Merge pull request #2435 from strapi/add-snyk

Check dependencies vulnerability with Snyk

.snyk

@@ -0,0 +1,9 @@
+# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.
+version: v1.12.0
+# ignores vulnerabilities until expiry date; change duration by modifying expiry date
+ignore:
+  shelljs:
+    - '*':
+        reason: testing
+        expires: 2019-01-04T14:31:33.160Z
+patch: {}

.travis.yml

@@ -6,14 +6,15 @@ git:
 language: node_js
 
 node_js:
-  - "10"
-  - "11"
+  - '10'
+  - '11'
 
 before_install:
   - export CHROME_BIN=chromium-browser
   - export DISPLAY=:99.0
   - sh -e /etc/init.d/xvfb start
   - git fetch -a
+  - git fetch origin master
   # - sudo chown -R $(whoami) $(npm config get prefix)/{lib/node_modules,bin,share}
   # - npm cache clean --force
   # - rm -rf node_modules/
@@ -21,10 +22,14 @@ before_install:
 install:
   - npm run setup --debug
 
+before_script:
+  - git fetch origin master:master
+
 script:
   - npm run lint
   - npm run doc
+  - npm run snyk
 
 cache:
   directories:
-    - "node_modules"
+    - 'node_modules'

package.json

@@ -20,7 +20,8 @@
     "redux-saga": "^0.14.3",
     "request": "^2.87.0",
     "shelljs": "^0.7.7",
-    "strapi-lint": "file:packages/strapi-lint"
+    "strapi-lint": "file:packages/strapi-lint",
+    "snyk": "^1.99.0"
   },
   "scripts": {
     "clean": "npm run removesymlinkdependencies && npx rimraf package-lock.json && npx rimraf packages/*/package-lock.json",
@@ -32,8 +33,9 @@
     "setup:build": "npm run setup --build",
     "setup": "npm run clean:all && npm install ./packages/strapi-lint --save-dev && npm install && node ./scripts/setup.js && npm run clean",
     "lint": "node ./scripts/lint.js",
-    "test": "node ./test/start.js",
-    "prettier": "node ./packages/strapi-lint/lib/internals/prettier/index.js"
+    "test": "snyk test && node ./test/start.js",
+    "prettier": "node ./packages/strapi-lint/lib/internals/prettier/index.js",
+    "snyk": "node ./scripts/snyk.js"
   },
   "author": {
     "email": "hi@strapi.io",

packages/strapi-admin/.snyk

@@ -0,0 +1,9 @@
+# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.
+version: v1.12.0
+# ignores vulnerabilities until expiry date; change duration by modifying expiry date
+ignore:
+  shelljs:
+    - '*':
+        reason: testing
+        expires: 2019-01-04T14:35:17.133Z
+patch: {}

packages/strapi-generate-admin/.snyk

@@ -0,0 +1,9 @@
+# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.
+version: v1.12.0
+# ignores vulnerabilities until expiry date; change duration by modifying expiry date
+ignore:
+  shelljs:
+    - '*':
+        reason: testing
+        expires: 2019-01-04T14:35:52.618Z
+patch: {}

packages/strapi-generate-api/.snyk

@@ -0,0 +1,9 @@
+# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.
+version: v1.12.0
+# ignores vulnerabilities until expiry date; change duration by modifying expiry date
+ignore:
+  shelljs:
+    - '*':
+        reason: testing
+        expires: 2019-01-04T14:35:54.864Z
+patch: {}

packages/strapi-generate-controller/.snyk

@@ -0,0 +1,9 @@
+# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.
+version: v1.12.0
+# ignores vulnerabilities until expiry date; change duration by modifying expiry date
+ignore:
+  shelljs:
+    - '*':
+        reason: testing
+        expires: 2019-01-04T14:35:57.351Z
+patch: {}

packages/strapi-generate-model/.snyk

@@ -0,0 +1,9 @@
+# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.
+version: v1.12.0
+# ignores vulnerabilities until expiry date; change duration by modifying expiry date
+ignore:
+  shelljs:
+    - '*':
+        reason: testing
+        expires: 2019-01-04T14:35:59.679Z
+patch: {}

packages/strapi-generate-new/.snyk

@@ -0,0 +1,9 @@
+# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.
+version: v1.12.0
+# ignores vulnerabilities until expiry date; change duration by modifying expiry date
+ignore:
+  shelljs:
+    - '*':
+        reason: testing
+        expires: 2019-01-04T14:36:04.222Z
+patch: {}

packages/strapi-generate-plugin/.snyk

@@ -0,0 +1,9 @@
+# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.
+version: v1.12.0
+# ignores vulnerabilities until expiry date; change duration by modifying expiry date
+ignore:
+  shelljs:
+    - '*':
+        reason: testing
+        expires: 2019-01-04T14:36:06.569Z
+patch: {}

packages/strapi-generate-policy/.snyk

@@ -0,0 +1,9 @@
+# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.
+version: v1.12.0
+# ignores vulnerabilities until expiry date; change duration by modifying expiry date
+ignore:
+  shelljs:
+    - '*':
+        reason: testing
+        expires: 2019-01-04T14:36:09.263Z
+patch: {}

packages/strapi-generate-service/.snyk

@@ -0,0 +1,9 @@
+# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.
+version: v1.12.0
+# ignores vulnerabilities until expiry date; change duration by modifying expiry date
+ignore:
+  shelljs:
+    - '*':
+        reason: testing
+        expires: 2019-01-04T14:36:25.992Z
+patch: {}

packages/strapi-generate/.snyk

@@ -0,0 +1,9 @@
+# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.
+version: v1.12.0
+# ignores vulnerabilities until expiry date; change duration by modifying expiry date
+ignore:
+  shelljs:
+    - '*':
+        reason: testing
+        expires: 2019-01-04T14:35:22.585Z
+patch: {}

packages/strapi-helper-plugin/.snyk

@@ -0,0 +1,9 @@
+# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.
+version: v1.12.0
+# ignores vulnerabilities until expiry date; change duration by modifying expiry date
+ignore:
+  shelljs:
+    - '*':
+        reason: testing
+        expires: 2019-01-04T14:36:48.647Z
+patch: {}

packages/strapi-hook-bookshelf/.snyk

@@ -0,0 +1,9 @@
+# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.
+version: v1.12.0
+# ignores vulnerabilities until expiry date; change duration by modifying expiry date
+ignore:
+  shelljs:
+    - '*':
+        reason: testing
+        expires: 2019-01-04T14:36:51.201Z
+patch: {}

packages/strapi-hook-ejs/.snyk

@@ -0,0 +1,9 @@
+# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.
+version: v1.12.0
+# ignores vulnerabilities until expiry date; change duration by modifying expiry date
+ignore:
+  shelljs:
+    - '*':
+        reason: testing
+        expires: 2019-01-04T14:36:53.294Z
+patch: {}

packages/strapi-hook-knex/.snyk

@@ -0,0 +1,9 @@
+# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.
+version: v1.12.0
+# ignores vulnerabilities until expiry date; change duration by modifying expiry date
+ignore:
+  shelljs:
+    - '*':
+        reason: testing
+        expires: 2019-01-04T14:36:55.758Z
+patch: {}

packages/strapi-hook-mongoose/.snyk

@@ -0,0 +1,9 @@
+# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.
+version: v1.12.0
+# ignores vulnerabilities until expiry date; change duration by modifying expiry date
+ignore:
+  shelljs:
+    - '*':
+        reason: testing
+        expires: 2019-01-04T14:36:58.340Z
+patch: {}

packages/strapi-hook-redis/.snyk

@@ -0,0 +1,9 @@
+# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.
+version: v1.12.0
+# ignores vulnerabilities until expiry date; change duration by modifying expiry date
+ignore:
+  shelljs:
+    - '*':
+        reason: testing
+        expires: 2019-01-04T14:37:00.449Z
+patch: {}

packages/strapi-lint/.snyk

@@ -0,0 +1,9 @@
+# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.
+version: v1.12.0
+# ignores vulnerabilities until expiry date; change duration by modifying expiry date
+ignore:
+  shelljs:
+    - '*':
+        reason: testing
+        expires: 2019-01-04T14:37:04.113Z
+patch: {}

packages/strapi-lint/lib/internals/shared/listChangedFiles.js

@@ -15,7 +15,12 @@ const exec = (command, args) => {
     stdio: 'pipe',
     encoding: 'utf-8',
   };
+
+  try {
     return execFileSync(command, args, options);
+  } catch (err) {
+    return '';
+  }
 };
 
 const execGitCmd = args =>
@@ -26,10 +31,15 @@ const execGitCmd = args =>
 
 const listChangedFiles = () => {
   const mergeBase = execGitCmd(['merge-base', 'HEAD', 'master']);
+
+  try {
     return new Set([
       ...execGitCmd(['diff', '--name-only', '--diff-filter=ACMRTUB', mergeBase]),
       ...execGitCmd(['ls-files', '--others', '--exclude-standard']),
     ]);
+  } catch (err) {
+    return [];
+  }
 };
 
 module.exports = listChangedFiles;

packages/strapi-middleware-views/.snyk

@@ -0,0 +1,9 @@
+# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.
+version: v1.12.0
+# ignores vulnerabilities until expiry date; change duration by modifying expiry date
+ignore:
+  shelljs:
+    - '*':
+        reason: testing
+        expires: 2019-01-04T14:37:06.512Z
+patch: {}

packages/strapi-plugin-content-manager/.snyk

@@ -0,0 +1,9 @@
+# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.
+version: v1.12.0
+# ignores vulnerabilities until expiry date; change duration by modifying expiry date
+ignore:
+  shelljs:
+    - '*':
+        reason: testing
+        expires: 2019-01-04T14:37:14.459Z
+patch: {}

packages/strapi-plugin-content-type-builder/.snyk

@@ -0,0 +1,9 @@
+# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.
+version: v1.12.0
+# ignores vulnerabilities until expiry date; change duration by modifying expiry date
+ignore:
+  shelljs:
+    - '*':
+        reason: testing
+        expires: 2019-01-04T14:37:23.290Z
+patch: {}

packages/strapi-plugin-email/.snyk

@@ -0,0 +1,9 @@
+# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.
+version: v1.12.0
+# ignores vulnerabilities until expiry date; change duration by modifying expiry date
+ignore:
+  shelljs:
+    - '*':
+        reason: testing
+        expires: 2019-01-04T14:37:31.383Z
+patch: {}

packages/strapi-plugin-graphql/.snyk

@@ -0,0 +1,17 @@
+# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.
+version: v1.12.0
+# ignores vulnerabilities until expiry date; change duration by modifying expiry date
+ignore:
+  shelljs:
+    - '*':
+        reason: testing
+        expires: 2019-01-04T14:37:34.495Z
+  qs:
+    - '*':
+        reason: Temporarily ignore
+        expires: 2019-01-31T00:00:00.000Z
+  apollo-server-koa@2.2.6:
+    - '*':
+        reason: Temporarily ignore
+        expires: 2019-01-04T16:34:24.069Z
+patch: {}

packages/strapi-plugin-settings-manager/.snyk

@@ -0,0 +1,9 @@
+# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.
+version: v1.12.0
+# ignores vulnerabilities until expiry date; change duration by modifying expiry date
+ignore:
+  shelljs:
+    - '*':
+        reason: testing
+        expires: 2019-01-04T14:37:42.177Z
+patch: {}

packages/strapi-plugin-upload/.snyk

@@ -0,0 +1,9 @@
+# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.
+version: v1.12.0
+# ignores vulnerabilities until expiry date; change duration by modifying expiry date
+ignore:
+  shelljs:
+    - '*':
+        reason: testing
+        expires: 2019-01-04T14:37:50.220Z
+patch: {}

packages/strapi-plugin-users-permissions/.snyk

@@ -0,0 +1,17 @@
+# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.
+version: v1.12.0
+# ignores vulnerabilities until expiry date; change duration by modifying expiry date
+ignore:
+  shelljs:
+    - '*':
+        reason: testing
+        expires: 2019-01-04T14:37:58.353Z
+  qs:
+    - '*':
+        reason: Temporarily ignore
+        expires: 2019-01-31T00:00:00.000Z
+  purest:
+    - '*':
+        reason: Temporarily ignore
+        expires: 2019-01-31T00:00:00.000Z
+patch: {}

packages/strapi-provider-email-amazon-ses/.snyk

@@ -0,0 +1,9 @@
+# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.
+version: v1.12.0
+# ignores vulnerabilities until expiry date; change duration by modifying expiry date
+ignore:
+  shelljs:
+    - '*':
+        reason: testing
+        expires: 2019-01-04T14:38:00.833Z
+patch: {}

