bug(nodejs): package.json parser fails on object notation for workspaces

[nikpivkin]

Ref:

• JSON schema package.json

Discussed in #6114

^{Originally posted by pjungermann February 13, 2024}

Description

Currently, the workspaces field in package.json files is only allowed to be an array of strings. However, it has also an object version.

https://classic.yarnpkg.com/blog/2018/02/15/nohoist/

Example

  "workspaces": {
    "packages": [
      "packages/*",
      "plugins/*"
    ]
  },

Ref to an active open-source project using this notation:
https://github.com/backstage/backstage/blob/master/package.json#L52

Impact e.g. on Trivy scans:

WARN  Unable to parse "package.json" to remove dev dependencies: unable to parse .: parse error: JSON decode error: json: cannot unmarshal object into Go struct field packageJSON.workspaces of type []string

Relates-to: aquasecurity/go-dep-parser#295

Desired Behavior

Parsing package.json files does not fail when workspaces object notation is used.

Actual Behavior

Parser fails and warning gets emitted:

WARN  Unable to parse "package.json" to remove dev dependencies: unable to parse .: parse error: JSON decode error: json: cannot unmarshal object into Go struct field packageJSON.workspaces of type []string

Reproduction Steps

1. Close or create a project with workspaces object notation (e.g., https://github.com/backstage/backstage/blob/master/package.json#L52)
2. Run `trivy fs .`

Target

Filesystem

Scanner

Vulnerability

Output Format

Table

Mode

Standalone

Debug Output

-

Operating System

MacOS Venture 13.6

Version

2024-02-13T10:23:25.765+0100    INFO    Loaded trivy.yaml
Version: 0.47.0
Vulnerability DB:
  Version: 2
  UpdatedAt: 2024-02-13 06:11:52.656032521 +0000 UTC
  NextUpdate: 2024-02-13 12:11:52.656032281 +0000 UTC
  DownloadedAt: 2024-02-13 08:38:29.761065 +0000 UTC
Policy Bundle:
  Digest: sha256:1df8ade71efc830877ca3b1130f83e0c6368e3a45b0d4c0f0418955501644054
  DownloadedAt: 2023-11-24 02:43:02.401033 +0000 UTC

Checklist

• Run trivy image --reset
• Read the troubleshooting

[gkumarcertinia]

I got the same issue while parsing package-lock.json .

Description :
Currently, the workspaces field in package-lock.json files is only allowed to be an array of strings. However, it has also an object version.

Example:

"workspaces": {
	"nohoist": [
		"**"
	]
}

Desired Behavior
Parsing package-lock.json files does not fail when workspaces object notation is used.

Actual Behavior
DEBUG Walk error file_path="package-lock.json" err="parse error: failed to parse package-lock.json: decode error: cannot set object value to target of type slice"

Command Using:
trivy fs . -d

Trivy Version:

INFO Loaded file_path=trivy.yaml

Version: 0.51.1
Vulnerability DB:
  Version: 2
  UpdatedAt: 2024-05-12 12:11:25.443676796 +0000 UTC
  NextUpdate: 2024-05-12 18:11:25.443676515 +0000 UTC
  DownloadedAt: 2024-05-12 16:46:18.464060983 +0000 UTC
Check Bundle:
  Digest: sha256:6d0771effa53c6cf8130861fc3ac28f5515c35a028edb4bb1e67261b9218c80e
  DownloadedAt: 2024-05-12 16:46:20.143160963 +0000 UTC

Operating System:
Ubuntu 22.04.4 LTS

[DmitriyLewen]

Hello @Gobardhan
Thanks for your report!

IIRC only yarn uses nohoist. Also npm docs don't contains info that workspaces can be object.
Can you reproduce the steps for npm to get package-lock.json file with workspace as map?

Regards, Dmitriy

[gkumarcertinia]

Thanks @DmitriyLewen to highlight that only yarn uses nohoist.
So we have removed the legacy code regarding the nohoist and now we have workspace in JSON array and trivy scan successfully.

[Varorbc]

@DmitriyLewen Hello, my project uses feelers. The workspaces in the package-lock.json is also an object rather than an array, which makes it impossible to parse

[DmitriyLewen]

Hello @Varorbc
Can you tell me more about your lock file and how it is related to feelers?

