|
| 1 | +/*! |
| 2 | +This file is part of CycloneDX JavaScript Library. |
| 3 | +
|
| 4 | +Licensed under the Apache License, Version 2.0 (the "License"); |
| 5 | +you may not use this file except in compliance with the License. |
| 6 | +You may obtain a copy of the License at |
| 7 | +
|
| 8 | + http://www.apache.org/licenses/LICENSE-2.0 |
| 9 | +
|
| 10 | +Unless required by applicable law or agreed to in writing, software |
| 11 | +distributed under the License is distributed on an "AS IS" BASIS, |
| 12 | +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 13 | +See the License for the specific language governing permissions and |
| 14 | +limitations under the License. |
| 15 | +
|
| 16 | +SPDX-License-Identifier: Apache-2.0 |
| 17 | +Copyright (c) OWASP Foundation. All Rights Reserved. |
| 18 | +*/ |
| 19 | + |
| 20 | +/** |
| 21 | + * This module tries to be as compatible as possible, it only uses basic methods that are known to be working in all FileSystem abstraction-layers. |
| 22 | + * In addition, we use type parameters for all `PathLike`s, so downstream users can utilize their implementations accordingly. |
| 23 | + * |
| 24 | + * @module |
| 25 | + */ |
| 26 | + |
| 27 | +import type { Stats } from 'node:fs' |
| 28 | + |
| 29 | +import { guessMimeTypeForLicenseFile } from '../_helpers/mime.node' |
| 30 | +import { AttachmentEncoding } from '../enums/attachmentEncoding' |
| 31 | +import { Attachment } from '../models/attachment' |
| 32 | + |
| 33 | +export interface FsUtils<P extends string> { |
| 34 | + readdirSync: (path: P ) => P[] |
| 35 | + readFileSync: (path: P) => Buffer |
| 36 | + statSync: (path: P) => Stats |
| 37 | +} |
| 38 | + |
| 39 | +export interface PathUtils<P extends string> { |
| 40 | + join: (...paths: P[]) => P |
| 41 | +} |
| 42 | + |
| 43 | +export interface FileAttachment<P extends string> { |
| 44 | + filePath: P |
| 45 | + file: P |
| 46 | + text: Attachment |
| 47 | +} |
| 48 | + |
| 49 | +const LICENSE_FILENAME_PATTERN = /^(?:UN)?LICEN[CS]E|.\.LICEN[CS]E$|^NOTICE$/i |
| 50 | + |
| 51 | +export type ErrorReporter = (e:Error) => any |
| 52 | + |
| 53 | +export class LicenseEvidenceGatherer<P extends string = string> { |
| 54 | + readonly #fs: FsUtils<P> |
| 55 | + readonly #path: PathUtils<P> |
| 56 | + |
| 57 | + /* eslint-disable tsdoc/syntax -- we want to use the dot-syntax - https://github.com/microsoft/tsdoc/issues/19 */ |
| 58 | + /** |
| 59 | + * `fs` and `path` can be supplied, if any compatibility-layer or drop-in replacement is used. |
| 60 | + * |
| 61 | + * @param options.fs - If omitted, the native `node:fs` is used. |
| 62 | + * @param options.path - If omitted, the native `node:path` is used. |
| 63 | + */ |
| 64 | + constructor (options: { fs?: FsUtils<P>, path?: PathUtils<P> } = {}) { |
| 65 | + /* eslint-disable @typescript-eslint/no-unsafe-assignment, @typescript-eslint/no-require-imports -- needed */ |
| 66 | + this.#fs = options.fs ?? require('node:fs') |
| 67 | + this.#path = options.path ?? require('node:path') |
| 68 | + /* eslint-enable @typescript-eslint/no-unsafe-assignment, @typescript-eslint/no-require-imports */ |
| 69 | + } |
| 70 | + /* eslint-enable tsdoc/syntax */ |
| 71 | + |
| 72 | + * getFileAttachments (prefixPath: P, onError: ErrorReporter = noop): Generator<FileAttachment<P>> { |
| 73 | + const files = this.#fs.readdirSync(prefixPath) // may throw |
| 74 | + for (const file of files) { |
| 75 | + if (!LICENSE_FILENAME_PATTERN.test(file)) { |
| 76 | + continue |
| 77 | + } |
| 78 | + const filePath = this.#path.join(prefixPath, file) |
| 79 | + if (!this.#fs.statSync(filePath).isFile()) { |
| 80 | + // Ignore all directories - they are not files :-) |
| 81 | + // Don't follow symlinks for security reasons! |
| 82 | + continue |
| 83 | + } |
| 84 | + const contentType = guessMimeTypeForLicenseFile(file) |
| 85 | + if (contentType === undefined) { |
| 86 | + continue |
| 87 | + } |
| 88 | + try { |
| 89 | + yield { filePath, file, text: new Attachment( |
| 90 | + // since we cannot be sure weather the file content is text-only, or maybe binary, |
| 91 | + // we tend to base64 everything, regardless of the detected encoding. |
| 92 | + this.#fs.readFileSync(filePath) // may throw |
| 93 | + .toString('base64'), |
| 94 | + { contentType, encoding: AttachmentEncoding.Base64 } |
| 95 | + ) } |
| 96 | + } catch (cause) { |
| 97 | + onError(new Error(`skipped license file ${filePath}`, {cause})) |
| 98 | + } |
| 99 | + } |
| 100 | + } |
| 101 | +} |
| 102 | + |
| 103 | +/* eslint-disable-next-line @typescript-eslint/no-empty-function -- ack */ |
| 104 | +function noop ():void {} |
0 commit comments