@cdxgen/cdxgen 13.1.0 → 13.3.0

package/lib/ecosystems/npmutils.js

@@ -2,8 +2,10 @@ import { existsSync, readFileSync } from "node:fs";
 import { join, resolve } from "node:path";
 
 import { build, Purl } from "@cdxgen/cdx-purl";
+import { clean } from "semver";
 
 import { safeExistsSync } from "../core/fs.js";
+import { parsePurlLoose } from "../inventory/purl.js";
 import { parseNpmrc, parseNpmrcFromEnv } from "../parsers/npmrc.js";
 
 const npmPackageHydrationFields = [
@@ -84,6 +86,89 @@ export function setNpmPeerProperty(pkg) {
   addComponentProperty(pkg, "cdx:npm:package:peer", "true");
 }
 
+/**
+ * Marks an npm component as imported only for its TypeScript types.
+ *
+ * @param {object} pkg Component object to annotate
+ * @returns {void}
+ */
+export function setNpmTypeOnlyProperty(pkg) {
+  addComponentProperty(pkg, "cdx:npm:package:type-only", "true");
+}
+
+/**
+ * Clean an npm version the way `npm publish` does before it records a release.
+ *
+ * Publishing a directory runs the manifest through `npm pkg fix`
+ * (`fixVersionField` in `@npmcli/package-json`, which calls `semver.clean` in
+ * loose mode) and then through libnpmpublish, which calls `semver.clean` again
+ * in strict mode and records the result as the packument version, the
+ * dist-tag, the `_id` and the tarball file name. Semver build metadata
+ * (`1.0.0+build.5`), a leading `v` or `=`, surrounding whitespace and leading
+ * zeros are dropped; a prerelease is kept.
+ *
+ * The `package.json` inside the published tarball keeps the original string,
+ * and so do the lockfiles npm, pnpm, yarn and bun write for a project, a
+ * workspace member or a git, file or link dependency. The cleaned form is the
+ * version the npm registry knows the package by.
+ *
+ * @param {string} version Version as a manifest or lockfile records it
+ * @returns {string|null} The cleaned version, or null when npm would reject `version` as invalid semver
+ */
+export function cleanNpmVersion(version) {
+  if (typeof version !== "string" || !version.trim()) {
+    return null;
+  }
+  const looseClean = clean(version, { loose: true });
+  if (!looseClean) {
+    return null;
+  }
+  return clean(looseClean);
+}
+
+/**
+ * Record the version npm would publish when it differs from the recorded one.
+ *
+ * Sets `cdx:npm:cleanedVersion` on an npm component whose version is valid
+ * semver but not in the form {@link cleanNpmVersion} produces, for example
+ * `1.0.0+build.5` (published as `1.0.0`). The component's `version` and `purl`
+ * keep the recorded string: that is what the manifest and lockfile say. A
+ * component whose version is already clean, or not semver at all (a git
+ * commit, a `file:` path), is left without the property, and a stale value from
+ * an earlier pass is replaced.
+ *
+ * @param {object} component Component or package object with `version` and `purl`
+ * @returns {object} The same component, for chaining
+ */
+export function setNpmCleanedVersionProperty(component) {
+  if (!component || typeof component !== "object") {
+    return component;
+  }
+  const purl = component.purl;
+  if (typeof purl !== "string" || !purl.startsWith("pkg:npm/")) {
+    return component;
+  }
+  const cleaned = cleanNpmVersion(component.version);
+  const wanted = cleaned && cleaned !== component.version ? cleaned : undefined;
+  const existing = component.properties?.filter(
+    (property) => property?.name === "cdx:npm:cleanedVersion",
+  );
+  if (
+    (!existing?.length && !wanted) ||
+    (existing?.length === 1 && existing[0].value === wanted)
+  ) {
+    return component;
+  }
+  const properties = (component.properties || []).filter(
+    (property) => property?.name !== "cdx:npm:cleanedVersion",
+  );
+  if (wanted) {
+    properties.push({ name: "cdx:npm:cleanedVersion", value: wanted });
+  }
+  component.properties = properties;
+  return component;
+}
+
 /**
  * Helper function to create a properly encoded workspace PURL
  *
@@ -130,14 +215,18 @@ export function findMatchingNpmWorkspace(workspacePackages, packageName) {
     return undefined;
   }
 
