93 lines
2.3 KiB
TypeScript
93 lines
2.3 KiB
TypeScript
import {Changes, Severity, SEVERITIES, Scope} from './schemas'
|
|
|
|
export function filterChangesBySeverity(
|
|
severity: Severity,
|
|
changes: Changes
|
|
): Changes {
|
|
const severityIdx = SEVERITIES.indexOf(severity)
|
|
let filteredChanges = []
|
|
for (const change of changes) {
|
|
if (
|
|
change === undefined ||
|
|
change.vulnerabilities === undefined ||
|
|
change.vulnerabilities.length === 0
|
|
) {
|
|
continue
|
|
}
|
|
|
|
const fChange = {
|
|
...change,
|
|
vulnerabilities: change.vulnerabilities.filter(vuln => {
|
|
const vulnIdx = SEVERITIES.indexOf(vuln.severity)
|
|
if (vulnIdx <= severityIdx) {
|
|
return true
|
|
}
|
|
})
|
|
}
|
|
filteredChanges.push(fChange)
|
|
}
|
|
|
|
// don't want to deal with changes with no vulnerabilities
|
|
filteredChanges = filteredChanges.filter(
|
|
change => change.vulnerabilities.length > 0
|
|
)
|
|
return filteredChanges
|
|
}
|
|
|
|
export function filterChangesByScopes(
|
|
scopes: Scope[] | undefined,
|
|
changes: Changes
|
|
): Changes {
|
|
if (scopes === undefined) {
|
|
return []
|
|
}
|
|
|
|
const filteredChanges = changes.filter(change => {
|
|
// if there is no scope on the change (Enterprise Server API for now), we will assume it is a runtime scope
|
|
const scope = change.scope || 'runtime'
|
|
return scopes.includes(scope)
|
|
})
|
|
|
|
return filteredChanges
|
|
}
|
|
|
|
/**
|
|
* Filter out changes that are allowed by the allow_ghsas config
|
|
* option. We want to remove these changes before we do any
|
|
* processing.
|
|
* @param ghsas - list of GHSA IDs to allow
|
|
* @param changes - list of changes to filter
|
|
* @returns a list of changes with the allowed GHSAs removed
|
|
*/
|
|
export function filterAllowedAdvisories(
|
|
ghsas: string[] | undefined,
|
|
changes: Changes
|
|
): Changes {
|
|
if (ghsas === undefined) {
|
|
return changes
|
|
}
|
|
|
|
const filteredChanges = changes.filter(change => {
|
|
const noAdvisories =
|
|
change.vulnerabilities === undefined ||
|
|
change.vulnerabilities.length === 0
|
|
|
|
if (noAdvisories) {
|
|
return true
|
|
}
|
|
|
|
let allAllowedAdvisories = true
|
|
// if there's at least one advisory that is not allowlisted, we will keep the change
|
|
for (const vulnerability of change.vulnerabilities) {
|
|
if (!ghsas.includes(vulnerability.advisory_ghsa_id)) {
|
|
allAllowedAdvisories = false
|
|
}
|
|
if (!allAllowedAdvisories) {
|
|
return true
|
|
}
|
|
}
|
|
})
|
|
|
|
return filteredChanges
|
|
}
|