@cdxgen/cdxgen 13.1.0 → 13.3.0

package/lib/ecosystems/parsers-gleam.js

@@ -1,6 +1,6 @@
 import { readFileSync } from "node:fs";
 
-import toml from "@iarna/toml";
+import * as toml from "smol-toml";
 
 import { tryBuildPurl } from "../inventory/purl.js";
 

package/lib/ecosystems/parsers-go.js

@@ -7,7 +7,12 @@ import { Purl } from "@cdxgen/cdx-purl";
 import { DEBUG_MODE } from "../core/activity.js";
 import { shouldFetchLicense, shouldFetchVCS } from "../core/env.js";
 import { safeExistsSync } from "../core/fs.js";
-import { applyPurl, tryBuildPurl, tryParsePurl } from "../inventory/purl.js";
+import {
+  applyPurl,
+  canonicalPurlFromLooseString,
+  tryBuildPurl,
+  tryParsePurl,
+} from "../inventory/purl.js";
 import {
   _clearMetadataCache,
   getGoPkgLicense,
@@ -443,6 +448,23 @@ function _addGoComponentEvidence(component, goModFile, confidence = 0.8) {
   return component;
 }
 
+/**
+ * Build the purl of one `module@version` token from `go mod graph` output.
+ *
+ * The version is written the way Go prints it, so `+incompatible` and the build
+ * metadata of a pseudo-version are unescaped. Reading the token strictly would
+ * reject it and leave a reference that keeps the module path's upper-case
+ * letters, which then never matches the lower-cased component and drops the
+ * dependency edge.
+ *
+ * @param {string} token Module path, optionally followed by `@version`
+ * @returns {Purl|null} Parsed purl, or null when the token forms no valid golang purl
+ */
+function goModGraphTokenPurl(token) {
+  const canonical = canonicalPurlFromLooseString(`pkg:golang/${token}`);
+  return canonical ? Purl.parse(canonical) : null;
+}
+
 /**
  * Parse go mod graph
  *
@@ -512,22 +534,20 @@ export async function parseGoModGraph(
           // cdx-purl requires a namespace. Use the raw ref when parsing fails.
           let sourceRefString;
           let sourceName = tmpA[0].split("@")[0];
-          let sourcePurl = null;
-          try {
-            sourcePurl = Purl.parse(`pkg:golang/${tmpA[0]}`);
+          const sourcePurl = goModGraphTokenPurl(tmpA[0]);
+          if (sourcePurl) {
             sourceRefString = decodeURIComponent(sourcePurl.toString());
             sourceName = `${sourcePurl.namespace ? `${sourcePurl.namespace}/` : ""}${sourcePurl.name}`;
-          } catch {
+          } else {
             sourceRefString = `pkg:golang/${tmpA[0]}`;
           }
           let dependsRefString;
           let dependsName = tmpA[1].split("@")[0];
-          let dependsPurl = null;
-          try {
-            dependsPurl = Purl.parse(`pkg:golang/${tmpA[1]}`);
+          const dependsPurl = goModGraphTokenPurl(tmpA[1]);
+          if (dependsPurl) {
             dependsRefString = decodeURIComponent(dependsPurl.toString());
             dependsName = `${dependsPurl.namespace ? `${dependsPurl.namespace}/` : ""}${dependsPurl.name}`;
-          } catch {
+          } else {
             dependsRefString = `pkg:golang/${tmpA[1]}`;
           }
           // Since go mod graph over-reports direct dependencies we use the existing list
@@ -683,6 +703,24 @@ export function parseGoModWhy(rawOutput) {
   return undefined;
 }
 
+/**
+ * Reports whether `go mod why -m` output says the main module does not need
+ * the module. go prints `(main module does not need module X)`, or
+ * `(main module does not need to vendor module X)` with `-vendor`, and exits
+ * with status 0 either way.
+ *
+ * @param {string} rawOutput Output from go mod why
+ * @returns {boolean} True when go reports the module as not needed
+ */
+export function isGoModWhyNotNeeded(rawOutput) {
+  if (typeof rawOutput !== "string") {
+    return false;
+  }
+  return rawOutput
+    .split("\n")
+    .some((line) => line.trim().startsWith("(main module does not need "));
+}
+
 /**
  * Parse go sum data
  * @param {string} gosumData Content of go.sum

