Merge pull request #199 from nodesource/minwoo/poc

[1.4.1] Avoiding npm substitution attacks & upgrade more deps

Author: edsadr

commands/install.js

@@ -2,7 +2,8 @@
 
 // In order to work around windows shell issues...
 const spawn = require('cross-spawn')
-const { getValue } = require('../lib/config')
+const { getValue, setValue } = require('../lib/config')
+const clientRequest = require('../lib/client-request')
 const { queryReadline, reversedSplit } = require('../lib/util')
 const details = require('./details')
 const {
@@ -11,20 +12,123 @@ const {
   failure
 } = require('../lib/ncm-style')
 const { helpHeader } = require('../lib/help')
+const path = require('path')
+const rc = require('rc')
 const chalk = require('chalk')
+
 const L = console.log
 const E = console.error
 
 module.exports = install
 module.exports.optionsList = optionsList
 
+const publicRegistryUrl = 'https://registry.npmjs.org/'
+const cachedPublicPackages = getValue('cachedPublicPackages')
+
+const registryUrl = scope => {
+  const result = rc('npm', { registry: publicRegistryUrl })
+  const url = result[`${scope}:registry`] || result.config_registry || result.registry
+  return url.slice(-1) === '/' ? url : `${url}/`
+}
+
+const scannerLog = () =>
+  L(chalk`[NCM::SECURITY] Scanning npm dependency substitution vulnerabilities...`)
+
+const concurrentTaskQueue = []
+const verificationTask = async ({ name, privateRegistryUrl }) => {
+  try {
+    L(`[NCM::SECURITY] Verifying the package "${name}"`)
+
+    // skip cached or scoped packages
+    if (cachedPublicPackages.includes(name) || name.includes('/')) return
+
+    const { body: { versions = {} } } = await clientRequest({
+      method: 'GET',
+      uri: `${privateRegistryUrl}${name}`,
+      json: true,
+      opted: true
+    })
+    let verLen = Object.keys(versions).length
+    if (!verLen) return
+
+    const { integrity: privateIntegrity } = versions[(Object.keys(versions)[verLen - 1])].dist
+    if (!privateIntegrity) return
+
+    const { body: { versions: pubVers = {} } } = await clientRequest({
+      method: 'GET',
+      uri: `${publicRegistryUrl}${name}`,
+      json: true,
+      opted: true
+    })
+    verLen = Object.keys(pubVers).length
+    if (!verLen) return
+
+    const { integrity: publicIntegrity } = pubVers[(Object.keys(pubVers)[verLen - 1])].dist
+
+    if (!publicIntegrity) return
+    if (privateIntegrity !== publicIntegrity) {
+      E(chalk.red(`[NCM::SECURITY ISSUE DETECTED] "${name}" is vulnerable to npm substitution attacks. Use scopes for the internal packages to fix this`))
+      process.exit(1)
+    } else {
+      cachedPublicPackages.push(name)
+      setValue('cachedPublicPackages', [...new Set(cachedPublicPackages)])
+    }
+  } catch (err) {
+    E(err)
+  }
+}
+
 async function install (argv, arg1, arg2, arg3) {
   const childArgv = Array.from(process.argv.slice(3))
+  const regUrl = registryUrl()
+  const privateRegistryUrl = regUrl.endsWith('/') ? regUrl : `${regUrl}/`
   let name
   let version
+
   if (!arg1) {
-    printHelp()
-    process.exitCode = 1
+    try {
+      scannerLog()
+
+      let deps
+      try {
+        deps = require(path.join(process.cwd(), 'package.json'))
+      } catch (_) {} // skipped by below if there's no package.json
+
+      if (deps) {
+        const pkgTree = [...new Set(Object.keys({
+          ...(deps.dependencies || {}),
+          ...(deps.devDependencies || {})
+        }))]
+
+        pkgTree.forEach(async name =>
+          concurrentTaskQueue.push(verificationTask({ name, privateRegistryUrl }))
+        )
+
+        try {
+          await Promise.all(concurrentTaskQueue)
+        } catch (pErr) {
+          E(pErr)
+        }
+      }
+    } catch (err) {
+      E(err)
+    }
+
+    L(chalk`[NCM::SECURITY] Passed. Now installing...`)
+    L()
+
+    const args = [getValue('installCmd'), '', ...childArgv]
+    const bin = getValue('installBin')
+    const cp = spawn(bin, args, { stdio: 'inherit' })
+
+    cp.on('error', error => {
+      E()
+      E(chalk`{COLORS.red ${error}}`)
+      E()
+    })
+    cp.on('exit', code => {
+      process.exitCode = code
+    })
     return
   } else if (arg1.lastIndexOf('@') > 0 && !arg2 && !arg3) {
     childArgv.splice(childArgv.indexOf(arg1), 1)
@@ -46,6 +150,19 @@ async function install (argv, arg1, arg2, arg3) {
     return
   }
 
