registry / @sasjs/cli / 4.18.1

@sasjs/cli@4.18.1

Command line interface for SASjs

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 282 file(s), 2.31 MB of source, external domains: api.agify.io, cli.sasjs.io, core.sasjs.io, example.com, github.com, raw.githubusercontent.com, sasjs.io, server.com, support.sas.com, test.sasjs, www.contributor-covenant.org, www.conventionalcommits.org, www.doxygen.nl

Source & flagged code

6 flagged

build/commands/create/spec/create.spec.jsView file

Lines 40-80javascript

40};

41Object.defineProperty(exports, "__esModule", { value: true });

42var dotenv_1 = __importDefault(require("dotenv"));

43var path_1 = __importDefault(require("path"));

44var test_1 = require("../../../utils/test");

45var utils_1 = require("@sasjs/utils");

46var config_1 = require("../../../utils/config");

47var minimalAppFiles_1 = require("./minimalAppFiles");

48var reactAppFiles_1 = require("./reactAppFiles");

49var angularAppFiles_1 = require("./angularAppFiles");

50var create_1 = require("../create");

51var utils_2 = require("../../../utils");

52var shelljs_1 = __importDefault(require("shelljs"));

53describe('sasjs create', function () {

54 beforeAll(function () {

55 dotenv_1.default.config();

56 });

57 beforeEach(function () {

58 var exec = shelljs_1.default.exec;

59 jest.spyOn(shelljs_1.default, 'exec').mockImplementation(function (command) {

60 if (!command.includes('npm install')) {

61 return exec(command, {

62 silent: true

High

Child Process

Package source references child process execution.

build/commands/create/spec/create.spec.jsView on unpkg · L60

63 });

64 }

65 return undefined;

66 });

67 });

68 afterEach(function () { return __awaiter(void 0, void 0, void 0, function () {

69 return __generator(this, function (_a) {

70 switch (_a.label) {

71 case 0: return [4 /*yield*/, (0, utils_1.deleteFolder)(path_1.default.join(__dirname, 'test-app-create-*'))];

72 case 1:

73 _a.sent();

74 return [2 /*return*/];

75 }

76 });

77 }); });

78 it('should set up a default app in the current folder', function () { return __awaiter(void 0, void 0, void 0, function () {

79 var appName;

80 return __generator(this, function (_a) {

build/utils/utils.jsView file

Lines 72-112javascript

72 if (!ar) ar = Array.prototype.slice.call(from, 0, i);

73 ar[i] = from[i];

74 }

75 }

76 return to.concat(ar || Array.prototype.slice.call

build/commands/add/spec/addTarget.spec.jsView file

Lines 217-257javascript

217 case 0:

218 commonFields = {

219 scope: targetScope_1.TargetScope.Local,

220 serverType: utils_1.ServerType.Sas9,

221 name: sas9TargetName,

222 appLoc: '/Public/app',

223 serverUrl: serverUrl,

224 existingTarget: {}

225 };

build/commands/job/spec/jobCommand.spec.jsView file

Lines 94-134javascript

94var jobCommand_1 = require("../jobCommand");

95var utils_1 = require("@sasjs/utils");

96var SasjsUtilsFilesModule = __importStar(require("@sasjs/utils/file"));

97var configUtils = __importStar(require

Source & flagged code

6 flagged · loading source

build/commands/create/spec/create.spec.jsView file

60if (!command.includes('npm install')) { L61: return exec(command, { L62: silent: true

High

Child Process

Package source references child process execution.

build/commands/create/spec/create.spec.jsView on unpkg · L60

build/utils/utils.jsView file

92Object.defineProperty(exports, "__esModule", { value: true }); L93: exports.isSasJsServerInServerMode = exports.getNodeModulePath = exports.isSASjsProject = exports.terminateProcess = exports.prefixAppLoc = exports.loadEnvVariables = exports.displa... L94: var shelljs_1 = __importDefault(require("shelljs"));

High

Shell

Package source references shell execution.

build/utils/utils.jsView on unpkg · L92

310(_c = process.logger) === null || _c === void 0 ? void 0 : _c.info('Installing @sasjs/core'); L311: shelljs_1.default.exec("cd \"".concat(folderPath, "\" && npm i @sasjs/core --save"), { L312: silent: true

