feat(nodejs): add yarn alias support

[DmitriyLewen]

Description

See #5817

Example:

➜  app cat yarn.lock
# THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
# yarn lockfile v1


"foo-ms@npm:ms":
  version "2.1.3"
  resolved "https://registry.yarnpkg.com/ms/-/ms-2.1.3.tgz#574c8138ce1d2b5861f0b44579dbadd60c6615b2"
  integrity sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==
➜  app cat package.json 
{
  "name": "test",
  "version": "1.0.0",
  "main": "index.js",
  "license": "MIT",
  "dependencies": {
    "foo-ms": "npm:ms"
  }
}

Before:

➜  app trivy -q fs -f json --list-all-pkgs . | jq .Results
[
  {
    "Target": "yarn.lock",
    "Class": "lang-pkgs",
    "Type": "yarn",
    "Packages": [
      {
        "ID": "[email protected]",
        "Name": "foo-ms",
        "Version": "2.1.3",
        "Layer": {},
        "Locations": [
          {
            "StartLine": 5,
            "EndLine": 8
          }
        ]
      }
    ]
  }
]

After:

➜  app ./trivy -q fs -f json --list-all-pkgs . | jq .Results
[
  {
    "Target": "yarn.lock",
    "Class": "lang-pkgs",
    "Type": "yarn",
    "Packages": [
      {
        "ID": "[email protected]",
        "Name": "ms",
        "Version": "2.1.3",
        "Licenses": [
          "MIT"
        ],
        "Layer": {},
        "Locations": [
          {
            "StartLine": 5,
            "EndLine": 8
          }
        ]
      }
    ]
  }
]

Related issues

• Close feat(yarn): add support for alias #5817

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).

[DmitriyLewen]

I was thinking about creating a fix in go-dep-parser.
But to do this we need to change logic for Indirect and Direct dependencies (we mark Indirect dependencies in Trivy):
We need to mark all dependencies as Indirect and we can mark only aliases as Direct dependencies.
(in this case, when we scan only the yarn.lock file (without package.lock), only aliases will be sold as Direct dependencies - this can be confusing).

[knqyf263]

@DmitriyLewen I thought it would be better to handle aliases like Yarn, so I incorporated a regular expression from the Yarn project.

Also, I was afraid the package ID would conflict when the same project is added twice, like yarn add my-foo1@npm:[email protected] and yarn add my-foo2@npm:[email protected], so I used the alias names in our id. Please correct me if I'm missing something.

[DmitriyLewen]

Hm... we use pkgName to detect vulnerabilities, so we can do that.
I think this is good solution, thanks!