-  const expectedEncodedPurl = createNpmWorkspacePurl(packageName);
-  const simplePurl = `pkg:npm/${packageName}`;
-
-  return workspacePackages.find(
-    (workspacePackage) =>
-      workspacePackage.startsWith(expectedEncodedPurl) ||
-      workspacePackage.startsWith(simplePurl),
-  );
+  // Compare the parsed coordinates: a prefix match on the purl text would let
+  // `ws` match `wsmember`, and the reference may be escaped or decoded.
+  return workspacePackages.find((workspacePackage) => {
+    const parts = parsePurlLoose(workspacePackage);
+    if (parts?.type !== "npm") {
+      return false;
+    }
+    const fullName = parts.namespace
+      ? `${parts.namespace}/${parts.name}`
+      : parts.name;
+    return fullName === packageName;
+  });
 }
 
 /**
@@ -201,6 +290,12 @@ export function collectNpmManifestSources(node) {
     return manifestSources;
   }
   for (const edge of node.edgesIn) {
+    // Arborist adds a `workspace` edge from the root to every member, with an
+    // absolute `file:` spec it builds from the checkout path. No manifest
+    // declares it, and copying it would put the local path into the BOM.
+    if (edge?.workspace || edge?.type === "workspace") {
+      continue;
+    }
     const manifestSource = classifyNpmManifestSource(edge?.spec);
     if (!manifestSource) {
       continue;
@@ -520,7 +615,9 @@ export function parsePnpmGitLockKey(lockKey) {
  * @returns {Object<string, object>} Map of lookup key to git package reference.
  */
 export function buildPnpmGitPkgRefs(packages, snapshots, npmrcConfig = {}) {
-  const gitPkgRefs = {};
+  // A null prototype keeps inherited Object properties (such as `constructor`)
+  // from masquerading as lookup hits for keys that were never registered.
+  const gitPkgRefs = Object.create(null);
   const registerEntry = (lockKey, packageNode) => {
     const resolution = packageNode?.resolution;
     const parsed = parsePnpmGitLockKey(lockKey);
@@ -531,6 +628,10 @@ export function buildPnpmGitPkgRefs(packages, snapshots, npmrcConfig = {}) {
       return;
     }
     const { group, name, gitSpec, fullName, packageName } = parsed;
+    if (name === "__proto__" || packageName === "__proto__") {
+      // A crafted lock key cannot become a lookup entry under this name.
+      return;
+    }
     const version = packageNode?.version || resolution?.commit || "";
     const repo = resolution?.repo || "";
     const commit = resolution?.commit || "";

