Skip to content

Commit 73cc59d

Browse files
ericcornelissenericcornelissen
authored
feat: add --integrity-exclude option (#188)
Add a new option available on the CLI as --integrity-exclude which allows user to disable the --validate-integrity check for specific packages.As an aside, this also formats the table in the lockfile-lint package's README. fix #187
1 parent 7958b39 commit 73cc59d

File tree

6 files changed

+58
-18
lines changed

6 files changed

+58
-18
lines changed

‎packages/lockfile-lint-api/__tests__/validators.integrityHashType.test.js

Lines changed: 28 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,15 @@ describe('Validator: Integrity', () => {
1717
expect(() => new ValidateIntegrity()).toThrowError()
1818
})
1919

20+
it('validator should throw an error when excludedPackages is not an array', () => {
21+
const options = {
22+
integrityExclude: 'not-an-array'
23+
}
24+
25+
const validator = new ValidateIntegrity({packages: {}})
26+
expect(() => validator.validate(options)).toThrowError()
27+
})
28+
2029
it('validator should fail if not allowed hash type is used for a resource', () => {
2130
const mockedPackages = {
2231
bolt11: {
@@ -29,7 +38,8 @@ describe('Validator: Integrity', () => {
2938
type: 'error',
3039
errors: [
3140
{
32-
message: 'detected invalid integrity hash type for package: bolt11\n expected: sha512\n actual: sha1-1ZNEUixLxGSmWnMKxpUAf9tm3Yg=\n',
41+
message:
42+
'detected invalid integrity hash type for package: bolt11\n expected: sha512\n actual: sha1-1ZNEUixLxGSmWnMKxpUAf9tm3Yg=\n',
3343
package: 'bolt11'
3444
}
3545
]
@@ -71,6 +81,23 @@ describe('Validator: Integrity', () => {
7181
})
7282
})
7383

84+
it('validator should not fail if an excluded package has an invalid integrity hash type', () => {
85+
const mockedPackages = {
86+
typescript: {
87+
integrity: 'sha1-1ZNEUixLxGSmWnMKxpUAf9tm3Yg='
88+
}
89+
}
90+
const options = {
91+
integrityExclude: ['typescript']
92+
}
93+
94+
const validator = new ValidateIntegrity({packages: mockedPackages})
95+
expect(validator.validate(options)).toEqual({
96+
type: 'success',
97+
errors: []
98+
})
99+
})
100+
74101
it('validator should return true for a single package with a valid URL', () => {
75102
const mockedPackages = {
76103
typescript: {

‎packages/lockfile-lint-api/src/validators/ValidateIntegrity.js

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,12 @@ module.exports = class ValidateIntegrity {
1313
this.packages = packages
1414
}
1515

16-
validate () {
16+
validate (options) {
17+
const excludedPackages = options && options.integrityExclude ? options.integrityExclude : []
18+
if (!Array.isArray(excludedPackages)) {
19+
throw new Error('excluded packages must be an array')
20+
}
21+
1722
const validationResult = {
1823
type: 'success',
1924
errors: []
@@ -24,12 +29,14 @@ module.exports = class ValidateIntegrity {
2429
continue
2530
}
2631

32+
if (excludedPackages.includes(packageName)) {
33+
continue
34+
}
35+
2736
try {
2837
if (!isSha512(packageMetadata)) {
2938
validationResult.errors.push({
30-
message: `detected invalid integrity hash type for package: ${packageName}\n expected: sha512\n actual: ${
31-
packageMetadata.integrity
32-
}\n`,
39+
message: `detected invalid integrity hash type for package: ${packageName}\n expected: sha512\n actual: ${packageMetadata.integrity}\n`,
3340
package: packageName
3441
})
3542
}

‎packages/lockfile-lint/README.md

Lines changed: 12 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -78,17 +78,18 @@ lockfile-lint --path yarn.lock --allowed-hosts yarn --allowed-urls https://githu
7878

7979
| command line argument | description | implemented |
8080
|----------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------|
81-
| `--path`, `-p` | path to the lockfile but you can also provide a glob matching pattern as long as it isn't expanded by a shell like bash or zsh. If that's the case, you can provide it as a string, for example: `-p '/Users/lirantal/repos/**/package-lock.json'` to match multiple lockfiles | ✅ |
82-
| `--type`, `-t` | lockfile type, options are `npm` or `yarn` | ✅ |
83-
| `--format`, `-f` | sets what type of report output is desired, one of [ `pretty`, `plain` ] with `plain` removing colors & status symbols from output | ✅ |
84-
| `--validate-https`, `-s` | validates the use of HTTPS as protocol schema for all resources in the lockfile | ✅ |
85-
| `--allowed-hosts`, `-a` | validates a list of allowed hosts to be used for all resources in the lockfile. Supported short-hands aliases are `npm`, `yarn`, and `verdaccio` which will match URLs `https://registry.npmjs.org`, `https://registry.yarnpkg.com` and `https://registry.verdaccio.org` respectively | ✅ |
86-
| `--allowed-schemes`, `-o` | allowed [URI schemes](https://tools.ietf.org/html/rfc2396#section-3.1) such as "https:", "http", "git+ssh:", or "git+https:" | ✅ |
87-
| `--allowed-urls`, `-u` | allowed URLs (e.g. `https://github.com/some-org/some-repo#some-hash`) | ✅ |
88-
| `--empty-hostname`, `-e` | allow empty hostnames, or set to false if you wish for a stricter policy | ✅ |
89-
| `--validate-package-names`, `-n` | validates that the resolved URL matches the package name | ✅ |
90-
| `--validate-integrity`, `-i` | validates the integrity field is a sha512 hash | ✅ |
91-
| `--allowed-package-name-aliases`, `-l` | allow package name aliases to be used by specifying package name and their alias as pairs (e.g: `string-width-cjs:string-width`) | ✅ |
81+
| `--path`, `-p` | path to the lockfile but you can also provide a glob matching pattern as long as it isn't expanded by a shell like bash or zsh. If that's the case, you can provide it as a string, for example: `-p '/Users/lirantal/repos/**/package-lock.json'` to match multiple lockfiles | ✅ |
82+
| `--type`, `-t` | lockfile type, options are `npm` or `yarn` | ✅ |
83+
| `--format`, `-f` | sets what type of report output is desired, one of [ `pretty`, `plain` ] with `plain` removing colors & status symbols from output | ✅ |
84+
| `--validate-https`, `-s` | validates the use of HTTPS as protocol schema for all resources in the lockfile | ✅ |
85+
| `--allowed-hosts`, `-a` | validates a list of allowed hosts to be used for all resources in the lockfile. Supported short-hands aliases are `npm`, `yarn`, and `verdaccio` which will match URLs `https://registry.npmjs.org`, `https://registry.yarnpkg.com` and `https://registry.verdaccio.org` respectively | ✅ |
86+
| `--allowed-schemes`, `-o` | allowed [URI schemes](https://tools.ietf.org/html/rfc2396#section-3.1) such as "https:", "http", "git+ssh:", or "git+https:" | ✅ |
87+
| `--allowed-urls`, `-u` | allowed URLs (e.g. `https://github.com/some-org/some-repo#some-hash`) | ✅ |
88+
| `--empty-hostname`, `-e` | allow empty hostnames, or set to false if you wish for a stricter policy | ✅ |
89+
| `--validate-package-names`, `-n` | validates that the resolved URL matches the package name | ✅ |
90+
| `--validate-integrity`, `-i` | validates the integrity field is a sha512 hash | ✅ |
91+
| `--allowed-package-name-aliases`, `-l` | allow package name aliases to be used by specifying package name and their alias as pairs (e.g: `string-width-cjs:string-width`) | ✅ |
92+
| `--integrity-exclude` | exclude packages from the `--validate-integrity` check | ✅ |
9293

9394
# File-Based Configuration
9495

‎packages/lockfile-lint/bin/lockfile-lint.js

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,8 @@ for (const lockfilePath of lockfilesList) {
8181
emptyHostname: config['empty-hostname'],
8282
allowedHosts: config['allowed-hosts'],
8383
allowedUrls: config['allowed-urls'],
84-
allowedPackageNameAliases: config['allowed-package-name-aliases']
84+
allowedPackageNameAliases: config['allowed-package-name-aliases'],
85+
integrityExclude: config['integrity-exclude']
8586
}
8687
})
8788
}

‎packages/lockfile-lint/src/config.js

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -85,6 +85,10 @@ module.exports = (argv, exitProcess = false, searchFrom = process.cwd()) => {
8585
type: 'array',
8686
describe: 'validates an alias of package names to be used for resources in the lockfile'
8787
},
88+
'integrity-exclude': {
89+
type: 'array',
90+
describe: 'do not validate integrity for these package'
91+
},
8892
format: {
8993
alias: ['f'],
9094
type: 'string',

‎packages/lockfile-lint/src/validators/index.js

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -134,5 +134,5 @@ function ValidateIntegrityManager ({path, type, validatorValues, validatorOption
134134
const lockfile = parser.parseSync()
135135
const validator = new ValidateIntegrity({packages: lockfile.object})
136136

137-
return validator.validate()
137+
return validator.validate(validatorOptions)
138138
}

0 commit comments

Comments
 (0)