package/lib/ecosystems/parsers-js.js

@@ -18,7 +18,7 @@ import { recordDegradation } from "../core/buildLedger.js";
 import { shouldFetchPackageMetadata } from "../core/env.js";
 import { safeExistsSync } from "../core/fs.js";
 import { analyzeSuspiciousJsFile } from "../inventory/analyzer.js";
-import { encodeForPurl, npmPurl } from "../inventory/purl.js";
+import { npmPurl, parsePurlLoose } from "../inventory/purl.js";
 import Arborist from "../third-party/arborist/lib/index.js";
 import { getNpmMetadata } from "./ecosystems.js";
 import {
@@ -914,11 +914,16 @@ export async function parsePkgLock(pkgLockFile, options = {}) {
       // A package.json need not declare a version, and npm installs without
       // one, so the root of a lockfile can reach here with none. A purl carries
       // no version rather than an empty one.
-      purlString = Purl.parse(
-        `pkg:npm/${projectGroup ? `${encodeURIComponent(projectGroup).replace(/%2F/g, "/")}/` : ""}${encodeURIComponent(projectName).replace(/%2F/g, "/")}${projectVersion ? `@${projectVersion}` : ""}`,
-      )
-        .toString()
-        .replace(/%2F/g, "/");
+      purlString = (
+        projectGroup
+          ? build({
+              type: "npm",
+              namespace: projectGroup,
+              name: projectName,
+              version: projectVersion || null,
+            })
+          : npmPurl(projectName, projectVersion)
+      ).replace(/%2F/g, "/");
       pkg = {
         author: authorString,
         group: options.projectGroup || "",
@@ -1778,17 +1783,15 @@ function _resolveYarnDependencyBomRef(
       packageNameToUse,
     );
     if (matchingWorkspace) {
-      const versionMatch = matchingWorkspace.match(/@([^@]+)$/);
-      if (versionMatch) {
-        resolvedVersion = versionMatch[1];
-      }
+      // The workspace reference may be an escaped purl, so its version is read
+      // through the purl parser rather than cut out of the string.
+      resolvedVersion =
+        parsePurlLoose(matchingWorkspace)?.version || resolvedVersion;
     }
   }
-  let purlPart = `pkg:npm/${encodeURIComponent(packageNameToUse).replace(/%2F/g, "/")}`;
-  if (resolvedVersion?.length) {
-    purlPart = `${purlPart}@${resolvedVersion}`;
-  }
-  return decodeURIComponent(Purl.parse(purlPart).toString());
+  return decodeURIComponent(
+    npmPurl(packageNameToUse, resolvedVersion?.length ? resolvedVersion : null),
+  );
 }
 
