@cdxgen/cdxgen 13.1.0 → 13.3.0

package/lib/inventory/purl.js

@@ -53,15 +53,30 @@ export function purlTypeIsRegisteredString(purlString) {
 }
 
 /**
- * Encode a string for safe inclusion in a PackageURL, percent-encoding special characters
- * while preserving already-encoded `%40` sequences and keeping `:` and `/` unencoded.
+ * Encode a string for inclusion in a hand-written PackageURL string,
+ * percent-encoding every character the purl grammar does not allow literally,
+ * while preserving already-encoded `%40` sequences and keeping `:` and `/`
+ * unencoded.
+ *
+ * `encodeURIComponent` alone leaves `!`, `'`, `(`, `)` and `*` literal, and the
+ * purl grammar requires them escaped, so they are escaped here as well.
+ *
+ * Only for comparing against or assembling purl text. Never pass the result to
+ * `build()`, `new Purl()` or one of the helpers in this module: they escape
+ * their inputs themselves, and escaping twice turns `+` into `%252B`.
  *
  * @param {string} s String to encode
  * @returns {string} Encoded string suitable for use in a PackageURL component
  */
 export function encodeForPurl(s) {
   return s && !s.includes("%40")
-    ? encodeURIComponent(s).replace(/%3A/g, ":").replace(/%2F/g, "/")
+    ? encodeURIComponent(s)
+        .replace(
+          /[!'()*]/g,
+          (c) => `%${c.charCodeAt(0).toString(16).toUpperCase()}`,
+        )
+        .replace(/%3A/g, ":")
+        .replace(/%2F/g, "/")
     : s;
 }
 
@@ -328,6 +343,140 @@ export function isValidPurl(candidate) {
   }
 }
 
+/**
+ * Split a purl into its components without requiring it to be well-formed.
+ *
+ * `Purl.parse` rejects a purl whose parts are not already escaped, which is the
+ * case this exists to handle: a `bom-ref` (cdxgen writes the decoded form of the
+ * purl there), a `go mod graph` token such as `github.com/Azure/go-autorest@v14.2.0+incompatible`,
+ * or a purl from a third-party document that left a `+` or a `://` unescaped.
+ * The separators (`:`, `/`, `@`, `?`, `#`, `&`, `=`) are structural and are read
+ * positionally; everything between them is decoded and handed back raw, ready
+ * for `build` to escape correctly.
+ *
+ * The version is taken after the last `@` of the path, so a scoped npm name
+ * (`@scope/name@1.0.0`) and a composer branch version (`dev-feature/x`) both
+ * split correctly.
+ *
+ * @param {string} purl Purl to split
+ * @returns {{type: string, namespace: (string|null), name: string, version: (string|null), qualifiers: (Object|null), subpath: (string|null)}|null} Parts, or null when the purl has no type and name
+ */
+export function splitPurlLoose(purl) {
+  if (typeof purl !== "string" || !purl.startsWith("pkg:")) {
+    return null;
+  }
+  const decode = (value) => {
+    try {
+      return decodeURIComponent(value);
+    } catch {
+      return value;
+    }
+  };
+  let rest = purl.slice("pkg:".length).replace(/^\/+/, "");
+  let subpath = null;
+  const hash = rest.indexOf("#");
+  if (hash !== -1) {
+    subpath = decode(rest.slice(hash + 1)) || null;
+    rest = rest.slice(0, hash);
+  }
+  let qualifiers = null;
+  const query = rest.indexOf("?");
+  if (query !== -1) {
+    qualifiers = {};
+    for (const pair of rest.slice(query + 1).split("&")) {
+      const equals = pair.indexOf("=");
+      if (equals <= 0) {
+        continue;
+      }
+      qualifiers[pair.slice(0, equals)] = decode(pair.slice(equals + 1));
+    }
+    if (!Object.keys(qualifiers).length) {
+      qualifiers = null;
+    }
+    rest = rest.slice(0, query);
+  }
+  const slash = rest.indexOf("/");
+  if (slash <= 0) {
+    return null;
+  }
+  const type = rest.slice(0, slash);
+  let path = rest.slice(slash + 1);
+  let version = null;
+  const at = path.lastIndexOf("@");
+  if (at > 0 && path[at - 1] !== "/") {
+    version = decode(path.slice(at + 1)) || null;
+    path = path.slice(0, at);
+  }
+  const segments = path.split("/").filter(Boolean).map(decode);
+  const name = segments.pop();
+  if (!name) {
+    return null;
+  }
+  return {
+    type,
+    namespace: segments.length ? segments.join("/") : null,
+    name,
+    version,
+    qualifiers,
+    subpath,
+  };
+}
+
+/**
+ * Parse a purl string that may carry unescaped reserved characters.
+ *
+ * A well-formed purl is parsed strictly, so its components come back exactly as
+ * cdx-purl reads them. Anything else is split structurally by
+ * {@link splitPurlLoose}. Use this where the input is known to be a decoded or
+ * hand-written purl (a `bom-ref`, a workspace reference, a package manager's
+ * `name@version` token), never to accept an invalid purl into a `purl` field:
+ * pass the parts to `build()` instead, which escapes them.
+ *
+ * @param {string} purlString Purl or decoded purl
+ * @returns {{type: string, namespace: (string|null), name: string, version: (string|null), qualifiers: (Object|null), subpath: (string|null)}|null} Raw components, or null when nothing purl-shaped remains
+ */
+export function parsePurlLoose(purlString) {
+  if (typeof purlString !== "string" || !purlString.startsWith("pkg:")) {
+    return null;
+  }
+  try {
+    const parsed = Purl.parse(purlString);
+    return {
+      type: parsed.type,
+      namespace: parsed.namespace || null,
+      name: parsed.name,
+      version: parsed.version || null,
+      qualifiers: parsed.qualifiers || null,
+      subpath: parsed.subpath || null,
+    };
+  } catch (err) {
+    if (!err?.code?.startsWith("E_")) {
+      throw err;
+    }
+  }
+  return splitPurlLoose(purlString);
+}
+
+/**
+ * Turn a decoded or hand-written purl into a canonical, correctly escaped one.
+ *
+ * `bom-ref` values are the decoded form of a purl
+ * (`pkg:npm/foo@1.0.0+build`), which cdx-purl rightly rejects as a purl. This
+ * recovers the purl the ref was made from by splitting it structurally and
+ * rebuilding it with `build()`, so every reserved character is escaped exactly
+ * once.
+ *
+ * @param {string} purlString Purl or decoded purl
+ * @returns {string|null} Canonical purl string, or `null` when no valid purl can be built
+ */
+export function canonicalPurlFromLooseString(purlString) {
+  const parts = parsePurlLoose(purlString);
+  if (!parts) {
+    return null;
+  }
+  return tryBuildPurl(parts);
+}
+
 /**
  * Parse a purl string, returning `null` instead of throwing when it is invalid.
  *

package/lib/inventory/rustFormulationParser.js

@@ -1,7 +1,7 @@
 import { readFileSync } from "node:fs";
 import { basename, dirname, join } from "node:path";
 
-import toml from "@iarna/toml";
+import * as toml from "smol-toml";
 
 import { safeExistsSync } from "../core/fs.js";
 

package/lib/inventory/sbomDocument.js

@@ -14,6 +14,7 @@
 import { build, Purl } from "@cdxgen/cdx-purl";
 
 import { isSpdxJsonLd } from "./bomUtils.js";
+import { splitPurlLoose } from "./purl.js";
 import { toCycloneDxLikeBom } from "./spdxUtils.js";
 
 // A document larger than this is not a plausible SBOM for a single
@@ -150,75 +151,6 @@ function encodeVersionBuildMetadata(purl) {
   return `${head.slice(0, at + 1)}${head.slice(at + 1).replaceAll("+", "%2B")}${tail}`;
 }
 