[Varorbc]

@DmitriyLewen Hello, I executed npm install feelers and got the following json. You can find that workspaces is an object, not an array

{
  "name": "Test",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "dependencies": {
        "feelers": "^1.4.0"
      }
    },
    "node_modules/@bpmn-io/cm-theme": {
      "version": "0.1.0-alpha.2",
      "resolved": "https://registry.npmjs.org/@bpmn-io/cm-theme/-/cm-theme-0.1.0-alpha.2.tgz",
      "integrity": "sha512-ZILgiYzxk3KMvxplUXmdRFQo45/JehDPg5k9tWfehmzUOSE13ssyLPil8uCloMQnb3yyzyOWTjb/wzKXTHlFQw==",
      "license": "MIT",
      "dependencies": {
        "@codemirror/language": "^6.3.1",
        "@codemirror/view": "^6.5.1",
        "@lezer/highlight": "^1.1.4"
      },
      "workspaces": {
        "packages": [
          "preview-themes"
        ]
      }
    },
    "node_modules/@bpmn-io/feel-lint": {
      "version": "1.4.0",
      "resolved": "https://registry.npmjs.org/@bpmn-io/feel-lint/-/feel-lint-1.4.0.tgz",
      "integrity": "sha512-1bsdR/9vPD7RQVqWWPk0X0tpjLsYTDrCxIzOVtN/h32o4nPGl0dZBU5m07qaFUGD4wG3eOH4Qim1wexHG8YkBw==",
      "license": "MIT",
      "dependencies": {
        "@codemirror/language": "^6.10.8",
        "lezer-feel": "^1.7.0"
      },
      "engines": {
        "node": "*"
      }
    },
    "node_modules/@codemirror/autocomplete": {
      "version": "6.18.7",
      "resolved": "https://registry.npmjs.org/@codemirror/autocomplete/-/autocomplete-6.18.7.tgz",
      "integrity": "sha512-8EzdeIoWPJDsMBwz3zdzwXnUpCzMiCyz5/A3FIPpriaclFCGDkAzK13sMcnsu5rowqiyeQN2Vs2TsOcoDPZirQ==",
      "license": "MIT",
      "dependencies": {
        "@codemirror/language": "^6.0.0",
        "@codemirror/state": "^6.0.0",
        "@codemirror/view": "^6.17.0",
        "@lezer/common": "^1.0.0"
      }
    },
    "node_modules/@codemirror/commands": {
      "version": "6.8.1",
      "resolved": "https://registry.npmjs.org/@codemirror/commands/-/commands-6.8.1.tgz",
      "integrity": "sha512-KlGVYufHMQzxbdQONiLyGQDUW0itrLZwq3CcY7xpv9ZLRHqzkBSoteocBHtMCoY7/Ci4xhzSrToIeLg7FxHuaw==",
      "license": "MIT",
      "dependencies": {
        "@codemirror/language": "^6.0.0",
        "@codemirror/state": "^6.4.0",
        "@codemirror/view": "^6.27.0",
        "@lezer/common": "^1.1.0"
      }
    },
    "node_modules/@codemirror/language": {
      "version": "6.11.3",
      "resolved": "https://registry.npmjs.org/@codemirror/language/-/language-6.11.3.tgz",
      "integrity": "sha512-9HBM2XnwDj7fnu0551HkGdrUrrqmYq/WC5iv6nbY2WdicXdGbhR/gfbZOH73Aqj4351alY1+aoG9rCNfiwS1RA==",
      "license": "MIT",
      "dependencies": {
        "@codemirror/state": "^6.0.0",
        "@codemirror/view": "^6.23.0",
        "@lezer/common": "^1.1.0",
        "@lezer/highlight": "^1.0.0",
        "@lezer/lr": "^1.0.0",
        "style-mod": "^4.0.0"
      }
    },
    "node_modules/@codemirror/lint": {
      "version": "6.8.5",
      "resolved": "https://registry.npmjs.org/@codemirror/lint/-/lint-6.8.5.tgz",
      "integrity": "sha512-s3n3KisH7dx3vsoeGMxsbRAgKe4O1vbrnKBClm99PU0fWxmxsx5rR2PfqQgIt+2MMJBHbiJ5rfIdLYfB9NNvsA==",
      "license": "MIT",
      "dependencies": {
        "@codemirror/state": "^6.0.0",
        "@codemirror/view": "^6.35.0",
        "crelt": "^1.0.5"
      }
    },
    "node_modules/@codemirror/state": {
      "version": "6.5.2",
