@cdxgen/cdxgen 13.1.0 → 13.3.0

package/lib/ecosystems/parsers-python.js

@@ -4,7 +4,7 @@ import process from "node:process";
 import { URL } from "node:url";
 
 import { build } from "@cdxgen/cdx-purl";
-import toml from "@iarna/toml";
+import * as toml from "smol-toml";
 import { parse as _load } from "yaml";
 
 import { DEBUG_MODE } from "../core/activity.js";
@@ -105,7 +105,9 @@ export async function parsePiplockData(lockData) {
       Object.keys(depBlock).forEach((p) => {
         const pkg = depBlock[p];
         if (Object.hasOwn(pkg, "version")) {
-          const versionStr = pkg.version.replace("==", "");
+          // `===` (arbitrary equality) pins as tightly as `==`, so both are
+          // stripped whole rather than leaving a stray `=` behind.
+          const versionStr = pkg.version.replace(/^\s*={2,3}\s*/, "");
           pkgList.push({ name: p, version: versionStr });
         }
       });
@@ -1427,6 +1429,16 @@ export async function parsePyLockData(lockData, lockFile, pyProjectFile) {
   };
 }
 
+/**
+ * First version clause of a PEP 508 requirement: an operator and the version
+ * that follows it.
+ *
+ * `===` (arbitrary equality) is tried before `==`, whitespace may separate the
+ * operator from the version, and a version may carry a PEP 440 epoch (`1!2.0`)
+ * or a local version label (`2.1.0+cpu`).
+ */
+const PEP440_VERSION_CLAUSE = /(===|==|!=|<=|>=|~=|<|>)\s*([0-9A-Za-z.*_+!-]*)/;
+
 /**
  * Method to parse requirements.txt file. This must be replaced with atom parsedeps.
  *
@@ -1513,10 +1525,13 @@ async function parseReqData(reqFile, reqData = null, fetchDepsInfo = false) {
       continue;
     }
     let comment = null;
-    const commentMatch = l.match(/\s+#(.*)$/);
-    if (commentMatch) {
-      comment = commentMatch[1].trim();
-      l = l.substring(0, commentMatch.index).trim();
+    // Equivalent to /\s+#(.*)$/ but linear: an unanchored `\s+` backtracks
+    // quadratically on long whitespace runs without a '#', which a crafted
+    // requirements.txt used to burn seconds of CPU per line.
+    const hashIndex = l.indexOf("#");
+    if (hashIndex > 0 && /\s/.test(l[hashIndex - 1])) {
+      comment = l.substring(hashIndex + 1).trim();
+      l = l.substring(0, hashIndex).trim();
     }
     const properties = reqFile
       ? [
@@ -1607,9 +1622,7 @@ async function parseReqData(reqFile, reqData = null, fetchDepsInfo = false) {
       if (PYTHON_STD_MODULES.includes(name)) {
         continue;
       }
-      const versionMatch = versionSpecifiers.match(
-        /(==|!=|<=|>=|<|>|~=)([0-9.a-zA-Z_*\-+]*)/,
-      );
+      const versionMatch = versionSpecifiers.match(PEP440_VERSION_CLAUSE);
       let version = null;
       if (versionMatch) {
         version = versionMatch[2].replaceAll("*", "0") || null;
@@ -1636,7 +1649,7 @@ async function parseReqData(reqFile, reqData = null, fetchDepsInfo = false) {
           value: extras.join(","),
         });
       }
-      if (versionSpecifiers && !versionSpecifiers.startsWith("==")) {
+      if (versionSpecifiers && !versionSpecifiers.trim().startsWith("==")) {
         properties.push({
           name: "cdx:pypi:versionSpecifiers",
           value: versionSpecifiers.trim(),
@@ -1673,9 +1686,7 @@ async function parseReqData(reqFile, reqData = null, fetchDepsInfo = false) {
       if (PYTHON_STD_MODULES.includes(name)) {
         continue;
       }
-      const versionMatch = versionSpecifiers.match(
-        /(==|!=|<=|>=|<|>|~=)([0-9.a-zA-Z_*\-+]*)/,
-      );
+      const versionMatch = versionSpecifiers.match(PEP440_VERSION_CLAUSE);
       let version = null;
       if (versionMatch) {
         version = versionMatch[2].replaceAll("*", "0") || null;
@@ -1691,7 +1702,7 @@ async function parseReqData(reqFile, reqData = null, fetchDepsInfo = false) {
       if (licenses) {
         apkg.licenses = licenses;
       }
-      if (versionSpecifiers && !versionSpecifiers.startsWith("==")) {
+      if (versionSpecifiers && !versionSpecifiers.trim().startsWith("==")) {
         properties.push({
           name: "cdx:pypi:versionSpecifiers",
           value: versionSpecifiers.trim(),
@@ -2201,6 +2212,7 @@ function normaliseMojoVersion(spec) {
   const trimmed = spec.trim();
   if (!trimmed) return undefined;
   // Strip common comparison operators and take the first concrete version.
