@cdxgen/cdxgen 0.0.1 → 13.0.1

package/lib/core/projectConfig.js

@@ -0,0 +1,122 @@
+import path from "node:path";
+
+import { toCamel } from "./paths.js";
+
+/**
+ * Config file names cdxgen reads from the directory it is invoked in.
+ */
+export const PROJECT_CONFIG_FILENAMES = [
+  ".cdxgenrc",
+  ".cdxgen.json",
+  ".cdxgen.yml",
+  ".cdxgen.yaml",
+];
+
+/**
+ * Options whose values name a file or directory cdxgen writes to or reads
+ * from. A config file may set these, but only to a location inside its own
+ * directory.
+ */
+const PATH_OPTIONS = new Set([
+  "output",
+  "evinse-output",
+  "proto-bin-file",
+  "deps-slices-file",
+  "usages-slices-file",
+  "data-flow-slices-file",
+  "reachables-slices-file",
+  "semantics-slices-file",
+  "openapi-spec-file",
+  "license-policy",
+  "bom-audit-rules-dir",
+]);
+
+/**
+ * Options that change where cdxgen sends data or how much of the host it
+ * touches. These stay usable, but never silently.
+ */
+const ANNOUNCED_OPTIONS = new Set([
+  "server-url",
+  "api-key",
+  "include-formulation",
+  "install-deps",
+  "deep",
+  "tea-publish",
+  "tea-fetch",
+  "tea-artifact-url",
+  "tea-token",
+]);
+
+/**
+ * Both spellings a config file may use for an option.
+ *
+ * @param {string} option kebab-case option name
+ * @returns {string[]} kebab-case and camelCase spellings
+ */
+function optionSpellings(option) {
+  const camel = toCamel(option);
+  return camel === option ? [option] : [option, camel];
+}
+
+/**
+ * Determine whether a config-supplied path stays inside the config's own
+ * directory.
+ *
+ * @param {string} configDir directory the config file was read from
+ * @param {unknown} value config-supplied path value
+ * @returns {boolean} true when the path resolves inside configDir
+ */
+function isContainedPath(configDir, value) {
+  if (typeof value !== "string" || !value.length) {
+    return false;
+  }
+  const relativePath = path.relative(
+    path.resolve(configDir),
+    path.resolve(configDir, value),
+  );
+  return (
+    relativePath === "" ||
+    (!relativePath.startsWith("..") && !path.isAbsolute(relativePath))
+  );
+}
+
+/**
+ * Apply the trust boundary between cdxgen and the directory it is scanning.
+ *
+ * A config file lives in the tree under analysis, so it is attacker-controlled
+ * whenever that tree is. Path options are therefore confined to the config's
+ * own directory - a scanned project may choose where in itself the BOM lands,
+ * but not write outside it - and options that redirect data off the host or
+ * widen what cdxgen executes are announced on the console.
+ *
+ * @param {Object} config parsed config file contents
+ * @param {string} configDir directory the config file was read from
+ * @returns {{config: Object, rejected: string[], announced: string[]}} sanitized config and what it did
+ */
+export function sanitizeProjectConfig(config, configDir) {
+  if (!config || typeof config !== "object") {
+    return { announced: [], config: {}, rejected: [] };
+  }
+  const sanitized = { ...config };
+  const rejected = [];
+  const announced = [];
+  for (const option of PATH_OPTIONS) {
+    for (const key of optionSpellings(option)) {
+      if (sanitized[key] === undefined) {
+        continue;
+      }
+      if (!isContainedPath(configDir, sanitized[key])) {
+        rejected.push(`${key}=${sanitized[key]}`);
+        delete sanitized[key];
+      }
+    }
+  }
+  for (const option of ANNOUNCED_OPTIONS) {
+    for (const key of optionSpellings(option)) {
+      if (sanitized[key] !== undefined) {
+        announced.push(key);
+      }
+    }
+  }
+  return { announced, config: sanitized, rejected };
+}

package/lib/core/propertySanitizer.js

@@ -0,0 +1,174 @@
+import path from "node:path";
+
+const DANGEROUS_OBJECT_KEYS = new Set([
+  "__proto__",
+  "constructor",
+  "prototype",
+]);
+const INLINE_CREDENTIAL_PATTERNS = [
+  /\bAKIA[0-9A-Z]{16}\b/gu,
+  /\bASIA[0-9A-Z]{16}\b/gu,
+  /\bbearer\s+[a-z0-9._-]{16,}\b/giu,
+  /\b(?:sk|rk|pk)(?:-[a-z0-9]+)?_[a-z0-9_-]{8,}\b/giu,
+  /\bgh[pousr]_[a-z0-9]{20,}\b/giu,
+  /\bAIza[0-9A-Za-z_-]{20,}\b/gu,
+  /\bxox[baprs]-[a-z0-9-]{10,}\b/giu,
+  /\bnpm_[a-z0-9]{20,}\b/giu,
+  /\b(?:eyJ[a-z0-9_-]+\.[a-z0-9._-]+\.[a-z0-9._-]+)\b/giu,
+];
+const SENSITIVE_KEY_PATTERN =
+  /(?:api[-_]?key|auth(?:orization)?|bearer|credential|passwd|password|secret|session|token)/iu;
+const JSON_PROPERTY_NAMES = new Set([
+  "cdx:agent:permission",
+  "cdx:mcp:toolAnnotations",
+  "cdx:skill:metadata",
+  "cdx:ai:codegen:evidence:json",
+]);
+const URL_PATTERN = /https?:\/\/[^\s<>"'),\]}]+/giu;
+const MAX_STRUCTURE_DEPTH = 6;
+
+function sanitizeUrlForBom(value) {
+  const input = String(value || "").trim();
+  if (!input) {
+    return input;
+  }
+  try {
+    const parsed = new URL(input);
+    parsed.username = "";
+    parsed.password = "";
+    parsed.search = "";
+    parsed.hash = "";
+    return parsed.toString();
+  } catch {
+    return input;
+  }
+}
+
+function sanitizeTextForBom(value) {
+  let sanitized = String(value ?? "");
+  sanitized = sanitized.replace(URL_PATTERN, (match) =>
+    sanitizeUrlForBom(match),
+  );
+  for (const pattern of INLINE_CREDENTIAL_PATTERNS) {
+    sanitized = sanitized.replace(pattern, "[redacted]");
+  }
+  return sanitized;
+}
+
+/**
+ * Recursively sanitize structured values before embedding them in a BOM.
+ *
+ * @param {unknown} value structured value
+ * @returns {unknown} sanitized value
+ */
+export function sanitizeStructuredValueForBom(value) {
+  return sanitizeStructuredValueEntryForBom(value, 0, new WeakSet());
+}
+
+function sanitizeStructuredValueEntryForBom(value, depth, seen) {
+  if (typeof value === "string") {
+    return sanitizeTextForBom(value);
+  }
+  if (depth >= MAX_STRUCTURE_DEPTH) {
+    return "[truncated]";
+  }
+  if (Array.isArray(value)) {
+    return value.map((entry) =>
+      sanitizeStructuredValueEntryForBom(entry, depth + 1, seen),
+    );
+  }
+  if (value && typeof value === "object") {
+    if (seen.has(value)) {
+      return "[circular]";
+    }
+    seen.add(value);
+    const sanitized = {};
+    for (const [key, entryValue] of Object.entries(value)) {
+      if (DANGEROUS_OBJECT_KEYS.has(key)) {
+        continue;
+      }
+      sanitized[key] = SENSITIVE_KEY_PATTERN.test(key)
+        ? "[redacted]"
+        : sanitizeStructuredValueEntryForBom(entryValue, depth + 1, seen);
+    }
+    seen.delete(value);
+    return sanitized;
+  }
+  return value;
+}
+
+function extractCommandExecutable(command) {
+  let trimmedCommand = String(command || "").trim();
+  if (!trimmedCommand) {
+    return "";
+  }
+  trimmedCommand = trimmedCommand.replace(
+    /^(?:[A-Za-z_][A-Za-z0-9_]*=(?:"[^"]*"|'[^']*'|[^\s]+)\s+)+/u,
+    "",
+  );
+  const quotedMatch = trimmedCommand.match(/^(['"])(.*?)\1/u);
+  if (quotedMatch?.[2]) {
+    return quotedMatch[2];
+  }
+  const envExecutableMatch = trimmedCommand.match(
+    /^(?:\/usr\/bin\/env\s+)?([A-Za-z0-9_./\\-]+)(?=\s|$)/u,
+  );
+  if (envExecutableMatch?.[1]) {
+    return envExecutableMatch[1];
+  }
+  const absolutePathMatch = trimmedCommand.match(
+    /^((?:[A-Za-z]:\\|\/).*?\.(?:bat|bin|cjs|cmd|com|exe|jar|js|mjs|ps1|py|rb|sh|ts|tsx))(?=\s|$)/iu,
+  );
+  if (absolutePathMatch?.[1]) {
+    return absolutePathMatch[1];
+  }
+  return trimmedCommand.split(/\s+/u)[0];
+}
+
+function summarizeExecutable(command) {
+  const executable = extractCommandExecutable(command);
+  if (!executable) {
+    return "configured";
+  }
+  if (executable.includes("\\")) {
+    return path.win32.basename(executable) || "configured";
+  }
+  return path.posix.basename(executable) || "configured";
+}
+
+/**
+ * Sanitize a URL value for safe BOM emission.
+ *
+ * @param {string} value URL value
+ * @returns {string} sanitized URL
+ */
+export function sanitizeBomUrl(value) {
+  return sanitizeUrlForBom(value);
+}
+
+/**
+ * Sanitize a property value before serializing it into BOM properties.
+ *
+ * @param {string} name property name
+ * @param {unknown} value property value
+ * @returns {string|unknown} sanitized property value
+ */
+export function sanitizeBomPropertyValue(name, value) {
+  if (value === undefined || value === null || value === "") {
+    return value;
+  }
+  if (name === "cdx:mcp:command") {
+    const sanitizedCommand = sanitizeTextForBom(value).trim();
+    if (!sanitizedCommand) {
+      return sanitizedCommand;
+    }
+    return summarizeExecutable(sanitizedCommand);
+  }
+  if (JSON_PROPERTY_NAMES.has(name) || typeof value === "object") {
+    return JSON.stringify(sanitizeStructuredValueForBom(value));
+  }
+  if (typeof value === "string") {
+    return sanitizeTextForBom(value);
+  }
+  return value;
+}

package/lib/core/spdx.js

@@ -0,0 +1,5 @@
+/** SPDX 3.0.1 JSON-LD context URL used when exporting CycloneDX documents to SPDX. */
+export const SPDX_JSONLD_CONTEXT =
+  "https://spdx.org/rdf/3.0.1/spdx-context.jsonld";
+/** SPDX specification version string targeted by the SPDX export converter. */
+export const SPDX_SPEC_VERSION = "3.0.1";

package/lib/core/state.js

@@ -0,0 +1,59 @@
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+
+import { dirNameStr } from "./paths.js";
+
+/** Loaded vendor alias mapping from data/vendor-alias.json. */
+const vendorAliases = JSON.parse(
+  readFileSync(join(dirNameStr, "data", "vendor-alias.json"), "utf-8"),
+);
+/** Loaded Meson WrapDB releases from data/wrapdb-releases.json. */
+const mesonWrapDB = JSON.parse(
+  readFileSync(join(dirNameStr, "data", "wrapdb-releases.json"), "utf-8"),
+);
+/** Loaded list of known frameworks from data/frameworks-list.json. */
+export const frameworksList = JSON.parse(
+  readFileSync(join(dirNameStr, "data", "frameworks-list.json"), "utf-8"),
+);
+const selfPJson = JSON.parse(
+  readFileSync(join(dirNameStr, "package.json"), "utf-8"),
+);
+
+/** Loaded set of C/C++ standard library modules from data/glibc-stdlib.json. */
+const CPP_STD_MODULES = JSON.parse(
+  readFileSync(join(dirNameStr, "data", "glibc-stdlib.json"), "utf-8"),
+);
+/** Installed cdxgen version, read from package.json. */
+export const CDXGEN_VERSION = selfPJson.version;
+
+/**
+ * cdxgen's own scope and name, read from its package.json rather than hardcoded.
+ *
+ * Both the tool component in `metadata.tools` and the code that later finds that
+ * component again (to attach release notes) need this identity. When the strings
+ * were duplicated, the v13 rename to `@cdxgen/cdxgen` updated the producer but
+ * not the consumer, and `--release-notes` silently became a no-op.
+ */
+const selfNameParts = selfPJson.name.split("/");
+/** cdxgen npm scope group (e.g. "@cdxgen"), or empty string when unscoped. */
+export const CDXGEN_TOOL_GROUP =
+  selfNameParts.length > 1 ? selfNameParts[0] : "";
+/** cdxgen bare tool name (the final path segment of the package name). */
+export const CDXGEN_TOOL_NAME = selfNameParts[selfNameParts.length - 1];
+
+/** Loaded set of Python standard library modules from data/python-stdlib.json. */
+const PYTHON_STD_MODULES = JSON.parse(
+  readFileSync(join(dirNameStr, "data", "python-stdlib.json"), "utf-8"),
+);
+/** Loaded mapping between Python module names and PyPI package names from data/pypi-pkg-aliases.json. */
+const PYPI_MODULE_PACKAGE_MAPPING = JSON.parse(
+  readFileSync(join(dirNameStr, "data", "pypi-pkg-aliases.json"), "utf-8"),
+);
+
+export {
+  CPP_STD_MODULES,
+  mesonWrapDB,
+  PYPI_MODULE_PACKAGE_MAPPING,
+  PYTHON_STD_MODULES,
+  vendorAliases,
+};

package/lib/core/text.js

@@ -0,0 +1,207 @@
+/**
+ * ANSI-aware text measurement, stripping, and wrapping helpers.
+ *
+ * Layer 0: this module imports nothing outside `lib/core`. It is the shared
+ * home for the width/wrap primitives that `lib/inventory/table.js` (layer 2)
+ * and `lib/core/ui.js` (layer 0) both need, so neither has to reach across a
+ * layer boundary for them.
+ */
+
+/** String source of a regex matching ANSI escape sequences (CSI forms). */
+const ANSI_PATTERN = "\\u001B\\[[0-?]*[ -/]*[@-~]";
+/** Global regex constructed from {@link ANSI_PATTERN}, used to strip ANSI escapes. */
+const ANSI_REGEX = new RegExp(ANSI_PATTERN, "g");
+/** Regex matching Unicode combining mark characters (the `\p{Mark}` category). */
+const COMBINING_MARK_REGEX = /\p{Mark}/u;
+
+/**
+ * Strip ANSI escape sequences from a string.
+ *
+ * @param {string} input Input possibly containing ANSI escapes
+ * @returns {string} Visible text only
+ */
+export const stripAnsi = (input) => `${input ?? ""}`.replace(ANSI_REGEX, "");
+
+/**
+ * Detect full-width East-Asian-Wide and emoji code points so they occupy two
+ * cells instead of one. The ranges mirror the EastAsianWidth+F/EV definitions
+ * used by mainstream terminal width libraries.
+ *
+ * @param {number} codePoint Code point to test
+ * @returns {boolean} True when the code point is double-width
+ */
+export const isFullWidthCodePoint = (codePoint) => {
+  return (
+    codePoint >= 0x1100 &&
+    (codePoint <= 0x115f ||
+      codePoint === 0x2329 ||
+      codePoint === 0x232a ||
+      (codePoint >= 0x2e80 && codePoint <= 0xa4cf && codePoint !== 0x303f) ||
+      (codePoint >= 0xac00 && codePoint <= 0xd7a3) ||
+      (codePoint >= 0xf900 && codePoint <= 0xfaff) ||
+      (codePoint >= 0xfe10 && codePoint <= 0xfe19) ||
+      (codePoint >= 0xfe30 && codePoint <= 0xfe6f) ||
+      (codePoint >= 0xff00 && codePoint <= 0xff60) ||
+      (codePoint >= 0xffe0 && codePoint <= 0xffe6) ||
+      (codePoint >= 0x1f300 && codePoint <= 0x1f64f) ||
+      (codePoint >= 0x1f900 && codePoint <= 0x1f9ff))
+  );
+};
+
+/**
+ * Measure the visible cell width of a string, accounting for ANSI escapes,
+ * combining marks, and full-width code points.
+ *
+ * @param {string} input Input to measure
+ * @returns {number} Visible width in terminal cells
+ */
+export const stringWidth = (input) => {
+  const clean = stripAnsi(input);
+  let width = 0;
+  for (const char of clean) {
+    if (char === "\n" || char === "\r") {
+      continue;
+    }
+    if (COMBINING_MARK_REGEX.test(char)) {
+      continue;
+    }
+    const codePoint = char.codePointAt(0);
+    width += isFullWidthCodePoint(codePoint) ? 2 : 1;
+  }
+  return width;
+};
+
+/**
+ * Pad/align text to a target visible width.
+ *
+ * @param {string} text Text to align
+ * @param {number} width Target cell width
+ * @param {"left"|"right"|"center"} [alignment="left"] Alignment
+ * @returns {string} Padded text
+ */
+export const alignText = (text, width, alignment = "left") => {
+  const visibleWidth = stringWidth(text);
+  if (visibleWidth >= width) {
+    return text;
+  }
+  const totalPad = width - visibleWidth;
+  if (alignment === "right") {
+    return `${" ".repeat(totalPad)}${text}`;
