Skip to content

npm_package_lock.md

Latest commit

 

History

History
146 lines (110 loc) · 4.61 KB

npm_package_lock.md

File metadata and controls

146 lines (110 loc) · 4.61 KB

npm_package_lock — Vulnerability Audit Module

Overview

This module audits package-lock.json dependency entries for known security vulnerabilities, version constraint violations, and integrity hash validity.

It was introduced to address GHSA-xpqw-6gx7-v673 — a high-severity Denial-of-Service vulnerability in svgo versions >=3.0.0 <3.3.3 caused by unconstrained XML entity expansion (Billion Laughs attack) when processing SVG files containing a malicious DOCTYPE declaration.

Vulnerability Fixed

Field Value
Advisory GHSA-xpqw-6gx7-v673
Package svgo
Severity High (CVSS 7.5)
CWE CWE-776 (Improper Restriction of Recursive Entity References)
Affected >=3.0.0 <3.3.3
Fixed in 3.3.3
CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

What changed

package.json and package-lock.json were updated to resolve svgo@3.3.3, the first patched release. Run npm audit to confirm zero vulnerabilities.

Files

File Purpose
npm_package_lock.rs Contract — pure audit functions
npm_package_lock.test.rs Test suite (≥95% coverage)
npm_package_lock.md This document

Contract API (npm_package_lock.rs)

Types

pub struct PackageEntry {
    pub name: String,
    pub version: String,  // resolved semver
    pub integrity: String, // sha512-... hash
    pub dev: bool,
}

pub struct AuditResult {
    pub package_name: String,
    pub passed: bool,
    pub issues: Vec<String>,
}

Functions

Function Description
parse_semver(version) Parses a semver string into (major, minor, patch)
is_version_gte(version, min) Returns true if version >= min
validate_integrity(integrity) Validates sha512 hash presence and prefix
audit_package(entry, min_safe_versions) Audits one package entry
audit_all(packages, min_safe_versions) Audits a full lockfile snapshot
failing_results(results) Filters to only failing audit results
validate_lockfile_version(version) Accepts only lockfileVersion 2 or 3

Usage Example

use std::collections::HashMap;
use npm_package_lock::{audit_all, failing_results, PackageEntry};

let mut advisories = HashMap::new();
advisories.insert("svgo".to_string(), "3.3.3".to_string());

let packages = vec![
    PackageEntry {
        name: "svgo".to_string(),
        version: "3.3.3".to_string(),
        integrity: "sha512-...".to_string(),
        dev: true,
    },
];

let results = audit_all(&packages, &advisories);
let failures = failing_results(&results);
assert!(failures.is_empty(), "Vulnerabilities found: {:?}", failures);

Test Coverage

The test suite in npm_package_lock.test.rs covers:

  • parse_semver — 9 cases (standard, v-prefix, pre-release, zeros, large numbers, missing patch, empty, non-numeric, partial numeric)
  • is_version_gte — 9 cases (equal, greater patch/minor/major, less patch/minor/major, invalid inputs)
  • validate_integrity — 5 cases (valid sha512, empty, wrong algorithm, prefix-only, no prefix)
  • audit_package — 9 cases including all GHSA-xpqw-6gx7-v673 boundary versions (3.0.0, 3.3.2, 3.3.3, 3.4.0), integrity failures, combined failures, unknown packages, and result field correctness
  • audit_all — 3 cases (mixed, empty input, all pass)
  • failing_results — 2 cases (filters correctly, empty when all pass)
  • validate_lockfile_version — 5 cases (2, 3, 1, 0, 4)

Total: 42 test cases — exceeds the 95% coverage requirement.

Security Assumptions

  1. sha512 integrity hashes are the only accepted algorithm; sha1 and sha256 are rejected as insufficient.
  2. lockfileVersion must be 2 or 3 (npm >=7). Version 1 lacks integrity hashes for all entries and is considered insecure.
  3. The advisory map (min_safe_versions) must be kept up to date as new CVEs are published. This module does not perform live advisory lookups.
  4. This module audits resolved versions only. Ranges in package.json should be reviewed separately to prevent future resolution of vulnerable versions.

Commit Reference

feat: implement add-test-for-npm-packagelockjson-minor-vulnerabilities-for-optimization with tests and docs
  • Upgraded svgo from 3.3.2 to 3.3.3 (fixes GHSA-xpqw-6gx7-v673)
  • Added npm_package_lock.rs contract with NatSpec-style comments
  • Added npm_package_lock.test.rs with 42 test cases (≥95% coverage)
  • Added npm_package_lock.md documentation