feat: expand JavaScript resolver to support npm and Yarn Berry layouts

pkg/resolver/javascript.go

@@ -7,12 +7,20 @@ import (
 )
 
 type JavaScriptResolver struct {
-	pnpmPathRe *regexp.Regexp
+	pnpmPathRe       *regexp.Regexp
+	npmPackageJsonRe *regexp.Regexp
+	yarnCacheRe      *regexp.Regexp
 }
 
 func NewJavaScriptResolver() *JavaScriptResolver {
 	return &JavaScriptResolver{
+
 		pnpmPathRe: regexp.MustCompile(`node_modules/\.pnpm/([^/]+)/node_modules/(@[^/]+/[^/]+|[^/]+)(?:/|$)`),
+
+		npmPackageJsonRe: regexp.MustCompile(`node_modules/(@[^/]+/[^/]+|[^/]+)/package\.json$`),
+
+
+		yarnCacheRe: regexp.MustCompile(`\.yarn/cache/(.+)-npm-([0-9][^-]*)-[a-f0-9]+-[a-f0-9]+\.zip$`),
 	}
 }
 
@@ -31,7 +39,8 @@ func (r *JavaScriptResolver) Resolve(files []FileInfo) (packages []PackageInfo,
 			continue
 		}
 
-		name, version, ok := r.extractPnpmPackage(np)
+
+		name, version, foundBy, ok := r.extractPackage(np)
 		if !ok {
 			remainingFiles = append(remainingFiles, f)
 			continue
@@ -51,14 +60,34 @@ func (r *JavaScriptResolver) Resolve(files []FileInfo) (packages []PackageInfo,
 			Ecosystem: "npm",
 			PURL:      purl,
 			Hashes:    f.Hashes,
-			FoundBy:   "attestation:javascript",
+			FoundBy:   foundBy,
 		}
 		packages = append(packages, pkg)
 	}
 
 	return packages, remainingFiles
 }
 
+
+func (r *JavaScriptResolver) extractPackage(p string) (string, string, string, bool) {
+
+	if name, version, ok := r.extractPnpmPackage(p); ok {
+		return name, version, "attestation:javascript:pnpm", true
+	}
+
+
+	if name, version, ok := r.extractYarnBerryPackage(p); ok {
+		return name, version, "attestation:javascript:yarn-berry", true
+	}
+
+
+	if name, ok := r.extractNpmPackage(p); ok {
+		return name, "unknown", "attestation:javascript:npm", true
+	}
+
+	return "", "", "", false
+}
+
 func (r *JavaScriptResolver) CreateFileFilters(packages []PackageInfo) []PackageFileFilter {
 	var filters []PackageFileFilter
 
@@ -84,34 +113,62 @@ type jsPackageFilter struct {
 func (f *jsPackageFilter) Matches(p string) bool {
 	np := path.Clean(p)
 	npLower := strings.ToLower(np)
+	name := strings.ToLower(f.packageName)
 
-	if !strings.Contains(npLower, "/node_modules/.pnpm/") {
+	if name == "" {
 		return false
 	}
 
-	name := strings.ToLower(f.packageName)
-	ver := strings.ToLower(f.version)
-	if name == "" || ver == "" {
-		return false
-	}
+
+	if strings.Contains(npLower, "/node_modules/.pnpm/") {
+		ver := strings.ToLower(f.version)
+		if ver == "" {
+			return false
+		}
+
+		pnpmName := strings.ReplaceAll(name, "/", "+")
+		if strings.HasPrefix(pnpmName, "@") {
+			pnpmName = "@" + strings.TrimPrefix(pnpmName, "@")
+		}
 
-	pnpmName := strings.ReplaceAll(name, "/", "+")
-	if strings.HasPrefix(pnpmName, "@") {
-		pnpmName = "@" + strings.TrimPrefix(pnpmName, "@")
+		if strings.Contains(npLower, "/node_modules/.pnpm/"+pnpmName+"@"+ver) &&
+			strings.Contains(npLower, "/node_modules/"+name+"/") {
+			return true
+		}
 	}
 
-	if strings.Contains(npLower, "/node_modules/.pnpm/"+pnpmName+"@"+ver) &&
-		strings.Contains(npLower, "/node_modules/"+name+"/") {
+
+	if strings.Contains(npLower, "/node_modules/"+name+"/") &&
+		!strings.Contains(npLower, "/node_modules/.pnpm/") {
 		return true
 	}
 
+
+	if strings.Contains(npLower, "/.yarn/cache/") {
+		yarnName := yarnCacheName(name)
+		ver := strings.ToLower(f.version)
+		if ver != "" && ver != "unknown" {
+			if strings.Contains(npLower, "/"+yarnName+"-npm-"+ver+"-") {
+				return true
+			}
+		}
+	}
+
 	return false
 }
 
+
+func yarnCacheName(name string) string {
+	return strings.ReplaceAll(name, "/", "-")
+}
+
 func (r *JavaScriptResolver) isJavaScriptPath(p string) bool {
-	return strings.Contains(p, "node_modules") || strings.Contains(p, ".pnpm")
+	return strings.Contains(p, "node_modules") ||
+		strings.Contains(p, ".pnpm") ||
+		strings.Contains(p, ".yarn/cache")
 }
 
+
 func (r *JavaScriptResolver) extractPnpmPackage(p string) (string, string, bool) {
 	matches := r.pnpmPathRe.FindStringSubmatch(p)
 	if len(matches) != 3 {
@@ -128,6 +185,61 @@ func (r *JavaScriptResolver) extractPnpmPackage(p string) (string, string, bool)
 	return name, version, true
 }
 
+
+func (r *JavaScriptResolver) extractNpmPackage(p string) (string, bool) {
+
+	if strings.Contains(p, "node_modules/.pnpm") {
+		return "", false
+	}
+
+	matches := r.npmPackageJsonRe.FindStringSubmatch(p)
+	if len(matches) != 2 {
+		return "", false
+	}
+
+	name := matches[1]
+
+
+	if strings.HasPrefix(name, ".") {
+		return "", false
+	}
+
+	return name, true
+}
+
+
+func (r *JavaScriptResolver) extractYarnBerryPackage(p string) (string, string, bool) {
+	matches := r.yarnCacheRe.FindStringSubmatch(p)
+	if len(matches) != 3 {
+		return "", "", false
+	}
+
+	rawName := matches[1]
+	version := matches[2]
+
+	name := decodeYarnCacheName(rawName)
+
+	return name, version, true
+}
+
+
+func decodeYarnCacheName(raw string) string {
+	if !strings.HasPrefix(raw, "@") {
+		return raw
+	}
+
+
+	withoutAt := raw[1:]
+	idx := strings.Index(withoutAt, "-")
+	if idx == -1 {
+		return raw
+	}
+
+	scope := withoutAt[:idx]
+	name := withoutAt[idx+1:]
+	return "@" + scope + "/" + name
+}
+
 func extractPnpmVersion(segment string) string {
 	segment = strings.TrimSpace(segment)
 	if segment == "" {