From 36a045fc7afc27c92c2657826488afb725d65fe0 Mon Sep 17 00:00:00 2001
From: luotianqi777 <luotianqi777@gmail.com>
Date: Thu, 11 Jan 2024 09:47:31 +0800
Subject: [PATCH] fix: npm lock v1 dev depdencies

---
 opensca/sca/javascript/npm.go | 37 +++++++++++++++++++++++------------
 1 file changed, 24 insertions(+), 13 deletions(-)

diff --git a/opensca/sca/javascript/npm.go b/opensca/sca/javascript/npm.go
index f862f81f..9a04d3cb 100644
--- a/opensca/sca/javascript/npm.go
+++ b/opensca/sca/javascript/npm.go
@@ -47,6 +47,7 @@ type PackageLock struct {
 type PackageLockDep struct {
 	name         string
 	Version      string                     `json:"version"`
+	Develop      bool                       `json:"dev"`
 	Requires     map[string]string          `json:"requires"`
 	Dependencies map[string]*PackageLockDep `json:"dependencies"`
 }
@@ -189,12 +190,16 @@ func ParsePackageJsonWithLock(pkgjson *PackageJson, pkglock *PackageLock) *model
 
 	// map[key]
 	depNameMap := map[string]*model.DepGraph{}
+	devDepNameMap := map[string]*model.DepGraph{}
 	_dep := _depSet().LoadOrStore
 
 	// 记录依赖
 	for name, lockDep := range pkglock.Dependencies {
-		dep := _dep(name, lockDep.Version)
-		depNameMap[name] = dep
+		if lockDep.Develop {
+			devDepNameMap[name] = _dep(name, lockDep.Version, "dev")
+		} else {
+			depNameMap[name] = _dep(name, lockDep.Version)
+		}
 	}
 
 	// 构建依赖关系
@@ -205,21 +210,34 @@ func ParsePackageJsonWithLock(pkgjson *PackageJson, pkglock *PackageLock) *model
 			n := q[0]
 			q = q[1:]
 
-			dep := _dep(n.name, n.Version)
+			var dep *model.DepGraph
+			if n.Develop {
+				dep = _dep(n.name, n.Version, "dev")
+			} else {
+				dep = _dep(n.name, n.Version)
+			}
 
 			dup := map[string]bool{}
 			for name, sub := range n.Dependencies {
 				dup[name] = true
 				sub.name = name
 				q = append(q, sub)
-				dep.AppendChild(_dep(name, sub.Version))
+				if sub.Develop || n.Develop {
+					dep.AppendChild(_dep(name, sub.Version, "dev"))
+				} else {
+					dep.AppendChild(_dep(name, sub.Version))
+				}
 			}
 
 			for name := range n.Requires {
 				if dup[name] {
 					continue
 				}
-				dep.AppendChild(depNameMap[name])
+				if n.Develop {
+					dep.AppendChild(devDepNameMap[name])
+				} else {
+					dep.AppendChild(depNameMap[name])
+				}
 			}
 
 		}
@@ -233,14 +251,7 @@ func ParsePackageJsonWithLock(pkgjson *PackageJson, pkglock *PackageLock) *model
 	}
 
 	for name := range pkgjson.DevDependencies {
-		dep := depNameMap[name]
-		if dep != nil {
-			devdep := _dep(dep.Name, dep.Version, "dev")
-			for _, c := range dep.Children {
-				devdep.AppendChild(c)
-			}
-			root.AppendChild(devdep)
-		}
+		root.AppendChild(devDepNameMap[name])
 	}
 
 	return root