package/lib/ecosystems/parsers-crystal.js

@@ -0,0 +1,179 @@
+import { readFileSync } from "node:fs";
+
+import { parse as loadYaml } from "yaml";
+
+import { tryBuildPurl } from "../inventory/purl.js";
+
+/**
+ * Crystal parser for `shard.yml` and `shard.lock`.
+ *
+ * Shards resolves dependencies declared in `shard.yml` and records the
+ * resolved set in `shard.lock`, which pins each dependency's version and
+ * source repository. Both files are YAML and are read with the standard
+ * parser.
+ *
+ * No `crystal` purl type is registered, so shards are identified as generic
+ * packages carrying a `cdx:purl:proposedType=crystal` property, following
+ * the convention used for nix and zig. This keeps the BOM valid today and
+ * allows a mechanical migration if a type is registered upstream.
+ */
+
+/**
+ * Parse a Crystal project from `shard.yml` and optional `shard.lock`.
+ *
+ * @param {string} shardYmlFile Path to `shard.yml`
+ * @param {string} [shardLockFile] Path to `shard.lock`, if present
+ * @returns {{ pkgList: object[], dependencies: object[], parentComponent: object, rootInputs?: string[] }}
+ */
+export function parseShardsProject(shardYmlFile, shardLockFile) {
+  const manifest = readYamlFile(shardYmlFile);
+
+  const parentComponent = {};
+  if (typeof manifest?.name === "string" && manifest.name) {
+    parentComponent.type = "application";
+    parentComponent.name = manifest.name;
+    if (typeof manifest.version === "string" && manifest.version) {
+      parentComponent.version = manifest.version;
+    }
+    parentComponent.description =
+      typeof manifest.description === "string" && manifest.description
+        ? manifest.description
+        : `Crystal shard: ${manifest.name}`;
+    parentComponent.properties = [
+      { name: "internal:SrcFile", value: shardYmlFile },
+    ];
+    if (typeof manifest.crystal === "string" && manifest.crystal) {
+      parentComponent.properties.push({
+        name: "cdx:crystal:languageVersion",
+        value: manifest.crystal,
+      });
+    }
+  }
+
+  const declared =
+    manifest?.dependencies && typeof manifest.dependencies === "object"
+      ? Object.keys(manifest.dependencies)
+      : [];
+  const devDeclared =
+    manifest?.development_dependencies &&
+    typeof manifest.development_dependencies === "object"
+      ? Object.keys(manifest.development_dependencies)
+      : [];
+
+  let lock;
+  if (shardLockFile) {
+    lock = readYamlFile(shardLockFile);
+  }
+  const lockedShards =
+    lock?.shards && typeof lock.shards === "object" ? lock.shards : undefined;
+  if (!lockedShards) {
+    // Lockless fallback: emit declared dependencies without resolved versions.
+    const pkgList = [
+      ...declared.map((name) =>
+        crystalPackage(name, undefined, {
+          direct: true,
+          dev: false,
+          srcFile: shardYmlFile,
+        }),
+      ),
+      ...devDeclared.map((name) =>
+        crystalPackage(name, undefined, {
+          direct: true,
+          dev: true,
+          srcFile: shardYmlFile,
+        }),
+      ),
+    ];
+    return {
+      pkgList,
+      dependencies: [],
+      parentComponent,
+      rootInputs: pkgList.map((p) => p["bom-ref"]),
+    };
+  }
+
+  const directNames = new Set(declared);
+  const devNames = new Set(devDeclared);
+  const pkgList = [];
+  const refByName = new Map();
+  for (const [name, entry] of Object.entries(lockedShards)) {
+    const version =
+      typeof entry?.version === "string" && entry.version
+        ? entry.version
+        : undefined;
+    const pkg = crystalPackage(name, version, {
+      direct: directNames.has(name),
+      dev: devNames.has(name),
+      srcFile: shardLockFile,
+    });
+    pkgList.push(pkg);
+    refByName.set(name, pkg["bom-ref"]);
+  }
+
+  // shard.lock records no dependency graph between shards, so the root links
+  // to the declared set and every other shard stands on its own version pin.
+  const rootInputs = [...directNames, ...devNames]
+    .map((name) => refByName.get(name))
+    .filter(Boolean);
+  return { pkgList, dependencies: [], parentComponent, rootInputs };
+}
+
+/**
+ * Build a component-like package record for a Crystal shard.
+ *
+ * @param {string} name Shard name
+ * @param {string|undefined} version Resolved version, if known
+ * @param {object} opts Extra context (`direct`, `dev`, `srcFile`)
+ * @returns {object} Package record
+ */
+function crystalPackage(name, version, opts) {
+  const purl = tryBuildPurl({
+    type: "generic",
+    name,
+    version: version || undefined,
+  });
+  const properties = [
+    { name: "internal:SrcFile", value: opts.srcFile },
+    { name: "cdx:purl:proposedType", value: "crystal" },
+  ];
+  if (opts.direct) {
+    properties.push({
+      name: "cdx:crystal:dependency",
+      value: opts.dev ? "direct-dev" : "direct",
+    });
+  } else {
+    properties.push({ name: "cdx:crystal:dependency", value: "transitive" });
+  }
+  if (opts.dev) {
+    properties.push({ name: "cdx:crystal:scope", value: "development" });
+  }
+  const pkg = {
+    name,
+    ...(version ? { version } : {}),
+    type: "library",
+    scope: opts.dev ? "optional" : "required",
+    properties,
+  };
+  if (purl) {
+    pkg.purl = purl;
+    pkg["bom-ref"] = decodeURIComponent(purl);
+  } else {
+    pkg["bom-ref"] = `library:${name}:${version || ""}`;
+  }
+  return pkg;
+}
+
+/**
+ * Read and parse a YAML file, warning instead of throwing.
+ *
+ * @param {string} filePath File to read
+ * @returns {object|undefined} Parsed value
+ */
+function readYamlFile(filePath) {
+  try {
+    return loadYaml(readFileSync(filePath, "utf-8"));
+  } catch (error) {
+    console.warn(`Failed to parse ${filePath}: ${error.message}`);
+    return undefined;
+  }
+}