 function _collectYarnRootDependencyRefs(
@@ -1919,7 +1922,7 @@ function _markYarnDependencyScopeClosures(
  * @param {Object} parentComponent parent component
  * @param {Array[String]} workspacePackages Workspace packages
  * @param {Object} workspaceSrcFiles Workspace package.json files
- * @param {Object} _workspaceDirectDeps Direct dependencies of each workspace
+ * @param {Object} workspaceDirectDeps Declared dependencies (name to range) of each workspace package
  * @param {Object} depsWorkspaceRefs Workspace references for each dependency
  */
 export async function parseYarnLock(
@@ -1927,12 +1930,14 @@ export async function parseYarnLock(
   parentComponent = null,
   workspacePackages = [],
   workspaceSrcFiles = {},
-  _workspaceDirectDeps = {},
+  workspaceDirectDeps = {},
   depsWorkspaceRefs = {},
 ) {
   let pkgList = [];
   const dependenciesList = [];
   const depKeys = {};
+  // The lock keys and the resolved version required to solve the dependency tree
+  let identMap = {};
   let yarnRootRefs = _createYarnRootDependencyRefs();
   const yarnOptionalDependencyRefs = new Set();
   const npmrcConfig = loadNpmrcConfig(dirname(yarnLockFile));
@@ -1951,8 +1956,7 @@ export async function parseYarnLock(
     const pkgAddedMap = {};
     // Map to track workspace package PURL replacements from 0.0.0-use.local to actual versions
     const workspacePurlMap = {};
-    // This would have the keys and the resolved version required to solve the dependency tree
-    const identMap = yarnLockToIdentMap(lockData);
+    identMap = yarnLockToIdentMap(lockData);
     yarnRootRefs = _collectYarnRootDependencyRefs(
       yarnLockFile,
       identMap,
@@ -2020,8 +2024,8 @@ export async function parseYarnLock(
               const actualWorkspacePurl = workspacePackages.find(
                 (wp) =>
                   wp.startsWith(expectedPurlStart) ||
-                  wp.includes(
-                    `pkg:npm/${encodeForPurl(group ? `${group}/${name}` : name)}@`,
+                  wp.startsWith(
+                    `${npmPurl(group ? `${group}/${name}` : name)}@`,
                   ),
               );
               // Also check if this package already exists in pkgList with a real version
@@ -2286,23 +2290,21 @@ export async function parseYarnLock(
           if (DEBUG_MODE) {
             console.log(`Processing workspace package: "${workspacePkg}"`);
           }
-          let purlObj;
-          // For workspace packages that already have versions in the PURL format
-          if (
-            workspacePkg.includes("@") &&
-            workspacePkg.lastIndexOf("@") > workspacePkg.indexOf("/")
-          ) {
-            // This is a scoped package with version like "npm:@swc/helpers@0.4.14"
-            const lastAtIndex = workspacePkg.lastIndexOf("@");
-            const purlWithoutVersion = workspacePkg.substring(0, lastAtIndex);
-            const version = workspacePkg.substring(lastAtIndex + 1);
-            // Parse the PURL without version first, then set the version.
-            purlObj = Purl.parse(purlWithoutVersion);
-            purlObj.version = version;
-          } else {
-            // Parse the PURL as-is (no version or simple package)
-            purlObj = Purl.parse(workspacePkg);
+          // Workspace references arrive both escaped (built by cdx-purl) and in
+          // the decoded bom-ref form, so they are split structurally and
+          // rebuilt. Copying the version text across forms is what turned
+          // `3.0.0+ws` into `3.0.0%252Bws`.
+          const workspaceParts = parsePurlLoose(workspacePkg);
+          if (!workspaceParts) {
+            continue;
           }
+          const purlObj = new Purl({
+            type: "npm",
+            namespace: workspaceParts.namespace,
+            name: workspaceParts.name,
+            version: workspaceParts.version,
+            subpath: workspaceParts.subpath,
+          });
 
           // Create the workspace component using the properly parsed PURL
           const workspaceComponent = {
@@ -2405,6 +2407,41 @@ export async function parseYarnLock(
         }
       }
     }
+    // A yarn v1 lock file has no entries for workspace packages, so a member
+    // would otherwise have no dependency entry and nothing would reach it.
+    // Each member gets one built from the dependencies its own package.json
+    // declares; the root's entry, built from every dependency entry, then
+    // includes the member too. A lock file that already recorded the member
+    // (yarn berry) keeps the entry it produced.
+    const recordedRefs = new Set(dependenciesList.map((d) => d.ref));
+    for (const workspacePkg of workspacePackages) {
+      const workspaceRef = decodeURIComponent(workspacePkg);
+      if (
+        recordedRefs.has(workspaceRef) ||
+        !pkgList.some((pkg) => pkg["bom-ref"] === workspaceRef)
+      ) {
+        continue;
+      }
+      const dependsOn = new Set();
+      for (const [depName, depRange] of Object.entries(
+        workspaceDirectDeps?.[workspacePkg] || {},
+      )) {
+        const depRef = _resolveYarnDependencyBomRef(
+          depName,
+          String(depRange),
+          identMap,
+          workspacePackages,
+        );
+        if (depRef && depRef !== workspaceRef) {
+          dependsOn.add(depRef);
+        }
+      }
+      dependenciesList.push({
+        ref: workspaceRef,
+        dependsOn: [...dependsOn].sort(),
+      });
+      recordedRefs.add(workspaceRef);
+    }
   }
 
   _markYarnDependencyScopeClosures(
@@ -2646,7 +2683,10 @@ export function stripPnpmPeerSuffix(version) {
  * {@link stripPnpmPeerSuffix}.
  *
  * @param {string|object} depPkg Dependency version string or package object.
- * @param {string} relativePath Base path for resolving link/file references.
+ * @param {string} relativePath Base path for resolving link/file references:
+ *   the directory of the importer that declares the dependency. Without it the
+ *   path is tried against the working directory, which only works when cdxgen
+ *   runs from the lock file's directory.
  * @returns {Promise<string|undefined>} The resolved published version.
  */
 export async function getVersionNumPnpm(depPkg, relativePath) {
@@ -2685,6 +2725,25 @@ export async function getVersionNumPnpm(depPkg, relativePath) {
   return version;
 }
 
+/**
+ * Split the package name of a pnpm `file:` lock key into scope and name.
+ *
+ * @param {string} fullName Package name as written before `@file:`, eg `@scope/pkg`
+ * @returns {{group: string, name: string}} Scope (with its `@`) and bare name
+ */
+function splitPnpmFilePackageName(fullName) {
+  if (fullName.startsWith("@")) {
+    const slash = fullName.indexOf("/");
+    if (slash > 0) {
+      return {
+        group: fullName.slice(0, slash),
+        name: fullName.slice(slash + 1),
+      };
+    }
+  }
+  return { group: "", name: fullName };
+}
+
 /**
  * Resolve a pnpm dependency to its PURL string.
  *
@@ -2723,11 +2782,16 @@ export async function getPnpmDepPurl(
     }
     gitPkgRefs[versionObj.version] = { group, name, version };
   } else {
+    const rawSpec =
+      typeof versionObj?.version === "string" ? versionObj.version : "";
     version = await getVersionNumPnpm(depPkg, relativePath);
     const gitEntry =
       gitPkgRefs[packageName] ||
       gitPkgRefs[version] ||
-      gitPkgRefs[normalizePnpmLockKey(`${packageName}@${version}`)];
+      gitPkgRefs[normalizePnpmLockKey(`${packageName}@${version}`)] ||
+      (rawSpec.startsWith("file:")
+        ? gitPkgRefs[normalizePnpmLockKey(`${packageName}@${rawSpec}`)]
+        : undefined);
     if (gitEntry) {
       group = gitEntry.group;
       name = gitEntry.name;
@@ -2980,7 +3044,8 @@ export async function pnpmMetadata(pkgList, lockFilePath) {
       // Silently ignore parsing errors for individual packages
       if (DEBUG_MODE) {
         console.log(
-          `Failed to parse package.json at ${packageJsonPath}:`,
+          "Failed to parse package.json at %s:",
+          packageJsonPath,
           error.message,
         );
       }
@@ -3148,6 +3213,33 @@ export async function parsePnpmLock(
         npmrcConfig,
       ),
     );
+    // A `file:` package is keyed by its path (`localdep@file:localdep.tgz`) and
+    // pnpm copies the manifest version into its `packages` entry. Registering
+    // it lets an importer that names the path resolve to the same ref the
+    // package loop below builds, instead of a version made from the path.
+    if (lockfileVersion >= 9) {
+      for (const [lockKey, pkgEntry] of Object.entries(
+        yamlObj.packages || {},
+      )) {
+        const fileAt = lockKey.indexOf("@file:", 1);
+        if (fileAt < 1 || !pkgEntry?.version) {
+          continue;
+        }
+        const normalizedKey = normalizePnpmLockKey(lockKey);
+        if (gitPkgRefs[normalizedKey]) {
+          continue;
+        }
+        const { group, name } = splitPnpmFilePackageName(
+          lockKey.slice(0, fileAt),
+        );
+        gitPkgRefs[normalizedKey] = {
+          group,
+          name,
+          version: String(pkgEntry.version),
+          vcsUrl: lockKey.slice(fileAt + 1),
+        };
+      }
+    }
     // This logic matches the pnpm list command to include only direct dependencies
     if (ppurl !== "" && yamlObj?.importers) {
       // In lock file version 6, direct dependencies is under importers
@@ -3184,7 +3276,7 @@ export async function parsePnpmLock(
           rootDevDeps[rdk],
           rdk,
           gitPkgRefs,
-          undefined,
+          pnpmLockDir,
           githubServerHost,
           npmrcConfig,
         );
@@ -3206,7 +3298,7 @@ export async function parsePnpmLock(
           rootOptionalDeps[rdk] || rootPeerDeps[rdk],
           rdk,
           gitPkgRefs,
