diff --git a/README.md b/README.md index 290304f..128d662 100644 --- a/README.md +++ b/README.md @@ -214,16 +214,16 @@ You can set the minimum package age through multiple sources (in order of priori ### Excluding Packages -Exclude trusted packages from minimum age filtering via environment variable or config file (both are merged). Supports wildcard patterns with trailing `*`: +Exclude trusted packages from minimum age filtering via environment variable or config file (both are merged). Use `@scope/*` to trust all packages from an organization: ```shell -export SAFE_CHAIN_NPM_MINIMUM_PACKAGE_AGE_EXCLUSIONS="@aikidosec/*,react-*,lodash" +export SAFE_CHAIN_NPM_MINIMUM_PACKAGE_AGE_EXCLUSIONS="@aikidosec/*" ``` ```json { "npm": { - "minimumPackageAgeExclusions": ["@aikidosec/*", "react-*", "lodash"] + "minimumPackageAgeExclusions": ["@aikidosec/*"] } } ``` diff --git a/packages/safe-chain/src/registryProxy/interceptors/npm/modifyNpmInfo.js b/packages/safe-chain/src/registryProxy/interceptors/npm/modifyNpmInfo.js index 9a36207..14e3ba7 100644 --- a/packages/safe-chain/src/registryProxy/interceptors/npm/modifyNpmInfo.js +++ b/packages/safe-chain/src/registryProxy/interceptors/npm/modifyNpmInfo.js @@ -196,7 +196,7 @@ export function getHasSuppressedVersions() { * @returns {boolean} */ function matchesExclusionPattern(packageName, pattern) { - if (pattern.endsWith("*")) { + if (pattern.endsWith("/*")) { return packageName.startsWith(pattern.slice(0, -1)); } return packageName === pattern; diff --git a/packages/safe-chain/src/registryProxy/interceptors/npm/npmInterceptor.minPackageAge.spec.js b/packages/safe-chain/src/registryProxy/interceptors/npm/npmInterceptor.minPackageAge.spec.js index 82fed71..834a2ad 100644 --- a/packages/safe-chain/src/registryProxy/interceptors/npm/npmInterceptor.minPackageAge.spec.js +++ b/packages/safe-chain/src/registryProxy/interceptors/npm/npmInterceptor.minPackageAge.spec.js @@ -509,32 +509,6 @@ describe("npmInterceptor minimum package age", async () => { assert.ok(Object.keys(modifiedJson.versions).includes("2.0.0")); }); - it("Should exclude packages matching wildcard pattern prefix-*", async () => { - minimumPackageAgeSettings = 5; - skipMinimumPackageAgeSetting = false; - minimumPackageAgeExclusionsSetting = ["react-*"]; - - const packageUrl = "https://registry.npmjs.org/react-dom"; - - const originalBody = JSON.stringify({ - name: "react-dom", - ["dist-tags"]: { latest: "18.0.0" }, - versions: { ["17.0.0"]: {}, ["18.0.0"]: {} }, - time: { - created: getDate(-365 * 24), - modified: getDate(-1), - ["17.0.0"]: getDate(-100), - ["18.0.0"]: getDate(-1), // Would normally be filtered - }, - }); - - const modifiedBody = await runModifyNpmInfoRequest(packageUrl, originalBody); - const modifiedJson = JSON.parse(modifiedBody); - - // All versions should remain since react-* matches react-dom - assert.equal(Object.keys(modifiedJson.versions).length, 2); - }); - it("Should NOT exclude packages that don't match wildcard pattern", async () => { minimumPackageAgeSettings = 5; skipMinimumPackageAgeSetting = false;