@cdxgen/cdxgen 13.0.0 → 13.1.0

package/lib/helpers/remote/dependency-track.js

@@ -1,4 +1,5 @@
 import { Buffer } from "node:buffer";
+import { randomBytes } from "node:crypto";
 
 import { hasDangerousUnicode } from "../../core/activity.js";
 
@@ -44,26 +45,23 @@ export function getDependencyTrackBomUrl(serverUrl) {
 }
 
 /**
- * Build the payload for Dependency-Track BOM submission.
+ * Build the form fields for a Dependency-Track BOM submission.
+ *
+ * Field names follow the `multipart/form-data` variant of `/api/v1/bom`, which differs
+ * from the JSON variant: the JSON body calls the flag `isLatestProjectVersion` and takes
+ * `projectTags` as an array of objects, while the form takes `isLatest` and a
+ * comma-separated tag list.
  *
  * @param {Object} args CLI/server arguments
- * @param {Object} bomContents BOM Json
- * @returns {Object | undefined} payload object if project coordinates are valid
+ * @returns {Object | undefined} field map if the project coordinates are valid
  */
-export function buildDependencyTrackBomPayload(args, bomContents) {
-  let encodedBomContents = Buffer.from(JSON.stringify(bomContents)).toString(
-    "base64",
-  );
-  if (encodedBomContents.startsWith("77u/")) {
-    encodedBomContents = encodedBomContents.substring(4);
-  }
+export function buildDependencyTrackBomPayload(args) {
   const autoCreate =
     typeof args.autoCreate === "boolean"
       ? args.autoCreate
       : args.autoCreate !== "false";
   const bomPayload = {
     autoCreate: String(autoCreate),
-    bom: encodedBomContents,
   };
   if (
     typeof args.projectId !== "undefined" ||
@@ -103,15 +101,84 @@ export function buildDependencyTrackBomPayload(args, bomContents) {
     args.isLatest === "true" ||
     args.isLatest === "false"
   ) {
-    bomPayload.isLatest =
+    bomPayload.isLatest = String(
       typeof args.isLatest === "boolean"
         ? args.isLatest
-        : args.isLatest === "true";
+        : args.isLatest === "true",
+    );
   }
   if (typeof args.projectTag !== "undefined") {
+    // The server splits this field on commas, so a tag cannot itself contain one.
     bomPayload.projectTags = (
       Array.isArray(args.projectTag) ? args.projectTag : [args.projectTag]
-    ).map((tag) => ({ name: tag }));
+    ).join(",");
   }
   return bomPayload;
 }
+
+/**
+ * Encode text fields and a single file part as a `multipart/form-data` body.
+ *
+ * @param {Object} fields Text fields keyed by field name
+ * @param {Object} file File part
+ * @param {string} file.name Field name of the file part
+ * @param {string} file.filename File name reported to the server
+ * @param {string} file.contentType Content type of the file part
+ * @param {Buffer} file.content File content
+ * @returns {{ body: Buffer, contentType: string }} encoded body and its content type
+ */
+export function encodeMultipartFormData(fields, file) {
+  // A random boundary keeps the delimiter from colliding with the BOM content.
+  const boundary = `--------------------------cdxgen${randomBytes(16).toString("hex")}`;
+  const chunks = [];
+  const pushPart = (header, content) => {
+    chunks.push(
+      Buffer.from(`--${boundary}\r\n${header}\r\n\r\n`),
+      Buffer.isBuffer(content) ? content : Buffer.from(String(content)),
+      Buffer.from("\r\n"),
+    );
+  };
+  for (const [name, value] of Object.entries(fields)) {
+    pushPart(`Content-Disposition: form-data; name="${name}"`, value);
+  }
+  pushPart(
+    `Content-Disposition: form-data; name="${file.name}"; filename="${file.filename}"\r\nContent-Type: ${file.contentType}`,
+    file.content,
+  );
+  chunks.push(Buffer.from(`--${boundary}--\r\n`));
+  return {
+    body: Buffer.concat(chunks),
+    contentType: `multipart/form-data; boundary=${boundary}`,
+  };
+}
+
+/**
+ * Build the `multipart/form-data` request for Dependency-Track BOM submission.
+ *
+ * The JSON variant of the endpoint carries the BOM as a base64 string, which Jackson
+ * refuses to read beyond 20,000,000 characters - roughly a 15 MB BOM, which container
+ * image scans exceed routinely. The form variant carries the BOM as a file part and has
+ * no such limit, and is what the server recommends for large uploads.
+ *
+ * @param {Object} args CLI/server arguments
+ * @param {Object | string} bomContents BOM Json
+ * @returns {{ body: Buffer, contentType: string } | undefined} request body and content type if the arguments are valid
+ */
+export function buildDependencyTrackBomRequest(args, bomContents) {
+  if (!bomContents) {
+    return undefined;
+  }
+  const fields = buildDependencyTrackBomPayload(args);
+  if (!fields) {
+    return undefined;
+  }
+  const bomString =
+    typeof bomContents === "string" ? bomContents : JSON.stringify(bomContents);
+  return encodeMultipartFormData(fields, {
+    name: "bom",
+    filename: "bom.json",
+    contentType: "application/vnd.cyclonedx+json",
+    // The server rejects a BOM that still carries a byte order mark.
+    content: Buffer.from(bomString.replace(/^\ufeff/, "")),
+  });
+}

package/lib/inventory/auditCategories.js

@@ -23,6 +23,15 @@ export const GOLEM_AUDIT_CATEGORIES = Object.freeze([
   "golem-compliance",
 ]);
 
