Support reviewed npm audit baselines

2026-09-01 20:06:16 +01:00
parent 8098495abf
commit 903e907225
5 changed files with 85 additions and 3 deletions
@@ -22,6 +22,7 @@ export async function loadPolicy(file) {
  validateVersionExceptions(policy.allowInstallScripts, "allowInstallScripts");
  validateVersionExceptions(policy.allowDirectLifecycleScripts, "allowDirectLifecycleScripts");
  validateArchiveExceptions(policy.archiveSizeExceptions);
+  validateAuditExceptions(policy.auditExceptions);
  validateSourceExceptions(policy.sourceEvidenceExceptions);
  validateMap(policy, "trustedRepositories", false);
  validateMap(policy, "trustedMaintainers", true);
@@ -83,6 +84,14 @@ function validateArchiveExceptions(value) {
  }
 }

+function validateAuditExceptions(value) {
+  if (!value || Array.isArray(value) || typeof value !== "object") throw new Error("auditExceptions must be an object");
+  for (const [id, exception] of Object.entries(value)) {
+    if (!/^GHSA-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}$/i.test(id)) throw new Error(`invalid auditExceptions advisory: ${id}`);
+    validateExceptionBase(id, exception, "auditExceptions", []);
+  }
+}
+
 function validateExceptionBase(name, exception, key, allowedFields) {
  if (!name || !exception || Array.isArray(exception) || typeof exception !== "object") {
    throw new Error(`invalid ${key} entry for ${name || "<empty>"}`);