mirror of
https://github.com/AikidoSec/safe-chain.git
synced 2026-05-26 12:10:49 +00:00
feat: allow python custom registries configuration through config file
This commit is contained in:
galargh
parent
39e2001d97
commit
c53a7347e2
5 changed files with 325 additions and 283 deletions
12
README.md
12
README.md
|
|
@ -188,9 +188,13 @@ You can set the minimum package age through multiple sources (in order of priori
|
|||
}
|
||||
```
|
||||
|
||||
## Custom NPM Registries
|
||||
## Custom Registries
|
||||
|
||||
Configure Safe Chain to scan packages from custom or private npm registries.
|
||||
Configure Safe Chain to scan packages from custom or private registries.
|
||||
|
||||
Supported ecosystems:
|
||||
- Node.js
|
||||
- Python
|
||||
|
||||
### Configuration Options
|
||||
|
||||
|
|
@ -200,6 +204,7 @@ You can set custom registries through environment variable or config file. Both
|
|||
|
||||
```shell
|
||||
export SAFE_CHAIN_NPM_CUSTOM_REGISTRIES="npm.company.com,registry.internal.net"
|
||||
export SAFE_CHAIN_PIP_CUSTOM_REGISTRIES="pip.company.com,registry.internal.net"
|
||||
```
|
||||
|
||||
2. **Config File** (`~/.aikido/config.json`):
|
||||
|
|
@ -208,6 +213,9 @@ You can set custom registries through environment variable or config file. Both
|
|||
{
|
||||
"npm": {
|
||||
"customRegistries": ["npm.company.com", "registry.internal.net"]
|
||||
},
|
||||
"pip": {
|
||||
"customRegistries": ["pip.company.com", "registry.internal.net"]
|
||||
}
|
||||
}
|
||||
```
|
||||
|
|
|
|||
|
|
@ -11,6 +11,7 @@ import { getEcoSystem } from "./settings.js";
|
|||
* @property {unknown | Number} scanTimeout
|
||||
* @property {unknown | Number} minimumPackageAgeHours
|
||||
* @property {unknown | SafeChainRegistryConfiguration} npm
|
||||
* @property {unknown | SafeChainRegistryConfiguration} pip
|
||||
*
|
||||
* @typedef {Object} SafeChainRegistryConfiguration
|
||||
* We cannot trust the input and should add the necessary validations.
|
||||
|
|
@ -104,6 +105,28 @@ export function getNpmCustomRegistries() {
|
|||
return customRegistries.filter((item) => typeof item === "string");
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the custom npm registries from the config file (format parsing only, no validation)
|
||||
* @returns {string[]}
|
||||
*/
|
||||
export function getPipCustomRegistries() {
|
||||
const config = readConfigFile();
|
||||
|
||||
if (!config || !config.pip) {
|
||||
return [];
|
||||
}
|
||||
|
||||
// TypeScript needs help understanding that config.pip exists and has customRegistries
|
||||
const pipConfig = /** @type {SafeChainRegistryConfiguration} */ (config.pip);
|
||||
const customRegistries = pipConfig.customRegistries;
|
||||
|
||||
if (!Array.isArray(customRegistries)) {
|
||||
return [];
|
||||
}
|
||||
|
||||
return customRegistries.filter((item) => typeof item === "string");
|
||||
}
|
||||
|
||||
/**
|
||||
* @param {import("../api/aikido.js").MalwarePackage[]} data
|
||||
* @param {string | number} version
|
||||
|
|
@ -169,6 +192,9 @@ function readConfigFile() {
|
|||
npm: {
|
||||
customRegistries: undefined,
|
||||
},
|
||||
pip: {
|
||||
customRegistries: undefined,
|
||||
},
|
||||
};
|
||||
|
||||
const configFilePath = getConfigFilePath();
|
||||
|
|
|
|||
|
|
@ -232,8 +232,11 @@ describe("getMinimumPackageAgeHours", async () => {
|
|||
});
|
||||
});
|
||||
|
||||
describe("getNpmCustomRegistries", async () => {
|
||||
const { getNpmCustomRegistries } = await import("./configFile.js");
|
||||
for (const packageManager of ["npm", "pip"]) {
|
||||
const fnName = `get${packageManager.charAt(0).toUpperCase()}${packageManager.slice(1)}CustomRegistries`;