-          undefined,
+          pnpmLockDir,
           githubServerHost,
           npmrcConfig,
         );
@@ -3229,7 +3321,7 @@ export async function parsePnpmLock(
           rootDirectDeps[dk],
           dk,
           gitPkgRefs,
-          undefined,
+          pnpmLockDir,
           githubServerHost,
           npmrcConfig,
         );
@@ -3340,7 +3432,7 @@ export async function parsePnpmLock(
             versionObj,
             cdk,
             gitPkgRefs,
-            importedComponentName,
+            join(pnpmLockDir, importedComponentName),
             githubServerHost,
             npmrcConfig,
           );
@@ -3357,7 +3449,10 @@ export async function parsePnpmLock(
           }
         }
         for (const cdk of Object.keys(componentDevDeps)) {
-          const version = await getVersionNumPnpm(componentDevDeps[cdk]);
+          const version = await getVersionNumPnpm(
+            componentDevDeps[cdk],
+            join(pnpmLockDir, importedComponentName),
+          );
           const dpurl = build({
             type: "npm",
             namespace: "" || null,
@@ -3375,6 +3470,7 @@ export async function parsePnpmLock(
         })) {
           const version = await getVersionNumPnpm(
             componentOptionalDeps[cdk] || componentPeerDeps[cdk],
+            join(pnpmLockDir, importedComponentName),
           );
           const dpurl = build({
             type: "npm",
@@ -3399,6 +3495,11 @@ export async function parsePnpmLock(
     // snapshots is a new key under lockfile version 9
     const snapshots = yamlObj.snapshots || {};
     const pkgKeys = { ...Object.keys(packages), ...Object.keys(snapshots) };
+    // A lock entry named `__proto__` is not a real package: emitting it as a
+    // component produces SBOM data that breaks naive JSON consumers, and the
+    // name can never come from the npm registry. Legitimate names such as
+    // `constructor` or `prototype` are unaffected.
+    const protoLockKey = /(^|\/)__proto__(@|$)/;
     for (const k in pkgKeys) {
       // Eg: @babel/code-frame/7.10.1
       // In lockfileVersion 6, /@babel/code-frame@7.18.6
@@ -3407,6 +3508,9 @@ export async function parsePnpmLock(
       if (lockfileVersion >= 6 && fullName.includes("(")) {
         fullName = fullName.split("(")[0];
       }
+      if (protoLockKey.test(pkgKeys[k]) || protoLockKey.test(fullName)) {
+        continue;
+      }
       const parts = fullName.split("/");
       const packageNode =
         packages[pkgKeys[k]] ||
@@ -3465,9 +3569,17 @@ export async function parsePnpmLock(
         }
         let opurlString;
         if (vers.includes("@")) {
-          opurlString = Purl.parse(
-            `pkg:npm/${vers.replace(/^@/g, "%40")}`,
-          ).toString();
+          // An aliased optional dependency records `name@version`, and the
+          // version may carry semver build metadata that must be escaped.
+          const aliasParts = parsePurlLoose(`pkg:npm/${vers}`);
+          opurlString = aliasParts
+            ? npmPurl(
+                aliasParts.namespace
+                  ? `${aliasParts.namespace}/${aliasParts.name}`
+                  : aliasParts.name,
+                aliasParts.version,
+              )
+            : npmPurl(opkgName, vers);
         } else {
           opurlString = npmPurl(opkgName, vers);
         }
@@ -3536,8 +3648,17 @@ export async function parsePnpmLock(
             possibleHttpParts[possibleHttpParts.length - 1].startsWith("file")
           ) {
             srcUrl = possibleHttpParts[possibleHttpParts.length - 1];
-            name = fullName.replace(`@${srcUrl}`, "");
-            version = "";
+            ({ group, name } = splitPnpmFilePackageName(
+              fullName.replace(`@${srcUrl}`, ""),
+            ));
+            // The key names the path, not a version. pnpm copies the version
+            // from the package's own manifest into its `packages` entry, and
+            // that may carry semver build metadata (`2.0.0+local`).
+            version = String(
+              packages[pkgKeys[k]]?.version ||
+                packages[fullName]?.version ||
+                "",
+            );
           } else {
             group = parts.length > 1 ? parts[0] : "";
             const tmpA = parts[parts.length - 1].split("@");