-/**
- * Split a purl into its components without requiring it to be well-formed.
- *
- * `Purl.parse` rejects a purl whose parts are not already escaped, which is the
- * case this exists to handle. The separators (`:`, `/`, `@`, `?`, `#`, `&`,
- * `=`) are structural and are read positionally; everything between them is
- * decoded and handed back raw, ready for `build` to escape correctly.
- *
- * @param {string} purl Purl to split
- * @returns {{type: string, namespace: (string|null), name: string, version: (string|null), qualifiers: (Object|null), subpath: (string|null)}|null} Parts, or null when the purl has no type and name
- */
-function splitPurl(purl) {
-  const decode = (value) => {
-    try {
-      return decodeURIComponent(value);
-    } catch {
-      return value;
-    }
-  };
-  let rest = purl.slice("pkg:".length).replace(/^\/+/, "");
-  let subpath = null;
-  const hash = rest.indexOf("#");
-  if (hash !== -1) {
-    subpath = decode(rest.slice(hash + 1)) || null;
-    rest = rest.slice(0, hash);
-  }
-  let qualifiers = null;
-  const query = rest.indexOf("?");
-  if (query !== -1) {
-    qualifiers = {};
-    for (const pair of rest.slice(query + 1).split("&")) {
-      const equals = pair.indexOf("=");
-      if (equals <= 0) {
-        continue;
-      }
-      qualifiers[pair.slice(0, equals)] = decode(pair.slice(equals + 1));
-    }
-    if (!Object.keys(qualifiers).length) {
-      qualifiers = null;
-    }
-    rest = rest.slice(0, query);
-  }
-  const slash = rest.indexOf("/");
-  if (slash <= 0) {
-    return null;
-  }
-  const type = rest.slice(0, slash);
-  let path = rest.slice(slash + 1);
-  let version = null;
-  const at = path.lastIndexOf("@");
-  if (at > 0) {
-    version = decode(path.slice(at + 1)) || null;
-    path = path.slice(0, at);
-  }
-  const segments = path.split("/").filter(Boolean).map(decode);
-  const name = segments.pop();
-  if (!name) {
-    return null;
-  }
-  return {
-    type,
-    namespace: segments.length ? segments.join("/") : null,
-    name,
-    version,
-    qualifiers,
-    subpath,
-  };
-}
-
 /**
  * Repair the purl of a component read from a third-party document.
  *
@@ -247,7 +179,7 @@ export function repairPurl(component) {
   } catch {
     // Fall through to the structural rebuild below.
   }
-  const parts = splitPurl(repaired);
+  const parts = splitPurlLoose(repaired);
   if (!parts) {
     return;
   }

package/lib/inventory/source.js

@@ -28,7 +28,9 @@ import {
   prefetchEnabled,
   prefetchedResponse,
   prefetchJson,
+  withHostRateLimit,
 } from "./fetchBatch.js";
+import { canonicalPurlFromLooseString } from "./purl.js";
 
 /** Raised when a caller omits a registry helper that the purl type requires. */
 class MissingRegistryHelperError extends Error {}
@@ -953,6 +955,36 @@ function packageNameForLookup(purlObj) {
   return `${namespace}/${purlObj.name}`;
 }
 
+/**
+ * Read a purl supplied as a scan source.
+ *
+ * People type purls the way their package manager prints versions and URLs:
+ * `pkg:cargo/wasi@0.11.0+wasi-snapshot-preview1` or
+ * `pkg:npm/foo?vcs_url=git+https://...`. cdx-purl requires those `+` to be
+ * escaped, so a purl that does not parse strictly is split on its separators
+ * and rebuilt with every component escaped once. The rebuilt purl is then
+ * parsed strictly, so validation always inspects cdx-purl's reading of it.
+ *
+ * @param {string} purlString Package URL as supplied
+ * @returns {Purl|undefined} Parsed purl, or undefined when none can be recovered
+ */
+function parsePurlSourceInput(purlString) {
+  try {
+    return Purl.parse(purlString);
+  } catch {
+    // Fall through to the structural rebuild.
+  }
+  const canonical = canonicalPurlFromLooseString(purlString);
+  if (!canonical) {
+    return undefined;
+  }
+  try {
+    return Purl.parse(canonical);
+  } catch {
+    return undefined;
+  }
+}
+
 /**
  * Validate package URL source input and return an error object when invalid.
  *
@@ -963,10 +995,8 @@ export function validatePurlSource(purlString) {
   if (!maybePurlSource(purlString)) {
     return null;
   }
-  let purlObj;
-  try {
-    purlObj = Purl.parse(purlString);
-  } catch (_err) {
+  const purlObj = parsePurlSourceInput(purlString);
+  if (!purlObj) {
     return {
       status: 400,
       error: "Invalid purl source",
@@ -1183,12 +1213,17 @@ export async function prefetchGitUrlSources(purlStrings) {
  * @returns {Promise<Object>} A response-shaped object with a `body`.
  */
 async function fetchRegistryDocument(lookup) {
+  // A prefetch miss issues the request here instead, so it goes through the
+  // same per-host gate the batch pool uses. That matters most for crates.io,
+  // whose policy is one request per second however the request was reached.
   return (
     prefetchedResponse(gitUrlSourcePrefetch, lookup.url) ||
-    (await cdxgenAgent.get(lookup.url, {
-      ...(lookup.accept ? { headers: { Accept: lookup.accept } } : {}),
-      responseType: "json",
-    }))
+    (await withHostRateLimit(lookup.url, () =>
+      cdxgenAgent.get(lookup.url, {
+        ...(lookup.accept ? { headers: { Accept: lookup.accept } } : {}),
+        responseType: "json",
+      }),
+    ))
   );
 }
 