|
||||
|
||||
describe(fnName, async () => {
|
||||
const fn = (await import("./configFile.js"))[fnName];
|
||||
|
||||
afterEach(() => {
|
||||
configFileContent = undefined;
|
||||
|
|
@ -242,49 +245,49 @@ describe("getNpmCustomRegistries", async () => {
|
|||
it("should return empty array when config file doesn't exist", () => {
|
||||
configFileContent = undefined;
|
||||
|
||||
const registries = getNpmCustomRegistries();
|
||||
const registries = fn();
|
||||
|
||||
assert.deepStrictEqual(registries, []);
|
||||
});
|
||||
|
||||
it("should return empty array when npm config is not set", () => {
|
||||
it(`should return empty array when ${packageManager} config is not set`, () => {
|
||||
configFileContent = JSON.stringify({ scanTimeout: 5000 });
|
||||
|
||||
const registries = getNpmCustomRegistries();
|
||||
const registries = fn();
|
||||
|
||||
assert.deepStrictEqual(registries, []);
|
||||
});
|
||||
|
||||
it("should return empty array when customRegistries is not an array", () => {
|
||||
configFileContent = JSON.stringify({
|
||||
npm: { customRegistries: "not-an-array" },
|
||||
[packageManager]: { customRegistries: "not-an-array" },
|
||||
});
|
||||
|
||||
const registries = getNpmCustomRegistries();
|
||||
const registries = fn();
|
||||
|
||||
assert.deepStrictEqual(registries, []);
|
||||
});
|
||||
|
||||
it("should return array of custom registries when set", () => {
|
||||
configFileContent = JSON.stringify({
|
||||
npm: {
|
||||
customRegistries: ["npm.company.com", "registry.internal.net"],
|
||||
[packageManager]: {
|
||||
customRegistries: [`${packageManager}.company.com`, "registry.internal.net"],
|
||||
},
|
||||
});
|
||||
|
||||
const registries = getNpmCustomRegistries();
|
||||
const registries = fn();
|
||||
|
||||
assert.deepStrictEqual(registries, [
|
||||
"npm.company.com",
|
||||
`${packageManager}.company.com`,
|
||||
"registry.internal.net",
|
||||
]);
|
||||
});
|
||||
|
||||
it("should filter out non-string values", () => {
|
||||
configFileContent = JSON.stringify({
|
||||
npm: {
|
||||
[packageManager]: {
|
||||
customRegistries: [
|
||||
"npm.company.com",
|
||||
`${packageManager}.company.com`,
|
||||
123,
|
||||
null,
|
||||
"registry.internal.net",
|
||||
|
|
@ -294,20 +297,20 @@ describe("getNpmCustomRegistries", async () => {
|
|||
},
|
||||
});
|
||||
|
||||
const registries = getNpmCustomRegistries();
|
||||
const registries = fn();
|
||||
|
||||
assert.deepStrictEqual(registries, [
|
||||
"npm.company.com",
|
||||
`${packageManager}.company.com`,
|
||||
"registry.internal.net",
|
||||
]);
|
||||
});
|
||||
|
||||
it("should return empty array for empty customRegistries array", () => {
|
||||
configFileContent = JSON.stringify({
|
||||
npm: { customRegistries: [] },
|
||||
[packageManager]: { customRegistries: [] },
|
||||
});
|
||||
|
||||
const registries = getNpmCustomRegistries();
|
||||
const registries = fn();
|
||||
|
||||
assert.deepStrictEqual(registries, []);
|
||||
});
|
||||
|
|
@ -315,8 +318,9 @@ describe("getNpmCustomRegistries", async () => {
|
|||
it("should handle malformed JSON and return empty array", () => {
|
||||
configFileContent = "{ invalid json";
|
||||
|
||||
const registries = getNpmCustomRegistries();
|
||||
const registries = fn();
|
||||
|
||||
assert.deepStrictEqual(registries, []);
|
||||
});
|
||||
});
|
||||
});
|
||||
}
|
||||
|
|
|
|||
|
|
@ -152,11 +152,10 @@ export function getPipCustomRegistries() {
|
|||
const envRegistries = parseRegistriesFromEnv(
|
||||
environmentVariables.getPipCustomRegistries()
|
||||
);
|
||||
// const configRegistries = configFile.getPipCustomRegistries();
