Handle cycles in audit report

Author: weirdwater

packages/pluggable-widgets-tools/src/commands/audit.ts

@@ -20,7 +20,7 @@ export async function auditPluggableWidgetsTools(fix: boolean = false) {
     }
 
     // Collect updateable, vulnerable packages installed by pwt
-    const vulnerabilities = NpmAudit.collectVulnerabilities(report, report.vulnerabilities[pluggableWidgetsTools]);
+    const vulnerabilities = NpmAudit.collectVulnerabilities(report, pluggableWidgetsTools);
     const vulnerableDependencies = vulnerabilities
         .map(v => v.name)
         .reduce((unique, p) => (unique.includes(p) ? unique : [...unique, p]), [] as NpmAudit.PackageName[]);

packages/pluggable-widgets-tools/src/common.ts

@@ -1,6 +1,13 @@
-export function ensure<T>(arg?: T): T {
-    if (arg == null) {
-        throw new Error("Did not expect an argument to be undefined");
+export function ensure<T>(arg?: T, label: string = "argument"): T {
+    if (arg === null || arg === undefined) {
+        throw new Error(`Did not expect ${label} to be ${arg}`);
     }
     return arg;
 }
+
+export function partition<T, A extends T, B extends Exclude<T, A>>(
+    input: Array<T>,
+    predicate: (x: T) => x is A
+): [A[], B[]] {
+    return [input.filter(predicate), input.filter((x): x is B => !predicate(x))] as const;
+}

packages/pluggable-widgets-tools/src/utils/npmAudit.ts

@@ -1,8 +1,9 @@
 import assert from "node:assert";
-import { exec } from "node:child_process";
 import { existsSync } from "node:fs";
 import { join } from "node:path";
 import { widgetRoot } from "../widget/paths";
+import { ensure, partition } from "../common";
+import { exec } from "node:child_process";
 
 export type Report = {
     auditReportVersion: 2;
@@ -59,15 +60,28 @@ export type Vulnerability = {
     range: string;
 };
 
-export function collectVulnerabilities(report: Report, dependency: Dependency): Vulnerability[] {
-    const vulnerabilities = dependency.via.filter(v => typeof v !== "string");
-    if (vulnerabilities.length > 0) {
-        return vulnerabilities;
+export function collectVulnerabilities(report: Report, rootDependency: PackageName): Vulnerability[] {
+    const dependencies: PackageName[] = [rootDependency];
+    const dependenciesSeen: PackageName[] = [];
+    const allVulnerabilities: Vulnerability[] = [];
+
+    while (dependencies.length > 0) {
+        const dependencyName = ensure(dependencies.shift());
+        dependenciesSeen.push(dependencyName);
+
+        const [transients, vulnerabilities] = partition(
+            report.vulnerabilities[dependencyName].via,
+            v => typeof v === "string"
+        );
+
+        if (vulnerabilities.length > 0) {
+            allVulnerabilities.push(...vulnerabilities);
+            continue;
+        }
+        dependencies.push(...transients.filter(d => !dependenciesSeen.includes(d)));
     }
 
-    return dependency.via
-        .filter(v => typeof v === "string")
-        .flatMap(v => collectVulnerabilities(report, report.vulnerabilities[v]));
+    return allVulnerabilities;
 }
 
 export async function run(): Promise<Report> {