sbt-utils.js

const fs = require("fs");
const os = require("os");
const pathLib = require("path");
const propertiesReader = require("properties-reader");
const semver = require("semver");
const { spawnSync } = require("child_process");
const utils = require("./utils");

const ADD_SBT_PLUGIN='addSbtPlugin("net.virtual-void" % "sbt-dependency-graph" % "0.10.0-RC1")';
const DISCLAIMER=`
// This file has been automatically generated by https://github.com/ShiftLeftSecurity/cdxgen and should be automatically deleted on cdxgen exit
`;
const ENABLE_SBT_PLUGIN='addDependencyTreePlugin';
const EOL = "\n";

const commonPluginContent = function(pluginName) {
  return `
  import sbt.AutoPlugin
  import sbt._
  import Keys._
  import complete.DefaultParsers._
  
  import java.io.{BufferedWriter, FileWriter}
  import java.nio.file.Paths
  
  object ShiftLeftDependencyListPlugin extends AutoPlugin {
    override def requires = ${pluginName}
    override def trigger = allRequirements
  
    object autoImport {
      // This task is supposed to be called like this:
      // customShiftLeftListDependencies path_to_existing_dir
      // path_to_existing_dir can be either absolute path or a path relative to build root
      // As a result of running this task a files subproject1.out, subproject2.out and so on will be created in path_to_existing_dir
      val customShiftLeftListDependencies = inputKey[Unit]("Shiftleft-specific list dependencies")
    }
    import autoImport._
  
    override lazy val projectSettings = Seq(
      customShiftLeftListDependencies := {
        val outDir = (Space ~ StringBasic).map(s => Paths.get(s._2)).parsed
        val filename = name.value + ".out"
        val outAbsPath = outDir.resolve(filename)
        val writer = new BufferedWriter(new FileWriter(outAbsPath.toString))
  
        val res = (Compile / dependencyList / asString).value
        writer.write(res)
        writer.close()
      }
    )
  }
  `
};

const pluginStringForNonBuiltin = `
${DISCLAIMER}

import net.virtualvoid.sbt.graph.DependencyGraphPlugin.autoImport.asString
import net.virtualvoid.sbt.graph.DependencyGraphPlugin.autoImport.dependencyList

${commonPluginContent('net.virtualvoid.sbt.graph.DependencyGraphPlugin')}
`;

const pluginStringForBuiltin = `
${DISCLAIMER}

import sbt.plugins.MiniDependencyTreeKeys.asString
import sbt.plugins.DependencyTreePlugin.autoImport.dependencyList

${commonPluginContent('sbt.plugins.DependencyTreePlugin')}
`;


/**
 * Parse sbt lock file
 *
 * @param {string} pkgLockFile build.sbt.lock file
 */
 const parseSbtLock = function (pkgLockFile) {
  const pkgList = [];
  if (fs.existsSync(pkgLockFile)) {
    lockData = JSON.parse(fs.readFileSync(pkgLockFile, "utf8"));
    if (lockData && lockData.dependencies) {
      for (let i in lockData.dependencies) {
        const pkg = lockData.dependencies[i];
        const artifacts = pkg.artifacts || undefined;
        let integrity = "";
        if (artifacts && artifacts.length) {
          integrity = artifacts[0].hash.replace("sha1:", "sha1-");
        }
        let compScope = undefined;
        if (pkg.configurations) {
          if (pkg.configurations.includes("runtime")) {
            compScope = "required";
          } else {
            compScope = "optional";
          }
        }
        pkgList.push({
          group: pkg.org,
          name: pkg.name,
          version: pkg.version,
          _integrity: integrity,
          scope: compScope,
        });
      }
    }
  }
  return pkgList;
};
exports.parseSbtLock = parseSbtLock;

/**
 * Determine the version of SBT used in compilation of this project.
 * By default it looks into a standard SBT location i.e.
 * <path-project>/project/build.properties
 * Returns `null` if the version cannot be determined.
 *
 * @param {string} projectPath Path to the SBT project
 */
const determineSbtVersion = function (projectPath) {
  const buildPropFile = pathLib.join(projectPath, "project", "build.properties");
  if (fs.existsSync(buildPropFile)) {
    let properties = propertiesReader(buildPropFile);
    let property = properties.get("sbt.version");
    if (property != null && semver.valid(property)) {
      return property;
    }
  }
  return null;
};
exports.determineSbtVersion = determineSbtVersion;

/**
 * Adds a new plugin to the SBT project by amending its plugins list.
 * Only recommended for SBT < 1.2.0 or otherwise use `addPluginSbtFile`
 * parameter.
 * The change manipulates the existing plugins' file by creating a copy of it
 * and returning a path where it is moved to.
 * Once the SBT task is complete one must always call `cleanupPlugin` to remove
 * the modifications made in place.
 *
 * @param {string} projectPath Path to the SBT project
 * @param {string} plugin Name of the plugin to add
 */
const addPlugin = function (projectPath, plugin, resourcesManager) {
  function uniqueFilename(attempt) {
    const proposedName = pathLib.join(projectPath, 'project', `shiftleft-enable-plugin${attempt}.sbt`);
    if (!fs.existsSync(proposedName)) {
      return proposedName;
    } else {
      return uniqueFilename(attempt + 1);
    }
  }

  const pluginFileName = uniqueFilename(0);
  resourcesManager.cleanUpFileOnShutdown(pluginFileName);
  fs.writeFileSync(pluginFileName, plugin);
  return pluginFileName;
};

const addCustomPlugin = function(projectPath, content, resourcesManager) {
  function uniqueFilename(attempt) {
    const proposedName = pathLib.join(projectPath, 'project', `shiftleft-custom-plugin${attempt}.scala`);
    if (!fs.existsSync(proposedName)) {
      return proposedName;
    } else {
      return uniqueFilename(attempt + 1);
    }
  }

  const customPluginFileName = uniqueFilename(0);
  resourcesManager.cleanUpFileOnShutdown(customPluginFileName);
  fs.writeFileSync(customPluginFileName, content);
  return customPluginFileName;
}

