codekingpro/portable-devtools

1const colors = require('../colors.js')
2
3const calculate = (data, { chalk }) => {
4  const c = colors(chalk)
5  const output = []
6  const { metadata: { vulnerabilities } } = data
7  const vulnCount = vulnerabilities.total
8
9  let someFixable = false
10  let someForceFixable = false
11  let forceFixSemVerMajor = false
12  let someUnfixable = false
13
14  if (vulnCount === 0) {
15    output.push(`found ${c.green('0')} vulnerabilities`)
16  } else {
17    for (const [, vuln] of Object.entries(data.vulnerabilities)) {
18      const { fixAvailable } = vuln
19      someFixable = someFixable || fixAvailable === true
20      someUnfixable = someUnfixable || fixAvailable === false
21      if (typeof fixAvailable === 'object') {
22        someForceFixable = true
23        forceFixSemVerMajor = forceFixSemVerMajor || fixAvailable.isSemVerMajor
24      }
25    }
26    const total = vulnerabilities.total
27    const sevs = Object.entries(vulnerabilities).filter(([s, count]) => {
28      return (s === 'low' || s === 'moderate' || s === 'high' || s === 'critical') &&
29        count > 0
30    })
31
32    if (sevs.length > 1) {
33      const severities = sevs.map(([s, count]) => {
34        return `${count} ${c.severity(s)}`
35      }).join(', ')
36      output.push(`${c.red(total)} vulnerabilities (${severities})`)
37    } else {
38      const [sev, count] = sevs[0]
39      output.push(`${count} ${c.severity(sev)} severity vulnerabilit${count === 1 ? 'y' : 'ies'}`)
40    }
41
42    // XXX use a different footer line if some aren't fixable easily.
43    // just 'run `npm audit` for details' maybe?
44
45    if (someFixable) {
46      output.push('', 'To address ' +
47        (someForceFixable || someUnfixable ? 'issues that do not require attention'
48        : 'all issues') + ', run:\n  npm audit fix')
49    }
50
51    if (someForceFixable) {
52      output.push('', 'To address all issues' +
53        (someUnfixable ? ' possible' : '') +
54        (forceFixSemVerMajor ? ' (including breaking changes)' : '') +
55        ', run:\n  npm audit fix --force')
56    }
57
58    if (someUnfixable) {
59      output.push('',
60        'Some issues need review, and may require choosing',
61        'a different dependency.')
62    }
63  }
64
65  const summary = output.join('\n')
66  return {
67    summary,
68    report: vulnCount > 0 ? `${summary}\n\nRun \`npm audit\` for details.`
69    : summary,
70  }
71}
72
73module.exports = Object.assign((data, opt) => calculate(data, opt).report, {
74  summary: (data, opt) => calculate(data, opt).summary,
75})
76