packages/strapi-provider-email-mailgun/.snyk

@@ -0,0 +1,9 @@
+# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.
+version: v1.12.0
+# ignores vulnerabilities until expiry date; change duration by modifying expiry date
+ignore:
+  shelljs:
+    - '*':
+        reason: testing
+        expires: 2019-01-04T14:38:03.075Z
+patch: {}

packages/strapi-provider-email-sendgrid/.snyk

@@ -0,0 +1,9 @@
+# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.
+version: v1.12.0
+# ignores vulnerabilities until expiry date; change duration by modifying expiry date
+ignore:
+  shelljs:
+    - '*':
+        reason: testing
+        expires: 2019-01-04T14:38:05.425Z
+patch: {}

packages/strapi-provider-email-sendmail/.snyk

@@ -0,0 +1,9 @@
+# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.
+version: v1.12.0
+# ignores vulnerabilities until expiry date; change duration by modifying expiry date
+ignore:
+  shelljs:
+    - '*':
+        reason: testing
+        expires: 2019-01-04T14:38:07.540Z
+patch: {}

packages/strapi-provider-upload-aws-s3/.snyk

@@ -0,0 +1,9 @@
+# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.
+version: v1.12.0
+# ignores vulnerabilities until expiry date; change duration by modifying expiry date
+ignore:
+  shelljs:
+    - '*':
+        reason: testing
+        expires: 2019-01-04T14:38:09.622Z
+patch: {}

packages/strapi-provider-upload-cloudinary/.snyk

@@ -0,0 +1,9 @@
+# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.
+version: v1.12.0
+# ignores vulnerabilities until expiry date; change duration by modifying expiry date
+ignore:
+  shelljs:
+    - '*':
+        reason: testing
+        expires: 2019-01-04T14:38:11.663Z
+patch: {}

packages/strapi-provider-upload-local/.snyk

@@ -0,0 +1,9 @@
+# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.
+version: v1.12.0
+# ignores vulnerabilities until expiry date; change duration by modifying expiry date
+ignore:
+  shelljs:
+    - '*':
+        reason: testing
+        expires: 2019-01-04T14:38:13.835Z
+patch: {}

packages/strapi-provider-upload-rackspace/.snyk

@@ -0,0 +1,9 @@
+# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.
+version: v1.12.0
+# ignores vulnerabilities until expiry date; change duration by modifying expiry date
+ignore:
+  shelljs:
+    - '*':
+        reason: testing
+        expires: 2019-01-04T14:38:15.967Z
+patch: {}

packages/strapi-utils/.snyk

@@ -0,0 +1,9 @@
+# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.
+version: v1.12.0
+# ignores vulnerabilities until expiry date; change duration by modifying expiry date
+ignore:
+  shelljs:
+    - '*':
+        reason: testing
+        expires: 2019-01-04T14:38:18.270Z
+patch: {}

packages/strapi/.snyk

@@ -0,0 +1,13 @@
+# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.
+version: v1.12.0
+# ignores vulnerabilities until expiry date; change duration by modifying expiry date
+ignore:
+  shelljs:
+    - '*':
+        reason: testing
+        expires: 2019-01-04T14:35:06.536Z
+  koa-body:
+    - '*':
+        reason: Temporarily ignore
+        expires: 2019-01-04T16:46:20.156Z
+patch: {}

scripts/snyk.js

@@ -0,0 +1,25 @@
+const fs = require('fs');
+const path = require('path');
+const shell = require('shelljs');
+
+try {
+  const packages = fs.readdirSync(path.resolve(process.cwd(), 'packages'), 'utf8');
+  shell.cd('packages/strapi');
+
+  packages
+    .filter(pkg => pkg.indexOf('strapi') !== -1)
+    .forEach(pkg => {
+      shell.cd('../' + pkg);
+      shell.echo(`Testing ${pkg} dependencies`);
+
+      const data = shell.exec('snyk test --severity-threshold=high', { silent: true });
+
+      if (data.code !== 0 && data.stdout.indexOf('Missing node_modules folder') === -1) {
+        shell.echo(data.stdout);
+
+        process.exit(1);
+      }
+    });
+} catch (error) {
+  console.error(error);
+}