npm: handle git urls correctly (#24)

CHANGELOG.md

@@ -4,12 +4,10 @@
     - New
         - npm: In case package was found, also check if all the package versions have been unpublished. This makes the package vulnerable to takeover
         - npm: Check for http & https and GitHub version references
+        - MVN (Maven) support
     - Changed
         - Fixed a bug where the pip requirements.txt parser processes a 'tilde equals' sign.
-
-- v0.4
-    - New
-        - MVN (Maven) support
+        - Fixed an issue that would detect git repository urls as matches
 
 - v0.3
     - New

npm.go

@@ -102,7 +102,7 @@ func (n *NPMLookup) ReadPackagesFromFile(filename string) error {
 func (n *NPMLookup) PackagesNotInPublic() []string {
 	notavail := []string{}
 	for _, pkg := range n.Packages {
-		if n.localReference(pkg.Version) || n.urlReference(pkg.Version) {
+		if n.localReference(pkg.Version) || n.urlReference(pkg.Version) || n.gitReference(pkg.Version) {
 			continue
 		}
 		if n.gitHubReference(pkg.Version) {
@@ -171,6 +171,18 @@ func (n *NPMLookup) urlReference(pkgversion string) bool {
 	return strings.HasPrefix(pkgversion, "http:") || strings.HasPrefix(pkgversion, "https:")
 }
 
+// gitReference checks if the package version is in fact a reference to a remote git repository
+func (n *NPMLookup) gitReference(pkgversion string) bool {
+	pkgversion = strings.ToLower(pkgversion)
+	gitResources := []string{"git+ssh:", "git+http:", "git+https:", "git:"}
+	for _, r := range gitResources {
+		if strings.HasPrefix(pkgversion, r) {
+			return true
+		}
+	}
+	return false
+}
+
 // gitHubReference checks if the package version refers to a GitHub repository
 func (n *NPMLookup) gitHubReference(pkgversion string) bool {
 	return !strings.HasPrefix(pkgversion, "@") && strings.Contains(pkgversion, "/")