fix(nodejs): find licenses for packages with slash (aquasecurity#5836)

pkg/fanal/analyzer/language/nodejs/npm/npm.go

@@ -8,7 +8,6 @@ import (
 	"os"
 	"path"
 	"path/filepath"
-	"strings"
 
 	"golang.org/x/xerrors"
 
@@ -87,13 +86,14 @@ func (a npmLibraryAnalyzer) PostAnalyze(_ context.Context, input analyzer.PostAn
 
 func (a npmLibraryAnalyzer) Required(filePath string, _ os.FileInfo) bool {
 	fileName := filepath.Base(filePath)
+	// Don't save package-lock.json from the `node_modules` directory to avoid duplication and mistakes.
 	if fileName == types.NpmPkgLock && !xpath.Contains(filePath, "node_modules") {
 		return true
 	}
-	// The file path to package.json - */node_modules/<package_name>/package.json
-	// The path is slashed in analyzers.
-	dirs := strings.Split(path.Dir(filePath), "/")
-	if len(dirs) > 1 && dirs[len(dirs)-2] == "node_modules" && fileName == types.NpmPkg {
+
+	// Save package.json files only from the `node_modules` directory.
+	// Required to search for licenses.
+	if fileName == types.NpmPkg && xpath.Contains(filePath, "node_modules") {
 		return true
 	}
 	return false

pkg/fanal/analyzer/language/nodejs/npm/npm_test.go

@@ -34,6 +34,19 @@ func Test_npmLibraryAnalyzer_Analyze(t *testing.T) {
 						Type:     types.Npm,
 						FilePath: "package-lock.json",
 						Libraries: types.Packages{
+							{
+								ID:       "@babel/[email protected]",
+								Name:     "@babel/parser",
+								Version:  "7.23.6",
+								Indirect: true,
+								Licenses: []string{"MIT"},
+								Locations: []types.Location{
+									{
+										StartLine: 6,
+										EndLine:   10,
+									},
+								},
+							},
 							{
 								ID:       "[email protected]",
 								Name:     "ansi-colors",
@@ -42,8 +55,8 @@ func Test_npmLibraryAnalyzer_Analyze(t *testing.T) {
 								Indirect: true,
 								Locations: []types.Location{
 									{
-										StartLine: 6,
-										EndLine:   11,
+										StartLine: 11,
+										EndLine:   16,
 									},
 								},
 							},
@@ -54,8 +67,8 @@ func Test_npmLibraryAnalyzer_Analyze(t *testing.T) {
 								Indirect: true,
 								Locations: []types.Location{
 									{
-										StartLine: 12,
-										EndLine:   16,
+										StartLine: 17,
+										EndLine:   21,
 									},
 								},
 							},
@@ -68,8 +81,8 @@ func Test_npmLibraryAnalyzer_Analyze(t *testing.T) {
 								Licenses:  []string{"MIT"},
 								Locations: []types.Location{
 									{
-										StartLine: 17,
-										EndLine:   39,
+										StartLine: 22,
+										EndLine:   44,
 									},
 								},
 							},
@@ -82,12 +95,12 @@ func Test_npmLibraryAnalyzer_Analyze(t *testing.T) {
 								Licenses:  []string{"MIT"},
 								Locations: []types.Location{
 									{
-										StartLine: 25,
-										EndLine:   32,
+										StartLine: 30,
+										EndLine:   37,
 									},
 									{
-										StartLine: 48,
-										EndLine:   55,
+										StartLine: 53,
+										EndLine:   60,
 									},
 								},
 							},
@@ -100,8 +113,8 @@ func Test_npmLibraryAnalyzer_Analyze(t *testing.T) {
 								Licenses:  []string{"MIT"},
 								Locations: []types.Location{
 									{
-										StartLine: 40,
-										EndLine:   62,
+										StartLine: 45,
+										EndLine:   67,
 									},
 								},
 							},
@@ -113,12 +126,12 @@ func Test_npmLibraryAnalyzer_Analyze(t *testing.T) {
 								Licenses: []string{"MIT"},
 								Locations: []types.Location{
 									{
-										StartLine: 33,
-										EndLine:   37,
+										StartLine: 38,
+										EndLine:   42,
 									},
 									{
-										StartLine: 56,
-										EndLine:   60,
+										StartLine: 61,
+										EndLine:   65,
 									},
 								},
 							},
@@ -130,8 +143,8 @@ func Test_npmLibraryAnalyzer_Analyze(t *testing.T) {
 								Licenses: []string{"MIT"},
 								Locations: []types.Location{
 									{
-										StartLine: 63,
-										EndLine:   67,
+										StartLine: 68,
+										EndLine:   72,
 									},
 								},
 							},
@@ -206,9 +219,14 @@ func Test_nodePkgLibraryAnalyzer_Required(t *testing.T) {
 			filePath: "npm/node_modules/ms/package.json",
 			want:     true,
 		},
+		{
+			name:     "package.json with `/` in name",
+			filePath: "npm/node_modules/@babel/parser/package.json",
+			want:     true,
+		},
 		{
 			name:     "sad path",
-			filePath: "npm/node_modules/package.json",
+			filePath: "npm/package.json",
 			want:     false,
 		},
 		{