@cdxgen/cdxgen 13.1.0 → 13.2.0

package/lib/core/activity.js

@@ -3,7 +3,7 @@ import process from "node:process";
 
 import { createHttpClient, getDefaultHttpTimeoutMs } from "./httpClient.js";
 import { traceLog } from "./logger.js";
-import { CDXGEN_VERSION } from "./state.js";
+import { getUserAgent } from "./userAgent.js";
 
 /** True when CDXGEN_DEBUG_MODE or SCAN_DEBUG_MODE requests debug/verbose output. */
 export const DEBUG_MODE =
@@ -85,6 +85,30 @@ const LOCKFILE_ACTIVITY_HINTS = new Map([
       label: "Bundler lockfile",
     },
   ],
+  [
+    "cpanfile.snapshot",
+    {
+      classification: "lockfile",
+      ecosystem: "cpan",
+      label: "Carton snapshot",
+    },
+  ],
+  [
+    "manifest.toml",
+    {
+      classification: "lockfile",
+      ecosystem: "gleam",
+      label: "Gleam or Julia lockfile",
+    },
+  ],
+  [
+    "nimble.lock",
+    {
+      classification: "lockfile",
+      ecosystem: "nim",
+      label: "Nimble lockfile",
+    },
+  ],
   [
     "package-lock.json",
     { classification: "lockfile", ecosystem: "npm", label: "npm lockfile" },
@@ -125,6 +149,62 @@ const LOCKFILE_ACTIVITY_HINTS = new Map([
       label: "PEP 751 lockfile",
     },
   ],
+  [
+    "renv.lock",
+    {
+      classification: "lockfile",
+      ecosystem: "cran",
+      label: "renv lockfile",
+    },
+  ],
+  [
+    "rebar.lock",
+    {
+      classification: "lockfile",
+      ecosystem: "hex",
+      label: "rebar3 lockfile",
+    },
+  ],
+  [
+    "shard.lock",
+    {
+      classification: "lockfile",
+      ecosystem: "crystal",
+      label: "Crystal shards lockfile",
+    },
+  ],
+  [
+    "spack.lock",
+    {
+      classification: "lockfile",
+      ecosystem: "spack",
+      label: "Spack lockfile",
+    },
+  ],
+  [
+    "stack.lock",
+    {
+      classification: "lockfile",
+      ecosystem: "hackage",
+      label: "Stack lockfile",
+    },
+  ],
+  [
+    "stack.yaml.lock",
+    {
+      classification: "lockfile",
+      ecosystem: "hackage",
+      label: "Stack lockfile",
+    },
+  ],
+  [
+    ".terraform.lock.hcl",
+    {
+      classification: "lockfile",
+      ecosystem: "terraform",
+      label: "Terraform provider lockfile",
+    },
+  ],
   [
     "uv.lock",
     { classification: "lockfile", ecosystem: "python", label: "uv lockfile" },
@@ -167,6 +247,18 @@ const MANIFEST_ACTIVITY_HINTS = new Map([
     "pom.xml",
     { classification: "manifest", ecosystem: "maven", label: "Maven manifest" },
   ],
+  [
+    "cpanfile",
+    { classification: "manifest", ecosystem: "cpan", label: "CPAN manifest" },
+  ],
+  [
+    "project.toml",
+    {
+      classification: "manifest",
+      ecosystem: "julia",
+      label: "Julia project manifest",
+    },
+  ],
   [
     "pyproject.toml",
     {
@@ -942,10 +1034,35 @@ function inferNetworkIntent(requestUrl) {
   return "metadata-fetch";
 }
 