+  }
+  if (alignment === "center") {
+    const left = Math.floor(totalPad / 2);
+    const right = totalPad - left;
+    return `${" ".repeat(left)}${text}${" ".repeat(right)}`;
+  }
+  return `${text}${" ".repeat(totalPad)}`;
+};
+
+/**
+ * Split a single line into ANSI and non-ANSI tokens, preserving the escape
+ * sequences so wrappers can re-emit them attached to the right chunk.
+ *
+ * @param {string} line Input line
+ * @returns {{isAnsi: boolean, value: string}[]} Tokens in order
+ */
+export const splitAnsiTokens = (line) => {
+  const tokens = [];
+  const ansiRegex = new RegExp(ANSI_PATTERN, "g");
+  let cursor = 0;
+  for (const match of line.matchAll(ansiRegex)) {
+    const index = match.index ?? 0;
+    if (index > cursor) {
+      tokens.push({ isAnsi: false, value: line.slice(cursor, index) });
+    }
+    tokens.push({ isAnsi: true, value: match[0] });
+    cursor = index + match[0].length;
+  }
+  if (cursor < line.length) {
+    tokens.push({ isAnsi: false, value: line.slice(cursor) });
+  }
+  return tokens;
+};
+
+/**
+ * Wrap a single line by character count, keeping ANSI sequences attached to
+ * the current chunk.
+ *
+ * @param {string} line Input line (no embedded newlines)
+ * @param {number} width Target cell width
+ * @returns {string[]} Wrapped lines
+ */
+export const wrapLineByChars = (line, width) => {
+  if (line === "") {
+    return [""];
+  }
+  if (width <= 0 || stringWidth(line) <= width) {
+    return [line];
+  }
+  const wrapped = [];
+  let chunk = "";
+  let chunkWidth = 0;
+  for (const token of splitAnsiTokens(line)) {
+    if (token.isAnsi) {
+      chunk += token.value;
+      continue;
+    }
+    for (const char of token.value) {
+      const charWidth = stringWidth(char);
+      if (chunkWidth + charWidth > width && chunk) {
+        wrapped.push(chunk);
+        chunk = "";
+        chunkWidth = 0;
+      }
+      chunk += char;
+      chunkWidth += charWidth;
+    }
+  }
+  if (chunk) {
+    wrapped.push(chunk);
+  }
+  return wrapped.length ? wrapped : [""];
+};
+
+/**
+ * Wrap a single line by word boundaries, falling back to character wrapping
+ * for words longer than the width.
+ *
+ * @param {string} line Input line
+ * @param {number} width Target cell width
+ * @returns {string[]} Wrapped lines
+ */
+export const wrapLineByWords = (line, width) => {
+  if (!line) {
+    return [""];
+  }
+  if (width <= 0 || stringWidth(line) <= width) {
+    return [line];
+  }
+  const words = line.split(/\s+/).filter(Boolean);
+  if (!words.length) {
+    return wrapLineByChars(line, width);
+  }
+  const wrapped = [];
+  let current = "";
+  for (const word of words) {
+    const candidate = current ? `${current} ${word}` : word;
+    if (stringWidth(candidate) <= width) {
+      current = candidate;
+      continue;
+    }
+    if (current) {
+      wrapped.push(current);
+    }
+    if (stringWidth(word) > width) {
+      wrapped.push(...wrapLineByChars(word, width));
+      current = "";
+    } else {
+      current = word;
+    }
+  }
+  if (current) {
+    wrapped.push(current);
+  }
+  return wrapped.length ? wrapped : [""];
+};
+
+export { ANSI_PATTERN, ANSI_REGEX, COMBINING_MARK_REGEX };