snyk-go-plugin - npm Package Compare versions

Comparing version 1.17.0 to 1.18.0

dist/index.js

@@ -55,6 +55,2 @@ "use strict";
         path.join(__dirname, '../gosrc/resolve-deps.go'),
-        path.join(__dirname, '../gosrc/resolver/pkg.go'),
-        path.join(__dirname, '../gosrc/resolver/resolver.go'),
-        path.join(__dirname, '../gosrc/resolver/dirwalk/dirwalk.go'),
-        path.join(__dirname, '../gosrc/resolver/graph/graph.go'),
     ];
@@ -120,3 +116,3 @@ }
         debug('executing go deps resolver', { cmd: 'go' + args.join(' ') });
-        const graphStr = await subProcess.execute('go', args, { cwd: root });
+        const graphStr = await runGo(args, { cwd: root, env: { GO111MODULE: 'off' } });
         tempDirObj.removeCallback();
@@ -309,5 +305,8 @@ debug('loading deps resolver graph output to graphlib', { jsonSize: graphStr.length });
         const goModAbsolutPath = path.resolve(root, path.dirname(targetFile));
-        goDepsOutput = await subProcess.execute('go list', ['-json', '-deps', './...'], { cwd: goModAbsolutPath });
+        goDepsOutput = await runGo(['list', '-json', '-deps', './...'], { cwd: goModAbsolutPath });
     }
     catch (err) {
+        if (/cannot find main module, but found/.test(err)) {
+            return depGraphBuilder.build();
+        }
         const userError = new custom_error_1.CustomError(err);
@@ -342,2 +341,17 @@ userError.userMessage = "'go list -json -deps ./...' command failed with error: " + userError.message;
 exports.buildDepGraphFromImportsAndModules = buildDepGraphFromImportsAndModules;
+async function runGo(args, options, additionalGoCommands = []) {
+    try {
+        return await subProcess.execute('go', args, options);
+    }
+    catch (err) {
+        const [command] = /(go mod download)|(go get [^"]*)/.exec(err) || [];
+        if (command && !additionalGoCommands.includes(command)) {
+            debug('running command:', command);
+            const [_, ...newArgs] = command.split(' ');
+            await subProcess.execute('go', newArgs, options);
+            return runGo(args, options, additionalGoCommands.concat(command));
+        }
+        throw err;
+    }
+}
 function buildGraph(depGraphBuilder, depPackages, packagesByName, currentParent, childrenChain, ancestorsChain) {
@@ -344,0 +358,0 @@ var _a;

dist/sub-process.d.ts

 export declare function execute(command: string, args: string[], options?: {
     cwd?: string;
+    env?: any;
 }): Promise<string>;

dist/sub-process.js

@@ -12,5 +12,8 @@ "use strict";
     const spawnOptions = { shell: true };
-    if (options && options.cwd) {
+    if (options === null || options === void 0 ? void 0 : options.cwd) {
         spawnOptions.cwd = options.cwd;
     }
+    if (options === null || options === void 0 ? void 0 : options.env) {
+        spawnOptions.env = Object.assign(Object.assign({}, process.env), options.env);
+    }
     return new Promise((resolve, reject) => {
@@ -17,0 +20,0 @@ let stdout = '';

lib/index.ts

@@ -87,6 +87,2 @@ import * as fs from 'fs';
     path.join(__dirname, '../gosrc/resolve-deps.go'),
-    path.join(__dirname, '../gosrc/resolver/pkg.go'),
-    path.join(__dirname, '../gosrc/resolver/resolver.go'),
-    path.join(__dirname, '../gosrc/resolver/dirwalk/dirwalk.go'),
-    path.join(__dirname, '../gosrc/resolver/graph/graph.go'),
   ];
@@ -168,6 +164,5 @@ }
     debug('executing go deps resolver', {cmd: 'go' + args.join(' ')});
-    const graphStr = await subProcess.execute(
-      'go',
+    const graphStr = await runGo(
       args,
-      {cwd: root},
+      { cwd: root, env: { GO111MODULE: 'off' } },
     );
@@ -488,4 +483,7 @@ tempDirObj.removeCallback();
     const goModAbsolutPath = path.resolve(root, path.dirname(targetFile));
-    goDepsOutput = await subProcess.execute('go list', ['-json', '-deps', './...'], { cwd: goModAbsolutPath } );
+    goDepsOutput = await runGo(['list', '-json', '-deps', './...'], {cwd: goModAbsolutPath});
   } catch (err) {
+    if (/cannot find main module, but found/.test(err)) {
+      return depGraphBuilder.build();
+    }
     const userError = new CustomError(err);
@@ -526,2 +524,17 @@ userError.userMessage = "'go list -json -deps ./...' command failed with error: " + userError.message;
 
+async function runGo(args: string[], options: any, additionalGoCommands: string[] = []): Promise<string> {
+  try {
+    return await subProcess.execute('go', args, options);
+  } catch (err) {
+    const [command] = /(go mod download)|(go get [^"]*)/.exec(err) || [];
+    if (command && !additionalGoCommands.includes(command)) {
+      debug('running command:', command);
+      const [_, ...newArgs] = command.split(' ');
+      await subProcess.execute('go', newArgs, options);
+      return runGo(args, options, additionalGoCommands.concat(command));
+    }
+    throw err;
+  }
+}
+
 function buildGraph(depGraphBuilder: DepGraphBuilder,
@@ -528,0 +541,0 @@ depPackages: string[],

lib/sub-process.ts

 import * as childProcess from 'child_process';
 
-export function execute(command: string, args: string[], options?: {cwd?: string}): Promise<string> {
+export function execute(command: string, args: string[], options?: { cwd?: string, env?: any }): Promise<string> {
 
@@ -12,5 +12,8 @@ if (process.env.TERM_PROGRAM === 'vscode') {
   const spawnOptions: childProcess.SpawnOptions = {shell: true};
-  if (options && options.cwd) {
+  if (options?.cwd) {
     spawnOptions.cwd = options.cwd;
   }
+  if (options?.env) {
+    spawnOptions.env = { ...process.env, ...options.env };
+  }
 
@@ -17,0 +20,0 @@ return new Promise((resolve, reject) => {

package.json

@@ -44,3 +44,3 @@ {
   },
-  "version": "1.17.0"
+  "version": "1.18.0"
 }

New alerts

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

87406

increased by0.83%

Lines of code

1624

increased by1.44%

Worsened metrics

Number of package files

23

decreased by-14.81%

Number of low supply chain risk alerts

3

increased by50%

No dependency changes