@cdxgen/cdxgen 13.1.0 → 13.2.0

package/lib/ecosystems/rusi.js

@@ -9,11 +9,16 @@ import {
   safeRmSync,
   safeSpawnSync,
 } from "../core/fs.js";
+import { dirNameStr } from "../core/paths.js";
 import { applyAlgorithmProperties } from "../inventory/cryptoAlgorithmFamily.js";
 import { resolvePluginBinary } from "../inventory/plugins.js";
 
 const RUST_LANGUAGES = new Set(["rust", "rs", "rust-lang"]);
 
+const RUSI_CRYPTO_OIDS = JSON.parse(
+  readFileSync(join(dirNameStr, "data", "crypto-oid.json"), "utf-8"),
+);
+
 /**
  * Resolves the rusi binary.
  *
@@ -82,6 +87,75 @@ function createPurlAliasMap(components = []) {
   return purlAliasMap;
 }
 
+/**
+ * Path roots that never name a dependency crate.
+ */
+const RUST_NON_CRATE_PATH_ROOTS = new Set([
+  "crate",
+  "self",
+  "super",
+  "std",
+  "core",
+  "alloc",
+  "proc_macro",
+  "test",
+]);
+
+/**
+ * Index the cargo components by the identifier a Rust path spells them with.
+ *
+ * A crate named `cfg-if` is written `cfg_if` in source, and a lock file can
+ * carry several versions of the same crate, so a name maps to every matching
+ * purl.
+ *
+ * @param {Object[]} components Components from the BOM
+ * @returns {Map<string, string[]>} Crate identifier to purls
+ */
+function createCrateNameIndex(components = []) {
+  const crateNameIndex = new Map();
+  for (const component of components) {
+    if (!component?.purl?.startsWith("pkg:cargo/") || !component.name) {
+      continue;
+    }
+    const crateIdentifier = component.name.toLowerCase().replaceAll("-", "_");
+    const purls = crateNameIndex.get(crateIdentifier) || [];
+    if (!purls.includes(component.purl)) {
+      purls.push(component.purl);
+    }
+    crateNameIndex.set(crateIdentifier, purls);
+  }
+  return crateNameIndex;
+}
+
+/**
+ * Resolve the dependency crates a Rust path refers to.
+ *
+ * rusi reports an import against the package that declares it, so the imported
+ * crate has to be recovered from the path itself. This is what turns an
+ * `use hex::encode;` into usage evidence for the `hex` component.
+ *
+ * @param {string} importPath Rust path, such as `hex::encode`
+ * @param {Map<string, string[]>} crateNameIndex Index from {@link createCrateNameIndex}
+ * @param {string} [ownerPurl] purl of the package that declares the path
+ * @returns {string[]} Matching component purls
+ */
+function resolveImportedCratePurls(importPath, crateNameIndex, ownerPurl) {
+  if (!importPath || !crateNameIndex?.size) {
+    return [];
+  }
+  const pathRoot = String(importPath)
+    .replace(/^::/, "")
+    .split("::")[0]
+    .trim()
+    .toLowerCase();
+  if (!pathRoot || RUST_NON_CRATE_PATH_ROOTS.has(pathRoot)) {
+    return [];
+  }
+  return (crateNameIndex.get(pathRoot) || []).filter(
+    (purl) => purl !== ownerPurl,
+  );
+}
+
 function resolveComponentPurl(purl, purlAliasMap) {
   if (!purl) {
     return undefined;
@@ -182,19 +256,37 @@ function mergeCryptoComponent(componentsByRef, component, item) {
   return existing;
 }
 
+// The schema requires an oid for algorithm assets, so an algorithm the OID
+// table cannot name is skipped rather than emitted invalid. rusi reports
+// display-cased names ("SHA-256") while the table is lowercase ("sha-256").
+function resolveCryptoAlgorithmMetadata(name) {
+  if (!name) {
+    return undefined;
+  }
+  const lowered = String(name).toLowerCase();
+  return (
+    RUSI_CRYPTO_OIDS[name] ||
+    RUSI_CRYPTO_OIDS[lowered] ||
+    RUSI_CRYPTO_OIDS[lowered.replace(/[\s_]+/g, "-")]
+  );
+}
+
 function cryptoAlgorithmComponent(asset) {
+  const algorithmName = asset.algorithm || asset.kind || "unknown";
+  const algorithmMetadata = resolveCryptoAlgorithmMetadata(algorithmName);
+  if (!algorithmMetadata?.oid) {
+    return undefined;
+  }
   const component = {
     type: "cryptographic-asset",
-    name: asset.algorithm || asset.kind || "unknown",
-    "bom-ref": cryptoBomRef(
-      "algorithm",
-      asset.algorithm || asset.kind,
-      asset.provider || "unknown",
-    ),
+    name: algorithmName,
+    "bom-ref": cryptoBomRef("algorithm", algorithmName, algorithmMetadata.oid),
     description:
+      algorithmMetadata.description ||
       "Cryptographic algorithm/component detected by rusi source analysis",
     cryptoProperties: {
       assetType: "algorithm",
+      oid: algorithmMetadata.oid,
       algorithmProperties: { primitive: asset.kind || "unknown" },
     },
     properties: [],
@@ -361,6 +453,7 @@ function addImportEvidence(
   purlAliasMap,
   purlLocationMap,
   componentPropertiesMap,
+  crateNameIndex,
 ) {
   for (const importUsage of rusiReport.imports || []) {
     const purl = resolveComponentPurl(importUsage.purl, purlAliasMap);
@@ -380,6 +473,31 @@ function addImportEvidence(
       "cdx:rusi:importAlias",
       importUsage.alias,
     );
+    // The import is also evidence about the crate being imported, which is the
+    // component a consumer filters on.
+    for (const cratePurl of resolveImportedCratePurls(
+      importUsage.path,
+      crateNameIndex,
+      purl,
+    )) {
+      addSetValue(
+        purlLocationMap,
+        cratePurl,
+        positionLocation(importUsage.position),
+      );
+      addPropertyValue(
+        componentPropertiesMap,
+        cratePurl,
+        "cdx:rusi:importedBy",
+        purl,
+      );
+      addPropertyValue(
+        componentPropertiesMap,
+        cratePurl,
+        "cdx:rusi:importPath",
+        importUsage.path,
+      );
+    }
   }
 }
 
@@ -761,6 +879,7 @@ export function analyzeRusiProject(src, options = {}) {
  */
 export function collectRusiEvidence(rusiReport = {}, components = []) {
   const purlAliasMap = createPurlAliasMap(components);
+  const crateNameIndex = createCrateNameIndex(components);
   const purlLocationMap = {};
   const dataFlowFrames = {};
   const componentPropertiesMap = {};
@@ -774,6 +893,7 @@ export function collectRusiEvidence(rusiReport = {}, components = []) {
     purlAliasMap,
     purlLocationMap,
     componentPropertiesMap,
+    crateNameIndex,
   );
   addUsageEvidence(
     rusiReport,

package/lib/evinser/evinser.js

@@ -25,6 +25,15 @@ import {
   getGradleCommand,
   getMavenCommand,
 } from "../ecosystems/gradleutils.js";
+import {
+  analyzeKosiProject,
+  collectKosiApiEndpoints,
+  collectKosiEvidence,
+  collectKosiServices,
+  isKosiKotlinLanguage,
+  kosiWorkspaceComponent,
+  mergeKosiEvidence,
+} from "../ecosystems/kosi.js";
 import {
   analyzeRusiProject,
   collectRusiEvidence,
@@ -42,6 +51,7 @@ import {
 import { collectMvnDependencies } from "../inventory/deps.js";
 import { mergeServices } from "../inventory/depsUtils.js";
 import {
+  applyDosaiReachabilityEvidence,
   collectDosaiAiComponents,
   collectDosaiDataFlowFrames,
   collectDosaiPurlEvidence,
@@ -616,8 +626,13 @@ export function initFromSbom(components, language) {
         });
     }
     if (comp.evidence.occurrences) {
+      // Keep the `location#line` shape so a re-run over a cdxgen BOM does not
+      // degrade seeded occurrences to file-only entries and duplicate the
+      // richer locations the fresh slice merge adds to the same set.
       purlLocationMap[comp.purl] = new Set(
-        comp.evidence.occurrences.map((v) => v.location),
+        comp.evidence.occurrences.map((v) =>
+          v.line ? `${v.location}#${v.line}` : v.location,
+        ),
       );
     }
   }
@@ -724,6 +739,84 @@ export async function analyzeProject(dbObjMap, options) {
     };
   }
 