+/**
+ * Set the request's user-agent to the value resolved for its destination host,
+ * so that a `CDXGEN_USER_AGENT_<REGISTRY>` override reaches the registry it
+ * names. A user-agent a caller set explicitly is left alone; only the client's
+ * own default, which carries no host context, is replaced.
+ *
+ * @param {Object} options Request options being prepared by the HTTP client.
+ * @returns {void}
+ */
+function applyUserAgent(options) {
+  const headers = options.headers || (options.headers = {});
+  const existingKey = Object.keys(headers).find(
+    (name) => name.toLowerCase() === "user-agent",
+  );
+  if (existingKey && headers[existingKey] !== getUserAgent()) {
+    return;
+  }
+  if (existingKey) {
+    delete headers[existingKey];
+  }
+  headers["user-agent"] = getUserAgent(options.url?.hostname);
+}
+
 /** The shared got-compatible HTTP client for all outbound requests, enforcing dry-run, host-allow-list, and secure-mode policies via beforeRequest/afterResponse/beforeError hooks. */
 export const cdxgenAgent = createHttpClient({
   headers: {
-    "user-agent": `@CycloneDX/cdxgen ${CDXGEN_VERSION}`,
+    // Per-host overrides are applied in beforeRequest; this is the fallback for
+    // any code path that reads the client's configured headers directly.
+    "user-agent": getUserAgent(),
   },
   // Bound every request so an unresponsive host cannot hang a scan. Overridable
   // via CDXGEN_HTTP_TIMEOUT_MS; individual calls may pass a smaller `timeout`.
@@ -959,6 +1076,7 @@ export const cdxgenAgent = createHttpClient({
       (options) => {
         const networkIntent =
           options.context?.activityIntent || inferNetworkIntent(options.url);
+        applyUserAgent(options);
         const allowedHostsEnv = readEnvironmentVariable("CDXGEN_ALLOWED_HOSTS");
         const hostAllowed = isAllowedHttpHost(
           options.url.hostname,

package/lib/core/env.js

@@ -256,6 +256,19 @@ if (readEnvironmentVariable("CARGO_CMD")) {
   CARGO_CMD = readEnvironmentVariable("CARGO_CMD");
 }
 
+/**
+ * Target triple the cargo resolve graph is filtered to, so that a
+ * cross-compiled project can be described for the triple it ships on rather
+ * than for the union of every triple its lock file covers.
+ *
+ * `CDXGEN_CARGO_TARGET` is cdxgen's own name for it; `CARGO_BUILD_TARGET` is
+ * cargo's standard variable, which a cross-compiling build already sets.
+ */
+export const CARGO_TARGET =
+  readEnvironmentVariable("CDXGEN_CARGO_TARGET") ||
+  readEnvironmentVariable("CARGO_BUILD_TARGET") ||
+  undefined;
+
 /** Resolved Clojure CLI executable command (CLJ_CMD env var, or "clj"). */
 export let CLJ_CMD = "clj";
 if (readEnvironmentVariable("CLJ_CMD")) {
@@ -307,6 +320,7 @@ export const PROJECT_TYPE_ALIASES = {
     "java24",
     "java25",
     "java26",
+    "java27",
     "groovy",
     "kotlin",
     "kt",
@@ -339,6 +353,9 @@ export const PROJECT_TYPE_ALIASES = {
     "nodejs20",
     "nodejs22",
     "nodejs23",
+    "nodejs24",
+    "nodejs25",
+    "nodejs26",
     "node",
     "node8",
     "node10",
@@ -349,11 +366,16 @@ export const PROJECT_TYPE_ALIASES = {
     "node20",
     "node22",
     "node23",
+    "node24",
+    "node25",
+    "node26",
     "js",
     "javascript",
     "typescript",
     "ts",
     "tsx",
+    "svelte",
+    "sveltekit",
     "yarn",
     "rush",
     "bun",
@@ -361,6 +383,7 @@ export const PROJECT_TYPE_ALIASES = {
   ],
   mcp: ["mcp"],
   "ai-skill": ["ai-skill", "skill", "skills"],
+  agentic: ["agentic", "agentic-cli", "ai-tools", "ai-cli"],
   py: [
     "py",
     "python",
@@ -372,6 +395,8 @@ export const PROJECT_TYPE_ALIASES = {
     "python311",
     "python312",
     "python313",
+    "python314",
+    "python315",
     "pixi",
     "pip",
     "poetry",
@@ -398,6 +423,8 @@ export const PROJECT_TYPE_ALIASES = {
     "dotnet7",
     "dotnet8",
     "dotnet9",
+    "dotnet10",
+    "dotnet11",
     "dotnet-framework",
     "dotnet-framework47",
     "dotnet-framework48",
@@ -417,8 +444,19 @@ export const PROJECT_TYPE_ALIASES = {
     "hmiproj",
   ],
   dart: ["dart", "flutter", "pub"],
-  haskell: ["haskell", "hackage", "cabal"],
+  haskell: ["haskell", "hackage", "cabal", "stack", "stackage"],
   elixir: ["elixir", "hex", "mix"],
+  erlang: ["erlang", "rebar", "rebar3"],
+  julia: ["julia"],
+  r: ["r", "cran", "renv"],
+  ocaml: ["ocaml", "opam", "dune"],
+  elm: ["elm"],
+  crystal: ["crystal", "shards"],
+  nim: ["nim", "nimble"],
+  lua: ["lua", "luarocks"],
+  perl: ["perl", "cpan", "carton", "cpanfile"],
+  spack: ["spack"],
+  terraform: ["terraform", "opentofu", "tf"],
   c: ["c", "cpp", "c++", "conan", "collider"],
   clojure: ["clojure", "edn", "clj", "leiningen"],
   github: ["github", "actions"],

package/lib/core/userAgent.js

@@ -0,0 +1,151 @@
+/**
+ * Outbound `user-agent` construction.
+ *
+ * Package registries police automated traffic through this header, and their
+ * requirements differ. GitHub rejects an absent one with a 403; crates.io
+ * rejects an absent one and additionally blocks a configurable list of exact
+ * strings and prefixes at the CDN edge; Packagist asks for a `mailto=` contact;
+ * PyPI asks for a value that uniquely identifies the consumer, with contact
+ * information; pub.dev documents a `name/version (+url)` shape. The default
+ * built here satisfies all of them at once.
+ *
+ * Two escape hatches exist for operators whose traffic a registry has taken
+ * issue with: `CDXGEN_USER_AGENT` replaces the header everywhere, and
+ * `CDXGEN_USER_AGENT_<REGISTRY>` replaces it for one destination.
+ */
+
+import { CDXGEN_VERSION } from "./state.js";
+
+/** Project home page offered as the contact URL in the default user-agent. */
+const CDXGEN_HOME_URL = "https://github.com/cdxgen/cdxgen";
+
+/**
+ * Contact address offered in the default user-agent. Packagist asks API
+ * consumers to include one so an operator can reach the project rather than
+ * block its traffic; crates.io and PyPI make the same recommendation.
+ * Overridable with CDXGEN_CONTACT_EMAIL.
+ */
+const CDXGEN_CONTACT_EMAIL = "cloud@appthreat.com";
+
+/**
+ * Registry keys and the hosts they cover, used to resolve the
+ * `CDXGEN_USER_AGENT_<REGISTRY>` override for a request. A host matches its
+ * entry exactly or as a subdomain of it.
+ */
+const REGISTRY_HOSTS = Object.freeze({
+  CRATES: ["crates.io", "static.crates.io", "index.crates.io"],
+  DOCKER: ["docker.io", "docker.com"],
+  ELM: ["package.elm-lang.org"],
+  GITHUB: ["github.com", "githubusercontent.com", "ghcr.io"],
+  GITLAB: ["gitlab.com"],
+  GOPROXY: ["proxy.golang.org", "sum.golang.org", "pkg.go.dev"],
+  HUGGINGFACE: ["huggingface.co"],
+  JSR: ["jsr.io"],
+  MAVEN: [
+    "repo1.maven.org",
+    "repo.maven.apache.org",
+    "search.maven.org",
+    "central.sonatype.com",
+    "oss.sonatype.org",
+  ],
+  NPM: ["registry.npmjs.org", "npmjs.org", "npmjs.com"],
+  NUGET: ["nuget.org"],
+  PACKAGIST: ["packagist.org"],
+  PUB: ["pub.dev"],
+  PYPI: ["pypi.org", "pythonhosted.org"],
+  RUBYGEMS: ["rubygems.org"],
+});
+
+/**
+ * Substrings that crates.io blocks at the edge, taken from the client
+ * libraries its middleware singles out. A user-agent containing one of these
+ * is refused with an empty-bodied 403, so an override carrying one would fail
+ * silently against that registry.
+ */
+const BLOCKED_SUBSTRINGS = Object.freeze([
+  "curl",
+  "python-requests",
+  "Go-http-client",
+]);
+
+/**
+ * The registry key covering a host, if any.
+ *
