From 5db437d0fcee0af60483fa56415102cdf87f2fd8 Mon Sep 17 00:00:00 2001 From: Priyajeet Hora Date: Wed, 28 Mar 2018 16:48:13 -0700 Subject: [PATCH] Chore: Add nsp to scan from known vulnerabilities (#153) --- build/publish.sh | 14 ++++++++ build/release.sh | 14 ++++++++ package.json | 6 ++-- yarn.lock | 85 ++++++++++++++++++++++++++++++++++++++++++++++-- 4 files changed, 114 insertions(+), 5 deletions(-) diff --git a/build/publish.sh b/build/publish.sh index 3b1d0fb00..c1f23a07c 100755 --- a/build/publish.sh +++ b/build/publish.sh @@ -35,6 +35,20 @@ install_dependencies() { echo "----------------------------------------------------" exit 1; fi + + echo "----------------------------------------------" + echo "Check for known vulnerabilities" + echo "----------------------------------------------" + if yarn run nsp; then + echo "----------------------------------------------------" + echo "No known vulnerabilities found" + echo "----------------------------------------------------" + else + echo "----------------------------------------------------" + echo "Vulnerabilities found!" + echo "----------------------------------------------------" + exit 1; + fi } lint_and_test() { diff --git a/build/release.sh b/build/release.sh index a2f95b4fe..b7f040f93 100755 --- a/build/release.sh +++ b/build/release.sh @@ -50,6 +50,20 @@ install_dependencies() { echo "----------------------------------------------------" exit 1; fi + + echo "----------------------------------------------" + echo "Check for known vulnerabilities" + echo "----------------------------------------------" + if yarn run nsp; then + echo "----------------------------------------------------" + echo "No known vulnerabilities found" + echo "----------------------------------------------------" + else + echo "----------------------------------------------------" + echo "Vulnerabilities found!" + echo "----------------------------------------------------" + exit 1; + fi } diff --git a/package.json b/package.json index 9d352f073..8011f344f 100644 --- a/package.json +++ b/package.json @@ -67,6 +67,7 @@ "mocha": "^5.0.1", "node-noop": "^1.0.0", "node-sass": "^4.7.2", + "nsp": "^3.2.1", "optimize-css-assets-webpack-plugin": "^3.2.0", "postcss-loader": "^2.0.9", "prettier": "^1.8.2", @@ -97,13 +98,14 @@ "commitmsg": "commitlint -e", "prepush": "yarn run lint", "prettier": "prettier-eslint \"src/**/*.js\" --print-width 120 --single-quote --tab-width 4 --write", - "ci": "yarn run clean && yarn run lint && yarn install && yarn run test", + "ci": "yarn install && yarn nsp && yarn run clean && yarn run lint && yarn install && yarn run test", "clean": "rm -rf lib && rm -rf reports/coverage", "github-release": "./node_modules/.bin/conventional-github-releaser", "changelog": "./node_modules/.bin/conventional-changelog -i CHANGELOG.md --same-file", "minor": "./build/release.sh -n && ./build/publish.sh", "major": "./build/release.sh -m && ./build/publish.sh", - "patch": "./build/release.sh -p && ./build/publish.sh" + "patch": "./build/release.sh -p && ./build/publish.sh", + "nsp": "nsp check --reporter summary" }, "lint-staged": { "src/**/*.js": [ diff --git a/yarn.lock b/yarn.lock index 1a7c8a587..63917cc11 100644 --- a/yarn.lock +++ b/yarn.lock @@ -288,6 +288,12 @@ agent-base@2: extend "~3.0.0" semver "~5.0.1" +agent-base@^4.1.0: + version "4.2.0" + resolved "https://registry.yarnpkg.com/agent-base/-/agent-base-4.2.0.tgz#9838b5c3392b962bad031e6a4c5e1024abec45ce" + dependencies: + es6-promisify "^5.0.0" + ajv-keywords@^2.0.0, ajv-keywords@^2.1.0: version "2.1.1" resolved "https://registry.yarnpkg.com/ajv-keywords/-/ajv-keywords-2.1.1.tgz#617997fc5f60576894c435f940d819e135b80762" @@ -1839,6 +1845,15 @@ cli-spinners@^0.1.2: version "0.1.2" resolved "https://registry.yarnpkg.com/cli-spinners/-/cli-spinners-0.1.2.tgz#bb764d88e185fb9e1e6a2a1f19772318f605e31c" +cli-table2@^0.2.0: + version "0.2.0" + resolved "https://registry.yarnpkg.com/cli-table2/-/cli-table2-0.2.0.tgz#2d1ef7f218a0e786e214540562d4bd177fe32d97" + dependencies: + lodash "^3.10.1" + string-width "^1.0.1" + optionalDependencies: + colors "^1.1.2" + cli-truncate@^0.2.1: version "0.2.1" resolved "https://registry.yarnpkg.com/cli-truncate/-/cli-truncate-0.2.1.tgz#9f15cfbb0705005369216c626ac7d05ab90dd574" @@ -1951,6 +1966,10 @@ colors@^1.1.0, colors@~1.1.2: version "1.1.2" resolved "https://registry.yarnpkg.com/colors/-/colors-1.1.2.tgz#168a4701756b6a7f51a12ce0c97bfa28c084ed63" +colors@^1.1.2: + version "1.2.1" + resolved "https://registry.yarnpkg.com/colors/-/colors-1.2.1.tgz#f4a3d302976aaf042356ba1ade3b1a2c62d9d794" + combine-lists@^1.0.0: version "1.0.1" resolved "https://registry.yarnpkg.com/combine-lists/-/combine-lists-1.0.1.tgz#458c07e09e0d900fc28b70a3fec2dacd1d2cb7f6" @@ -2493,6 +2512,10 @@ custom-event@~1.0.0: version "1.0.1" resolved "https://registry.yarnpkg.com/custom-event/-/custom-event-1.0.1.tgz#5d02a46850adf1b4a317946a3928fccb5bfd0425" +cvss@^1.0.2: + version "1.0.2" + resolved "https://registry.yarnpkg.com/cvss/-/cvss-1.0.2.tgz#df67e92bf12a796f49e928799c8db3ba74b9fcd6" + d@1: version "1.0.0" resolved "https://registry.yarnpkg.com/d/-/d-1.0.0.tgz#754bb5bfe55451da69a58b94d45f4c5b0462d58f" @@ -3006,6 +3029,12 @@ es6-promise@^4.0.3: version "4.1.1" resolved "https://registry.yarnpkg.com/es6-promise/-/es6-promise-4.1.1.tgz#8811e90915d9a0dba36274f0b242dbda78f9c92a" +es6-promisify@^5.0.0: + version "5.0.0" + resolved "https://registry.yarnpkg.com/es6-promisify/-/es6-promisify-5.0.0.tgz#5109d62f3e56ea967c4b63505aef08291c8a5203" + dependencies: + es6-promise "^4.0.3" + es6-set@~0.1.5: version "0.1.5" resolved "https://registry.yarnpkg.com/es6-set/-/es6-set-0.1.5.tgz#d2b3ec5d4d800ced818db538d28974db0a73ccb1" @@ -4392,6 +4421,13 @@ https-proxy-agent@1: debug "2" extend "3" +https-proxy-agent@^2.1.0: + version "2.2.0" + resolved "https://registry.yarnpkg.com/https-proxy-agent/-/https-proxy-agent-2.2.0.tgz#7fbba856be8cd677986f42ebd3664f6317257887" + dependencies: + agent-base "^4.1.0" + debug "^3.1.0" + husky@^0.14.3: version "0.14.3" resolved "https://registry.yarnpkg.com/husky/-/husky-0.14.3.tgz#c69ed74e2d2779769a17ba8399b54ce0b63c12c3" @@ -4489,7 +4525,7 @@ inline-source-map@~0.6.0: dependencies: source-map "~0.5.3" -inquirer@^3.0.6: +inquirer@^3.0.6, inquirer@^3.3.0: version "3.3.0" resolved "https://registry.yarnpkg.com/inquirer/-/inquirer-3.3.0.tgz#9dd2f2ad765dcab1ff0443b491442a20ba227dc9" dependencies: @@ -5741,7 +5777,7 @@ lodash.upperfirst@4.3.1: version "4.3.1" resolved "https://registry.yarnpkg.com/lodash.upperfirst/-/lodash.upperfirst-4.3.1.tgz#1365edf431480481ef0d1c68957a5ed99d49f7ce" -lodash@^3.8.0: +lodash@^3.10.1, lodash@^3.8.0: version "3.10.1" resolved "https://registry.yarnpkg.com/lodash/-/lodash-3.10.1.tgz#5bf45e8e49ba4189e17d482789dfd15bd140b7b6" @@ -6431,6 +6467,10 @@ nodemailer@^2.5.0: nodemailer-smtp-transport "2.7.2" socks "1.1.9" +nodesecurity-npm-utils@^6.0.0: + version "6.0.0" + resolved "https://registry.yarnpkg.com/nodesecurity-npm-utils/-/nodesecurity-npm-utils-6.0.0.tgz#5fb5974008c0c97a5c01844faa8fd3fc5520806c" + "nopt@2 || 3", nopt@3.x, nopt@~3.0.6: version "3.0.6" resolved "https://registry.yarnpkg.com/nopt/-/nopt-3.0.6.tgz#c6465dbf08abcd4db359317f79ac68a646b28ff9" @@ -6509,6 +6549,20 @@ npm-which@^3.0.1: gauge "~2.7.3" set-blocking "~2.0.0" +nsp@^3.2.1: + version "3.2.1" + resolved "https://registry.yarnpkg.com/nsp/-/nsp-3.2.1.tgz#0f540f8e85851e4ad370b14d5001098046dedfd1" + dependencies: + chalk "^2.1.0" + cli-table2 "^0.2.0" + cvss "^1.0.2" + https-proxy-agent "^2.1.0" + inquirer "^3.3.0" + nodesecurity-npm-utils "^6.0.0" + semver "^5.4.1" + wreck "^12.5.1" + yargs "^9.0.1" + null-check@^1.0.0: version "1.0.0" resolved "https://registry.yarnpkg.com/null-check/-/null-check-1.0.0.tgz#977dffd7176012b9ec30d2a39db5cf72a0439edd" @@ -8202,7 +8256,7 @@ semver-regex@^1.0.0: version "5.4.1" resolved "https://registry.yarnpkg.com/semver/-/semver-5.4.1.tgz#e059c09d8571f0540823733433505d3a2f00b18e" -semver@5.5.0: +semver@5.5.0, semver@^5.4.1: version "5.5.0" resolved "https://registry.yarnpkg.com/semver/-/semver-5.5.0.tgz#dc4bbc7a6ca9d916dee5d43516f0092b58f7b8ab" @@ -9621,6 +9675,13 @@ wrappy@1: version "1.0.2" resolved "https://registry.yarnpkg.com/wrappy/-/wrappy-1.0.2.tgz#b5243d8f3ec1aa35f1364605bc0d1036e30ab69f" +wreck@^12.5.1: + version "12.5.1" + resolved "https://registry.yarnpkg.com/wreck/-/wreck-12.5.1.tgz#cd2ffce167449e1f0242ed9cf80552e20fb6902a" + dependencies: + boom "5.x.x" + hoek "4.x.x" + write-file-stdout@0.0.2: version "0.0.2" resolved "https://registry.yarnpkg.com/write-file-stdout/-/write-file-stdout-0.0.2.tgz#c252d7c7c5b1b402897630e3453c7bfe690d9ca1" @@ -9761,6 +9822,24 @@ yargs@^8.0.2: y18n "^3.2.1" yargs-parser "^7.0.0" +yargs@^9.0.1: + version "9.0.1" + resolved "https://registry.yarnpkg.com/yargs/-/yargs-9.0.1.tgz#52acc23feecac34042078ee78c0c007f5085db4c" + dependencies: + camelcase "^4.1.0" + cliui "^3.2.0" + decamelize "^1.1.1" + get-caller-file "^1.0.1" + os-locale "^2.0.0" + read-pkg-up "^2.0.0" + require-directory "^2.1.1" + require-main-filename "^1.0.1" + set-blocking "^2.0.0" + string-width "^2.0.0" + which-module "^2.0.0" + y18n "^3.2.1" + yargs-parser "^7.0.0" + yargs@~3.10.0: version "3.10.0" resolved "https://registry.yarnpkg.com/yargs/-/yargs-3.10.0.tgz#f7ee7bd857dd7c1d2d38c0e74efbd681d1431fd1"