nodesecurity/nsp — pull request #41 by pose (2014-09-11 01:27:56+00:00)
Title: Fixes and improvements for `audit-package`.

Hi,

I've had a couple of issues while using `nsp`. In this PR, I'm fixing some of the issues but there are a couple more that need to be addressed (I'm going to create issues for those). Take into account, that my fixes are only on the `audit-package` mode. It would be great if we could make a commitment to have this changes also performed on `audit-shrinkwrap` mode. Thanks!

----

Here is an overview of the changes:

### Obscure parent /multiple dependencies support

If you tried to see which package were introducing vulnerabilities, the following cryptic message was displayed:

```
❯ nsp shrinkwrap
Name Installed Patched Vulnerable Dependency
insecure 0.0.1 >= 0.1.x my-project > foo
insecure 0.0.1 >= 0.1.x my-project > foo
insecure 0.0.1 >= 0.1.x my-project > bar
insecure 0.0.1 >= 0.1.x my-project > bar
```

In most of the cases, while doing `find . -name "request"` the problem was with `my-project` including a transitive dependency. That was not clear. That's why I've changed it to be:

```
Name Installed Patched Vulnerable Dependency
insecure 0.0.1 >= 1.x my-project@0.0.0 > foo@1.2.3 > baz@1.1.1 > qs@0.6.6
insecure 0.0.1 >= 1.x my-project@0.0.0 > bar@3.2.1 > qs@0.6.5
```

Now, the whole chain of dependencies is displayed with the offending module. Also, the versions are included, so it's easier to see why that module is being included. Moreover, the repeated message has been erased (it took me some time to find it was duplicated).

**Action Item**: It would be great to add this feature to `auditShrinkwrap` mode.

### URL dependencies were ignored

> *URL depencies*: Using an URL as a dependency to download/fetch the module.

`nsp` was silently ignoring them which could lead to some vulnerabilities go undetected. I did not implement this feature but I've added a warning saying that git dependency was not resolved. For instance, on the following `package.json`:

```json
{
"name": "my-module",
"version": "0.0.1",
"dependencies": {
"foo": "git+ssh://git@github.com:foo/barbaz.git",
"foobar": "https://github.com/wow/foo/tarball/foobar",
"bar": "https://registry.npmjs.org/baz/-/foobar-0.0.0.tgz",
"f00": "https://github.com/bar/f000bar/tarball/foo"
}
}
```

This will be reported:

```
❯ nsp package
Warning: Git dependency [foo@git+ssh://git@github.com:foo/barbaz.git] ignored.
Warning: Git dependency [foobar@https://github.com/wow/foo/tarball/foobar] ignored.
Warning: Git dependency [bar@https://registry.npmjs.org/baz/-/foobar-0.0.0.tgz] ignored.
Warning: Git dependency [f00@https://github.com/bar/f000bar/tarball/foo] ignored.
```

**Action Item**: It would be great to add support for git repository fetching and analyzing.
**Action Item**: It would be great to add this feature to `auditShrinkwrap` mode.

### Tests

I've added tests showing the cases described on top and some sample `package.json` as fixtures.