registry / @itentialopensource/adapter-git / 1.0.7

@itentialopensource/adapter-git@1.0.7

Itential adapter to run git commands

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireFilesystem

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 7 file(s), 41.4 KB of source

Source & flagged code

10 flagged

package.jsonView file

Lines 1-28json

2 "name": "@itentialopensource/adapter-git",

3 "version": "1.0.7",

4 "description": "Itential adapter to run git commands",

5 "main": "adapter.js",

6 "adapterType":

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.preinstall = node utils/setup.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

test/unit/adapterTestUnit.jsView file

34patternName = generic_password severity = medium line = 34 matchedText = const pa...rd';

Medium

Secret Pattern

Package contains a possible secret pattern.

test/unit/adapterTestUnit.jsView on unpkg · L34

50patternName = generic_password severity = medium line = 50 matchedText = passwo...

Medium

Secret Pattern

Hardcoded password in test/unit/adapterTestUnit.js

test/unit/adapterTestUnit.jsView on unpkg · L50

adapter.jsView file

15/* Required libraries. */ L16: const fs = require('fs-extra'); L17: const builtInfs = require('fs');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

adapter.jsView on unpkg · L15

utils/pre-commit.shView file

•path = utils/pre-commit.sh kind = build_helper sizeBytes = 689 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

utils/pre-commit.shView on unpkg

test/integration/adapterTestIntegration.jsView file

31patternName = generic_password severity = medium line = 31 matchedText = const pa...rd';

Medium

Secret Pattern

Hardcoded password in test/integration/adapterTestIntegration.js

test/integration/adapterTestIntegration.jsView on unpkg · L31

49patternName = generic_password severity = medium line = 49 matchedText = passwo...

Medium

Secret Pattern

Hardcoded password in test/integration/adapterTestIntegration.js

test/integration/adapterTestIntegration.jsView on unpkg · L49

utils/testRunner.jsView file

19patternName = generic_password severity = medium line = 19 matchedText = let pass...rd';

Medium

Secret Pattern

Hardcoded password in utils/testRunner.js

utils/testRunner.jsView on unpkg · L19

29patternName = generic_password severity = medium line = 29 matchedText = const dp...rd';

Medium

Secret Pattern

Hardcoded password in utils/testRunner.js

utils/testRunner.jsView on unpkg · L29

89patternName = generic_password severity = medium line = 89 matchedText = intTest ...;`);

Medium

Secret Pattern

Hardcoded password in utils/testRunner.js

utils/testRunner.jsView on unpkg · L89

Findings

1 High10 Medium2 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumSecret Patterntest/unit/adapterTestUnit.js

MediumDynamic Requireadapter.js

MediumShips Build Helperutils/pre-commit.sh

MediumStructural Risk Force Deep Review

MediumSecret Patterntest/unit/adapterTestUnit.js

MediumSecret Patterntest/integration/adapterTestIntegration.js

MediumSecret Patternutils/testRunner.js

LowScripts Present

LowFilesystem

test/unit/adapterTestUnit.jsView file

Lines 14-70javascript

14const winston = require('winston');

15const execute = require('child_process').execSync;

16const { expect } = require('chai');

17const { use } = require('chai');

18const td = require('testdouble');

19const Ajv = require('ajv');

20const log = require('../../utils/logger');

22const ajv = new Ajv({ strictSchema: false, allErrors: true, allowUnionTypes: true });

24const anything = td.matchers.anything();

26// stub and attemptTimeout are used throughout the code so set them here

27const stub = true;

28const isRapidFail = false;

29const attemptTimeout = 120000;

31// these variables can be changed to run in integrated mode so easier to set them here

32// always check these in with bogus data!!!

33const username = 'username';

34const password = 'password';

Medium

Secret Pattern

Package contains a possible secret pattern.

test/unit/adapterTestUnit.jsView on unpkg · L34

36// these are the adapter properties. You generally should not need to alter

37// any of these after they are initially set up

38global.pronghornProps = {

39 pathProps: {

40 encrypted: false

41 },

42 adapterProps: {

43 adapters: [{

44 id: 'Test-Git',

45 type: 'Git',

46 stub: true,

47 properties: {

48 authentication: {

49 username: 'username',

50 password: 'password'

Medium

Secret Pattern

Hardcoded password in test/unit/adapterTestUnit.js

test/unit/adapterTestUnit.jsView on unpkg · L50

51 }

52 }

53 }]

54 }

55};

57global.$HOME = `${__dirname}/../..`;

59/**

60 * Runs the error asserts for the test

61 */

62function runErrorAsserts(data, error, code, origin, displayStr) {

63 assert.equal(null, data);

64 assert.notEqual(undefined, error);

65 assert.notEqual(null, error);

66 assert.notEqual(undefined, error.IAPerror);

67 assert.notEqual(null, error.IAPerror);

68 assert.notEqual(undefined, error.IAPerror.displayString);

69 assert.notEqual(null, error.IAPerror.displayString);

