Skip to content

Added local node_module check for NodePackageAnalyzer#4753

Merged
jeremylong merged 3 commits intodependency-check:mainfrom
yarisvt:main
Aug 19, 2022
Merged

Added local node_module check for NodePackageAnalyzer#4753
jeremylong merged 3 commits intodependency-check:mainfrom
yarisvt:main

Conversation

@yarisvt
Copy link
Copy Markdown
Contributor

@yarisvt yarisvt commented Aug 15, 2022

Fixes Issue #4752

Description of Change

Ignore packages that start with "./", since those are local packages

Have test cases been added to cover the new functionality?

no

@boring-cyborg boring-cyborg Bot added the core changes to core label Aug 15, 2022
@jeremylong
Copy link
Copy Markdown
Collaborator

Do you have an example where version.matches("^[.~]*/.*") indicates a local node module is being used?

@yarisvt
Copy link
Copy Markdown
Contributor Author

yarisvt commented Aug 17, 2022

@jeremylong

I am using vaadin to build a web app and it automatically generates js files in the node_modules folder. It then puts the following local path in the package.json (without prefixing it with file:)
image

According to the npm docs, local paths can use four forms:

../foo/bar
~/foo/bar
./foo/bar
/foo/bar

Therefore, the regex ^[.~]*/.* matches all four of them:
image

Comment thread core/src/main/java/org/owasp/dependencycheck/analyzer/NodePackageAnalyzer.java Outdated
@jeremylong jeremylong added this to the 7.1.2 milestone Aug 18, 2022
@jeremylong
Copy link
Copy Markdown
Collaborator

Thanks for the detailed response! I made one very minor change to the regex (s/*/{0,2}/).

@yarisvt
Copy link
Copy Markdown
Contributor Author

yarisvt commented Aug 18, 2022

Great!

@jeremylong jeremylong merged commit 1e25e18 into dependency-check:main Aug 19, 2022
@github-actions github-actions Bot locked as resolved and limited conversation to collaborators Dec 21, 2024
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

core changes to core

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants