sbom-cyclonedx 0.1.0 → 0.2.0

data/lib/sbom/cyclone_dx/validator/record_validator.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+require_relative "base_validator"
+
+module SBOM
+  module CycloneDX
+    # TODO: Add helpful errors
+    module Validator
+      class RecordValidator < BaseValidator
+        def initialize(type:, required: false)
+          super(type, required: required)
+
+          @record_type = type
+        end
+
+        def validate(value)
+          rv = super
+          return rv unless value.is_a?(@record_type)
+
+          rv += value.valid? ? [] : value.formatted_errors
+          rv.compact
+        end
+      end
+    end
+  end
+end

data/lib/sbom/cyclone_dx/validator/string_validator.rb

@@ -0,0 +1,33 @@
+# frozen_string_literal: true
+
+require_relative "base_validator"
+require_relative "../pattern"
+
+module SBOM
+  module CycloneDX
+    # TODO: Add helpful errors
+    module Validator
+      class StringValidator < BaseValidator
+        # TODO: Validate max/min_length >= 0 and max_length >= min_length
+        def initialize(enum: nil, max_length: nil, min_length: nil, pattern: Pattern::DEFAULT, required: true)
+          super(String, required: required)
+
+          @enum = enum
+          @length_range = (min_length..max_length)
+          @pattern = pattern
+        end
+
+        def validate(value)
+          rv = super
+          return rv unless value.is_a?(String)
+
+          rv << "Value is not within enum" if @enum&.exclude?(value)
+          rv << "Value is not within length range" unless @length_range.cover?(value.length)
+          rv << "Value does not match pattern" unless Pattern.match_exactly?(@pattern, value)
+
+          rv
+        end
+      end
+    end
+  end
+end

data/lib/sbom/cyclone_dx/validator/union_validator.rb

@@ -0,0 +1,39 @@
+# frozen_string_literal: true
+
+require_relative "base_validator"
+require_relative "../validator"
+
+module SBOM
+  module CycloneDX
+    # TODO: Add helpful errors
+    module Validator
+      class UnionValidator < BaseValidator
+        def initialize(of:, required: false)
+          super(required: required)
+
+          @nested_validators = []
+
+          of.each do |union_item|
+            (klass, validator_params) = union_item.is_a?(Array) ? union_item : [union_item, {}]
+
+            @nested_validators << Validator.for(klass, required: required, **validator_params)
+          end
+        end
+
+        def validate(value)
+          # TODO: Build message based on type and params, e.g.
+          # "Expected one of: [String, Integer], got: Float"
+          # "Expected one of: [String with length <= 2, Integer with maximum 99], got: String with length 3"
+          rv = @nested_validators.map { |validator| validator.validate(value) }
+          return [] if rv.any?(&:empty?)
+
+          rv.flatten
+        end
+
+        def raw_types
+          @nested_validators.flat_map(&:raw_types)
+        end
+      end
+    end
+  end
+end

data/lib/sbom/cyclone_dx/validator/uri_validator.rb

@@ -0,0 +1,32 @@
+# frozen_string_literal: true
+
+require "uri"
+require_relative "base_validator"
+
+module SBOM
+  module CycloneDX
+    # TODO: Add helpful errors
+    module Validator
+      class URIValidator < BaseValidator
+        def initialize(required: false)
+          super(::URI::Generic, String, required: required)
+        end
+
+        def validate(value)
+          rv = super
+          return rv unless value.is_a?(::URI::Generic) || value.is_a?(String)
+
+          begin
+            # Steep is, for some reason, looking at OpenURI's ::URI, and not ::URI from stdlib...
+            uri_value = value.is_a?(URI::Generic) ? value : URI.parse(value)
+            return rv if uri_value.scheme.present? && uri_value.host.present?
+          rescue NoMethodError, URI::Error
+            # Do nothing, all errors handled below
+          end
+
+          rv << "Invalid URI"
+        end
+      end
+    end
+  end
+end

data/lib/sbom/cyclone_dx/validator.rb

@@ -0,0 +1,32 @@
+# frozen_string_literal: true
+
+Dir[File.join(".", "validator", "*.rb")].each { |file| require_relative file }
+
+module SBOM
+  module CycloneDX
+    module Validator
+      SIMPLE_TYPES = %i[boolean date_time email_address float integer string uri].freeze
+
+      class << self
+        def for(type, **kwargs) # rubocop:disable Metrics/CyclomaticComplexity,Metrics/MethodLength,Metrics/AbcSize
+          case type
+          when :array then ArrayValidator.new(items: kwargs.fetch(:items), **kwargs)
+          when :boolean then BooleanValidator.new(**kwargs)
+          when :date_time then DateTimeValidator.new(**kwargs)
+          when :email_address then EmailAddressValidator.new(**kwargs)
+          when :float then FloatValidator.new(**kwargs)
+          when :integer then IntegerValidator.new(**kwargs)
+          when :string then StringValidator.new(**kwargs)
+          when :union then UnionValidator.new(of: kwargs.fetch(:of), **kwargs)
+          when :uri then URIValidator.new(**kwargs)
+          when Class
+            raise ArgumentError, "Unsupported type: #{type.name}" unless type < Record::Base
+
+            RecordValidator.new(type: type, **kwargs)
+          else raise ArgumentError, "Unsupported type: #{type}"
+          end
+        end
+      end
+    end
+  end
+end

data/lib/sbom/cyclone_dx/version.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+module SBOM
+  module CycloneDX
+    VERSION = "0.2.0"
+  end
+end

data/lib/sbom/cyclone_dx.rb

@@ -0,0 +1,39 @@
+# frozen_string_literal: true
+
+require_relative "../email_address_extension"
+require_relative "cyclone_dx/enum"
+require_relative "cyclone_dx/field"
+require_relative "cyclone_dx/pattern"
+require_relative "cyclone_dx/record"
+require_relative "cyclone_dx/validator"
+require_relative "cyclone_dx/version"
+require "json"
+
+# Disable DNS lookup and host validation for the EmailAddress gem, so we don't accidentally hit the network.
+# We also override this in the EmailAddressExtension module, but this is a good safety net.
+(_ = EmailAddress::Config).configure({ dns_lookup: :off, host_validation: :syntax })
+
+module SBOM
+  module CycloneDX
+    class Error < StandardError; end
+
+    class << self
+      def create(hash)
+        Record::Root.new(**hash)
+      end
+
+      def load(file)
+        parse(file.read)
+      end
+
+      def parse(string)
+        json_hash = JSON.parse(string, symbolize_names: true)
+        Record::Root.json_create(json_hash)
+      end
+
+      def json_create(hash)
+        Record::Root.json_create(hash)
+      end
+    end
+  end
+end

data/rbs_collection.lock.yaml

@@ -0,0 +1,288 @@
+---
+path: ".gem_rbs_collection"
+gems:
+- name: activesupport
+  version: '7.0'
+  source:
+    type: git
+    name: ruby/gem_rbs_collection
+    revision: 56038c8a383c25bae14a891e3c0cc5c2e5a9c976
+    remote: https://github.com/ruby/gem_rbs_collection.git
+    repo_dir: gems
+- name: ast
+  version: '2.4'
+  source:
+    type: git
+    name: ruby/gem_rbs_collection
+    revision: 56038c8a383c25bae14a891e3c0cc5c2e5a9c976
+    remote: https://github.com/ruby/gem_rbs_collection.git
+    repo_dir: gems
+- name: base64
+  version: '0'
+  source:
+    type: git
+    name: ruby/rbs
+    revision: e1636a79d553715cbf40343c6d33b4dd0fe8c2f3
+    remote: https://github.com/ruby/rbs.git
+    repo_dir: stdlib
+- name: benchmark
+  version: '0'
+  source:
+    type: git
+    name: ruby/rbs
+    revision: e1636a79d553715cbf40343c6d33b4dd0fe8c2f3
+    remote: https://github.com/ruby/rbs.git
+    repo_dir: stdlib
+- name: bigdecimal
+  version: '0'
+  source:
+    type: git
+    name: ruby/rbs
+    revision: e1636a79d553715cbf40343c6d33b4dd0fe8c2f3
+    remote: https://github.com/ruby/rbs.git
+    repo_dir: stdlib
+- name: concurrent-ruby
+  version: '1.1'
+  source:
+    type: git
+    name: ruby/gem_rbs_collection
+    revision: 56038c8a383c25bae14a891e3c0cc5c2e5a9c976
+    remote: https://github.com/ruby/gem_rbs_collection.git
+    repo_dir: gems
+- name: connection_pool
+  version: '2.4'
+  source:
+    type: git
+    name: ruby/gem_rbs_collection
+    revision: 56038c8a383c25bae14a891e3c0cc5c2e5a9c976
+    remote: https://github.com/ruby/gem_rbs_collection.git
+    repo_dir: gems
+- name: date
+  version: '0'
+  source:
+    type: stdlib
+- name: dbm
+  version: '0'
+  source:
+    type: stdlib
+- name: diff-lcs
+  version: '1.5'
+  source:
+    type: git
+    name: ruby/gem_rbs_collection
+    revision: 56038c8a383c25bae14a891e3c0cc5c2e5a9c976
+    remote: https://github.com/ruby/gem_rbs_collection.git
+    repo_dir: gems
+- name: digest
+  version: '0'
+  source:
+    type: stdlib
+- name: email_address
+  version: '0.2'
+  source:
+    type: git
+    name: ruby/gem_rbs_collection
+    revision: 56038c8a383c25bae14a891e3c0cc5c2e5a9c976
+    remote: https://github.com/ruby/gem_rbs_collection.git
+    repo_dir: gems
+- name: erb
+  version: '0'
+  source:
+    type: stdlib
+- name: faker
+  version: '2.23'
+  source:
+    type: git
+    name: ruby/gem_rbs_collection
+    revision: 56038c8a383c25bae14a891e3c0cc5c2e5a9c976
+    remote: https://github.com/ruby/gem_rbs_collection.git
+    repo_dir: gems
+- name: fileutils
+  version: '0'
+  source:
+    type: stdlib
+- name: i18n
+  version: '1.10'
+  source:
+    type: git
+    name: ruby/gem_rbs_collection
+    revision: 56038c8a383c25bae14a891e3c0cc5c2e5a9c976
+    remote: https://github.com/ruby/gem_rbs_collection.git
+    repo_dir: gems
+- name: io-console
+  version: '0'
+  source:
+    type: git
+    name: ruby/rbs
+    revision: e1636a79d553715cbf40343c6d33b4dd0fe8c2f3
+    remote: https://github.com/ruby/rbs.git
+    repo_dir: stdlib
+- name: json
+  version: '0'
+  source:
+    type: git
+    name: ruby/rbs
+    revision: e1636a79d553715cbf40343c6d33b4dd0fe8c2f3
+    remote: https://github.com/ruby/rbs.git
+    repo_dir: stdlib
+- name: logger
+  version: '0'
+  source:
+    type: stdlib
+- name: minitest
+  version: '0'
+  source:
+    type: stdlib
+- name: monitor
+  version: '0'
+  source:
+    type: stdlib
+- name: mutex_m
+  version: '0'
+  source:
+    type: git
