File Explorer

1// this is the public class that is used by consumers.2// the Advisory class handles all the calculation, and this3// class handles all the IO with the registry and cache.4const pacote = require('pacote')5const cacache = require('cacache')6const { time } = require('proc-log')7const Advisory = require('./advisory.js')8const { homedir } = require('os')9const jsonParse = require('json-parse-even-better-errors')10 11const _packument = Symbol('packument')12const _cachePut = Symbol('cachePut')13const _cacheGet = Symbol('cacheGet')14const _cacheData = Symbol('cacheData')15const _packuments = Symbol('packuments')16const _cache = Symbol('cache')17const _options = Symbol('options')18const _advisories = Symbol('advisories')19const _calculate = Symbol('calculate')20 21class Calculator {22  constructor (options = {}) {23    this[_options] = { ...options }24    this[_cache] = this[_options].cache || (homedir() + '/.npm/_cacache')25    this[_options].cache = this[_cache]26    this[_packuments] = new Map()27    this[_cacheData] = new Map()28    this[_advisories] = new Map()29  }30 31  get cache () {32    return this[_cache]33  }34 35  get options () {36    return { ...this[_options] }37  }38 39  async calculate (name, source) {40    const k = `security-advisory:${name}:${source.id}`41    if (this[_advisories].has(k)) {42      return this[_advisories].get(k)43    }44 45    const p = this[_calculate](name, source)46    this[_advisories].set(k, p)47    return p48  }49 50  async [_calculate] (name, source) {51    const k = `security-advisory:${name}:${source.id}`52    const timeEnd = time.start(`metavuln:calculate:${k}`)53    const advisory = new Advisory(name, source, this[_options])54    // load packument and cached advisory55    const [cached, packument] = await Promise.all([56      this[_cacheGet](advisory),57      this[_packument](name),58    ])59    const timeEndLoad = time.start(`metavuln:load:${k}`)60    advisory.load(cached, packument)61    timeEndLoad()62    if (advisory.updated) {63      await this[_cachePut](advisory)64    }65    this[_advisories].set(k, advisory)66    timeEnd()67    return advisory68  }69 70  async [_cachePut] (advisory) {71    const { name, id } = advisory72    const key = `security-advisory:${name}:${id}`73    const timeEnd = time.start(`metavuln:cache:put:${key}`)74    const data = JSON.stringify(advisory)75    const options = { ...this[_options] }76    this[_cacheData].set(key, jsonParse(data))77    await cacache.put(this[_cache], key, data, options).catch(() => {})78    timeEnd()79  }80 81  async [_cacheGet] (advisory) {82    const { name, id } = advisory83    const key = `security-advisory:${name}:${id}`84    /* istanbul ignore if - should be impossible, since we memoize the85     * advisory object itself using the same key, just being cautious */86    if (this[_cacheData].has(key)) {87      return this[_cacheData].get(key)88    }89 90    const timeEnd = time.start(`metavuln:cache:get:${key}`)91    const p = cacache.get(this[_cache], key, { ...this[_options] })92      .catch(() => ({ data: '{}' }))93      .then(({ data }) => {94        data = jsonParse(data)95        timeEnd()96        this[_cacheData].set(key, data)97        return data98      })99    this[_cacheData].set(key, p)100    return p101  }102 103  async [_packument] (name) {104    if (this[_packuments].has(name)) {105      return this[_packuments].get(name)106    }107 108    const timeEnd = time.start(`metavuln:packument:${name}`)109    const p = pacote.packument(name, { ...this[_options] })110      .catch(() => {111        // presumably not something from the registry.112        // an empty packument will have an effective range of *113        return {114          name,115          versions: {},116        }117      })118      .then(paku => {119        timeEnd()120        this[_packuments].set(name, paku)121        return paku122      })123    this[_packuments].set(name, p)124    return p125  }126}127 128module.exports = Calculator129