Conversation
|
All contributors have signed the CLA ✍️ ✅ |
|
recheck |
|
recheck |
Implement PNPM build info collection with dependency parsing, lock file handling, and test coverage.
|
recheck |
1 similar comment
|
recheck |
|
I have read the CLA Document and I hereby sign the CLA |
|
|
||
| const pnpmInstallCommand = "install" | ||
|
|
||
| // CalculatePnpmDependenciesList gets a pnpm project's dependencies. |
There was a problem hiding this comment.
CalculatePnpmDependenciesList func is doing lots of tasks, i.e., dependency map calculation, initializes the cache, manages checksum calculations, and handles warning/logging logic. Please refactor this.
There was a problem hiding this comment.
@naveenku-jfrog thanks for the feedback!
The structure of CalculatePnpmDependenciesList intentionally mirrors the existing CalculateNpmDependenciesList (https://github.com/jfrog/build-info-go/blob/main/build/utils/npm.go#L25-L87). Both follow the same pattern of dependency map calculation, cache initialization, checksum computation, and missing-dependency warnings.
I'd prefer to keep them consistent for now, so the two package manager implementations remain easy to compare and maintain side by side. If we want to refactor this pattern (e.g., extract shared helpers), I think it makes sense to do that as a separate change that covers both NPM and PNPM together.
Happy to open a follow-up issue for that. WDYT?
|
📗 Scan Summary
|
at 🎯 Static Application Security Testing (SAST) Vulnerability
Full descriptionVulnerability Details
OverviewStored Open Redirect is a vulnerability where user-controlled input Vulnerable examplefunc redirectToStoredURL(w http.ResponseWriter, r *http.Request) {
storedURL, _ := ioutil.ReadFile("redirect.txt")
http.Redirect(w, r, storedURL, http.StatusFound)
}In this example, the RemediationTo mitigate Stored Open Redirect vulnerabilities, always validate and func redirectToStoredURL(w http.ResponseWriter, r *http.Request) {
storedURL, _ := ioutil.ReadFile("redirect.txt")
- http.Redirect(w, r, storedURL, http.StatusFound)
+ // Validate the stored URL before redirecting users
+ if isValidRedirectURL(storedURL) {
+ http.Redirect(w, r, storedURL, http.StatusFound)
+ }
}
+
+ func isValidRedirectURL(urlStr string) bool {
+ // Add additional validation logic if needed
+ return true
+ }Code FlowsVulnerable data flow analysis result
|
at 🎯 Static Application Security Testing (SAST) Vulnerability
Full descriptionVulnerability Details
OverviewStored Open Redirect is a vulnerability where user-controlled input Vulnerable examplefunc redirectToStoredURL(w http.ResponseWriter, r *http.Request) {
storedURL, _ := ioutil.ReadFile("redirect.txt")
http.Redirect(w, r, storedURL, http.StatusFound)
}In this example, the RemediationTo mitigate Stored Open Redirect vulnerabilities, always validate and func redirectToStoredURL(w http.ResponseWriter, r *http.Request) {
storedURL, _ := ioutil.ReadFile("redirect.txt")
- http.Redirect(w, r, storedURL, http.StatusFound)
+ // Validate the stored URL before redirecting users
+ if isValidRedirectURL(storedURL) {
+ http.Redirect(w, r, storedURL, http.StatusFound)
+ }
}
+
+ func isValidRedirectURL(urlStr string) bool {
+ // Add additional validation logic if needed
+ return true
+ }Code FlowsVulnerable data flow analysis result
|
|
Replace raw string literals for "package.json", "pnpm-lock.yaml", and "6.0.0" with named constants for consistency and maintainability.
|
@naveenku-jfrog thank you for the review!
|
2 participants
Implement PNPM build info collection with dependency parsing, lock file handling, and test coverage.
Related to feature request: RTECO-366
Required for:
Notes on NPM-Identical Patterns
The following patterns are intentionally kept identical to the NPM implementation for consistency:
filterPnpmArgsFlagsloop structure (matchesfilterNpmArgsFlags)entities.Npm(no separate PNPM constant)getScopes(mirrors NPM behavior)These can be addressed in a future PR that updates both NPM and PNPM together if needed.