package/lib/ecosystems/parsers-dotnet.js

@@ -13,6 +13,34 @@ import { findLicenseId } from "../inventory/spdx.js";
 import { xml2js } from "../parsers/xml.js";
 import { extractPackageInfoFromHintPath } from "./dotnetutils.js";
 
+/**
+ * Apply a version to a NuGet component so that the `version` field and the purl
+ * always agree.
+ *
+ * A .NET manifest can state a version that is not a version: an MSBuild property
+ * such as `$(JsonVersion)`, a range such as `[3.13.3,4.0)`, a wildcard such as
+ * `2.0.*`, or nothing at all. Such a declaration cannot go into a purl, so a
+ * component that kept it in `version` while its purl carried none described one
+ * package two ways. A scanner range matching on the versionless purl then reports
+ * every advisory published against the package name.
+ *
+ * The declaration is not lost: callers record it as `cdx:nuget:declared_version_range`.
+ *
+ * @param {Object} pkg Component to update in place. `name` must already be set.
+ * @param {String} [version] Version as stated or resolved, concrete or not
+ *
+ * @returns {Object} The same component
+ */
+export function applyNugetVersion(pkg, version) {
+  const concrete = concreteVersion(version);
+  if (concrete) {
+    pkg.version = concrete;
+  } else {
+    delete pkg.version;
+  }
+  return applyPurl(pkg, nugetPurl(pkg.name, concrete));
+}
+
 /**
  * Method to parse .nupkg files
  *
@@ -140,16 +168,22 @@ export function parseNuspecData(nupkgFile, nuspecData) {
             continue;
           }
           groupPkg.name = agroupdep.id;
+          let declaredRange;
           if (agroupdep?.version) {
             let versionStr = agroupdep.version;
             // version could have square brackets around them
             if (versionStr.startsWith("[") && versionStr.endsWith("]")) {
               versionStr = versionStr.replace(/[\[\]]/g, "");
             }
-            groupPkg.version = versionStr;
-            applyPurl(groupPkg, nugetPurl(groupPkg.name, versionStr));
+            // A nuspec dependency states the range the package accepts, not the
+            // version installed. Anything that is not a single version stays a
+            // declaration so the component and its purl agree - #4359.
+            if (!concreteVersion(versionStr)) {
+              declaredRange = agroupdep.version;
+            }
+            applyNugetVersion(groupPkg, versionStr);
           } else {
-            applyPurl(groupPkg, nugetPurl(groupPkg.name));
+            applyNugetVersion(groupPkg);
           }
           groupPkg.scope = "optional";
           groupPkg.properties = [
@@ -158,6 +192,12 @@ export function parseNuspecData(nupkgFile, nuspecData) {
               value: nupkgFile,
             },
           ];
+          if (declaredRange) {
+            groupPkg.properties.push({
+              name: "cdx:nuget:declared_version_range",
+              value: declaredRange,
+            });
+          }
           if (targetFramework) {
             groupPkg.properties.push({
               name: "cdx:dotnet:target_framework",
@@ -243,20 +283,15 @@ export function parseCsPkgData(pkgData, pkgFile, pkgNameVersions = {}) {
     // so the declaration stays visible, and the version is resolved from a
     // more precise manifest so the purl names the package that is present.
     let declaredRange;
-    if (!pkg.version || pkg.version.includes("$(")) {
+    if (!concreteVersion(pkg.version)) {
       confidence = 0.5;
+      declaredRange = pkg.version;
       // Backfill from a version already resolved by a more precise manifest.
       // Concrete versions are never overridden - a disagreement means both
       // versions must be tracked.
-      pkg.version = pkgNameVersions[pkg.name] || undefined;
-    } else if (/[[\](),*]/.test(pkg.version)) {
-      confidence = 0.5;
-      if (pkgNameVersions[pkg.name]) {
-        declaredRange = pkg.version;
-        pkg.version = pkgNameVersions[pkg.name];
-      }
+      pkg.version = pkgNameVersions[pkg.name];
     }
-    applyPurl(pkg, nugetPurl(pkg.name, pkg.version));
+    applyNugetVersion(pkg, pkg.version);
     if (pkgFile) {
       pkg.properties = [
         {
@@ -431,6 +466,21 @@ export function getPropertyGroupTextNodes(propsFiles) {
   return matches;
 }
 
+/**
+ * Read the trimmed text of an MSBuild property from a parsed PropertyGroup.
+ *
+ * @param {Object} propertyGroup PropertyGroup parsed by xml2js in compact mode
+ * @param {string} key Property name
+ * @returns {string|undefined} The text, or undefined when absent or empty
+ */
+function propertyGroupText(propertyGroup, key) {
+  const text = propertyGroup?.[key]?.[0]?._?.[0];
+  if (typeof text !== "string" || !text.trim().length) {
+    return undefined;
+  }
+  return text.trim();
+}
+
 /**
  * Method to parse .csproj like xml files
  *
@@ -479,6 +529,35 @@ export function parseCsProjData(
     return pkgList;
   }
   const project = projects[0];
+  // SDK-style projects declare their version through the MSBuild properties
+  // that `dotnet pack` reads: PackageVersion, which defaults to Version, which
+  // in turn defaults to VersionPrefix plus an optional `-VersionSuffix`. A
+  // property may be set in any PropertyGroup, so they are collected first.
+  const sdkVersionProps = {};
+  for (const apg of project?.PropertyGroup || []) {
+    for (const key of [
+      "PackageVersion",
+      "Version",
+      "VersionPrefix",
+      "VersionSuffix",
+    ]) {
+      const value = propertyGroupText(apg, key);
+      if (value !== undefined) {
+        sdkVersionProps[key] = value;
+      }
+    }
+  }
+  let sdkVersion =
+    sdkVersionProps.PackageVersion ||
+    sdkVersionProps.Version ||
+    (sdkVersionProps.VersionPrefix
+      ? `${sdkVersionProps.VersionPrefix}${sdkVersionProps.VersionSuffix ? `-${sdkVersionProps.VersionSuffix}` : ""}`
+      : undefined);
+  // An MSBuild property reference such as $(BuildNumber) is only known at
+  // build time, so a version that still contains one is not reported.
+  if (sdkVersion?.includes("$(")) {
+    sdkVersion = undefined;
+  }
   // First make up a parentcomponent name based on the .csproj file name
   if (projFile) {
     parentComponent.name = basename(projFile).replaceAll(
@@ -536,10 +615,6 @@ export function parseCsProjData(
         if (outputType === "Library") {
           parentComponent.type = "library";
         }
-        applyPurl(
-          parentComponent,
-          nugetPurl(parentComponent.name, parentComponent.version || "latest"),
-        );
         // The MSBuild OutputType (Exe, WinExe, …) used to ride along as an
         // `output_type` purl qualifier, which nuget does not define — every such
         // purl was invalid. It is project metadata, so it belongs in properties.
@@ -712,23 +787,17 @@ export function parseCsProjData(
           const exactPin = pkg.version.match(/^\[([^,[\]()]+)\]$/);
           if (exactPin) {
             pkg.version = exactPin[1];
-          } else if (
-            pkg.version.includes("$(") ||
-            /[*[\](),]/.test(pkg.version)
-          ) {
-            const resolved =
+          } else if (!concreteVersion(pkg.version)) {
+            declaredRange = pkg.version;
+            pkg.version =
               pkgNameVersions[pkg.name] ||
               centralVersions[pkg.name.toLowerCase()];
-            if (resolved) {
-              declaredRange = pkg.version;
-              pkg.version = resolved;
-            }