      "resolved": "https://registry.npmjs.org/@codemirror/state/-/state-6.5.2.tgz",
      "integrity": "sha512-FVqsPqtPWKVVL3dPSxy8wEF/ymIEuVzF1PK3VbUgrxXpJUSHQWWZz4JMToquRxnkw+36LTamCZG2iua2Ptq0fA==",
      "license": "MIT",
      "dependencies": {
        "@marijn/find-cluster-break": "^1.0.0"
      }
    },
    "node_modules/@codemirror/view": {
      "version": "6.38.3",
      "resolved": "https://registry.npmjs.org/@codemirror/view/-/view-6.38.3.tgz",
      "integrity": "sha512-x2t87+oqwB1mduiQZ6huIghjMt4uZKFEdj66IcXw7+a5iBEvv9lh7EWDRHI7crnD4BMGpnyq/RzmCGbiEZLcvQ==",
      "license": "MIT",
      "dependencies": {
        "@codemirror/state": "^6.5.0",
        "crelt": "^1.0.6",
        "style-mod": "^4.1.0",
        "w3c-keyname": "^2.2.4"
      }
    },
    "node_modules/@lezer/common": {
      "version": "1.2.3",
      "resolved": "https://registry.npmjs.org/@lezer/common/-/common-1.2.3.tgz",
      "integrity": "sha512-w7ojc8ejBqr2REPsWxJjrMFsA/ysDCFICn8zEOR9mrqzOu2amhITYuLD8ag6XZf0CFXDrhKqw7+tW8cX66NaDA==",
      "license": "MIT"
    },
    "node_modules/@lezer/highlight": {
      "version": "1.2.1",
      "resolved": "https://registry.npmjs.org/@lezer/highlight/-/highlight-1.2.1.tgz",
      "integrity": "sha512-Z5duk4RN/3zuVO7Jq0pGLJ3qynpxUVsh7IbUbGj88+uV2ApSAn6kWg2au3iJb+0Zi7kKtqffIESgNcRXWZWmSA==",
      "license": "MIT",
      "dependencies": {
        "@lezer/common": "^1.0.0"
      }
    },
    "node_modules/@lezer/lr": {
      "version": "1.4.2",
      "resolved": "https://registry.npmjs.org/@lezer/lr/-/lr-1.4.2.tgz",
      "integrity": "sha512-pu0K1jCIdnQ12aWNaAVU5bzi7Bd1w54J3ECgANPmYLtQKP0HBj2cE/5coBD66MT10xbtIuUr7tg0Shbsvk0mDA==",
      "license": "MIT",
      "dependencies": {
        "@lezer/common": "^1.0.0"
      }
    },
    "node_modules/@lezer/markdown": {
      "version": "1.4.3",
      "resolved": "https://registry.npmjs.org/@lezer/markdown/-/markdown-1.4.3.tgz",
      "integrity": "sha512-kfw+2uMrQ/wy/+ONfrH83OkdFNM0ye5Xq96cLlaCy7h5UT9FO54DU4oRoIc0CSBh5NWmWuiIJA7NGLMJbQ+Oxg==",
      "license": "MIT",
      "dependencies": {
        "@lezer/common": "^1.0.0",
        "@lezer/highlight": "^1.0.0"
      }
    },
    "node_modules/@marijn/find-cluster-break": {
      "version": "1.0.2",
      "resolved": "https://registry.npmjs.org/@marijn/find-cluster-break/-/find-cluster-break-1.0.2.tgz",
      "integrity": "sha512-l0h88YhZFyKdXIFNfSWpyjStDjGHwZ/U7iobcK1cQQD8sejsONdQtTVU+1wVN1PBw40PiiHB1vA5S7VTfQiP9g==",
      "license": "MIT"
    },
    "node_modules/crelt": {
      "version": "1.0.6",
      "resolved": "https://registry.npmjs.org/crelt/-/crelt-1.0.6.tgz",
      "integrity": "sha512-VQ2MBenTq1fWZUH9DJNGti7kKv6EeAuYr3cLwxUWhIu1baTaXh4Ib5W2CqHVqib4/MqbYGJqiL3Zb8GJZr3l4g==",
      "license": "MIT"
    },
    "node_modules/domify": {
      "version": "2.0.0",
      "resolved": "https://registry.npmjs.org/domify/-/domify-2.0.0.tgz",
      "integrity": "sha512-rmvrrmWQPD/X1A/nPBfIVg4r05792QdG9Z4Prk6oQG0F9zBMDkr0GKAdds1wjb2dq1rTz/ywc4ZxpZbgz0tttg==",
      "license": "MIT",
      "engines": {
        "node": ">=18"
      },
      "funding": {
        "url": "https://github.com/sponsors/sindresorhus"
      }
    },
    "node_modules/feelers": {
      "version": "1.4.0",
      "resolved": "https://registry.npmjs.org/feelers/-/feelers-1.4.0.tgz",
      "integrity": "sha512-CGa/7ILuqoqTaeYeoKsg/4tzu2es9sEEJTmSjdu0lousZBw4V9gcYhHYFNmbrSrKmbAVfOzj6/DsymGJWFIOeg==",
