SEND SOME Hash hash hash to IQ

.vscode/launch.json

@@ -15,7 +15,7 @@
       "type": "node",
       "request": "launch",
       "name": "Launch with Nexus IQ Server",
-      "args": ["iq", "-a", "auditjs"],
+      "args": ["iq", "-a", "testapp"],
       "program": "${workspaceFolder}/src/index.ts",
       "preLaunchTask": "tsc: build - tsconfig.json",
       "console": "integratedTerminal",

.vscode/tasks.json

@@ -0,0 +1,17 @@
+{
+    // See https://go.microsoft.com/fwlink/?LinkId=733558
+    // for the documentation about the tasks.json format
+    "version": "2.0.0",
+    "tasks": [
+      {
+        "type": "typescript",
+        "tsconfig": "tsconfig.json",
+        "problemMatcher": ["$tsc"],
+        "group": {
+          "kind": "build",
+          "isDefault": true
+        }
+      }
+    ]
+  }
+

package.json

@@ -51,7 +51,9 @@
   "devDependencies": {
     "@types/chai": "4.2.0",
     "@types/chai-as-promised": "7.1.1",
+    "@types/elementtree": "^0.1.0",
     "@types/figlet": "^1.2.0",
+    "@types/glob": "^7.1.3",
     "@types/js-yaml": "^3.12.2",
     "@types/mocha": "5.2.7",
     "@types/mock-fs": "^4.10.0",
@@ -86,7 +88,9 @@
   "dependencies": {
     "chalk": "^3.0.0",
     "colors": "^1.3.1",
+    "elementtree": "^0.1.7",
     "figlet": "^1.2.4",
+    "glob": "^7.1.6",
     "https-proxy-agent": "^5.0.0",
     "js-yaml": "3.13.1",
     "log4js": "^6.1.2",

src/Application/Application.ts

@@ -32,6 +32,10 @@ import { filterVulnerabilities } from '../Whitelist/VulnerabilityExcluder';
 import { IqServerConfig } from '../Config/IqServerConfig';
 import { OssIndexServerConfig } from '../Config/OssIndexServerConfig';
 import { visuallySeperateText } from '../Visual/VisualHelper';
+import { Lister } from '../Hasher/Lister';
+import { join } from 'path';
+import { Merger } from '../Merger/Merger';
+import { Hasher } from '../Hasher/Hasher';
 const pj = require('../../package.json');
 
 export class Application {
@@ -74,7 +78,7 @@ export class Application {
       logMessage('Attempting to start application', DEBUG);
       logMessage('Getting coordinates for Sonatype IQ', DEBUG);
       this.spinner.maybeCreateMessageForSpinner('Getting coordinates for Sonatype IQ');
-      await this.populateCoordinatesForIQ();
+      await this.populateCoordinatesForIQ(args.deep);
       logMessage(`Coordinates obtained`, DEBUG, this.sbom);
 
       this.spinner.maybeSucceed();
@@ -133,11 +137,38 @@ export class Application {
     }
   }
 
-  private async populateCoordinatesForIQ(): Promise<void> {
+  private getHashesFromPath(paths: Set<string>, basePath = '') {
+    const promises: any[] = [];
+    const hasher = new Hasher('sha1');
+
+    paths.forEach((path) => {
+      promises.push(hasher.getHashFromPath(join(process.cwd(), basePath, path)));
+    });
+
+    return Promise.all(promises);
+  }
+
+  private async populateCoordinatesForIQ(deepPath = ''): Promise<void> {
     try {
-      logMessage('Trying to get sbom from cyclonedx/bom', DEBUG);
-      this.sbom = await this.muncher.getSbomFromCommand();
-      logMessage('Successfully got sbom from cyclonedx/bom', DEBUG);
+      if (deepPath != '') {
+        logMessage('Trying to get sbom from cyclonedx/bom and list of hashes from deepPath', DEBUG);
+        const files = Lister.getListOfFilesInBasePath(join(deepPath));
+        logMessage('Got list of files to get hashes from', DEBUG, { files: files });
+        logMessage('Attempting to generate sbom and get hashes', DEBUG);
+        await Promise.all([this.getHashesFromPath(files, deepPath), this.muncher.getSbomFromCommand()]).then(
+          async (values) => {
+            logMessage('Got sbom and hashes, attempting to merge them', DEBUG);
+            const merger = new Merger();
+            this.sbom = await merger.mergeHashesIntoSbom(values[0], values[1]);
+            logMessage('Sbom merged', DEBUG, { sbom: this.sbom });
+            logMessage('Merge of sbom and hashes successful, our work is done here', DEBUG);
+          },
+        );
+      } else {
+        logMessage('Trying to get sbom from cyclonedx/bom', DEBUG);
+        this.sbom = await this.muncher.getSbomFromCommand();
+        logMessage('Successfully got sbom from cyclonedx/bom', DEBUG);
+      }
     } catch (e) {
       logMessage(`An error was encountered while gathering your dependencies into an SBOM`, ERROR, {
         title: e.message,