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

build/utils/utils.jsView on unpkg · L310

build/commands/add/spec/addTarget.spec.jsView file

237patternName = generic_password severity = medium line = 237 matchedText = password...ord'

Medium

Secret Pattern

Hardcoded password in build/commands/add/spec/addTarget.spec.js

build/commands/add/spec/addTarget.spec.jsView on unpkg · L237

359patternName = generic_password severity = medium line = 359 matchedText = password...ord'

Medium

Secret Pattern

Hardcoded password in build/commands/add/spec/addTarget.spec.js

build/commands/add/spec/addTarget.spec.jsView on unpkg · L359

build/commands/job/spec/jobCommand.spec.jsView file

114patternName = generic_password severity = medium line = 114 matchedText = passwo...

Medium

Secret Pattern

Hardcoded password in build/commands/job/spec/jobCommand.spec.js

build/commands/job/spec/jobCommand.spec.jsView on unpkg · L114

Findings

3 High6 Medium5 Low

HighChild Processbuild/commands/create/spec/create.spec.js

HighShellbuild/utils/utils.js

HighRuntime Package Installbuild/utils/utils.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSecret Patternbuild/commands/add/spec/addTarget.spec.js

MediumSecret Patternbuild/commands/job/spec/jobCommand.spec.js

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

build/commands/create/spec/create.spec.jsView file

Lines 40-80javascript

40};

41Object.defineProperty(exports, "__esModule", { value: true });

42var dotenv_1 = __importDefault(require("dotenv"));

43var path_1 = __importDefault(require("path"));

44var test_1 = require("../../../utils/test");

45var utils_1 = require("@sasjs/utils");

46var config_1 = require("../../../utils/config");

47var minimalAppFiles_1 = require("./minimalAppFiles");

48var reactAppFiles_1 = require("./reactAppFiles");

49var angularAppFiles_1 = require("./angularAppFiles");

50var create_1 = require("../create");

51var utils_2 = require("../../../utils");

52var shelljs_1 = __importDefault(require("shelljs"));

53describe('sasjs create', function () {

54 beforeAll(function () {

55 dotenv_1.default.config();

56 });

57 beforeEach(function () {

58 var exec = shelljs_1.default.exec;

59 jest.spyOn(shelljs_1.default, 'exec').mockImplementation(function (command) {

60 if (!command.includes('npm install')) {

61 return exec(command, {

62 silent: true

High

Child Process

Package source references child process execution.

build/commands/create/spec/create.spec.jsView on unpkg · L60

63 });

64 }

65 return undefined;

66 });

67 });

68 afterEach(function () { return __awaiter(void 0, void 0, void 0, function () {

69 return __generator(this, function (_a) {

70 switch (_a.label) {

71 case 0: return [4 /*yield*/, (0, utils_1.deleteFolder)(path_1.default.join(__dirname, 'test-app-create-*'))];

72 case 1:

73 _a.sent();

74 return [2 /*return*/];

75 }

76 });

77 }); });

78 it('should set up a default app in the current folder', function () { return __awaiter(void 0, void 0, void 0, function () {

79 var appName;

80 return __generator(this, function (_a) {

build/utils/utils.jsView file

Lines 72-112javascript

72 if (!ar) ar = Array.prototype.slice.call(from, 0, i);

73 ar[i] = from[i];

74 }

75 }

76 return to.concat(ar || Array.prototype.slice.call

build/commands/add/spec/addTarget.spec.jsView file

Lines 217-257javascript

217 case 0:

218 commonFields = {

219 scope: targetScope_1.TargetScope.Local,

220 serverType: utils_1.ServerType.Sas9,

221 name: sas9TargetName,

222 appLoc: '/Public/app',

223 serverUrl: serverUrl,

224 existingTarget: {}

225 };

build/commands/job/spec/jobCommand.spec.jsView file

Lines 94-134javascript

94var jobCommand_1 = require("../jobCommand");

95var utils_1 = require("@sasjs/utils");

96var SasjsUtilsFilesModule = __importStar(require("@sasjs/utils/file"));

