public static JsonObject sanitize ( JsonObject packageJson ) { final JsonObjectBuilder payloadBuilder = Json . createObjectBuilder ( ) ; final String projectName = packageJson . getString ( "name" , "" ) ; final String projectVersion = packageJson . getString ( "version" , "" ) ; if ( ! projectName . isEmpty ( ) ) { payloadBuilder . add ( "name" , projectName ) ; } if ( ! projectVersion . isEmpty ( ) ) { payloadBuilder . add ( "version" , projectVersion ) ; } // In most package-lock.json files, 'requires' is a boolean, however, NPM Audit expects // 'requires' to be an object containing key/value pairs corresponding to the module // name (key) and version (value). final JsonValue jsonValue = packageJson . get ( "requires" ) ; if ( jsonValue . getValueType ( ) != JsonValue . ValueType . OBJECT ) { final JsonObjectBuilder requiresBuilder = Json . createObjectBuilder ( ) ; final JsonObject dependencies = packageJson . getJsonObject ( "dependencies" ) ; for ( String moduleName : dependencies . keySet ( ) ) { final JsonObject module = dependencies . getJsonObject ( moduleName ) ; final String version = module . getString ( "version" ) ; requiresBuilder . add ( moduleName , version ) ; } payloadBuilder . add ( "requires" , requiresBuilder . build ( ) ) ; } payloadBuilder . add ( "dependencies" , packageJson . getJsonObject ( "dependencies" ) ) ; payloadBuilder . add ( "install" , Json . createArrayBuilder ( ) . build ( ) ) ; payloadBuilder . add ( "remove" , Json . createArrayBuilder ( ) . build ( ) ) ; payloadBuilder . add ( "metadata" , Json . createObjectBuilder ( ) . add ( "npm_version" , "6.1.0" ) . add ( "node_version" , "v10.5.0" ) . add ( "platform" , "linux" ) ) ; // Create a new 'package-lock.json' object return payloadBuilder . build ( ) ; }
The NPM Audit API only accepts a modified version of package - lock . json . This method will make the necessary modifications in - memory sanitizing non - public dependencies by omitting them and returns a new sanitized version .