      "license": "MIT",
      "dependencies": {
        "@bpmn-io/cm-theme": "^0.1.0-alpha.2",
        "@bpmn-io/feel-lint": "^1.2.0",
        "@codemirror/autocomplete": "^6.10.1",
        "@codemirror/commands": "^6.3.0",
        "@codemirror/language": "^6.9.1",
        "@codemirror/lint": "^6.4.2",
        "@codemirror/state": "^6.3.0",
        "@codemirror/view": "^6.21.3",
        "@lezer/common": "^1.1.0",
        "@lezer/highlight": "^1.1.6",
        "@lezer/lr": "^1.3.13",
        "@lezer/markdown": "^1.1.0",
        "feelin": "^3.0.1",
        "lezer-feel": "^1.2.4",
        "min-dom": "^5.0.0"
      },
      "engines": {
        "node": "*"
      },
      "workspaces": {
        "packages": [
          "feelers-playground"
        ]
      }
    },
    "node_modules/feelin": {
      "version": "3.2.0",
      "resolved": "https://registry.npmjs.org/feelin/-/feelin-3.2.0.tgz",
      "integrity": "sha512-GFDbHsTYk7YXO1tyw1dOjb7IODeAZvNIosdGZThUwPx5XcD/XhO0hnPZXsIbAzSsIdrgGlTEEdby9fZ2gixysA==",
      "license": "MIT",
      "dependencies": {
        "@lezer/lr": "^1.4.2",
        "lezer-feel": "^1.4.0",
        "luxon": "^3.5.0"
      },
      "engines": {
        "node": "*"
      }
    },
    "node_modules/lezer-feel": {
      "version": "1.8.1",
      "resolved": "https://registry.npmjs.org/lezer-feel/-/lezer-feel-1.8.1.tgz",
      "integrity": "sha512-g0eGi7/INNPtPbtcz5ubInc3rSvXuJI5NfmS1hVU1FkaKNdBpwWdxXzrUb4wxr8DNXhXnUs1/a9rO4HaDzII7Q==",
      "license": "MIT",
      "dependencies": {
        "@lezer/highlight": "^1.2.1",
        "@lezer/lr": "^1.4.2",
        "min-dash": "^4.2.1"
      },
      "engines": {
        "node": "*"
      }
    },
    "node_modules/luxon": {
      "version": "3.7.2",
      "resolved": "https://registry.npmjs.org/luxon/-/luxon-3.7.2.tgz",
      "integrity": "sha512-vtEhXh/gNjI9Yg1u4jX/0YVPMvxzHuGgCm6tC5kZyb08yjGWGnqAjGJvcXbqQR2P3MyMEFnRbpcdFS6PBcLqew==",
      "license": "MIT",
      "engines": {
        "node": ">=12"
      }
    },
    "node_modules/min-dash": {
      "version": "4.2.3",
      "resolved": "https://registry.npmjs.org/min-dash/-/min-dash-4.2.3.tgz",
      "integrity": "sha512-VLMYQI5+FcD9Ad24VcB08uA83B07OhueAlZ88jBK6PyupTvEJwllTMUqMy0wPGYs7pZUEtEEMWdHB63m3LtEcg==",
      "license": "MIT"
    },
    "node_modules/min-dom": {
      "version": "5.1.1",
      "resolved": "https://registry.npmjs.org/min-dom/-/min-dom-5.1.1.tgz",
      "integrity": "sha512-GaKUlguMAofd3OJsB0OkP17i5kucKqErgVCJxPawO9l5NwIPnr28SAr99zzlzMCWWljISBYrnZVWdE2Q92YGFQ==",
      "license": "MIT",
      "dependencies": {
        "domify": "^2.0.0",
        "min-dash": "^4.2.1"
      }
    },
    "node_modules/style-mod": {
      "version": "4.1.2",
      "resolved": "https://registry.npmjs.org/style-mod/-/style-mod-4.1.2.tgz",
      "integrity": "sha512-wnD1HyVqpJUI2+eKZ+eo1UwghftP6yuFheBqqe+bWCotBjC2K1YnteJILRMs3SM4V/0dLEW1SC27MWP5y+mwmw==",
      "license": "MIT"
    },
    "node_modules/w3c-keyname": {
      "version": "2.2.8",
      "resolved": "https://registry.npmjs.org/w3c-keyname/-/w3c-keyname-2.2.8.tgz",
      "integrity": "sha512-dpojBhNsCNN7T82Tm7k26A6G9ML3NkhDsnw9n/eoxSRlVBB4CEtIQ/KTCLI2Fwf3ataSXRhYFkQi3SlnFwPvPQ==",
      "license": "MIT"
    }
  }
}

[DmitriyLewen]

@Varorbc Thanks for this info and example.
I created #9517