           }
         }
         // A version that could not be resolved from any source must not be
         // stringified into the purl - `@undefined` is not a version and makes the
         // component unmatchable. Mirrors parseCsPkgData.
-        applyPurl(pkg, nugetPurl(pkg.name, pkg.version));
+        applyNugetVersion(pkg, pkg.version);
         if (projFile) {
           pkg.properties = [
             {
@@ -821,26 +890,27 @@ export function parseCsProjData(
           });
         }
         const version = hintVersion ?? assemblyVersion;
-        if (version) {
-          pkg.version = version;
-          applyPurl(pkg, nugetPurl(pkg.name, version));
-        } else {
-          applyPurl(pkg, nugetPurl(pkg.name));
-          if (
-            pkg.name.startsWith("System.") ||
+        // An assembly reference that states no version anywhere - no HintPath to
+        // read one from and no `Version=` on the Include - leaves the component
+        // versionless in both fields. The registry's latest release is not a
+        // stand-in: `<Reference>` resolves an assembly from a targeting pack, a
+        // lib folder or the GAC, and the project does not say which package it
+        // came from. See #4359.
+        applyNugetVersion(pkg, version);
+        if (
+          !pkg.version &&
+          (pkg.name.startsWith("System.") ||
             pkg.name.startsWith("Mono.") ||
-            pkg.name.startsWith("Microsoft.")
-          ) {
-            // If this is a System package, then track the target frameworks
-            for (const tf of projectTargetFrameworks) {
-              pkg.properties.push({
-                name: "cdx:dotnet:target_framework",
-                value: tf,
-              });
-            }
+            pkg.name.startsWith("Microsoft."))
+        ) {
+          // If this is a System package, then track the target frameworks
+          for (const tf of projectTargetFrameworks) {
+            pkg.properties.push({
+              name: "cdx:dotnet:target_framework",
+              value: tf,
+            });
           }
         }
-        pkg["bom-ref"] = pkg.purl;
         if (assemblyName) {
           pkg.properties.push({
             name: "cdx:dotnet:assembly_name",
@@ -894,21 +964,22 @@ export function parseCsProjData(
       }
     }
   }
-  // If the parent still lacks a purl, add one based on the name and version
-  if (parentComponent && !parentComponent.purl && parentComponent.name) {
+  if (sdkVersion) {
+    parentComponent.version = sdkVersion;
+  }
+  // The purl is built once every PropertyGroup has been read, so a version
+  // declared after OutputType is not lost.
+  if (parentComponent.name) {
     applyPurl(
       parentComponent,
       nugetPurl(parentComponent.name, parentComponent.version || "latest"),
     );
   }
-  if (parentComponent?.purl) {
-    parentComponent["bom-ref"] = parentComponent.purl;
-  }
   let dependencies = [];
   if (parentComponent?.["bom-ref"]) {
     dependencies = [
       {
-        ref: parentComponent.purl,
+        ref: parentComponent["bom-ref"],
         dependsOn: [...new Set(pkgList.map((p) => p["bom-ref"]))].sort(),
       },
     ];