+/**
+ * Frozen list of audit categories that never activate on their own. These
+ * rule packs serve a specific feature (`--introspect` for build-fidelity) and
+ * stay inactive unless the caller explicitly requests the category, so a
+ * default `--bom-audit` run - which evaluates every loaded rule - cannot pick
+ * them up.
+ */
+export const OPT_IN_BOM_AUDIT_CATEGORIES = Object.freeze(["build-fidelity"]);
+
 /** Frozen list of AI-bill-of-materials audit categories. */
 export const AI_BOM_AUDIT_CATEGORIES = Object.freeze([
   "ai-governance",

package/lib/inventory/depsUtils.js

@@ -222,6 +222,28 @@ function serviceIdentityKey(service) {
   return `${service?.group || ""}:${service?.name || ""}:${service?.version || ""}`.toLowerCase();
 }
 
+/**
+ * Union two services[].data[] lists, keyed by flow + classification + name so that repeated
+ * classifications of the same payload do not accumulate duplicates.
+ *
+ * @param {Array} existingData Data entries already on the service
+ * @param {Array} newData Data entries being merged in
+ * @returns {Array} Merged data entries
+ */
+function mergeServiceData(existingData = [], newData = []) {
+  const seen = new Map();
+  for (const entry of [...existingData, ...newData]) {
+    if (!entry?.flow || !entry?.classification) {
+      continue;
+    }
+    const key = `${entry.flow}|${entry.classification}|${entry.name || ""}`;
+    if (!seen.has(key)) {
+      seen.set(key, entry);
+    }
+  }
+  return Array.from(seen.values());
+}
+
 function mergeServiceProperties(existingProps = [], newProps = []) {
   const merged = [...existingProps];
   for (const newProp of newProps) {
@@ -249,6 +271,38 @@ function normalizeServiceEndpoints(endpoints) {
   return [];
 }
 
+function evidenceOccurrenceKey(occurrence) {
+  const location = occurrence?.location || {};
+  return `${location.path || ""}#${location.line ?? ""}#${location.column ?? ""}`;
+}
+
+/**
+ * Union two service evidence objects by their occurrences so a collision keeps
+ * every call site instead of whichever side arrived first.
+ *
+ * @param {Object} [existingEvidence] Evidence already on the service
+ * @param {Object} [newEvidence] Evidence being merged in
+ * @returns {Object} Evidence covering both inputs
+ */
+function mergeServiceEvidence(existingEvidence, newEvidence) {
+  if (!existingEvidence) {
+    return newEvidence;
+  }
+  const occurrences = [...(existingEvidence.occurrences || [])];
+  const seen = new Set(occurrences.map(evidenceOccurrenceKey));
+  for (const occurrence of newEvidence?.occurrences || []) {
+    const key = evidenceOccurrenceKey(occurrence);
+    if (!seen.has(key)) {
+      seen.add(key);
+      occurrences.push(occurrence);
+    }
+  }
+  if (!occurrences.length) {
+    return existingEvidence;
+  }
+  return { ...existingEvidence, occurrences };
+}
+
 /**
  * Merge CycloneDX services using bom-ref or group/name/version identity.
  *
@@ -313,6 +367,24 @@ export function mergeServices(services, newServices) {
       existing.properties || [],
       service.properties || [],
     );
+    // Carry the richer fields through a collision too. Without these, a dosai service that collided
+    // with one derived from endpoints lost precisely what schema 4.0.0 adds: its bom-ref, its data
+    // classifications, and its evidence.
+    existing["bom-ref"] = existing["bom-ref"] || service["bom-ref"];
+    if (Array.isArray(service.data) && service.data.length) {
+      existing.data = mergeServiceData(existing.data || [], service.data);
+    }
+    if (service.evidence) {
+      existing.evidence = mergeServiceEvidence(
+        existing.evidence,
+        service.evidence,
+      );
+    }
+    if (Array.isArray(service.tags) && service.tags.length) {
+      existing.tags = Array.from(
+        new Set([...(existing.tags || []), ...service.tags]),
+      );
+    }
     if (Array.isArray(service.services) && service.services.length) {
       existing.services = mergeServices(
         existing.services || [],