-  const match = trimmed.match(/(\d+(?:\.\d+)*(?:[+-][A-Za-z0-9.]+)?)/);
+  // A PEP 440 epoch (`1!2.0`) is part of the version, not a separator.
+  const match = trimmed.match(/((?:\d+!)?\d+(?:\.\d+)*(?:[+-][A-Za-z0-9.]+)?)/);
   return match ? match[1] : undefined;
 }

package/lib/ecosystems/parsers-r.js

@@ -0,0 +1,148 @@
+import { readFileSync } from "node:fs";
+
+import { tryBuildPurl } from "../inventory/purl.js";
+
+/**
+ * R project parser for renv lock files.
+ *
+ * `renv.lock` records the R version, the repositories packages were resolved
+ * from, and every package in the project library with its exact version, an
+ * integrity hash, and the names of the packages it requires. The lock is a
+ * JSON document, which makes it a reliable offline source of both the
+ * resolved dependency set and the graph between packages.
+ *
+ * Packages are identified with the registered `cran` purl type
+ * (`pkg:cran/<Package>@<Version>`). Requirement strings may carry version
+ * constraints (`"R (>= 3.6)"`); only the leading package name is used, and
+ * the R runtime itself is recorded as the parent's version rather than an
+ * edge.
+ */
+
+/**
+ * Parse an `renv.lock` file.
+ *
+ * @param {string} renvLockFile Path to `renv.lock`
+ * @returns {{
+ *   pkgList: object[],
+ *   dependencies: object[],
+ *   rootInputs: string[],
+ *   parentComponent: object,
+ *   rVersion: string|undefined
+ * }}
+ */
+export function parseRenvLock(renvLockFile) {
+  let lock;
+  try {
+    lock = JSON.parse(readFileSync(renvLockFile, "utf-8"));
+  } catch (error) {
+    console.warn(`Failed to parse ${renvLockFile}: ${error.message}`);
+    return emptyResult();
+  }
+  if (!lock || typeof lock !== "object" || !lock.Packages) {
+    return emptyResult();
+  }
+
+  const rVersion =
+    typeof lock.R?.Version === "string" && lock.R.Version
+      ? lock.R.Version
+      : undefined;
+
+  const pkgList = [];
+  const refByName = new Map();
+  for (const record of Object.values(lock.Packages)) {
+    if (!record?.Package || !record?.Version) {
+      continue;
+    }
+    const purl = tryBuildPurl({
+      type: "cran",
+      name: record.Package,
+      version: record.Version,
+    });
+    const properties = [{ name: "internal:SrcFile", value: renvLockFile }];
+    if (typeof record.Source === "string" && record.Source) {
+      properties.push({
+        name: "cdx:renv:source",
+        // Normalised to a category so repository flavours stay comparable.
