OwlCyberSecurity - MANAGER

Edit File: inflate-shrinkwrap.js

'use strict'

const BB = require('bluebird')

let addBundled
const childPath = require('../utils/child-path.js')
const createChild = require('./node.js').create
let fetchPackageMetadata
const inflateBundled = require('./inflate-bundled.js')
const moduleName = require('../utils/module-name.js')
const normalizePackageData = require('normalize-package-data')
const npm = require('../npm.js')
const realizeShrinkwrapSpecifier = require('./realize-shrinkwrap-specifier.js')
const validate = require('aproba')
const path = require('path')
const isRegistry = require('../utils/is-registry.js')
const hasModernMeta = require('./has-modern-meta.js')
const ssri = require('ssri')
const npa = require('npm-package-arg')

module.exports = function (tree, sw, opts, finishInflating) {
  if (!fetchPackageMetadata) {
    fetchPackageMetadata = BB.promisify(require('../fetch-package-metadata.js'))
    addBundled = BB.promisify(fetchPackageMetadata.addBundled)
  }
  if (arguments.length === 3) {
    finishInflating = opts
    opts = {}
  }
  if (!npm.config.get('shrinkwrap') || !npm.config.get('package-lock')) {
    return finishInflating()
  }
  tree.loaded = false
  tree.hasRequiresFromLock = sw.requires
  return inflateShrinkwrap(tree.path, tree, sw.dependencies, opts).then(
    () => finishInflating(),
    finishInflating
  )
}

function inflateShrinkwrap (topPath, tree, swdeps, opts) {
  if (!swdeps) return Promise.resolve()
  if (!opts) opts = {}
  const onDisk = {}
  tree.children.forEach((child) => {
    onDisk[moduleName(child)] = child
  })

tree.children = []

return BB.each(Object.keys(swdeps), (name) => {
    const sw = swdeps[name]
    const dependencies = sw.dependencies || {}
    const requested = realizeShrinkwrapSpecifier(name, sw, topPath)

if (Object.keys(sw).length === 0) {
      let message = `Object for dependency "${name}" is empty.\n`
      message += 'Something went wrong. Regenerate the package-lock.json with "npm install".\n'
      message += 'If using a shrinkwrap, regenerate with "npm shrinkwrap".'
      return Promise.reject(new Error(message))
    }

return inflatableChild(
      onDisk[name], name, topPath, tree, sw, requested, opts
    ).then((child) => {
      child.hasRequiresFromLock = tree.hasRequiresFromLock
      return inflateShrinkwrap(topPath, child, dependencies)
    })
  })
}

function normalizePackageDataNoErrors (pkg) {
  try {
    normalizePackageData(pkg)
  } catch (ex) {
    // don't care
  }
}

function quotemeta (str) {
  return str.replace(/([^A-Za-z_0-9/])/g, '\\$1')
}

function tarballToVersion (name, tb) {
  const registry = quotemeta(npm.config.get('registry') || '')
    .replace(/https?:/, 'https?:')
    .replace(/([^/])$/, '$1/')
  let matchRegTarball
  if (name) {
    const nameMatch = quotemeta(name)
    matchRegTarball = new RegExp(`^${registry}${nameMatch}/-/${nameMatch}-(.*)[.]tgz$`)
  } else {
    matchRegTarball = new RegExp(`^${registry}(.*)?/-/\\1-(.*)[.]tgz$`)
  }
  const match = tb.match(matchRegTarball)
  if (!match) return
  return match[2] || match[1]
}

function relativizeLink (name, spec, topPath, requested) {
  if (!spec.startsWith('file:')) {
    return
  }

let requestedPath = requested.fetchSpec
  if (requested.type === 'file') {
    requestedPath = path.dirname(requestedPath)
  }

const relativized = path.relative(requestedPath, path.resolve(topPath, spec.slice(5)))
  return 'file:' + relativized
}

