits.airflow.apache.org%3E",
145+
"https://lists.apache.org/thread.html/ba79cf1658741e9f146e4c59b50aee56656ea95d841d358d006c18b6@%3Ccommits.roller.apache.org%3E",
146+
"https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3@%3Ccommits.nifi.apache.org%3E",
147+
"https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E",
148+
"https://lists.apache.org/thread.html/r2041a75d3fc09dec55adfd95d598b38d22715303f65c997c054844c9@%3Cissues.flink.apache.org%3E",
149+
"https://lists.apache.org/thread.html/r2baacab6e0acb5a2092eb46ae04fd6c3e8277b4fd79b1ffb7f3254fa@%3Cissues.flink.apache.org%3E",
150+
"https://lists.apache.org/thread.html/r38f0d1aa3c923c22977fe7376508f030f22e22c1379fbb155bf29766@%3Cdev.syncope.apache.org%3E",
151+
"https://lists.apache.org/thread.html/r41b5bfe009c845f67d4f68948cc9419ac2d62e287804aafd72892b08@%3Cissues.flink.apache.org%3E",
152+
"https://lists.apache.org/thread.html/r7aac081cbddb6baa24b75e74abf0929bf309b176755a53e3ed810355@%3Cdev.flink.apache.org%3E",
153+
"https://lists.apache.org/thread.html/r7d64895cc4dff84d0becfc572b20c0e4bf9bfa7b10c6f5f73e783734@%3Cdev.storm.apache.org%3E",
154+
"https://lists.apache.org/thread.html/r7e8ebccb7c022e41295f6fdb7b971209b83702339f872ddd8cf8bf73@%3Cissues.flink.apache.org%3E",
155+
"https://lists.apache.org/thread.html/rac25da84ecdcd36f6de5ad0d255f4e967209bbbebddb285e231da37d@%3Cissues.flink.apache.org%3E",
156+
"https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b@%3Ccommits.nifi.apache.org%3E",
157+
"https://lists.debian.org/debian-lts-announce/2019/05/msg00006.html",
158+
"https://lists.debian.org/debian-lts-announce/2019/05/msg00029.html",
159+
"https://lists.debian.org/debian-lts-announce/2020/02/msg00024.html",
160+
"https://lists.fedoraproject.org/archives/list/[email protected]/message/4UOAZIFCSZ3ENEFOR5IXX6NFAD3HV7FA/",
161+
"https://lists.fedoraproject.org/archives/list/[email protected]/message/5IABSKTYZ5JUGL735UKGXL5YPRYOPUYI/",
162+
"https://lists.fedoraproject.org/archives/list/[email protected]/message/KYH3OAGR2RTCHRA5NOKX2TES7SNQMWGO/",
163+
"https://lists.fedoraproject.org/archives/list/[email protected]/message/QV3PKZC3PQCO3273HAT76PAQZFBEO4KP/",
164+
"https://lists.fedoraproject.org/archives/list/[email protected]/message/RLXRX23725JL366CNZGJZ7AQQB7LHQ6F/",
165+
"https://lists.fedoraproject.org/archives/list/[email protected]/message/WZW27UCJ5CYFL4KFFFMYMIBNMIU2ALG5/",
166+
"https://nvd.nist.gov/vuln/detail/CVE-2019-11358",
167+
"https://seclists.org/bugtraq/2019/Apr/32",
168+
"https://seclists.org/bugtraq/2019/Jun/12",
169+
"https://seclists.org/bugtraq/2019/May/18",
170+
"https://security.netapp.com/advisory/ntap-20190919-0001/",
171+
"https://snyk.io/vuln/SNYK-JS-JQUERY-174006",
172+
"https://www.debian.org/security/2019/dsa-4434",
173+
"https://www.debian.org/security/2019/dsa-4460",
174+
"https://www.drupal.org/sa-core-2019-006",
175+
"https://www.oracle.com//security-alerts/cpujul2021.html",
176+
"https://www.oracle.com/security-alerts/cpuApr2021.html",
177+
"https://www.oracle.com/security-alerts/cpuapr2020.html",
178+
"https://www.oracle.com/security-alerts/cpujan2020.html",
179+
"https://www.oracle.com/security-alerts/cpujan2021.html",
180+
"https://www.oracle.com/security-alerts/cpujul2020.html",
181+
"https://www.oracle.com/security-alerts/cpuoct2020.html",
182+
"https://www.oracle.com/security-alerts/cpuoct2021.html",
183+
"https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html",
184+
"https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html",
185+
"https://www.privacy-wise.com/mitigating-cve-2019-11358-in-old-versions-of-jquery/",
186+
"https://www.synology.com/security/advisory/Synology_SA_19_19",
187+
"https://www.tenable.com/security/tns-2019-08",
188+
"https://www.tenable.com/security/tns-2020-02"
189+
],
190+
"PublishedDate": "2019-04-20T00:29:00Z",
191+
"LastModifiedDate": "2021-10-20T11:15:00Z"
192+
}
193+
]
194+
}
195+
]
196+
}

‎integration/testdata/fixtures/repo/bun/bun.lock

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
{
2+
"lockfileVersion": 1,
3+
"workspaces": {
4+
"": {
5+
"name": "buntest",
6+
"dependencies": {
7+
"jquery": "3.3.1",
8+
},
9+
"devDependencies": {
10+
"@types/bun": "latest",
11+
},
12+
"peerDependencies": {
13+
"typescript": "^5",
14+
},
15+
},
16+
},
17+
"packages": {
18+
"@types/bun": ["@types/[email protected]", "", { "dependencies": { "bun-types": "1.2.14" } }, "sha512-VsFZKs8oKHzI7zwvECiAJ5oSorWndIWEVhfbYqZd4HI/45kzW7PN2Rr5biAzvGvRuNmYLSANY+H59ubHq8xw7Q=="],
19+
20+
"@types/node": ["@types/[email protected]", "", { "dependencies": { "undici-types": "~6.21.0" } }, "sha512-EV/37Td6c+MgKAbkcLG6vqZ2zEYHD7bvSrzqqs2RIhbA6w3x+Dqz8MZM3sP6kGTeLrdoOgKZe+Xja7tUB2DNkQ=="],
21+
22+
"bun-types": ["[email protected]", "", { "dependencies": { "@types/node": "*" } }, "sha512-Kuh4Ub28ucMRWeiUUWMHsT9Wcbr4H3kLIO72RZZElSDxSu7vpetRvxIUDUaW6QtaIeixIpm7OXtNnZPf82EzwA=="],
23+
24+
"jquery": ["[email protected]", "", {}, "sha512-Ubldcmxp5np52/ENotGxlLe6aGMvmF4R8S6tZjsP6Knsaxd/xp3Zrh50cG93lR6nPXyUFwzN3ZSOQI0wRJNdGg=="],
25+
26+
"typescript": ["[email protected]", "", { "bin": { "tsc": "bin/tsc", "tsserver": "bin/tsserver" } }, "sha512-p1diW6TqL9L07nNxvRMM7hMMw4c5XOo/1ibL4aAIGmSAt9slTE1Xgw5KWuof2uTOvCg9BY7ZRi+GaF+7sfgPeQ=="],
27+
28+
"undici-types": ["[email protected]", "", {}, "sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ=="],
29+
}
30+
}

‎pkg/detector/library/driver.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ func NewDriver(libType ftypes.LangType) (Driver, bool) {
4242
case ftypes.Jar, ftypes.Pom, ftypes.Gradle, ftypes.Sbt:
4343
ecosystem = vulnerability.Maven
4444
comparer = maven.Comparer{}
45-
case ftypes.Npm, ftypes.Yarn, ftypes.Pnpm, ftypes.NodePkg, ftypes.JavaScript:
45+
case ftypes.Npm, ftypes.Yarn, ftypes.Pnpm, ftypes.Bun, ftypes.NodePkg, ftypes.JavaScript:
4646
ecosystem = vulnerability.Npm
4747
comparer = npm.Comparer{}
4848
case ftypes.NuGet, ftypes.DotNetCore, ftypes.PackagesProps:

‎pkg/fanal/analyzer/all/import.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ import (
2222
_ "github.com/aquasecurity/trivy/pkg/fanal/analyzer/language/java/pom"
2323
_ "github.com/aquasecurity/trivy/pkg/fanal/analyzer/language/java/sbt"
2424
_ "github.com/aquasecurity/trivy/pkg/fanal/analyzer/language/julia/pkg"
25+
_ "github.com/aquasecurity/trivy/pkg/fanal/analyzer/language/nodejs/bun"
2526
_ "github.com/aquasecurity/trivy/pkg/fanal/analyzer/language/nodejs/npm"
2627
_ "github.com/aquasecurity/trivy/pkg/fanal/analyzer/language/nodejs/pkg"
2728
_ "github.com/aquasecurity/trivy/pkg/fanal/analyzer/language/nodejs/pnpm"

‎pkg/fanal/analyzer/const.go

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,7 @@ const (
6666
TypeNodePkg Type = "node-pkg"
6767
TypeYarn Type = "yarn"
6868
TypePnpm Type = "pnpm"
69+
TypeBun Type = "bun"
6970

7071
// .NET
7172
TypeNuget Type = "nuget"
@@ -191,6 +192,7 @@ var (
191192
TypeNodePkg,
192193
TypeYarn,
193194
TypePnpm,
195+
TypeBun,
194196
TypeNuget,
195197
TypeDotNetCore,
196198
TypePackagesProps,
@@ -220,6 +222,7 @@ var (
220222
TypeNpmPkgLock,
221223
TypeYarn,
222224
TypePnpm,
225+
TypeBun,
223226
TypePip,
224227
TypePipenv,
225228
TypePoetry,

0 commit comments

Comments
 (0)