+        value: record.Source.toLowerCase(),
+      });
+    }
+    if (typeof record.Repository === "string" && record.Repository) {
+      properties.push({
+        name: "cdx:renv:repository",
+        value: record.Repository,
+      });
+    }
+    if (typeof record.Hash === "string" && record.Hash) {
+      // The renv hash covers the package DESCRIPTION, not the artifact bytes,
+      // so it belongs in a property rather than the CycloneDX hashes array.
+      properties.push({ name: "cdx:renv:hash", value: record.Hash });
+    }
+    const pkg = {
+      name: record.Package,
+      version: record.Version,
+      type: "library",
+      scope: "required",
+      properties,
+    };
+    if (purl) {
+      pkg.purl = purl;
+      pkg["bom-ref"] = decodeURIComponent(purl);
+    } else {
+      pkg["bom-ref"] = `library:${record.Package}:${record.Version}`;
+    }
+    pkgList.push(pkg);
+    refByName.set(record.Package, pkg["bom-ref"]);
+  }
+
+  // Requirements give the graph between packages; the R runtime ("R" with a
+  // constraint) is skipped because it is not a lock entry.
+  const dependencies = [];
+  const requiredNames = new Set();
+  for (const record of Object.values(lock.Packages)) {
+    const ref = refByName.get(record?.Package);
+    if (!ref) {
+      continue;
+    }
+    const dependsOn = new Set();
+    for (const requirement of Array.isArray(record.Requirements)
+      ? record.Requirements
+      : []) {
+      if (typeof requirement !== "string" || !requirement) {
+        continue;
+      }
+      const required = requirement.split(/\s+/u)[0];
+      const targetRef = required ? refByName.get(required) : undefined;
+      if (targetRef && targetRef !== ref) {
+        dependsOn.add(targetRef);
+        requiredNames.add(required);
+      }
+    }
+    dependencies.push({ ref, dependsOn: [...dependsOn].sort() });
+  }
+  const rootInputs = pkgList
+    .filter((pkg) => !requiredNames.has(pkg.name))
+    .map((pkg) => pkg["bom-ref"]);
+
+  return {
+    pkgList,
+    dependencies,
+    rootInputs,
+    parentComponent: {},
+    rVersion,
+  };
+}
+
+/**
+ * Shared empty result for unreadable or malformed locks.
+ *
+ * @returns {{pkgList: object[], dependencies: object[], rootInputs: string[], parentComponent: object, rVersion: undefined}}
+ */
+function emptyResult() {
+  return {
+    pkgList: [],
+    dependencies: [],
+    rootInputs: [],
+    parentComponent: {},
+    rVersion: undefined,
+  };
+}

package/lib/ecosystems/parsers-rebar.js

@@ -0,0 +1,411 @@
+import { readFileSync } from "node:fs";
+
+import { tryBuildPurl } from "../inventory/purl.js";
+
+/**
+ * Erlang rebar3 parser for `rebar.lock`.
+ *
+ * A rebar lock holds one or two Erlang terms, each ended by a period:
+ *
+ *   {"1.2.0", [{<<"cowboy">>,{pkg,<<"cowboy">>,<<"2.10.0">>},0}]}.
+ *   [{pkg_hash, [{<<"cowboy">>, <<"3AFD...">>}]},
+ *    {pkg_hash_ext, [...]}].
+ *
+ * The first term pairs the lock format version with the locked dependency
+ * list; the hashes live in a separate second term, which is absent from locks
+ * that hold no hex packages. Lock format 1.0.0 omitted the version and wrote
+ * the dependency list as the only term.
+ *
+ * Rather than a large regular expression over the surface syntax, a small
+ * recursive reader parses the terms into plain JavaScript values: tuples and
+ * lists become arrays, binaries and strings become strings, atoms become
+ * strings. Only the shapes rebar actually writes are understood; anything
+ * else is skipped.