@@ -1203,24 +1238,13 @@ function parsePurlForSourceResolution(purlString) {
   if (!maybePurlSource(purlString) || validatePurlSource(purlString)) {
     return undefined;
   }
-  let purlObj;
-  try {
-    // Some purls in the wild use unencoded + in qualifier values (e.g.
-    // git+https:// in vcs_url). cdx-purl requires percent-encoding; normalize
-    // the qualifier section before parsing so real-world purls resolve.
-    const qIdx = purlString.indexOf("?");
-    const safePurlString =
-      qIdx >= 0
-        ? purlString.slice(0, qIdx + 1) +
-          purlString.slice(qIdx + 1).replaceAll("+", "%2B")
-        : purlString;
-    purlObj = Purl.parse(safePurlString);
-  } catch (err) {
+  // Purls in the wild leave `+` unescaped in versions and in qualifier values
+  // such as `vcs_url=git+https://`; the shared reader rebuilds them.
+  const purlObj = parsePurlSourceInput(purlString);
+  if (!purlObj) {
     if (DEBUG_MODE) {
-      const errorMessage = err?.message || String(err);
       thoughtLog("Unable to resolve repository URL for purl.", {
         purlString,
-        errorMessage,
       });
     }
     return undefined;

package/lib/inventory/stylePackageRefs.js

@@ -0,0 +1,41 @@
+// Shared CSS package-reference extraction for stylesheet content.
+//
+// Angular style files, Vue and Svelte single-file-component `<style>` blocks,
+// and `additionalData` strings injected by vite/vue configs all refer to npm
+// packages through the same small set of CSS rules (`@use`, `@import`,
+// `@forward`, and `url()` references). The patterns and the `url()` package
+// guard live here so every collector applies one dialect instead of drifting
+// per-framework copies.
+//
+// Both patterns are global and therefore stateful (`lastIndex`): call sites
+// that reuse them across files must reset `lastIndex = 0` first, the way
+// `matchAll` callers in this codebase already do.
+
+/**
+ * Patterns matching a package reference inside CSS/SCSS/Less/Stylus content.
+ * Capture group 1 holds the reference (for example `bulma/sass/utilities`).
+ *
+ * @type {RegExp[]}
+ */
+export const STYLE_PACKAGE_REFERENCE_PATTERNS = [
+  /@(?:import|use|forward)\s+(?:url\(\s*)?['"]([^'"\n)]+)['"]/g,
+  /url\(\s*['"](~?[^'"\n)]+)['"]\s*\)/g,
+];
+
+/**
+ * True when a `url()` reference points at a package rather than a local file.
+ * Only the `~package/...` and `node_modules/...` spellings qualify; plain
+ * relative URLs stay local.
+ *
+ * @param {string} reference Value captured from a `url()` rule.
+ * @returns {boolean}
+ */
+export const isPackageStyleUrlReference = (reference) => {
+  const normalizedReference = String(reference || "")
+    .trim()
+    .replaceAll("\\", "/");
+  return (
+    normalizedReference.startsWith("~") ||
+    normalizedReference.startsWith("node_modules/")
+  );
+};