src/Hasher/Hasher.spec.ts

@@ -0,0 +1,51 @@
+/*
+ * Copyright (c) 2020-present Sonatype, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import expect from '../Tests/TestHelper';
+import { Hasher } from './Hasher';
+import mock from 'mock-fs';
+
+const json = `{"thing": "value"}`;
+
+const json2 = `{"anotherThing": "anotherValue"}`;
+
+const json3 = `{"yetAnotherThing": "yetAnotherValue"}`;
+
+describe('Hasher', () => {
+  it('should return a sha1 hash for a provided path', async () => {
+    mock({
+      '/nonsensical': {
+        'auditjs.js': json,
+        directory: {
+          'anotherpath.js': json2,
+          'fakething.js': json3,
+          anotherdirectory: {},
+        },
+      },
+    });
+
+    const expected = '54bbc009e6ba2ee4e892a0347279819bd30e5e29';
+
+    const hasher = new Hasher('sha1');
+
+    const result = await hasher.getHashFromPath('/nonsensical/auditjs.js');
+
+    expect(result.hash).to.eq(expected);
+
+    expect(result.path).to.eq('/nonsensical/auditjs.js');
+
+    mock.restore();
+  });
+});

src/Hasher/Hasher.ts

@@ -0,0 +1,42 @@
+/*
+ * Copyright (c) 2020-present Sonatype, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import fs from 'fs';
+import crypto from 'crypto';
+import { HashCoordinate } from '../Types/HashCoordinate';
+
+export class Hasher {
+  constructor(readonly algorithm: string = 'sha1') {}
+
+  public getHashFromPath(path: string): Promise<HashCoordinate> {
+    return new Promise((resolve, reject) => {
+      const fd = fs.createReadStream(path);
+      const hash = crypto.createHash(this.algorithm);
+      hash.setEncoding('hex');
+
+      fd.on('end', () => {
+        hash.end();
+        resolve(new HashCoordinate(hash.read(), path));
+      });
+
+      fd.on('error', (err) => {
+        reject(err);
+      });
+
+      fd.pipe(hash);
+    });
+  }
+}

src/Hasher/Lister.spec.ts

@@ -0,0 +1,44 @@
+/*
+ * Copyright (c) 2020-present Sonatype, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import expect from '../Tests/TestHelper';
+import { Lister } from './Lister';
+import mock from 'mock-fs';
+
+describe('Lister', () => {
+  it('should return a set of paths to js files and no directories given a base path', async () => {
+    mock({
+      '/nonsensical': {
+        'auditjs.js': '{}',
+        directory: {
+          'anotherpath.js': '{}',
+          'fakething.notjs': '{}',
+          anotherdirectory: {},
+        },
+      },
+    });
+
+    const expected = new Set();
+
+    expected.add('auditjs.js');
+    expected.add('directory/anotherpath.js');
+
+    const result = Lister.getListOfFilesInBasePath('/nonsensical');
+
+    expect(result).to.deep.eq(expected);
+
+    mock.restore();
+  });
+});

src/Hasher/Lister.ts

@@ -0,0 +1,24 @@
+/*
+ * Copyright (c) 2020-present Sonatype, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import glob from 'glob';
+
+export abstract class Lister {
+  public static getListOfFilesInBasePath(path: string): Set<string> {
+    const files = glob.sync(`**/*.js`, { nodir: true, cwd: path });
+
+    return new Set(files);
+  }
+}