+ *
+ * Hex dependencies are identified with the registered `hex` purl type, since
+ * rebar resolves Erlang packages through hex.pm. The `pkg_hash` values hex
+ * publishes are SHA-256 digests of the package tarball, so they are emitted
+ * into the CycloneDX `hashes` array where consumers expect content hashes.
+ */
+
+/**
+ * Parse a `rebar.lock` file.
+ *
+ * @param {string} rebarLockFile Path to `rebar.lock`
+ * @returns {{ pkgList: object[] }} Locked packages
+ */
+export function parseRebarLock(rebarLockFile) {
+  let text;
+  try {
+    text = readFileSync(rebarLockFile, "utf-8");
+  } catch (error) {
+    console.warn(`Failed to read ${rebarLockFile}: ${error.message}`);
+    return { pkgList: [] };
+  }
+  const terms = parseErlangTerms(text);
+  const deps = lockedDependencies(terms);
+  const pkgHashes = hexHashesFromTerms(terms);
+
+  const pkgList = [];
+  const seen = new Set();
+  for (const entry of deps) {
+    if (!Array.isArray(entry) || typeof entry[0] !== "string" || !entry[0]) {
+      continue;
+    }
+    const name = entry[0];
+    const spec = entry[1];
+    let pkgName = name;
+    let version;
+    if (Array.isArray(spec) && spec[0] === "pkg") {
+      if (typeof spec[1] === "string" && spec[1]) {
+        pkgName = spec[1];
+      }
+      if (typeof spec[2] === "string" && spec[2]) {
+        version = spec[2];
+      }
+    } else if (Array.isArray(spec) && spec[0] === "git") {
+      // Git-sourced entries carry {git, Url, {ref, Sha}}; the revision is the
+      // most precise version available without running git.
+      const ref =
+        Array.isArray(spec[2]) && spec[2][0] === "ref" ? spec[2][1] : undefined;
+      if (typeof ref === "string" && ref) {
+        version = ref;
+      }
+    } else if (typeof spec === "string" && spec) {
+      version = spec;
+    }
+    if (seen.has(pkgName)) {
+      continue;
+    }
+    seen.add(pkgName);
+    pkgList.push(
+      rebarPackage(pkgName, version, {
+        // rebar records the dependency depth; level 0 entries are the
+        // project's own dependencies, deeper entries are transitive.
+        direct: entry[2] === 0,
+        sha256: pkgHashes.get(pkgName) || pkgHashes.get(name),
+        srcFile: rebarLockFile,
+      }),
+    );
+  }
+  return { pkgList };
+}
+
+/**
+ * Build a component-like package record for a rebar dependency.
+ *
+ * @param {string} name Hex package name
+ * @param {string|undefined} version Resolved version or git revision
+ * @param {object} opts Extra context (`direct`, `sha256`, `srcFile`)
+ * @returns {object} Package record
+ */
+function rebarPackage(name, version, opts) {
+  const purl = tryBuildPurl({
+    type: "hex",
+    name,
+    version: version || undefined,
+  });
+  const properties = [
+    { name: "internal:SrcFile", value: opts.srcFile },
+    {
+      name: "cdx:rebar:dependency",
+      value: opts.direct ? "direct" : "transitive",
+    },
+  ];
+  const pkg = {
+    name,
+    ...(version ? { version } : {}),
+    type: "library",
+    scope: "required",
+    properties,
+  };
+  if (opts.sha256 && /^[0-9a-f]{64}$/iu.test(opts.sha256)) {
+    pkg.hashes = [{ alg: "SHA-256", content: opts.sha256.toLowerCase() }];
+  }
+  if (purl) {
+    pkg.purl = purl;
+    pkg["bom-ref"] = decodeURIComponent(purl);
+  } else {
+    pkg["bom-ref"] = `library:${name}:${version || ""}`;
+  }
+  return pkg;
+}
+
+/**
+ * Pick the locked dependency list out of the parsed terms.
+ *
+ * The current format wraps it in `{Version, Deps}`; format 1.0.0 wrote the
+ * list on its own. A dependency entry is always a tuple whose first element
+ * is the application name, which tells the two shapes apart.
+ *
+ * @param {Array} terms Parsed top-level terms
+ * @returns {Array} Dependency entries
+ */
+function lockedDependencies(terms) {
+  for (const term of terms) {
+    if (!Array.isArray(term)) {
+      continue;
+    }
+    if (typeof term[0] === "string" && Array.isArray(term[1])) {
+      // {Version, Deps}
+      return term[1];
+    }
+    if (term.every(isDependencyEntry)) {
+      // A bare dependency list, including the empty lock `[].`
+      return term;
+    }
+  }
+  return [];
+}
+
+/**
+ * Recognise a locked dependency entry: `{Name, Source, Level}`.
+ *
+ * @param {*} entry Candidate entry
+ * @returns {boolean} true when the entry looks like a dependency tuple
+ */
+function isDependencyEntry(entry) {
+  return (
+    Array.isArray(entry) &&
+    typeof entry[0] === "string" &&
+    entry[0].length > 0 &&
+    entry.length >= 2
+  );
+}
+
+/**
+ * Collect the `pkg_hash` digests from the parsed terms.
+ *
+ * The digests live in their own top-level term, a list of
+ * `{pkg_hash, [{Name, Digest}]}` tuples. `pkg_hash_ext` covers a different
+ * packaging of the same release and is ignored so one digest is emitted per
+ * package.
+ *
+ * @param {Array} terms Parsed top-level terms
+ * @returns {Map<string, string>} Package name to SHA-256 hex digest
+ */
+function hexHashesFromTerms(terms) {
+  const hashes = new Map();
+  for (const term of terms) {
+    if (!Array.isArray(term)) {
+      continue;
+    }
+    for (const item of term) {
+      if (
+        !Array.isArray(item) ||
+        item[0] !== "pkg_hash" ||
+        !Array.isArray(item[1])
+      ) {
+        continue;
+      }
+      for (const pair of item[1]) {
+        if (Array.isArray(pair) && typeof pair[0] === "string") {
+          hashes.set(pair[0], pair[1]);
+        }
+      }
+    }
+  }
+  return hashes;
+}
+
+/**
+ * Parse every period-terminated Erlang term in a source text.
+ *
+ * @param {string} text Source text
+ * @returns {Array} Parsed terms, in file order
+ */
+export function parseErlangTerms(text) {
+  const state = { text, pos: 0 };
+  const terms = [];
+  // A lock holds at most two terms; the bound stops a malformed file from
+  // driving the reader in circles.
+  for (let i = 0; i < 8; i += 1) {
+    skipTrivia(state);
+    if (state.pos >= text.length) {
+      break;
+    }
+    const before = state.pos;
+    let term;
+    try {
+      term = readValue(state);
+    } catch {
+      break;
+    }
+    if (state.pos === before) {
+      break;
+    }
+    terms.push(term);
+    skipTrivia(state);
+    if (text[state.pos] === ".") {
+      state.pos += 1;
+    }
+  }
+  return terms;
+}
+
+/**
+ * Advance past whitespace and `%` line comments.
+ *
+ * @param {{text: string, pos: number}} state Reader state
+ */
+function skipTrivia(state) {
+  const { text } = state;
+  let { pos } = state;
+  while (pos < text.length) {
+    const char = text[pos];
+    if (char === " " || char === "\t" || char === "\r" || char === "\n") {
+      pos += 1;
+    } else if (char === "%") {
+      while (pos < text.length && text[pos] !== "\n") {
+        pos += 1;
+      }
+    } else {
+      break;
+    }
+  }
+  state.pos = pos;
+}
+
+/**
+ * Read one Erlang value at the cursor.
