jeemok/better-npm-audit

Provide more output when parsing exceptions file

alert-debug opened this issue · 1 comments

I really appreciate the ability to specify an expiry time for exceptions, but I must admit it took me a few attempts to realise that I had specified the timestamp in seconds rather than milliseconds. Unfortunately the README doesn't make this clear, and nor is there any indication in the output of the audit that an invalid expiry time has been specified.

Fixing those would be really helpful, as would having a mode which just validates the contents of the exceptions file. For example, it could confirm that the file has been found, is valid JSON, has valid timestamps, and that the ignore parameters are present.

More generally, the names related to this file are a little ambiguous:

  1. There is the potential for confusion when using the word "exception" in a JavaScript context, when "exclusion" might be clearer.
  2. The parameter ignore doesn't make it clear whether the tool is being instructed to ignore a vulnerability or to ignore the exclusion of that vulnerability. The README doesn't make it any clearer, since it gives examples of exclusions with ignore set to true and false respectively, and both have a reason starting with "Ignored".
  3. When exceptions are specified on the command line, the --ignore flag is used. It might be better to name this flag --exclude, and use -x for short. The noun and verb pair exclusion/exclude are more clear than exception/ignore, or any alternative like exception/except or ignorance/ignore.

Again I hope that these suggestions are seen as constructive, so that more people can enjoy this great software.

If there were a "test exceptions file" command, another feature it should have is outputting a warning when it detects an expired exception.

I'm imagining a situation where someone adds an exception, then forgets about it, then fixes the vulnerability as part of some other work, and doesn't remove the exception.