 /**
 * Parse dependencies in Key:Value format
 */
const parseKVDep = function (rawOutput) {
  if (typeof rawOutput === "string") {
    const deps = [];
    rawOutput.split(EOL).forEach((l) => {
      const tmpA = l.split(":");
      if (tmpA.length === 3) {
        deps.push({
          group: tmpA[0],
          name: tmpA[1],
          version: tmpA[2],
          qualifiers: { type: "jar" },
        });
      } else if (tmpA.length === 2) {
        deps.push({
          group: "",
          name: tmpA[0],
          version: tmpA[1],
          qualifiers: { type: "jar" },
        });
      }
    });
    return deps;
  }
  return [];
};
exports.parseKVDep = parseKVDep;

const sbtInvoker = function (debugMode, path, resourcesManager) {
  let SBT_CMD = process.env.SBT_CMD || "sbt";
  let sbtVersion = determineSbtVersion(path);
  if (debugMode) {
    console.log("Detected sbt version: " + sbtVersion);
  }
  const standalonePluginFileSupported = standalonePluginFile(sbtVersion);

  let enablePluginString =  isDependencyTreeBuiltIn(sbtVersion) ? ENABLE_SBT_PLUGIN : ADD_SBT_PLUGIN;

  let pluginFileInTempDir = resourcesManager.tmpFile('shiftleft-enable-plugin.sbt');
  if (standalonePluginFileSupported) {
    fs.writeFileSync(pluginFileInTempDir, enablePluginString);
  }

  return {
    invokeDependencyList: function(commandPrefix, basePath, timeoutMs) {
      let dependencyListCmd;
      
      const outDir = resourcesManager.createTmpSubDir('sbt-list-dependencies-out');

      if (commandPrefix !== '') {
        dependencyListCmd = `"${commandPrefix}customShiftLeftListDependencies ${outDir}"`;
      } else {
        dependencyListCmd = `"customShiftLeftListDependencies ${outDir}"`;
      }

      let customPluginContent = isDependencyTreeBuiltIn(sbtVersion) ? pluginStringForBuiltin : pluginStringForNonBuiltin;
      addCustomPlugin(basePath, customPluginContent, resourcesManager);
      if (standalonePluginFileSupported) {
        sbtArgs = [`-addPluginSbtFile=${pluginFileInTempDir}`, dependencyListCmd];
      } else {
        // write to a new shiftleft-cdxgen-plugins0.sbt file
        addPlugin(basePath, enablePluginString, resourcesManager);
        sbtArgs = [dependencyListCmd];
      }

      outputAsStr = '';
      console.log(`Executing ${SBT_CMD} ${sbtArgs} in ${basePath}`);
      // Note that the command has to be invoked with `shell: true` to properly execute sbt
      const result = spawnSync(
        SBT_CMD,
        sbtArgs,
        { cwd: basePath, shell: true, encoding: "utf-8", timeout: timeoutMs }
      );
      if (result.status == 1 || result.error) {
        console.error(result.stdout, result.stderr);
        utils.debug(`1. Check if scala and sbt is installed and available in PATH. Only scala 2.10 + sbt 0.13.6+ and 2.12 + sbt 1.0+ is supported for now.`);
        utils.debug(`2. Check if the plugin net.virtual-void:sbt-dependency-graph 0.10.0-RC1 can be used in the environment`);
      } else {
        utils.debug(result.stdout);
      }
      fs.readdirSync(outDir).forEach(f => {
        const file = pathLib.join(outDir, f)
        try {
          outputAsStr += fs.readFileSync(file, { encoding: "utf-8" });
          // Files we merge don't have trailing EOL so if we don't put it manually we would end up with 2 entries at a single line
          outputAsStr += EOL;
        } catch(error) {
          utils.debug(`Reading ${file} failed. Continuing anyway...`)
        }
      });
      return outputAsStr;
    }
  }
}
exports.sbtInvoker = sbtInvoker;

/**
 *
 * @param {string} sbtVersion SBT version, might be null
 * @returns {boolean} true if SBT version has sbt-dependency-graph built-in
 */
const isDependencyTreeBuiltIn = function(sbtVersion) {
  // Introduced in https://www.scala-sbt.org/1.x/docs/sbt-1.4-Release-Notes.html#sbt-dependency-graph+is+in-sourced
  return sbtVersion != null && semver.gte(sbtVersion, "1.4.0");
}

/**
 *
 * @param {string} sbtVersion SBT version, might be null
 * @returns {boolean} true if SBT version supports addPluginSbtFile
 */
 const standalonePluginFile = function (sbtVersion) {
  // Introduced in 1.2.0 https://www.scala-sbt.org/1.x/docs/sbt-1.2-Release-Notes.html#addPluginSbtFile+command,
  // however working properly for real only since 1.3.4: https://github.com/sbt/sbt/releases/tag/v1.3.4
  return sbtVersion != null && semver.gte(sbtVersion, "1.3.4");
}