+ * @param {String} hostname Lower-case hostname of the request
+ * @returns {String|undefined} Registry key such as `CRATES`, or undefined
+ */
+export function registryKeyForHost(hostname) {
+  if (!hostname) {
+    return undefined;
+  }
+  const host = hostname.toLowerCase().replace(/\.$/, "");
+  for (const [key, hosts] of Object.entries(REGISTRY_HOSTS)) {
+    for (const candidate of hosts) {
+      if (host === candidate || host.endsWith(`.${candidate}`)) {
+        return key;
+      }
+    }
+  }
+  return undefined;
+}
+
+/**
+ * The default user-agent: `cdxgen/<version> (+<home url>; mailto=<address>)`.
+ * Setting CDXGEN_CONTACT_EMAIL substitutes a different address, which is what
+ * an operator running cdxgen at scale should do so that a registry contacts
+ * them rather than the project.
+ *
+ * The `@scope/name` npm spelling is deliberately avoided. crates.io blocks
+ * user-agents beginning `@CycloneDX/cdxgen` outright, and a leading `@` is
+ * unusual enough elsewhere to invite the same treatment.
+ *
+ * @returns {String} Default user-agent for outbound requests
+ */
+export function defaultUserAgent() {
+  const email =
+    (process.env.CDXGEN_CONTACT_EMAIL || "").trim() || CDXGEN_CONTACT_EMAIL;
+  return `cdxgen/${CDXGEN_VERSION} (+${CDXGEN_HOME_URL}; mailto=${email})`;
+}
+
+/**
+ * The user-agent to send to a host. A `CDXGEN_USER_AGENT_<REGISTRY>` override
+ * wins for the hosts of that registry, then the global `CDXGEN_USER_AGENT`,
+ * then the default. Blank overrides are ignored: several registries reject an
+ * empty header outright, so falling back is safer than honouring it.
+ *
+ * @param {String} [hostname] Hostname the request is bound for
+ * @returns {String} User-agent header value
+ */
+export function getUserAgent(hostname) {
+  const key = registryKeyForHost(hostname);
+  const perRegistry = key
+    ? (process.env[`CDXGEN_USER_AGENT_${key}`] || "").trim()
+    : "";
+  if (perRegistry) {
+    return perRegistry;
+  }
+  const global = (process.env.CDXGEN_USER_AGENT || "").trim();
+  return global || defaultUserAgent();
+}
+
+/**
+ * Whether a user-agent carries a substring that crates.io blocks. Useful for
+ * warning an operator whose override would be refused there.
+ *
+ * @param {String} userAgent User-agent value to test
+ * @returns {String|undefined} The offending substring, or undefined
+ */
+export function blockedUserAgentSubstring(userAgent) {
+  if (!userAgent) {
+    return undefined;
+  }
+  const lowered = userAgent.toLowerCase();
+  return BLOCKED_SUBSTRINGS.find((candidate) =>
+    lowered.includes(candidate.toLowerCase()),
+  );
+}
+
+/** Registry keys that `CDXGEN_USER_AGENT_<REGISTRY>` accepts. */
+export const USER_AGENT_REGISTRY_KEYS = Object.freeze(
+  Object.keys(REGISTRY_HOSTS),
+);