|
||||
const configRegistries = configFile.getPipCustomRegistries();
|
||||
|
||||
// Merge both sources and remove duplicates
|
||||
// const allRegistries = [...envRegistries, ...configRegistries];
|
||||
const allRegistries = [...envRegistries];
|
||||
const allRegistries = [...envRegistries, ...configRegistries];
|
||||
const uniqueRegistries = [...new Set(allRegistries)];
|
||||
|
||||
// Normalize each registry (remove protocol if any)
|
||||
|
|
|
|||
|
|
@ -11,19 +11,23 @@ mock.module("fs", {
|
|||
},
|
||||
});
|
||||
|
||||
describe("getNpmCustomRegistries", async () => {
|
||||
for (const packageManager of ["npm", "pip"]) {
|
||||
const fnName = `get${packageManager.charAt(0).toUpperCase()}${packageManager.slice(1)}CustomRegistries`;
|
||||
const envVarName = `SAFE_CHAIN_${packageManager.toUpperCase()}_CUSTOM_REGISTRIES`;
|
||||
|
||||
describe(fnName, async () => {
|
||||
let originalEnv;
|
||||
const { getNpmCustomRegistries } = await import("./settings.js");
|
||||
const fn = (await import("./settings.js"))[fnName];
|
||||
|
||||
beforeEach(() => {
|
||||
originalEnv = process.env.SAFE_CHAIN_NPM_CUSTOM_REGISTRIES;
|
||||
originalEnv = process.env[envVarName];
|
||||
});
|
||||
|
||||
afterEach(() => {
|
||||
if (originalEnv !== undefined) {
|
||||
process.env.SAFE_CHAIN_NPM_CUSTOM_REGISTRIES = originalEnv;
|
||||
process.env[envVarName] = originalEnv;
|
||||
} else {
|
||||
delete process.env.SAFE_CHAIN_NPM_CUSTOM_REGISTRIES;
|
||||
delete process.env[envVarName];
|
||||
}
|
||||
configFileContent = undefined;
|
||||
});
|
||||
|
|
@ -31,77 +35,77 @@ describe("getNpmCustomRegistries", async () => {
|
|||
it("should return empty array when no registries configured", () => {
|
||||
configFileContent = undefined;
|
||||
|
||||
const registries = getNpmCustomRegistries();
|
||||
const registries = fn();
|
||||
|
||||
assert.deepStrictEqual(registries, []);
|
||||
});
|
||||
|
||||
it("should return registries without protocol", () => {
|
||||
configFileContent = JSON.stringify({
|
||||
npm: {
|
||||
customRegistries: ["npm.company.com", "registry.internal.net"],
|
||||
[packageManager]: {
|
||||
customRegistries: [`${packageManager}.company.com`, "registry.internal.net"],
|
||||
},
|
||||
});
|
||||
|
||||
const registries = getNpmCustomRegistries();
|
||||
const registries = fn();
|
||||
|
||||
assert.deepStrictEqual(registries, [
|
||||
"npm.company.com",
|
||||
`${packageManager}.company.com`,
|
||||
"registry.internal.net",
|
||||
]);
|
||||
});
|
||||
|
||||
it("should strip https:// protocol from registries", () => {
|
||||
configFileContent = JSON.stringify({
|
||||
npm: {
|
||||
[packageManager]: {
|
||||
customRegistries: [
|
||||
"https://npm.company.com",
|
||||
`https://${packageManager}.company.com`,
|
||||
"https://registry.internal.net",
|
||||
],
|
||||
},
|
||||
});
|
||||
|
||||
const registries = getNpmCustomRegistries();
|
||||
const registries = fn();
|
||||
|
||||
assert.deepStrictEqual(registries, [
|
||||
"npm.company.com",
|
||||
`${packageManager}.company.com`,
|
||||
"registry.internal.net",
|
||||
]);
|
||||
});
|
||||
|
||||
it("should strip http:// protocol from registries", () => {
|
||||
configFileContent = JSON.stringify({
|
||||
npm: {
|
||||
[packageManager]: {
|
||||
customRegistries: [
|
||||
"http://npm.company.com",
|
||||
`http://${packageManager}.company.com`,
|
||||
"http://registry.internal.net",
|
||||
],
|
||||
},
|
||||
});
|
||||
|
||||
const registries = getNpmCustomRegistries();
|
||||
const registries = fn();
|
||||
|
||||
assert.deepStrictEqual(registries, [
|
||||
"npm.company.com",
|
||||
`${packageManager}.company.com`,
|
||||
"registry.internal.net",
|
||||
]);
|
||||
});
|
||||
|
||||
it("should handle mixed protocols and no protocol", () => {
|
||||
configFileContent = JSON.stringify({
|
||||
npm: {
|
||||
[packageManager]: {
|
||||
customRegistries: [
|
||||
"https://npm.company.com",
|
||||
`https://${packageManager}.company.com`,
|
||||
"registry.internal.net",
|
||||
"http://private.registry.io",
|
||||
],
|
||||
},
|
||||
});
|
||||
|
||||
const registries = getNpmCustomRegistries();
|
||||
const registries = fn();
|
||||
|
||||
assert.deepStrictEqual(registries, [
|
||||
"npm.company.com",
|
||||
`${packageManager}.company.com`,
|
||||
"registry.internal.net",
|
||||
"private.registry.io",
|
||||
]);
|
||||
|
|
@ -109,29 +113,29 @@ describe("getNpmCustomRegistries", async () => {
|
|||
|
||||
it("should preserve registry path after stripping protocol", () => {
|
||||
configFileContent = JSON.stringify({
|
||||
npm: {
|
||||
[packageManager]: {
|
||||
customRegistries: [
|
||||
"https://npm.company.com/custom/path",
|
||||
"registry.internal.net/npm",
|
||||
`https://${packageManager}.company.com/custom/path`,
|
||||
`registry.internal.net/${packageManager}`,
|
||||
],
|
||||
},
|
||||
});
|
||||
|
||||
const registries = getNpmCustomRegistries();
|
||||
const registries = fn();
|
||||
|
||||
assert.deepStrictEqual(registries, [
|
||||
"npm.company.com/custom/path",
|
||||
"registry.internal.net/npm",
|
||||
`${packageManager}.company.com/custom/path`,
|
||||
`registry.internal.net/${packageManager}`,
|
||||
]);
|
||||
});
|
||||
|
||||
it("should parse comma-separated registries from environment variable", () => {
|
||||
delete process.env.SAFE_CHAIN_NPM_CUSTOM_REGISTRIES;
|
||||
process.env.SAFE_CHAIN_NPM_CUSTOM_REGISTRIES =
|
||||
delete process.env[envVarName];
|
||||
process.env[envVarName] =
|
||||
"env1.registry.com,env2.registry.net";
|
||||
configFileContent = undefined;
|
||||
|
||||
const registries = getNpmCustomRegistries();
|
||||
const registries = fn();
|
||||
|
||||
assert.deepStrictEqual(registries, [
|
||||
"env1.registry.com",
|
||||
|
|
@ -140,12 +144,12 @@ describe("getNpmCustomRegistries", async () => {
|
|||
});
|
||||
|
||||
it("should trim whitespace from environment variable registries", () => {
|
||||
delete process.env.SAFE_CHAIN_NPM_CUSTOM_REGISTRIES;
|
||||
process.env.SAFE_CHAIN_NPM_CUSTOM_REGISTRIES =
|
||||
delete process.env[envVarName];
|
||||
process.env[envVarName] =
|
||||
" env1.registry.com , env2.registry.net ";
|
||||
configFileContent = undefined;
|
||||
|
||||
const registries = getNpmCustomRegistries();
|
||||
const registries = fn();
|
||||
|
||||
assert.deepStrictEqual(registries, [
|
||||
"env1.registry.com",
|
||||
|
|
@ -154,15 +158,15 @@ describe("getNpmCustomRegistries", async () => {
|
|||
});
|
||||
|
||||
it("should merge environment variable and config file registries", () => {
|
||||
delete process.env.SAFE_CHAIN_NPM_CUSTOM_REGISTRIES;
|
||||
process.env.SAFE_CHAIN_NPM_CUSTOM_REGISTRIES = "env1.registry.com";
|
||||
delete process.env[envVarName];
|
||||
process.env[envVarName] = "env1.registry.com";
|
||||
configFileContent = JSON.stringify({
|
||||
npm: {
|
||||
[packageManager]: {
|
||||
customRegistries: ["config1.registry.net"],
|
||||
},
|
||||
});
|
||||
|
||||
const registries = getNpmCustomRegistries();
|
||||
const registries = fn();
|
||||
|
||||
assert.deepStrictEqual(registries, [
|
||||
"env1.registry.com",
|
||||
|
|
@ -171,31 +175,31 @@ describe("getNpmCustomRegistries", async () => {
|
|||
});
|
||||
|
||||
it("should remove duplicate registries when merging env and config", () => {
|
||||
delete process.env.SAFE_CHAIN_NPM_CUSTOM_REGISTRIES;
|
||||
process.env.SAFE_CHAIN_NPM_CUSTOM_REGISTRIES =
|
||||
"npm.company.com,env.registry.com";
|
||||
delete process.env[envVarName];
|
||||
process.env[envVarName] =
|
||||
`${packageManager}.company.com,env.registry.com`;
|
||||
configFileContent = JSON.stringify({
|
||||
npm: {
|
||||
customRegistries: ["npm.company.com", "config.registry.net"],
|
||||
[packageManager]: {
|
||||
customRegistries: [`${packageManager}.company.com`, "config.registry.net"],
|
||||
},
|
||||
});
|
||||
|
||||
const registries = getNpmCustomRegistries();
|
||||
const registries = fn();
|
||||
|
||||
assert.deepStrictEqual(registries, [
|
||||
"npm.company.com",
|
||||
`${packageManager}.company.com`,
|
||||
"env.registry.com",
|
||||
"config.registry.net",
|
||||
]);
|
||||
});
|
||||
|
||||
it("should normalize protocols from environment variable registries", () => {
|
||||
delete process.env.SAFE_CHAIN_NPM_CUSTOM_REGISTRIES;
|
||||
process.env.SAFE_CHAIN_NPM_CUSTOM_REGISTRIES =
|
||||
delete process.env[envVarName];
|
||||
process.env[envVarName] =
|
||||
"https://env1.registry.com,http://env2.registry.net";
|
||||
configFileContent = undefined;
|
||||
|
||||
const registries = getNpmCustomRegistries();
|
||||
const registries = fn();
|
||||
|
||||
assert.deepStrictEqual(registries, [
|
||||
"env1.registry.com",
|
||||
|
|
@ -204,12 +208,12 @@ describe("getNpmCustomRegistries", async () => {
|
|||
});
|
||||
|
||||
it("should handle empty strings in comma-separated list", () => {
|
||||
delete process.env.SAFE_CHAIN_NPM_CUSTOM_REGISTRIES;
|
||||
process.env.SAFE_CHAIN_NPM_CUSTOM_REGISTRIES =
|
||||
delete process.env[envVarName];
|
||||
process.env[envVarName] =
|
||||
"env1.registry.com,,env2.registry.net,";
|
||||
configFileContent = undefined;
|
||||
|
||||
const registries = getNpmCustomRegistries();
|
||||
const registries = fn();
|
||||
|
||||
assert.deepStrictEqual(registries, [
|
||||
"env1.registry.com",
|
||||
|
|
@ -218,32 +222,33 @@ describe("getNpmCustomRegistries", async () => {
|
|||
});
|
||||
|
||||
it("should handle single registry in environment variable", () => {
|
||||
delete process.env.SAFE_CHAIN_NPM_CUSTOM_REGISTRIES;
|
||||
process.env.SAFE_CHAIN_NPM_CUSTOM_REGISTRIES = "single.registry.com";
|
||||
delete process.env[envVarName];
|
||||
process.env[envVarName] = "single.registry.com";
|
||||
configFileContent = undefined;
|
||||
|
||||
const registries = getNpmCustomRegistries();
|
||||
const registries = fn();
|
||||
|
||||
assert.deepStrictEqual(registries, ["single.registry.com"]);
|
||||
});
|
||||
|
||||
it("should return empty array for empty environment variable", () => {
|
||||
delete process.env.SAFE_CHAIN_NPM_CUSTOM_REGISTRIES;
|
||||
process.env.SAFE_CHAIN_NPM_CUSTOM_REGISTRIES = "";
|
||||
delete process.env[envVarName];
|
||||
process.env[envVarName] = "";
|
||||
configFileContent = undefined;
|
||||
|
||||
const registries = getNpmCustomRegistries();
|
||||
const registries = fn();
|
||||
|
||||
assert.deepStrictEqual(registries, []);
|
||||
});
|
||||
|
||||
it("should return empty array for whitespace-only environment variable", () => {
|
||||
delete process.env.SAFE_CHAIN_NPM_CUSTOM_REGISTRIES;
|
||||
process.env.SAFE_CHAIN_NPM_CUSTOM_REGISTRIES = " , , ";
|
||||
delete process.env[envVarName];
|
||||
process.env[envVarName] = " , , ";
|
||||
configFileContent = undefined;
|
||||
|
||||
const registries = getNpmCustomRegistries();
|
||||
const registries = fn();
|
||||
|
||||
assert.deepStrictEqual(registries, []);
|
||||
});
|
||||
});
|
||||
});
|
||||
}
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue