@cdxgen/cdxgen 0.0.1 → 13.0.1

package/lib/inventory/rustFormulationParser.js

@@ -0,0 +1,339 @@
+import { readFileSync } from "node:fs";
+import { basename, dirname, join } from "node:path";
+
+import toml from "@iarna/toml";
+
+import { safeExistsSync } from "../core/fs.js";
+
+// Keep this list conservative and high-signal: it is meant to surface common
+// Rust native build helpers for audit triage, not to exhaustively model every
+// crate that may participate in a native build pipeline.
+const NATIVE_BUILD_DEPENDENCIES = [
+  "autocfg",
+  "bindgen",
+  "cc",
+  "cbindgen",
+  "cmake",
+  "cxx-build",
+  "grpcio-compiler",
+  "nasm-rs",
+  "openssl-sys",
+  "pkg-config",
+  "prost-build",
+  "protobuf-src",
+  "pyo3-build-config",
+  "ring",
+  "tauri-build",
+  "tonic-build",
+];
+
+const BUILD_SCRIPT_CAPABILITY_PATTERNS = [
+  ["process-execution", /\b(?:std::process::Command|Command::new|duct::cmd)\b/],
+  [
+    "native-tooling",
+    /\b(?:cc::Build|bindgen::Builder|cmake::Config|pkg_config::Config|autocfg::)/,
+  ],
+  [
+    "linker-directives",
+    /cargo:rustc-link-(?:lib|search|arg|arg-bins|arg-bin|arg-tests|arg-examples)/,
+  ],
+  [
+    "file-generation",
+    /\b(?:std::fs::(?:write|copy|create_dir_all)|include_bytes!|include_str!)\b/,
+  ],
+  ["network-access", /\b(?:reqwest|ureq|curl|git2)\b/],
+];
+
+function appendProperty(properties, name, value) {
+  if (!name || value === undefined || value === null || value === "") {
+    return;
+  }
+  properties.push({
+    name,
+    value: typeof value === "string" ? value : String(value),
+  });
+}
+
+function createFormulationComponent(name, filePath, toolName) {
+  return {
+    type: "application",
+    name,
+    version: "config",
+    "bom-ref": `urn:cdxgen:formulation:${toolName}:${filePath}`,
+    properties: [{ name: "internal:SrcFile", value: filePath }],
+  };
+}
+
+function parseCargoManifest(filePath) {
+  let cargoData;
+  try {
+    cargoData = toml.parse(readFileSync(filePath, { encoding: "utf-8" }));
+  } catch {
+    return undefined;
+  }
+  if (!cargoData || typeof cargoData !== "object") {
+    return undefined;
+  }
+  const packageName =
+    cargoData?.package?.name || basename(dirname(filePath)) || "cargo-project";
+  const component = createFormulationComponent(packageName, filePath, "cargo");
+  const properties = component.properties;
+  const buildDependencies = cargoData?.["build-dependencies"];
+  const devDependencies = cargoData?.["dev-dependencies"];
+  const targetBlocks =
+    cargoData?.target && typeof cargoData.target === "object"
+      ? Object.values(cargoData.target)
+      : [];
+  const targetDependencyBlocks = targetBlocks.filter(
+    (block) => block && typeof block === "object",
+  );
+  const packageNode = cargoData?.package || {};
+  const buildScriptPath =
+    typeof packageNode.build === "string"
+      ? join(dirname(filePath), packageNode.build)
+      : join(dirname(filePath), "build.rs");
+  const hasBuildScript =
+    typeof packageNode.build === "string" || safeExistsSync(buildScriptPath);
+  const buildDependencyNames = Object.keys(buildDependencies || {});
+  const targetBuildDependencyNames = targetDependencyBlocks.flatMap((block) =>
+    Object.keys(block?.["build-dependencies"] || {}),
+  );
+  const allBuildDependencyNames = [
+    ...new Set([...buildDependencyNames, ...targetBuildDependencyNames]),
+  ];
+  const nativeBuildIndicators = buildDependencyNames.filter((dependencyName) =>
+    NATIVE_BUILD_DEPENDENCIES.includes(dependencyName),
+  );
+  const targetNativeBuildIndicators = targetBuildDependencyNames.filter(
+    (dependencyName) =>
+      NATIVE_BUILD_DEPENDENCIES.includes(dependencyName) ||
+      dependencyName.endsWith("-sys"),
+  );
+  const expandedNativeBuildIndicators = [
+    ...new Set([
+      ...nativeBuildIndicators,
+      ...targetNativeBuildIndicators,
+      ...allBuildDependencyNames.filter((dependencyName) =>
+        dependencyName.endsWith("-sys"),
+      ),
+    ]),
+  ];
+  const releaseProfiles = Object.keys(cargoData?.profile || {});
+  let buildScriptCapabilities = [];
+  let buildScriptIndicators = [];
+  if (hasBuildScript) {
+    try {
+      const buildScriptContent = readFileSync(buildScriptPath, {
+        encoding: "utf-8",
+      });
+      buildScriptCapabilities = BUILD_SCRIPT_CAPABILITY_PATTERNS.filter(
+        ([, pattern]) => pattern.test(buildScriptContent),
+      ).map(([capability]) => capability);
+      if (/println!\s*\(\s*"cargo:/.test(buildScriptContent)) {
+        buildScriptIndicators.push("cargo-directives");
+      }
+      if (/include_bytes!|include_str!/.test(buildScriptContent)) {
+        buildScriptIndicators.push("embedded-assets");
+      }
+    } catch {
+      buildScriptCapabilities = [];
+      buildScriptIndicators = [];
+    }
+  }
+
+  appendProperty(properties, "cdx:rust:buildTool", "cargo");
+  appendProperty(
+    properties,
+    "cdx:cargo:manifestMode",
+    cargoData?.workspace ? "workspace" : "package",
+  );
+  appendProperty(
+    properties,
+    "cdx:cargo:hasWorkspaceMembers",
+    Array.isArray(cargoData?.workspace?.members) ? "true" : undefined,
+  );
+  appendProperty(
+    properties,
+    "cdx:cargo:workspaceMembers",
+    Array.isArray(cargoData?.workspace?.members)
+      ? cargoData.workspace.members.join(", ")
+      : undefined,
+  );
+  appendProperty(
+    properties,
+    "cdx:cargo:hasBuildDependencies",
+    allBuildDependencyNames.length ? "true" : undefined,
+  );
+  appendProperty(
+    properties,
+    "cdx:cargo:hasDevDependencies",
+    Object.keys(devDependencies || {}).length ? "true" : undefined,
+  );
+  appendProperty(
+    properties,
+    "cdx:cargo:hasTargetDependencies",
+    targetDependencyBlocks.some(
+      (block) =>
+        Object.keys(block?.dependencies || {}).length ||
+        Object.keys(block?.["build-dependencies"] || {}).length ||
+        Object.keys(block?.["dev-dependencies"] || {}).length,
+    )
+      ? "true"
+      : undefined,
+  );
+  appendProperty(
+    properties,
+    "cdx:cargo:hasBuildScript",
+    hasBuildScript ? "true" : undefined,
+  );
+  appendProperty(
+    properties,
+    "cdx:cargo:buildScript",
+    hasBuildScript ? buildScriptPath : undefined,
+  );
+  appendProperty(
+    properties,
+    "cdx:cargo:publish",
+    packageNode.publish === false ? "false" : undefined,
+  );
+  appendProperty(
+    properties,
+    "cdx:cargo:rustVersion",
+    packageNode["rust-version"],
+  );
+  appendProperty(
+    properties,
+    "cdx:cargo:releaseProfiles",
+    releaseProfiles.length ? releaseProfiles.join(", ") : undefined,
+  );
+  appendProperty(
+    properties,
+    "cdx:cargo:nativeBuildIndicators",
+    expandedNativeBuildIndicators.length
+      ? expandedNativeBuildIndicators.join(", ")
+      : undefined,
+  );
+  appendProperty(
+    properties,
+    "cdx:cargo:buildDependencyNames",
+    allBuildDependencyNames.length
+      ? allBuildDependencyNames.join(", ")
+      : undefined,
+  );
+  appendProperty(
+    properties,
+    "cdx:cargo:buildScriptCapabilities",
+    buildScriptCapabilities.length
+      ? buildScriptCapabilities.join(", ")
+      : undefined,
+  );
+  appendProperty(
+    properties,
+    "cdx:cargo:buildScriptIndicators",
+    buildScriptIndicators.length ? buildScriptIndicators.join(", ") : undefined,
+  );
+  appendProperty(
+    properties,
+    "cdx:cargo:hasNativeBuild",
+    hasBuildScript ||
+      expandedNativeBuildIndicators.length ||
+      buildScriptCapabilities.length
+      ? "true"
+      : undefined,
+  );
+  appendProperty(
+    properties,
+    "cdx:cargo:usesMaturin",
+    cargoData?.package?.metadata?.maturin ? "true" : undefined,
+  );
+  return component;
+}
+
+function parsePyProject(filePath) {
+  let pyprojectData;
+  try {
+    pyprojectData = toml.parse(readFileSync(filePath, { encoding: "utf-8" }));
+  } catch {
+    return undefined;
+  }
+  const buildBackend = pyprojectData?.["build-system"]?.["build-backend"];
+  const toolMaturin = pyprojectData?.tool?.maturin;
+  if (
+    !toolMaturin &&
+    (typeof buildBackend !== "string" || !buildBackend.includes("maturin"))
+  ) {
+    return undefined;
+  }
+  const component = createFormulationComponent(
+    pyprojectData?.project?.name ||
+      basename(dirname(filePath)) ||
+      "maturin-project",
+    filePath,
+    "maturin",
+  );
+  const properties = component.properties;
+  appendProperty(properties, "cdx:rust:buildTool", "maturin");
+  appendProperty(properties, "cdx:maturin:buildBackend", buildBackend);
+  appendProperty(
+    properties,
+    "cdx:maturin:moduleName",
+    toolMaturin?.["module-name"] || toolMaturin?.module_name,
+  );
+  appendProperty(properties, "cdx:maturin:bindings", toolMaturin?.bindings);
+  appendProperty(
+    properties,
+    "cdx:maturin:compatibility",
+    toolMaturin?.compatibility,
+  );
+  appendProperty(
+    properties,
+    "cdx:maturin:features",
+    Array.isArray(toolMaturin?.features)
+      ? toolMaturin.features.join(", ")
+      : undefined,
+  );
+  appendProperty(
+    properties,
+    "cdx:maturin:manifestPath",
+    toolMaturin?.manifest_path || toolMaturin?.["manifest-path"],
+  );
+  appendProperty(
+    properties,
+    "cdx:maturin:strip",
+    toolMaturin?.strip === true ? "true" : undefined,
+  );
+  return component;
+}
+
+/**
+ * Parser for Rust/Cargo and Pixi maturin formulation components.
+ *
+ * Matches `Cargo.toml` and `pyproject.toml` files and converts them into
+ * formulation components carrying build-tool, build-script capability, native
+ * build dependency, and maturin metadata properties.
+ *
+ * @type {{id: string, patterns: string[], parse(files: string[]): {components: Object[]}}}
+ */
+export const rustFormulationParser = {
+  id: "rust-build",
+  patterns: ["**/Cargo.toml", "**/pyproject.toml"],
+  parse(files) {
+    const components = [];
+    for (const filePath of files || []) {
+      if (filePath.endsWith("Cargo.toml")) {
+        const cargoComponent = parseCargoManifest(filePath);
+        if (cargoComponent) {
+          components.push(cargoComponent);
+        }
+        continue;
+      }
+      if (filePath.endsWith("pyproject.toml")) {
+        const pyprojectComponent = parsePyProject(filePath);
+        if (pyprojectComponent) {
+          components.push(pyprojectComponent);
+        }
+      }
+    }
+    return { components };
+  },
+};

package/lib/inventory/sbomDocument.js

@@ -0,0 +1,340 @@
+// Parsing of third-party SBOM documents that cdxgen did not produce.
+//
+// Two features consume documents from outside the build: PEP 770 SBOMs embedded
+// under `<dist>.dist-info/sboms/`, and BOM artifacts retrieved from a
+// Transparency Exchange API server. Both receive untrusted input over a channel
+// cdxgen does not control, so both need the same handling: bound the size,
+// refuse to parse anything that is not a recognised SBOM shape, and skip a bad
+// document with a warning instead of failing the run.
+//
+// CycloneDX documents pass through unchanged. SPDX 3.x JSON-LD is converted by
+// the shared converter; SPDX 2.x JSON is read directly from `packages[]` so an
+// embedded 2.3 document is not silently dropped.
+
+import { build, Purl } from "@cdxgen/cdx-purl";
+
+import { isSpdxJsonLd } from "./bomUtils.js";
+import { toCycloneDxLikeBom } from "./spdxUtils.js";
+
+// A document larger than this is not a plausible SBOM for a single
+// distribution or artifact. The bound keeps a malicious or malformed archive
+// from driving parsing into an out-of-memory failure.
+/**
+ * Maximum size in bytes (5 MiB) of a third-party SBOM document accepted for parsing.
+ *
+ * @type {number}
+ */
+export const MAX_SBOM_DOCUMENT_BYTES = 5 * 1024 * 1024;
+
+function purlOfSpdxPackage(pkg) {
+  return pkg?.externalRefs?.find((ref) => ref?.referenceType === "purl")
+    ?.referenceLocator;
+}
+
+function componentsFromSpdx2(doc) {
+  return doc.packages
+    .filter((pkg) => pkg && (pkg.name || pkg.SPDXID))
+    .map((pkg) => {
+      const purl = purlOfSpdxPackage(pkg);
+      return {
+        type: "library",
+        name: pkg.name || pkg.SPDXID,
+        version: pkg.versionInfo,
+        purl,
+        "bom-ref": purl || pkg.SPDXID,
+      };
+    });
+}
+
+/**
+ * Parse a third-party SBOM document into components and dependencies.
+ *
+ * Returns null — never throws — when the document is too large, is not JSON, is
+ * not a recognised SBOM shape, or carries nothing worth merging. Every rejection
+ * is reported once, naming the source, so a skipped document is visible rather
+ * than silent.
+ *
+ * @param {string} text Raw document text
+ * @param {Object} [input] Parse inputs
+ * @param {string} [input.source] Provenance label used in warnings (path, entry name or URL)
+ * @param {number} [input.maxBytes] Size bound. Defaults to `MAX_SBOM_DOCUMENT_BYTES`
+ * @returns {{components: Object[], dependencies: Object[], format: string, rootRef: (string|undefined)}|null}
+ */
+export function parseSbomDocument(
+  text,
+  { source = "unknown", maxBytes = MAX_SBOM_DOCUMENT_BYTES } = {},
+) {
+  const content = typeof text === "string" ? text : "";
+  if (!content.length) {
+    return null;
+  }
+  if (Buffer.byteLength(content) > maxBytes) {
+    console.warn(
+      `cdxgen: skipping SBOM document at ${source} (exceeds ${maxBytes} bytes).`,
+    );
+    return null;
+  }
+  let doc;
+  try {
+    doc = JSON.parse(content);
+  } catch (_err) {
+    console.warn(`cdxgen: skipping SBOM document at ${source} (invalid JSON).`);
+    return null;
+  }
+  if (!doc || typeof doc !== "object") {
+    return null;
+  }
+  let parsed;
+  if (doc.bomFormat === "CycloneDX") {
+    if (!doc.specVersion) {
+      console.warn(
+        `cdxgen: skipping CycloneDX document at ${source} (no specVersion).`,
+      );
+      return null;
+    }
+    parsed = {
+      components: Array.isArray(doc.components) ? doc.components : [],
+      dependencies: Array.isArray(doc.dependencies) ? doc.dependencies : [],
+      format: `cyclonedx-${doc.specVersion}`,
+      rootRef: doc.metadata?.component?.["bom-ref"],
+    };
+  } else if (isSpdxJsonLd(doc)) {
+    const like = toCycloneDxLikeBom(doc);
+    parsed = {
+      components: Array.isArray(like.components) ? like.components : [],
+      dependencies: Array.isArray(like.dependencies) ? like.dependencies : [],
+      format: doc.specVersion ? `spdx-${doc.specVersion}` : "spdx-3",
+      rootRef: undefined,
+    };
+  } else if (Array.isArray(doc.packages)) {
+    parsed = {
+      components: componentsFromSpdx2(doc),
+      dependencies: [],
+      format: doc.spdxVersion ? `spdx-${doc.spdxVersion}` : "spdx-2",
+      rootRef: undefined,
+    };
+  } else {
+    console.warn(
+      `cdxgen: skipping document at ${source} (not a recognised SBOM format).`,
+    );
+    return null;
+  }
+  if (!parsed.components.length && !parsed.dependencies.length) {
+    return null;
+  }
+  for (const component of parsed.components) {
+    repairPurl(component);
+  }
+  return parsed;
+}
+
+/**
+ * Percent-encode semver build metadata in a purl version.
+ *
+ * Cargo versions carry it (`1.1.3+spec-1.1.0`), and `+` is not a character a
+ * purl version may hold unescaped.
+ *
+ * @param {string} purl Purl to rewrite
+ * @returns {string} The purl with an escaped version
+ */
+function encodeVersionBuildMetadata(purl) {
+  // Only the part before the qualifiers holds the version, and a qualifier
+  // value may itself contain an `@`.
+  const cut = purl.indexOf("?");
+  const head = cut === -1 ? purl : purl.slice(0, cut);
+  const tail = cut === -1 ? "" : purl.slice(cut);
+  const at = head.lastIndexOf("@");
+  if (at === -1 || !head.slice(at + 1).includes("+")) {
+    return purl;
+  }
+  return `${head.slice(0, at + 1)}${head.slice(at + 1).replaceAll("+", "%2B")}${tail}`;
+}
+
+/**
+ * Split a purl into its components without requiring it to be well-formed.
+ *
+ * `Purl.parse` rejects a purl whose parts are not already escaped, which is the
+ * case this exists to handle. The separators (`:`, `/`, `@`, `?`, `#`, `&`,
+ * `=`) are structural and are read positionally; everything between them is
+ * decoded and handed back raw, ready for `build` to escape correctly.
+ *
+ * @param {string} purl Purl to split
+ * @returns {{type: string, namespace: (string|null), name: string, version: (string|null), qualifiers: (Object|null), subpath: (string|null)}|null} Parts, or null when the purl has no type and name
+ */
+function splitPurl(purl) {
+  const decode = (value) => {
+    try {
+      return decodeURIComponent(value);
+    } catch {
+      return value;
+    }
+  };
+  let rest = purl.slice("pkg:".length).replace(/^\/+/, "");
+  let subpath = null;
+  const hash = rest.indexOf("#");
+  if (hash !== -1) {
+    subpath = decode(rest.slice(hash + 1)) || null;
+    rest = rest.slice(0, hash);
+  }
+  let qualifiers = null;
+  const query = rest.indexOf("?");
+  if (query !== -1) {
+    qualifiers = {};
+    for (const pair of rest.slice(query + 1).split("&")) {
+      const equals = pair.indexOf("=");
+      if (equals <= 0) {
+        continue;
+      }
+      qualifiers[pair.slice(0, equals)] = decode(pair.slice(equals + 1));
+    }
+    if (!Object.keys(qualifiers).length) {
+      qualifiers = null;
+    }
+    rest = rest.slice(0, query);
+  }
+  const slash = rest.indexOf("/");
+  if (slash <= 0) {
+    return null;
+  }
+  const type = rest.slice(0, slash);
+  let path = rest.slice(slash + 1);
+  let version = null;
+  const at = path.lastIndexOf("@");
+  if (at > 0) {
+    version = decode(path.slice(at + 1)) || null;
+    path = path.slice(0, at);
+  }
+  const segments = path.split("/").filter(Boolean).map(decode);
+  const name = segments.pop();
+  if (!name) {
+    return null;
+  }
+  return {
+    type,
+    namespace: segments.length ? segments.join("/") : null,
+    name,
+    version,
+    qualifiers,
+    subpath,
+  };
+}
+
+/**
+ * Repair the purl of a component read from a third-party document.
+ *
+ * Producers write a `download_url` as a bare URL, but a purl qualifier value is
+ * percent-encoded, so an unescaped `://` makes the whole purl unparseable. A
+ * `file:` URL is dropped instead of escaped: it names a path on the machine
+ * that built the document, so it identifies nothing for a reader of the BOM.
+ * Versions are escaped for build metadata in either case.
+ *
+ * A purl that is still unparseable afterwards is split on its separators and
+ * rebuilt, which escapes any remaining reserved character wherever it sits —
+ * a shared-library name such as `libstdc++.so.6`, for instance.
+ *
+ * @param {object} component Component whose purl is rewritten in place
+ */
+export function repairPurl(component) {
+  const purl = component?.purl;
+  if (typeof purl !== "string" || !purl.startsWith("pkg:")) {
+    return;
+  }
+  repairDownloadUrl(component, purl);
+  const repaired = component.purl;
+  try {
+    Purl.parse(repaired);
+    return;
+  } catch {
+    // Fall through to the structural rebuild below.
+  }
+  const parts = splitPurl(repaired);
+  if (!parts) {
+    return;
+  }
+  try {
+    component.purl = build(parts).toString();
+  } catch {
+    // Nothing more can be recovered; the caller reports the invalid purl.
+  }
+}
+
+/**
+ * Rewrite the `download_url` qualifier of a purl, in place on the component.
+ *
+ * @param {object} component Component whose purl is rewritten in place
+ * @param {string} purl The component's current purl
+ */
+function repairDownloadUrl(component, purl) {
+  if (!purl.includes("download_url=")) {
+    component.purl = encodeVersionBuildMetadata(purl);
+    return;
+  }
+  const [base, query] = purl.split("?");
+  const kept = [];
+  let downloadUrl;
+  for (const pair of query.split("&")) {
+    if (!pair.startsWith("download_url=")) {
+      kept.push(pair);
+      continue;
+    }
+    const raw = pair.slice("download_url=".length);
+    let value;
+    try {
+      value = decodeURIComponent(raw);
+    } catch {
+      value = raw;
+    }
+    if (!/^file:/i.test(value)) {
+      downloadUrl = value;
+    }
+  }
+  const stripped = kept.length ? `${base}?${kept.join("&")}` : base;
+  if (!downloadUrl) {
+    component.purl = encodeVersionBuildMetadata(stripped);
+    return;
+  }
+  // Rebuilt rather than re-encoded by hand: a purl escapes the separators in a
+  // qualifier value but not the scheme colon, and only `build` knows the rule.
+  try {
+    const parts = Purl.parse(stripped);
+    component.purl = build({
+      type: parts.type,
+      namespace: parts.namespace || null,
+      name: parts.name,
+      version: parts.version || null,
+      qualifiers: { ...(parts.qualifiers || {}), download_url: downloadUrl },
+      subpath: parts.subpath || null,
+    }).toString();
+  } catch {
+    component.purl = stripped;
+  }
+}
+
+/**
+ * Attach provenance properties to every component of a parsed document. The
+ * caller owns the property names so each provenance channel stays
+ * distinguishable in the merged BOM.
+ *
+ * @param {Object[]} components Components from `parseSbomDocument`
+ * @param {Array<{name: string, value: string}>} properties Properties to add
+ * @returns {Object[]} The same array, with properties attached
+ */
+export function tagSbomComponents(components, properties) {
+  for (const component of components || []) {
+    if (!component || typeof component !== "object") {
+      continue;
+    }
+    component.properties = Array.isArray(component.properties)
+      ? component.properties
+      : [];
+    for (const property of properties) {
+      if (property?.name && property?.value) {
+        component.properties.push({
+          name: property.name,
+          value: String(property.value),
+        });
+      }
+    }
+  }
+  return components;
+}