+  if (isKosiKotlinLanguage(language)) {
+    const kosiReports = analyzeKosiProject(dirPath, options);
+    if (kosiReports?.report && Object.keys(kosiReports.report).length) {
+      // The workspace component: cdxgen's Kotlin BOM carries no project
+      // component, so every workspace-anchored slice (reachability, the
+      // app's own flows) would have nothing to attach to. createEvinseFile
+      // re-reads the BOM from disk, so the candidate rides the artefacts
+      // instead of a mutation here — applied when the BOM lacks a project
+      // component OR carries one with no purl: every kosi evidence join is
+      // keyed by purl, so a purl-less component anchors nothing and is, for
+      // this purpose, no anchor at all (found on the sample app: Gradle
+      // identity with empty group and version "latest" emits no purl, and
+      // the reachableFromRoots/cryptoFlow evidence silently attached to
+      // nothing while the dependency-joined kinds landed).
+      const metadataComponentHasPurl = Boolean(
+        bomJson.metadata?.component?.purl,
+      );
+      let workspaceComponent;
+      if (!metadataComponentHasPurl) {
+        // kosi's modules[] holds the project's OWN Gradle/Maven modules
+        // (dependencies never appear there), so the project component is
+        // its root: the shortest modulePath, ties broken by name so the
+        // choice is deterministic. `workspaceMember` is not the selector —
+        // it is a String naming the owning workspace member in kosi's
+        // schema, empty for a single-module build and then omitted from the
+        // JSON entirely, so testing it against `undefined` picked nothing
+        // on exactly the single-module projects this fallback exists for.
+        const workspaceModule = (kosiReports.report.modules || [])
+          .filter((candidate) => candidate?.purl)
+          .sort(
+            (a, b) =>
+              (a.modulePath || "").length - (b.modulePath || "").length ||
+              (a.name || "").localeCompare(b.name || ""),
+          )[0];
+        if (workspaceModule?.purl) {
+          workspaceComponent = kosiWorkspaceComponent(workspaceModule);
+        }
+      }
+      const analysisComponents = [
+        bomJson.metadata?.component,
+        workspaceComponent,
+        ...components,
+      ].filter(Boolean);
+      const kosiEvidence = collectKosiEvidence(
+        kosiReports.report,
+        analysisComponents,
+      );
+      mergeKosiEvidence(
+        kosiEvidence,
+        collectKosiEvidence(
+          kosiReports.reachableReport || {},
+          analysisComponents,
+        ),
+      );
+      servicesMap = collectKosiServices(kosiReports.report, servicesMap);
+      // The INBOUND surface: the routes the app serves, with the
+      // authentication kosi found declared on them.
+      servicesMap = collectKosiApiEndpoints(kosiReports.report, servicesMap);
+      return {
+        purlLocationMap: kosiEvidence.purlLocationMap,
+        dataFlowFrames: kosiEvidence.dataFlowFrames,
+        componentPropertiesMap: kosiEvidence.componentPropertiesMap,
+        metadataProperties: kosiEvidence.metadataProperties,
+        cryptoComponents: kosiEvidence.cryptoComponents,
+        cryptoGeneratePurls: kosiEvidence.cryptoGeneratePurls,
+        servicesMap,
+        userDefinedTypesMap,
+        workspaceComponent,
+      };
+    }
+    return {
+      purlLocationMap,
+      servicesMap,
+      dataFlowFrames,
+      userDefinedTypesMap,
+    };
+  }
+
   if (isDosaiDotnetLanguage(language)) {
     if (options.profile === "research") {
       options.withDataFlow = true;
@@ -746,6 +839,10 @@ export async function analyzeProject(dbObjMap, options) {
     }
     if (usageSlice && Object.keys(usageSlice).length) {
       const dosaiEvidence = collectDosaiPurlEvidence(usageSlice, components);
+      // Confidence/evidence facts ride along as properties so an unbuilt tree (Low
+      // confidence, unresolved evidence) stays distinguishable from an only-imported
+      // package in the emitted BOM.
+      applyDosaiReachabilityEvidence(usageSlice, components);
       for (const [purl, locations] of Object.entries(
         dosaiEvidence.purlLocationMap,
       )) {
@@ -1833,6 +1930,7 @@ export async function createEvinseFile(sliceArtefacts, options) {
     cryptoComponents,
     aiComponents,
     cryptoGeneratePurls,
+    workspaceComponent,
   } = sliceArtefacts;
   const bomFile = options.input;
   const evinseOutFile = options.output;
@@ -1840,6 +1938,18 @@ export async function createEvinseFile(sliceArtefacts, options) {
   const components = bomJson.components || [];
   // Clear existing annotations
   bomJson.annotations = [];
+  if (workspaceComponent && !bomJson.metadata?.component?.purl) {
+    if (bomJson.metadata?.component) {
+      // A purl-less project component: keep cdxgen's own identity fields
+      // and supply the purl kosi's module discovery published, so the
+      // evidence loop below can anchor workspace evidence to it.
+      bomJson.metadata.component.purl = workspaceComponent.purl;
+      bomJson.metadata.component["bom-ref"] ??= workspaceComponent.purl;
+    } else {
+      bomJson.metadata ??= {};
+      bomJson.metadata.component = workspaceComponent;
+    }
+  }
   appendComponentProperties(bomJson.metadata?.component, metadataProperties);
   let occEvidencePresent = false;
   let csEvidencePresent = false;