@cdxgen/cdxgen 13.1.0 → 13.3.0

package/lib/ecosystems/rusi.js

@@ -9,11 +9,16 @@ import {
   safeRmSync,
   safeSpawnSync,
 } from "../core/fs.js";
+import { dirNameStr } from "../core/paths.js";
 import { applyAlgorithmProperties } from "../inventory/cryptoAlgorithmFamily.js";
 import { resolvePluginBinary } from "../inventory/plugins.js";
 
 const RUST_LANGUAGES = new Set(["rust", "rs", "rust-lang"]);
 
+const RUSI_CRYPTO_OIDS = JSON.parse(
+  readFileSync(join(dirNameStr, "data", "crypto-oid.json"), "utf-8"),
+);
+
 /**
  * Resolves the rusi binary.
  *
@@ -82,6 +87,75 @@ function createPurlAliasMap(components = []) {
   return purlAliasMap;
 }
 
+/**
+ * Path roots that never name a dependency crate.
+ */
+const RUST_NON_CRATE_PATH_ROOTS = new Set([
+  "crate",
+  "self",
+  "super",
+  "std",
+  "core",
+  "alloc",
+  "proc_macro",
+  "test",
+]);
+
+/**
+ * Index the cargo components by the identifier a Rust path spells them with.
+ *
+ * A crate named `cfg-if` is written `cfg_if` in source, and a lock file can
+ * carry several versions of the same crate, so a name maps to every matching
+ * purl.
+ *
+ * @param {Object[]} components Components from the BOM
+ * @returns {Map<string, string[]>} Crate identifier to purls
+ */
+function createCrateNameIndex(components = []) {
+  const crateNameIndex = new Map();
+  for (const component of components) {
+    if (!component?.purl?.startsWith("pkg:cargo/") || !component.name) {
+      continue;
+    }
+    const crateIdentifier = component.name.toLowerCase().replaceAll("-", "_");
+    const purls = crateNameIndex.get(crateIdentifier) || [];
+    if (!purls.includes(component.purl)) {
+      purls.push(component.purl);
+    }
+    crateNameIndex.set(crateIdentifier, purls);
+  }
+  return crateNameIndex;
+}
+
+/**
+ * Resolve the dependency crates a Rust path refers to.
+ *
+ * rusi reports an import against the package that declares it, so the imported
+ * crate has to be recovered from the path itself. This is what turns an
+ * `use hex::encode;` into usage evidence for the `hex` component.
+ *
+ * @param {string} importPath Rust path, such as `hex::encode`
+ * @param {Map<string, string[]>} crateNameIndex Index from {@link createCrateNameIndex}
+ * @param {string} [ownerPurl] purl of the package that declares the path
+ * @returns {string[]} Matching component purls
+ */
+function resolveImportedCratePurls(importPath, crateNameIndex, ownerPurl) {
+  if (!importPath || !crateNameIndex?.size) {
+    return [];
+  }
+  const pathRoot = String(importPath)
+    .replace(/^::/, "")
+    .split("::")[0]
+    .trim()
+    .toLowerCase();
+  if (!pathRoot || RUST_NON_CRATE_PATH_ROOTS.has(pathRoot)) {
+    return [];
+  }
+  return (crateNameIndex.get(pathRoot) || []).filter(
+    (purl) => purl !== ownerPurl,
+  );
+}
+
 function resolveComponentPurl(purl, purlAliasMap) {
   if (!purl) {
     return undefined;
@@ -182,19 +256,37 @@ function mergeCryptoComponent(componentsByRef, component, item) {
   return existing;
 }
 
+// The schema requires an oid for algorithm assets, so an algorithm the OID
+// table cannot name is skipped rather than emitted invalid. rusi reports
+// display-cased names ("SHA-256") while the table is lowercase ("sha-256").
+function resolveCryptoAlgorithmMetadata(name) {
+  if (!name) {
+    return undefined;
+  }
+  const lowered = String(name).toLowerCase();
+  return (
+    RUSI_CRYPTO_OIDS[name] ||
+    RUSI_CRYPTO_OIDS[lowered] ||
+    RUSI_CRYPTO_OIDS[lowered.replace(/[\s_]+/g, "-")]
+  );
+}
+
 function cryptoAlgorithmComponent(asset) {
+  const algorithmName = asset.algorithm || asset.kind || "unknown";
+  const algorithmMetadata = resolveCryptoAlgorithmMetadata(algorithmName);
+  if (!algorithmMetadata?.oid) {
+    return undefined;
+  }
   const component = {
     type: "cryptographic-asset",
-    name: asset.algorithm || asset.kind || "unknown",
-    "bom-ref": cryptoBomRef(
-      "algorithm",
-      asset.algorithm || asset.kind,
-      asset.provider || "unknown",
-    ),
+    name: algorithmName,
+    "bom-ref": cryptoBomRef("algorithm", algorithmName, algorithmMetadata.oid),
     description:
+      algorithmMetadata.description ||
       "Cryptographic algorithm/component detected by rusi source analysis",
     cryptoProperties: {
       assetType: "algorithm",
+      oid: algorithmMetadata.oid,
       algorithmProperties: { primitive: asset.kind || "unknown" },
     },
     properties: [],
@@ -258,6 +350,29 @@ function cryptoMaterialComponent(material) {
   return component;
 }
 