+  try {
+    scannerLog()
+
+    concurrentTaskQueue.push(verificationTask({ name, privateRegistryUrl }))
+    try {
+      await Promise.all(concurrentTaskQueue)
+    } catch (pErr) {
+      E(pErr)
+    }
+  } catch (err) {
+    E(err)
+  }
+
   await details(argv, arg1, arg2, arg3)
 
   const good = process.exitCode === 0 || process.exitCode === undefined

commands/report.js

@@ -115,6 +115,23 @@ async function report (argv, _dir) {
     return
   }
 
+  const {
+    name: pkgName,
+    version: pkgVersion
+  } = require(path.join(__dirname, '..', 'package.json'))
+
+  let nestedPkgName, nestedPkgVersion
+  try {
+    const {
+      name: _nestedPkgName,
+      version: _nestedPkgVersion
+    } = require(`${dir}/package.json`)
+    nestedPkgName = _nestedPkgName
+    nestedPkgVersion = _nestedPkgVersion
+  } catch (_) {}
+
+  const isNested = pkgName === nestedPkgName && pkgVersion === nestedPkgVersion
+
   for (let { name, version, scores, published } of data) {
     let maxSeverity = 0
     let license
@@ -147,6 +164,10 @@ async function report (argv, _dir) {
       version = '0.0.0-UNKNOWN-VERSION'
     }
 
+    if (isNested && !!maxSeverity) {
+      continue
+    }
+
     pkgScores.push({
       name,
       version,

lib/client-request.js

@@ -50,7 +50,7 @@ async function ClientRequestExtended (options) {
   }
 
   // Any non- 200-series code
-  if (response.statusCode < 200 || response.statusCode >= 300) {
+  if (!options.opted && (response.statusCode < 200 || response.statusCode >= 300)) {
     response.destroy()
 
     let error

lib/config.js

@@ -14,7 +14,8 @@ const keys = {
   org: 'default',
   orgId: '1',
   policy: ' ',
-  policyId: ' '
+  policyId: ' ',
+  cachedPublicPackages: []
 }
 
 module.exports = {

lib/report/short.js

@@ -55,6 +55,11 @@ function shortReport (report, whitelist, dir, argv) {
     L()
   }
 
+  let maxSeverityOfReport = 0
+  report.forEach(({ maxSeverity }) => {
+    maxSeverityOfReport = Math.max(maxSeverity, maxSeverityOfReport)
+  })
+
   if (filterCompliance || filterSecurity || filterLevel > 0) {
     const filterFormat = formatFilterOptions(filterOptions)
     if (whitelist.length > 0) {
@@ -76,7 +81,7 @@ function shortReport (report, whitelist, dir, argv) {
         filterOptions
       )
     }
-  } else {
+  } else if (maxSeverityOfReport > 0) {
     moduleList(report.slice(0, 5), 'Top 5: Highest Risk Modules')
   }
 }