97var configUtils = __importStar(require

Lines 290-330javascript

290 var _this = this;

291 return __generator(this, function (_a) {

292 folderPath = path_1.default.join(process.projectDir, folderName);

293 return [2 /*return*/, new Promise(function (resolve, _) { return __awaiter(_this, void 0, void 0, function () {

294 var isExistingProject;

295 var _a, _b, _c;

296 return __generator(this, function (_d) {

297 switch (_d.label) {

298 case 0: return [4 /*yield*/, inExistingProject(folderName)];

299 case 1:

300 isExistingProject = _d.sent();

301 if (!isExistingProject) {

302 (_a = process.logger) === null || _a === void 0 ? void 0 : _a.info("Initialising NPM project in ".concat(folderPath));

303 shelljs_1.default.exec("cd \"".concat(folderPath, "\" && npm init --yes"), {

304 silent: true

305 });

306 }

307 else {

308 (_b = process.logger) === null || _b === void 0 ? void 0 : _b.success('Existing NPM project detected.');

309 }

310 (_c = process.logger) === null || _c === void 0 ? void 0 : _c.info('Installing @sasjs/core');

311 shelljs_1.default.exec("cd \"".concat(folderPath, "\" && npm i @sasjs/core --save"), {

312 silent: true

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

build/utils/utils.jsView on unpkg · L310

313 });

314 return [2 /*return*/, resolve()];

315 }

316 });

317 }); })];

318 });

319 });

320}

321exports.setupNpmProject = setupNpmProject;

322function setupGitIgnore(folderName) {

323 var _a, _b;

324 return __awaiter(this, void 0, void 0, function () {

325 var gitIgnoreFilePath, gitIgnoreExists, gitIgnoreContent, newgitIgnoreContent, regExpSasjsBuild, regExpSasjsResults, regExpNodeModules, regExpEnv;

326 return __generator(this, function (_c) {

327 switch (_c.label) {

328 case 0:

329 gitIgnoreFilePath = path_1.default.join(process.projectDir, folderName, '.gitignore');

330 return [4 /*yield*/, (0, utils_1.fileExists)(gitIgnoreFilePath)];

Lines 339-379javascript

339 target = (config.targets || []).find(function (t) { return t.name === 'sas9'; });

340 commonFields = {

341 scope: targetScope_1.TargetScope.Local,

342 serverType: utils_1.ServerType.Sas9,

343 name: 'sas9',

344 appLoc: '/Public/app/new/location/2',

345 serverUrl: serverUrl,

346 existingTarget: target

347 };

348 jest

349 .spyOn(inputModule, 'getCommonFields')

350 .mockImplementation(function () { return Promise.resolve(commonFields); });

351 jest

352 .spyOn(inputModule, 'getIsDefault')

353 .mockImplementation(function () { return Promise.resolve(false); });

354 jest.spyOn(inputModule, 'getAndValidateSas9Fields').mockImplementation(function () {

355 return Promise.resolve({

356 serverName: 'testServer',

357 repositoryName: 'testRepo',

358 userName: 'tstusr',

359 password: 'Some_Random_Password'

Medium

Secret Pattern

Hardcoded password in build/commands/add/spec/addTarget.spec.js

build/commands/add/spec/addTarget.spec.jsView on unpkg · L359

360 });

361 });

362 return [4 /*yield*/, expect((0, addTarget_1.addTarget)(false)).resolves.toEqual(true)];

363 case 2:

364 _a.sent();

365 return [4 /*yield*/, verifyTarget(commonFields, true)];

366 case 3:

367 _a.sent();

368 return [2 /*return*/];

369 }

370 });

371 }); });

372 it('should update a SASJS target in the local sasjsconfig.json file', function () { return __awaiter(void 0, void 0, void 0, function () {

373 var buildSourceFolder, config, targetJson, commonFields;

374 return __generator(this, function (_a) {

375 switch (_a.label) {

376 case 0:

377 buildSourceFolder = process.sasjsConstants.buildSourceFolder;

378 return [4 /*yield*/, (0, config_1.getConfiguration)(path_1.default.join(buildSourceFolder, 'sasjs', 'sasjsconfig.json'))];

379 case 1: