mirror of
https://github.com/aquasecurity/trivy.git
synced 2025-12-23 15:37:50 -08:00
b6d5b82c48
* feat: add comparer * refactor: rename lang with ecosystem * feat(bundler): add comparer * feat(node): add comparer * feat(bundler): integrate comparer * feat(cargo): integrate comparer * feat(composer): add comparer * feat(ghsa): integrate comparer * feat(node): integrate comparer * feat(python): integrate comparer * test(bundler): add tests * test(cargo): add tests * test(composer): add tests * test(ghsa): add tests * test(node): add tests * test(python): add tests * refactor(utils): remove unnecessary functions * test(utils): add tests * test: rename bucket prefixes * fix(detect): use string * chore: update dependencies * docs: add comments * fix(cargo): handle unpatched vulnerability * test(db): update trivy-db for integration tests * test(integration): update a golden file * test(cargo): Add a case for missing patched version Signed-off-by: Simarpreet Singh <simar@linux.com> * refactor(advisory): update comments * refactor(node/advisory): change the receiver * chore(mod): update dependencies * refactor(comparer): unexport MatchVersion * refactor: fix maligned structs * test(node): add empty value * refactor * refactor: sort imports * chore(mod): update trivy-db Co-authored-by: Simarpreet Singh <simar@linux.com>
33 lines
989 B
Go
33 lines
989 B
Go
package node
|
|
|
|
import (
|
|
"golang.org/x/xerrors"
|
|
|
|
npm "github.com/aquasecurity/go-npm-version/pkg"
|
|
dbTypes "github.com/aquasecurity/trivy-db/pkg/types"
|
|
"github.com/aquasecurity/trivy/pkg/detector/library/comparer"
|
|
)
|
|
|
|
// NpmComparer represents a comparer for npm
|
|
type NpmComparer struct{}
|
|
|
|
// IsVulnerable checks if the package version is vulnerable to the advisory.
|
|
func (n NpmComparer) IsVulnerable(ver string, advisory dbTypes.Advisory) bool {
|
|
return comparer.IsVulnerable(ver, advisory, n.matchVersion)
|
|
}
|
|
|
|
// matchVersion checks if the package version satisfies the given constraint.
|
|
func (n NpmComparer) matchVersion(currentVersion, constraint string) (bool, error) {
|
|
v, err := npm.NewVersion(currentVersion)
|
|
if err != nil {
|
|
return false, xerrors.Errorf("npm version error (%s): %s", currentVersion, err)
|
|
}
|
|
|
|
c, err := npm.NewConstraints(constraint)
|
|
if err != nil {
|
|
return false, xerrors.Errorf("npm constraint error (%s): %s", constraint, err)
|
|
}
|
|
|
|
return c.Check(v), nil
|
|
}
|