+/**
+ * Returns the backend rusi actually used. `options.backend` is only the
+ * requested backend: when the compiler backend cannot run (missing
+ * components, wrapper build failure), rusi still echoes "compiler" but falls
+ * back to the stable source analysis. Compiler evidence was collected only
+ * when rusi emits its compiler-source-evidence diagnostic; a backend-error
+ * alone is not conclusive because native interop scanning reports failures
+ * under that kind too.
+ *
+ * @param {Object} rusiReport Parsed rusi report
+ * @returns {string|undefined} Effective backend name
+ */
+export function effectiveRusiBackend(rusiReport = {}) {
+  const requested = rusiReport.options?.backend;
+  if (requested !== "compiler") {
+    return requested;
+  }
+  const collected = (rusiReport.diagnostics || []).some(
+    (d) => d?.kind === "compiler-source-evidence",
+  );
+  return collected ? requested : "stable";
+}
+
 function addMetadataProperties(properties, rusiReport = {}) {
   appendUniqueProperty(
     properties,
@@ -282,7 +397,15 @@ function addMetadataProperties(properties, rusiReport = {}) {
   appendUniqueProperty(properties, "cdx:rusi:host", rusiReport.runtime?.host);
 
   const options = rusiReport.options || {};
-  appendUniqueProperty(properties, "cdx:rusi:backend", options.backend);
+  const backend = effectiveRusiBackend(rusiReport);
+  appendUniqueProperty(properties, "cdx:rusi:backend", backend);
+  if (options.backend && options.backend !== backend) {
+    appendUniqueProperty(
+      properties,
+      "cdx:rusi:requestedBackend",
+      options.backend,
+    );
+  }
   appendUniqueProperty(
     properties,
     "cdx:rusi:analysisScope",
@@ -361,6 +484,7 @@ function addImportEvidence(
   purlAliasMap,
   purlLocationMap,
   componentPropertiesMap,
+  crateNameIndex,
 ) {
   for (const importUsage of rusiReport.imports || []) {
     const purl = resolveComponentPurl(importUsage.purl, purlAliasMap);
@@ -380,6 +504,31 @@ function addImportEvidence(
       "cdx:rusi:importAlias",
       importUsage.alias,
     );
+    // The import is also evidence about the crate being imported, which is the
+    // component a consumer filters on.
+    for (const cratePurl of resolveImportedCratePurls(
+      importUsage.path,
+      crateNameIndex,
+      purl,
+    )) {
+      addSetValue(
+        purlLocationMap,
+        cratePurl,
+        positionLocation(importUsage.position),
+      );
+      addPropertyValue(
+        componentPropertiesMap,
+        cratePurl,
+        "cdx:rusi:importedBy",
+        purl,
+      );
+      addPropertyValue(
+        componentPropertiesMap,
+        cratePurl,
+        "cdx:rusi:importPath",
+        importUsage.path,
+      );
+    }
   }
 }
 
@@ -761,6 +910,7 @@ export function analyzeRusiProject(src, options = {}) {
  */
 export function collectRusiEvidence(rusiReport = {}, components = []) {
   const purlAliasMap = createPurlAliasMap(components);
+  const crateNameIndex = createCrateNameIndex(components);
   const purlLocationMap = {};
   const dataFlowFrames = {};
   const componentPropertiesMap = {};
@@ -774,6 +924,7 @@ export function collectRusiEvidence(rusiReport = {}, components = []) {
     purlAliasMap,
     purlLocationMap,
     componentPropertiesMap,
+    crateNameIndex,
   );
   addUsageEvidence(
     rusiReport,