+    name: ruby/rbs
+    revision: e1636a79d553715cbf40343c6d33b4dd0fe8c2f3
+    remote: https://github.com/ruby/rbs.git
+    repo_dir: stdlib
+- name: openssl
+  version: '0'
+  source:
+    type: stdlib
+- name: optparse
+  version: '0'
+  source:
+    type: stdlib
+- name: parallel
+  version: '1.20'
+  source:
+    type: git
+    name: ruby/gem_rbs_collection
+    revision: 56038c8a383c25bae14a891e3c0cc5c2e5a9c976
+    remote: https://github.com/ruby/gem_rbs_collection.git
+    repo_dir: gems
+- name: parser
+  version: '3.2'
+  source:
+    type: git
+    name: ruby/gem_rbs_collection
+    revision: 56038c8a383c25bae14a891e3c0cc5c2e5a9c976
+    remote: https://github.com/ruby/gem_rbs_collection.git
+    repo_dir: gems
+- name: pathname
+  version: '0'
+  source:
+    type: stdlib
+- name: pstore
+  version: '0'
+  source:
+    type: stdlib
+- name: psych
+  version: '0'
+  source:
+    type: git
+    name: ruby/rbs
+    revision: e1636a79d553715cbf40343c6d33b4dd0fe8c2f3
+    remote: https://github.com/ruby/rbs.git
+    repo_dir: stdlib
+- name: rainbow
+  version: '3.0'
+  source:
+    type: git
+    name: ruby/gem_rbs_collection
+    revision: 56038c8a383c25bae14a891e3c0cc5c2e5a9c976
+    remote: https://github.com/ruby/gem_rbs_collection.git
+    repo_dir: gems
+- name: rake
+  version: '13.0'
+  source:
+    type: git
+    name: ruby/gem_rbs_collection
+    revision: 56038c8a383c25bae14a891e3c0cc5c2e5a9c976
+    remote: https://github.com/ruby/gem_rbs_collection.git
+    repo_dir: gems
+- name: rbs
+  version: 3.7.0
+  source:
+    type: rubygems
+- name: rdoc
+  version: '0'
+  source:
+    type: git
+    name: ruby/rbs
+    revision: e1636a79d553715cbf40343c6d33b4dd0fe8c2f3
+    remote: https://github.com/ruby/rbs.git
+    repo_dir: stdlib
+- name: regexp_parser
+  version: '2.8'
+  source:
+    type: git
+    name: ruby/gem_rbs_collection
+    revision: 56038c8a383c25bae14a891e3c0cc5c2e5a9c976
+    remote: https://github.com/ruby/gem_rbs_collection.git
+    repo_dir: gems
+- name: rubocop
+  version: '1.57'
+  source:
+    type: git
+    name: ruby/gem_rbs_collection
+    revision: 56038c8a383c25bae14a891e3c0cc5c2e5a9c976
+    remote: https://github.com/ruby/gem_rbs_collection.git
+    repo_dir: gems
+- name: rubocop-ast
+  version: '1.30'
+  source:
+    type: git
+    name: ruby/gem_rbs_collection
+    revision: 56038c8a383c25bae14a891e3c0cc5c2e5a9c976
+    remote: https://github.com/ruby/gem_rbs_collection.git
+    repo_dir: gems
+- name: securerandom
+  version: '0'
+  source:
+    type: stdlib
+- name: singleton
+  version: '0'
+  source:
+    type: stdlib
+- name: socket
+  version: '0'
+  source:
+    type: stdlib
+- name: stringio
+  version: '0'
+  source:
+    type: git
+    name: ruby/rbs
+    revision: e1636a79d553715cbf40343c6d33b4dd0fe8c2f3
+    remote: https://github.com/ruby/rbs.git
+    repo_dir: stdlib
+- name: time
+  version: '0'
+  source:
+    type: stdlib
+- name: timeout
+  version: '0'
+  source:
+    type: stdlib
+- name: tsort
+  version: '0'
+  source:
+    type: stdlib
+- name: tzinfo
+  version: '2.0'
+  source:
+    type: git
+    name: ruby/gem_rbs_collection
+    revision: 56038c8a383c25bae14a891e3c0cc5c2e5a9c976
+    remote: https://github.com/ruby/gem_rbs_collection.git
+    repo_dir: gems
+- name: uri
+  version: '0'
+  source:
+    type: git
+    name: ruby/rbs
+    revision: e1636a79d553715cbf40343c6d33b4dd0fe8c2f3
+    remote: https://github.com/ruby/rbs.git
+    repo_dir: stdlib
+gemfile_lock_path: Gemfile.lock

data/rbs_collection.yaml

@@ -0,0 +1,31 @@
+# Download sources
+sources:
+  - type: git
+    name: ruby/gem_rbs_collection
+    remote: https://github.com/ruby/gem_rbs_collection.git
+    revision: main
+    repo_dir: gems
+  - type: git
+    name: ruby/rbs
+    remote: https://github.com/ruby/rbs.git
+    revision: master
+    repo_dir: stdlib
+
+# You can specify local directories as sources also.
+# - type: local
+#   path: path/to/your/local/repository
+
+# A directory to install the downloaded RBSs
+path: .gem_rbs_collection
+
+# gems:
+#   # If you want to avoid installing rbs files for gems, you can specify them here.
+#   - name: GEM_NAME
+#     ignore: true
+gems:
+  - name: email_address
+    ignore: false
+  - name: uri
+    ignore: false
+  - name: json
+    ignore: false

data/sbom-cyclone_dx.gemspec

@@ -0,0 +1,32 @@
+# frozen_string_literal: true
+
+require_relative "lib/sbom/cyclone_dx/version"
+
+Gem::Specification.new do |spec|
+  spec.name = "sbom-cyclonedx"
+  spec.version = SBOM::CycloneDX::VERSION
+  spec.authors = ["Rob Trame"]
+  spec.email = ["rtrame@hackerone.com"]
+
+  spec.summary = "Gem for generating/parsing CycloneDX JSON SBOMs"
+  spec.description = "Gem for generating/parsing CycloneDX JSON SBOMs"
+  spec.homepage = "https://github.com/Hacker0x01/sbom-cyclonedx"
+  spec.license = "MIT"
+  spec.required_ruby_version = ">= 3.0.0"
+
+  # spec.metadata["allowed_push_host"] = "TODO: Set to your gem server 'https://example.com'"
+
+  spec.metadata["homepage_uri"] = spec.homepage
+  spec.metadata["source_code_uri"] = "https://github.com/Hacker0x01/sbom-cyclonedx"
+  spec.metadata["changelog_uri"] = "https://github.com/Hacker0x01/sbom-cyclonedx/blob/main/CHANGELOG.md"
+
+  spec.files = `git ls-files`.split("\n")
+  spec.bindir = "bin"
+  spec.executables = `git ls-files -- bin/*`.split("\n").map{ |f| File.basename(f) }
+
+  spec.require_paths = ["lib"]
+
+  spec.add_dependency "activesupport", ">= 6.1", "< 8"
+  spec.add_dependency "email_address", "~> 0.2", ">= 0.2.4"
+  spec.metadata["rubygems_mfa_required"] = "true"
+end

data/sig/email_address_extension.rbs

@@ -0,0 +1,14 @@
+interface _EmailAddress
+  def initialize: (String, ?Hash[Symbol, untyped], ?String) -> void
+end
+
+module EmailAddressExtension
+  include _EmailAddress
+
+  def to_json: (*untyped) -> ::String
+  def as_json: (*untyped) -> ::String
+end
+
+class EmailAddress::Address
+  prepend EmailAddressExtension
+end

data/sig/sbom/cyclone_dx/enum.rbs

@@ -0,0 +1,93 @@
+module SBOM
+  module CycloneDX
+    module Enum
+      ACCESS_MODE: ::Array[String]
+
+      ACTIVITY: ::Array[String]
+
+      AFFECTED_STATUS: ::Array[String]
+
+      AGGREGATE_TYPE: ::Array[String]
+
+      ALGORITHM_MODE: ::Array[String]
+
+      ASSET_TYPE: ::Array[String]
+
+      CERTIFICATION_LEVEL: ::Array[String]
+
+      COMPONENT_DATA_TYPE: ::Array[String]
+
+      COMPONENT_TYPE: ::Array[String]
+
+      CRYPTO_FUNCTION: ::Array[String]
+
+      DATA_FLOW_DIRECTION: ::Array[String]
+
+      ENERGY_SOURCE: ::Array[String]
+
+      EXECUTION_ENVIRONMENT: ::Array[String]
+
+      EXTERNAL_REFERENCE_TYPE: ::Array[String]
+
+      FIELD: ::Array[String]
+
+      HASH_ALG: ::Array[String]
+
+      IMPACT_ANALYSIS_JUSTIFICATION: ::Array[String]
+
+      IMPACT_ANALYSIS_STATE: ::Array[String]
+
+      IMPLEMENTATION_PLATFORM: ::Array[String]
+
+      ISSUE_TYPE: ::Array[String]
+
+      LEARNING_TYPE: ::Array[String]
+
+      LICENSE_ACKNOWLEDGEMENT: ::Array[String]
+
+      LICENSE_ID: ::Array[String]
+
+      LICENSE_TYPE: ::Array[String]
+
+      OUTPUT_TYPE: ::Array[String]
+
+      PADDING: ::Array[String]
+
+      PATCH_TYPE: ::Array[String]
+
+      PHASE: ::Array[String]
+
+      PRIMITIVE: ::Array[String]
+
+      PROTOCOL_TYPE: ::Array[String]
+
+      RELATED_CRYPTO_MATERIAL_STATE: ::Array[String]
+
+      RELATED_CRYPTO_MATERIAL_TYPE: ::Array[String]
+
+      RESPONSE: ::Array[String]
+
+      SCOPE: ::Array[String]
+
+      SCORE_METHOD: ::Array[String]
+
+      SEVERITY: ::Array[String]
+
+      SIGNATURE_ALGORITHM: ::Array[String]
+
+      SIGNATURE_KEY_TYPE: ::Array[String]
+
+      SIGNATURE_EC_CRV: ::Array[String]
+
+      SIGNATURE_OKP_CRV: ::Array[String]
+
+      TASK_TYPE: ::Array[String]
+
+      TECHNIQUE: ::Array[String]
+
+      TRIGGER_TYPE: ::Array[String]
+
+      VOLUME_MODE: ::Array[String]
+    end
+  end
+end