function inflatableChild (onDiskChild, name, topPath, tree, sw, requested, opts) {
  validate('OSSOOOO|ZSSOOOO', arguments)
  const usesIntegrity = (
    requested.registry ||
    requested.type === 'remote' ||
    requested.type === 'file'
  )
  const regTarball = tarballToVersion(name, sw.version)
  if (regTarball) {
    sw.resolved = sw.version
    sw.version = regTarball
  }
  if (sw.requires) {
    Object.keys(sw.requires).forEach(name => {
      const spec = sw.requires[name]
      sw.requires[name] = tarballToVersion(name, spec) ||
        relativizeLink(name, spec, topPath, requested) ||
        spec
    })
  }
  const modernLink = requested.type === 'directory' && !sw.from
  if (hasModernMeta(onDiskChild) && childIsEquivalent(sw, requested, onDiskChild)) {
    // The version on disk matches the shrinkwrap entry.
    if (!onDiskChild.fromShrinkwrap) onDiskChild.fromShrinkwrap = requested
    onDiskChild.package._requested = requested
    onDiskChild.package._spec = requested.rawSpec
    onDiskChild.package._where = topPath
    onDiskChild.package._optional = sw.optional
    onDiskChild.package._development = sw.dev
    onDiskChild.package._inBundle = sw.bundled
    onDiskChild.fromBundle = (sw.bundled || onDiskChild.package._inBundle) ? tree.fromBundle || tree : null
    if (!onDiskChild.package._args) onDiskChild.package._args = []
    onDiskChild.package._args.push([String(requested), topPath])
    // non-npm registries can and will return unnormalized data, plus
    // even the npm registry may have package data normalized with older
    // normalization rules. This ensures we get package data in a consistent,
    // stable format.
    normalizePackageDataNoErrors(onDiskChild.package)
    onDiskChild.swRequires = sw.requires
    tree.children.push(onDiskChild)
    return BB.resolve(onDiskChild)
  } else if ((sw.version && (sw.integrity || !usesIntegrity) && (requested.type !== 'directory' || modernLink)) || sw.bundled) {
    // The shrinkwrap entry has an integrity field. We can fake a pkg to get
    // the installer to do a content-address fetch from the cache, if possible.
    return BB.resolve(makeFakeChild(name, topPath, tree, sw, requested))
  } else {
    // It's not on disk, and we can't just look it up by address -- do a full
    // fpm/inflate bundle pass. For registry deps, this will go straight to the
    // tarball URL, as if it were a remote tarball dep.
    return fetchChild(topPath, tree, sw, requested)
  }
}

function isGit (sw) {
  const version = npa.resolve(sw.name, sw.version)
  return (version && version.type === 'git')
}

function makeFakeChild (name, topPath, tree, sw, requested) {
  const isDirectory = requested.type === 'directory'
  const from = sw.from || requested.raw
  const pkg = {
    name: name,
    version: sw.version,
    _id: name + '@' + sw.version,
    _resolved: sw.resolved || (isGit(sw) && sw.version),
    _requested: requested,
    _optional: sw.optional,
    _development: sw.dev,
    _inBundle: sw.bundled,
    _integrity: sw.integrity,
    _from: from,
    _spec: requested.rawSpec,
    _where: topPath,
    _args: [[requested.toString(), topPath]],
    dependencies: sw.requires
  }

if (!sw.bundled) {
    const bundleDependencies = Object.keys(sw.dependencies || {}).filter((d) => sw.dependencies[d].bundled)
    if (bundleDependencies.length === 0) {
      pkg.bundleDependencies = bundleDependencies
    }
  }
  const child = createChild({
    package: pkg,
    loaded: isDirectory,
    parent: tree,
    children: [],
    fromShrinkwrap: requested,
    fakeChild: sw,
    fromBundle: sw.bundled ? tree.fromBundle || tree : null,
    path: childPath(tree.path, pkg),
    realpath: isDirectory ? requested.fetchSpec : childPath(tree.realpath, pkg),
    location: (tree.location === '/' ? '' : tree.location + '/') + pkg.name,
    isLink: isDirectory,
    isInLink: tree.isLink || tree.isInLink,
    swRequires: sw.requires
  })
  tree.children.push(child)
  return child
}

function fetchChild (topPath, tree, sw, requested) {
  return fetchPackageMetadata(requested, topPath).then((pkg) => {
    pkg._from = sw.from || requested.raw
    pkg._optional = sw.optional
    pkg._development = sw.dev
    pkg._inBundle = false
    return addBundled(pkg).then(() => pkg)
  }).then((pkg) => {
    var isLink = pkg._requested.type === 'directory'
    const child = createChild({
      package: pkg,
      loaded: false,
      parent: tree,
      fromShrinkwrap: requested,
      path: childPath(tree.path, pkg),
      realpath: isLink ? requested.fetchSpec : childPath(tree.realpath, pkg),
      children: pkg._bundled || [],
      location: (tree.location === '/' ? '' : tree.location + '/') + pkg.name,
      fromBundle: null,
      isLink: isLink,
      isInLink: tree.isLink,
      swRequires: sw.requires
    })
    tree.children.push(child)
    if (pkg._bundled) {
      delete pkg._bundled
      inflateBundled(child, child, child.children)
    }
    return child
  })
}

function childIsEquivalent (sw, requested, child) {
  if (!child) return false
  if (child.fromShrinkwrap) return true
  if (
    sw.integrity &&
    child.package._integrity &&
    ssri.parse(sw.integrity).match(child.package._integrity)
  ) return true
  if (child.isLink && requested.type === 'directory') return path.relative(child.realpath, requested.fetchSpec) === ''

if (sw.resolved) return child.package._resolved === sw.resolved
  if (!isRegistry(requested) && sw.from) return child.package._from === sw.from
  if (!isRegistry(requested) && child.package._resolved) return sw.version === child.package._resolved
  return child.package.version === sw.version
}