+ *
+ * @param {{text: string, pos: number}} state Reader state
+ * @returns {*} Parsed value
+ */
+function readValue(state) {
+  skipTrivia(state);
+  const char = state.text[state.pos];
+  if (char === "{") {
+    return readTupleOrList(state, "}");
+  }
+  if (char === "[") {
+    return readTupleOrList(state, "]");
+  }
+  if (char === '"') {
+    return readString(state, '"');
+  }
+  if (char === "<" && state.text[state.pos + 1] === "<") {
+    return readBinary(state);
+  }
+  if (char === "'") {
+    return readString(state, "'");
+  }
+  if (char === "-" || (char >= "0" && char <= "9")) {
+    return readNumber(state);
+  }
+  return readAtom(state);
+}
+
+/**
+ * Read a `{...}` tuple or `[...]` list into an array.
+ *
+ * @param {{text: string, pos: number}} state Reader state
+ * @param {string} closer `}` or `]`
+ * @returns {Array} Elements
+ */
+function readTupleOrList(state, closer) {
+  state.pos += 1;
+  const items = [];
+  skipTrivia(state);
+  if (state.text[state.pos] === closer) {
+    state.pos += 1;
+    return items;
+  }
+  for (;;) {
+    items.push(readValue(state));
+    skipTrivia(state);
+    const next = state.text[state.pos];
+    if (next === ",") {
+      state.pos += 1;
+      continue;
+    }
+    if (next === closer) {
+      state.pos += 1;
+      return items;
+    }
+    // Malformed content: bail out rather than scanning the rest of the file.
+    throw new Error(`unexpected character at offset ${state.pos}`);
+  }
+}
+
+/**
+ * Read a quoted string, honouring Erlang escapes.
+ *
+ * @param {{text: string, pos: number}} state Reader state
+ * @param {string} quote Quote character
+ * @returns {string} Decoded string
+ */
+function readString(state, quote) {
+  state.pos += 1;
+  let out = "";
+  while (state.pos < state.text.length) {
+    const char = state.text[state.pos];
+    if (char === "\\") {
+      out += state.text[state.pos + 1] ?? "";
+      state.pos += 2;
+      continue;
+    }
+    if (char === quote) {
+      state.pos += 1;
+      return out;
+    }
+    out += char;
+    state.pos += 1;
+  }
+  throw new Error("unterminated string");
+}
+
+/**
+ * Read a `<<"...">>` binary as a string.
+ *
+ * @param {{text: string, pos: number}} state Reader state
+ * @returns {string} Decoded binary content
+ */
+function readBinary(state) {
+  state.pos += 2;
+  skipTrivia(state);
+  if (state.text[state.pos] !== '"') {
+    throw new Error("only string binaries are supported");
+  }
+  const value = readString(state, '"');
+  skipTrivia(state);
+  if (state.text[state.pos] === ">" && state.text[state.pos + 1] === ">") {
+    state.pos += 2;
+    return value;
+  }
+  throw new Error("unterminated binary");
+}
+
+/**
+ * Read an integer or float.
+ *
+ * @param {{text: string, pos: number}} state Reader state
+ * @returns {number} Parsed number
+ */
+function readNumber(state) {
+  const start = state.pos;
+  if (state.text[state.pos] === "-") {
+    state.pos += 1;
+  }
+  while (/[0-9.]/u.test(state.text[state.pos] || "")) {
+    state.pos += 1;
+  }
+  return Number(state.text.slice(start, state.pos));
+}
+
+/**
+ * Read a bare atom such as `pkg` or `git`.
+ *
+ * @param {{text: string, pos: number}} state Reader state
+ * @returns {string} Atom name
+ */
+function readAtom(state) {
+  const start = state.pos;
+  while (/[A-Za-z0-9_@]/u.test(state.text[state.pos] || "")) {
+    state.pos += 1;
+  }
+  if (state.pos === start) {
+    throw new Error(`cannot parse token at offset ${start}`);
+  }
+  return state.text.slice(start, state.pos);
+}