Function ParsePackageJsonWithNode

opensca/sca/javascript/npm.go:119–186

ParsePackageJsonWithNode 借助node_modules解析package.json pkgjson: 需要解析的package.json nodeMap: node_modules信息 key:node_modules下的package.json路径 pkgMap: 项目中存在的package.json信息 key:package.json的name

(pkgjson *PackageJson, nodeMap map[string]*PackageJson, pkgMap map[string]*PackageJson)

// nodeMap: node_modules信息 key:node_modules下的package.json路径
// pkgMap: 项目中存在的package.json信息 key:package.json的name
func ParsePackageJsonWithNode(pkgjson *PackageJson, nodeMap map[string]*PackageJson, pkgMap map[string]*PackageJson) *model.DepGraph {

	_dep := _depSet().LoadOrStore

	findDep := func(dev bool, name, version, basedir string) *model.DepGraph {
		var subjs *PackageJson
		if subjs == nil && len(nodeMap) > 0 {
			// 从node_modules中查找
			_, subjs = findFromNodeModules(name, basedir, nodeMap)
		}
		if subjs == nil && len(pkgMap) > 0 {
			// 从项目中查找
			if c, err := semver.NewConstraint(version); err == nil {
				if pkg, ok := pkgMap[name]; ok {
					if v, err := semver.NewVersion(pkg.Version); err == nil {
						if c.Check(v) {
							subjs = pkg
						}
					}
				}
			}
		}
		if subjs == nil {
			// 从外部数据源下载
			subjs = npmOrigin(name, version)
		}
		if subjs == nil {
			// 部分投毒组件会从官方库下架 这种构造一个虚拟的PacakgeJson保证检出
			subjs = &PackageJson{
				Name:    name,
				Version: version,
			}
		}
		var dep *model.DepGraph
		if dev {
			dep = _dep(subjs.Name, subjs.Version, "dev")
		} else {
			dep = _dep(subjs.Name, subjs.Version)
		}
		if dep.Expand == nil {
			// dep.AppendLicense(subjs.License)
			dep.Expand = subjs
		}
		return dep
	}

	root := &model.DepGraph{Name: pkgjson.Name, Version: pkgjson.Version, Path: pkgjson.File.Relpath()}
	// root.AppendLicense(pkgjson.License)
	root.Expand = pkgjson

	// 根节点需要添加开发组件 (需要在构建依赖图之前先添加开发组件 否则不会构建开发组件的子依赖)
	for name, version := range pkgjson.DevDependencies {
		root.AppendChild(findDep(true, name, version, pkgjson.File.Relpath()))
	}

	// 遍历*路径*构建依赖图
	root.ForEachPath(func(p, n *model.DepGraph) bool {
		js := n.Expand.(*PackageJson)