70 assert.equal(code, error.icode);

adapter.jsView file

Lines 1-35javascript

1/* @copyright Itential, LLC 2019 (pre-modifications) */

3// Set globals

4/* global eventSystem log */

5/* eslint no-underscore-dangle: warn */

6/* eslint no-loop-func: warn */

7/* eslint no-cond-assign: warn */

8/* eslint no-unused-vars: warn */

9/* eslint consistent-return: warn */

10/* eslint import/no-dynamic-require: warn */

11/* eslint global-require: warn */

12/* eslint no-await-in-loop: warn */

13/* eslint default-param-last: warn */

15/* Required libraries. */

16const fs = require('fs-extra');

17const builtInfs = require('fs');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

adapter.jsView on unpkg · L15

18const path = require('path');

19const util = require('util');

20/* Fetch in the other needed components for the this Adaptor */

21const EventEmitterCl = require('events').EventEmitter;

22const AjvCl = require('ajv');

23const git = require('isomorphic-git');

24const http = require('isomorphic-git/http/node');

26let myid = null;

27let errors = [];

29/**

30 * @summary Build a standard error object from the data provided

31 *

32 * @function formatErrorObject

33 * @param {String} origin - the originator of the error (optional).

34 * @param {String} type - the internal error type (optional).

35 * @param {String} variables - the variables to put into the error message (optional).

test/integration/adapterTestIntegration.jsView file

Lines 11-69javascript

11const mocha = require('mocha');

12const path = require('path');

13const winston = require('winston');

14const { expect } = require('chai');

15const { use } = require('chai');

16const td = require('testdouble');

17const log = require('../../utils/logger');

19const anything = td.matchers.anything();

21// stub and attemptTimeout are used throughout the code so set them here

22const stub = true;

23const isRapidFail = false;

24const isSaveMockData = false;

25const attemptTimeout = 10000;

27// these variables can be changed to run in integrated mode so easier to set them here

28// always check these in with bogus data!!!

29const host = 'localhost';

30const username = 'username';

31const password = 'password';

Medium

Secret Pattern

Hardcoded password in test/integration/adapterTestIntegration.js

test/integration/adapterTestIntegration.jsView on unpkg · L31

32const sslenable = false;

33const sslinvalid = false;

35// these are the adapter properties. You generally should not need to alter

36// any of these after they are initially set up

37global.pronghornProps = {

38 pathProps: {

39 encrypted: false

40 },

41 adapterProps: {

42 adapters: [{

43 id: 'Test-Git',

44 type: 'Git',

45 stub: true,

46 properties: {

47 authentication: {

48 username: 'username',

49 password: 'password'

Medium

Secret Pattern

Hardcoded password in test/integration/adapterTestIntegration.js

test/integration/adapterTestIntegration.jsView on unpkg · L49

50 }

51 }

52 }]

53 }

54};

56global.$HOME = `${__dirname}/../..`;

58/**

59 * Runs the common asserts for test

60 */

61function runCommonAsserts(data, error) {

62 assert.equal(undefined, error);

63 assert.notEqual(undefined, data);

64 assert.notEqual(null, data);

65 assert.notEqual(undefined, data.response);

66 assert.notEqual(null, data.response);

67}

69const Git = require('../../adapter');

utils/testRunner.jsView file

Lines 1-49javascript

1#!/usr/bin/env node

2/* @copyright Itential, LLC 2019 */

4const execute = require('child_process').exec;

5const fs = require('fs-extra');

6const rl = require('readline-sync');

8/**

9 * This script will determine the type of integration test to run

10 * based on input. If other information is needed, it will solicit

11 * that input and then edit the integration test accordingly.

12 */

14let stub = true;

15let isRapidFail = false;

16let isSaveMockData = false;

17let host = 'replace.hostorip.here';

18let username = 'username';

19let password = 'password';

Medium

Secret Pattern

Hardcoded password in utils/testRunner.js

utils/testRunner.jsView on unpkg · L19

20let protocol = 'http';

21let port = 80;

22let sslenable = false;

23let sslinvalid = false;

24const dstub = true;

25const disRapidFail = false;

26const disSaveMockData = false;

27const dhost = 'replace.hostorip.here';

28const dusername = 'username';

29const dpassword = 'password';

Medium

Secret Pattern

Hardcoded password in utils/testRunner.js

utils/testRunner.jsView on unpkg · L29

30const dprotocol = 'http';

31const dport = 80;

32const dsslenable = false;

33const dsslinvalid = false;

35let stderror = false;

36let running = false;

38/**

39 * Updates the integration test file with the proper vars

40 */

41function replaceTestVars(test) {

42 if (!fs.existsSync(test)) {

43 console.log(`Could not find ${test}`);

44 return 'error';

45 }

47 let intTest = fs.readFileSync(test, 'utf8');

49 // replace stub variable but check if it exists first

89patternName = generic_password severity = medium line = 89 matchedText = intTest ...;`);

Medium

Secret Pattern

Hardcoded password in utils/testRunner.js

utils/testRunner.jsView on unpkg · L89