@cdxgen/cdxgen 13.1.0 → 13.3.0

package/lib/inventory/traceRunner.js

@@ -20,6 +20,17 @@ try {
   SaferExec = undefined;
 }
 
+/**
+ * Whether the @cdxgen/safer-exec tracing runtime could be loaded. When false,
+ * dynamic tracing cannot run at all, and every trace would otherwise exit 0
+ * with a valid but empty BOM, hiding the broken installation (#4378).
+ *
+ * @returns {boolean} True when the tracing runtime is available
+ */
+export function isSaferExecAvailable() {
+  return Boolean(SaferExec);
+}
+
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
 
@@ -105,8 +116,10 @@ export function resolveSaferExecBinary() {
     }
 
     for (const modulesDir of searchDirs) {
-      // Direct structure under node_modules
-      const directPath = join(modulesDir, pkgName, "bin", "safer-exec");
+      // Direct structure under node_modules. The Go runtime inside the
+      // platform package is bin/safer-exec-rt; "safer-exec" is the JS
+      // dispatcher's npm bin name, not a file on disk.
+      const directPath = join(modulesDir, pkgName, "bin", "safer-exec-rt");
       let realDirectPath;
       try {
         realDirectPath = realpathSync(directPath);
@@ -157,7 +170,19 @@ export function resolveSaferExecBinary() {
  * @param {boolean} [options.traceExec] - Log every child process spawned
  * @param {string[]} [options.allowExec] - Executables the command is allowed to run
  * @param {string[]} [options.blockExec] - Executables to block from running
- * @returns {Promise<{libPaths: string[], httpAccessEntries: Object[]}>} Collected libraries and HTTP URLs
+ * @param {boolean} [options.proxyEgress] - Route egress through safer-exec's hostname-pinning proxy (network stays enabled; only allowHosts are reachable)
+ * @param {boolean} [options.allowLoopback] - Allow loopback connections
+ * @param {boolean} [options.dryRun] - Deny every filesystem and network side effect and collect a dry-run report
+ * @param {string} [options.policy] - Named safer-exec ecosystem policy (npm, pypi, maven, ...)
+ * @param {string} [options.policyFile] - Path to a safer-exec JSON policy file
+ * @param {boolean} [options.blockInterpreters] - Block interpreters with sandbox or task-port exemptions (macOS)
+ * @param {boolean} [options.denyPersistenceWrites] - Deny writes to auto-execution and persistence locations
+ * @param {boolean} [options.privateTmp] - Private tmpfs /tmp and /var/tmp (Linux)
+ * @param {string} [options.protectHome] - Home isolation: read-only, tmpfs, or off (Linux)
+ * @returns {Promise<{libPaths: string[], httpAccessEntries: Object[], egressEntries?: Object[], dryRunSummary?: Object}>} Collected libraries, HTTP URLs, proxy egress decisions, and the dry-run summary
+ * @throws {Error} When the @cdxgen/safer-exec tracing runtime is not installed
+ *   (for example after pruning it from a standalone payload), since the traced
+ *   command could never run and the BOM would silently be empty
  */
 export async function executeAndTrace(commandStr, workingDir, options = {}) {
   const emptyResult = { libPaths: [], httpAccessEntries: [] };
@@ -174,11 +199,23 @@ export async function executeAndTrace(commandStr, workingDir, options = {}) {
   );
 
   if (!SaferExec) {
-    return emptyResult;
+    throw new Error(
+      "Dynamic tracing requires the @cdxgen/safer-exec package, which could not be loaded from this installation. Re-install with optional dependencies enabled, or use the official tracebom standalone binary.",
+    );
+  }
+
+  const exec = new SaferExec();
+  // Policies are applied first so explicit options below take precedence, and
+  // outside the try so an unknown policy or unreadable policy file fails the
+  // run instead of producing an empty BOM.
+  if (options.policy) {
+    exec.applyPolicy(options.policy);
+  }
+  if (options.policyFile) {
+    exec.applyPolicyFile(options.policyFile);
   }
 
   try {
-    const exec = new SaferExec();
     if (workingDir) {
       exec.workingDir(workingDir);
     }
@@ -192,9 +229,41 @@ export async function executeAndTrace(commandStr, workingDir, options = {}) {
     exec.traceLibraries().suppressLibLoadStderr(true).enableAudit();
 
     // Apply sandbox options
-    if (options.disableNetwork !== false && !options.traceHTTPURLs) {
+    // The egress proxy runs on the host side and must be reachable, so it
+    // needs the network enabled (an isolated namespace would bypass it).
+    if (
+      options.disableNetwork !== false &&
+      !options.traceHTTPURLs &&
+      !options.proxyEgress
+    ) {
       exec.disableNetwork();
     }
+    if (options.proxyEgress) {
+      if (!options.allowHosts?.length && !options.allowUrls?.length) {
+        console.warn(
+          "[cdxgen trace] egress proxy enabled without --allow-host: every outbound connection will be denied.",
+        );
+      }
+      exec.proxyEgress();
+    }
+    if (options.allowLoopback) {
+      exec.allowLoopback();
+    }
+    if (options.dryRun) {
+      exec.enableDryRun();
+    }
+    if (options.blockInterpreters) {
+      exec.blockInterpreters();
+    }
+    if (options.denyPersistenceWrites) {
+      exec.denyPersistenceWrites();
+    }
+    if (options.privateTmp) {
+      exec.privateTmp();
+    }
+    if (options.protectHome && options.protectHome !== "off") {
+      exec.protectHome(options.protectHome);
+    }
     if (options.readPaths?.length) {
       exec.readPaths(options.readPaths);
     }
@@ -306,25 +375,53 @@ export async function executeAndTrace(commandStr, workingDir, options = {}) {
     }
 
     const result = await exec.run(cmd, args);
-    if (result && result.exitCode !== 0 && result.stderr) {
-      if (result.stderr.includes("[safer-exec] Error:")) {
-        console.error(
-          "Tracing launcher execution failed:",
-          result.stderr.trim(),
+    const stderr = result?.stderr || "";
+    if (result && result.exitCode !== 0) {
+      if (stderr.includes("[safer-exec] Error:")) {
+        console.error("Tracing launcher execution failed:", stderr.trim());
+      } else {
+        // A failing command usually means a partial trace (for example a
+        // sandbox denial), so the BOM may be incomplete.
+        console.warn(
+          `[cdxgen trace] traced command exited with code ${result.exitCode}; the BOM may be incomplete.`,
         );
       }
-    } else if (options.traceHTTPURLs && result?.stderr) {
-      // Surface eBPF/http-trace warnings even when exit code is 0
-      const stderr = result.stderr || "";
+    }
+    if (options.traceHTTPURLs) {
+      // eBPF URL tracing needs CAP_BPF/CAP_PERFMON. Surface why it was not
+      // available whatever the command's exit code, since the BOM otherwise
+      // silently lacks services.
+      const httpLines = stderr
+        .split("\n")
+        .filter(
+          (line) =>
+            line.includes("http-trace") ||
+            line.includes("httptrace") ||
+            line.includes("SSL/TLS libraries"),
+        );
       if (
-        stderr.includes("http-trace") ||
-        stderr.includes("httptrace") ||
-        stderr.includes("SSL/TLS libraries")
+        httpLines.some((line) => /warning|not supported|failed/i.test(line))
       ) {
-        console.warn("[cdxgen trace] HTTP URL tracing warning:", stderr.trim());
+        console.warn(
+          "[cdxgen trace] HTTP URL tracing unavailable or degraded (it needs root or CAP_BPF and CAP_PERFMON):",
+          httpLines.join("\n"),
+        );
       }
     }
 
+    // Without an event source (strace on Linux) a dry run still denies every
+    // side effect but reports nothing, which must not read as "no activity".
+    let dryRunSummary = result?.dryRun?.summary;
+    if (
+      options.dryRun &&
+      result?.stderr?.includes("dry-run cannot capture attempted operations")
+    ) {
+      console.warn(
+        "[cdxgen trace] dry run could not capture attempted operations on this host (install strace or relax ptrace_scope); the BOM records no counts.",
+      );
+      dryRunSummary = { captured: false };
+    }
+
     // Read and parse CBOM file if temp/explicit path was used
     let cryptoComponents = [];
     const cbomPathToRead = options.cbom || tempCbomPath;
@@ -377,6 +474,8 @@ export async function executeAndTrace(commandStr, workingDir, options = {}) {
         httpAccessEntries: [...collectedUrls, ...urls],
         cryptoEntries: [...collectedCrypto, ...cryptoLogs],
         cryptoComponents,
+        egressEntries: parseEgressEntries(result.auditLog),
+        dryRunSummary,
       };
     }
 
@@ -385,6 +484,8 @@ export async function executeAndTrace(commandStr, workingDir, options = {}) {
       httpAccessEntries: collectedUrls,
       cryptoEntries: collectedCrypto,
       cryptoComponents,
+      egressEntries: [],
+      dryRunSummary,
     };
   } catch (err) {
     console.error("Tracing command execution failed:", err);
@@ -392,6 +493,86 @@ export async function executeAndTrace(commandStr, workingDir, options = {}) {
   return emptyResult;
 }
 
+/**
+ * Returns the sorted, de-duplicated parameter names of a query string.
+ *
+ * @param {string} query - Raw query string, with or without a leading "?"
+ * @returns {string} Comma-separated parameter names, or "" when there are none
+ */
+function queryParameterNames(query) {
+  if (!query) {
+    return "";
+  }
+  const names = new Set();
+  for (const pair of String(query).replace(/^\?/, "").split("&")) {
+    const eqIdx = pair.indexOf("=");
+    const name = (eqIdx >= 0 ? pair.substring(0, eqIdx) : pair).trim();
+    if (name) {
+      names.add(name);
+    }
+  }
+  return Array.from(names).sort().join(",");
+}
+
+/**
+ * Extracts the egress proxy's decisions from a safer-exec audit log.
+ * "proxy-connect" targets are "host:port"; "proxy-violation" targets are
+ * "CONNECT host:port" or "METHOD http://host[:port]/path". Only the authority
+ * is kept, never a path or query.
+ *
+ * @param {Object[]} auditLog - safer-exec audit entries
+ * @returns {{host: string, port: number, protocol: string, decision: string}[]} Unique egress decisions
+ */
+export function parseEgressEntries(auditLog) {
+  const seen = new Set();
+  const entries = [];
+  for (const e of auditLog || []) {
+    if (e?.type !== "proxy-connect" && e?.type !== "proxy-violation") {
+      continue;
+    }
+    const target = String(e.target || "");
+    let authority = target;
+    let protocol = "https";
+    if (e.type === "proxy-connect") {
+      protocol = e.details === "http" ? "http" : "https";
+    } else {
+      const spaceIdx = target.indexOf(" ");
+      authority = spaceIdx >= 0 ? target.substring(spaceIdx + 1) : target;
+      const schemeIdx = authority.indexOf("://");
+      if (schemeIdx >= 0) {
+        protocol = authority.substring(0, schemeIdx);
+        authority = authority.substring(schemeIdx + 3);
+        const slashIdx = authority.indexOf("/");
+        if (slashIdx >= 0) {
+          authority = authority.substring(0, slashIdx);
+        }
+      }
+    }
+    let host = authority;
+    let port = protocol === "http" ? 80 : 443;
+    const colonIdx = authority.lastIndexOf(":");
+    if (colonIdx > 0 && !authority.endsWith("]")) {
+      const parsedPort = Number.parseInt(authority.substring(colonIdx + 1), 10);
+      if (!Number.isNaN(parsedPort)) {
+        port = parsedPort;
+        host = authority.substring(0, colonIdx);
+      }
+    }
+    host = host.replace(/^\[|\]$/g, "").toLowerCase();
+    if (!host) {
+      continue;
+    }
+    const decision = e.type === "proxy-connect" ? "allowed" : "denied";
+    const key = `${decision}|${protocol}|${host}|${port}`;
+    if (seen.has(key)) {
+      continue;
+    }
+    seen.add(key);
+    entries.push({ host, port, protocol, decision });
+  }
+  return entries;
+}
+
 /**
  * Groups HTTP access entries into a CycloneDX services-ready map.
  * Each unique (host, port, protocol) combination becomes a service.
@@ -409,7 +590,9 @@ export function groupHttpEntriesToServices(httpAccessEntries) {
         properties: [],
       };
     }
-    const endpoint = `https://${entry.host}${entry.port && entry.port !== 443 ? `:${entry.port}` : ""}${entry.path || "/"}`;
+    const scheme = entry.protocol === "http" ? "http" : "https";
+    const defaultPort = scheme === "http" ? 80 : 443;
+    const endpoint = `${scheme}://${entry.host}${entry.port && entry.port !== defaultPort ? `:${entry.port}` : ""}${entry.path || "/"}`;
     servicesMap[serviceName].endpoints.add(endpoint);
     if (entry.method) {
       const methodProp = {
@@ -424,8 +607,14 @@ export function groupHttpEntriesToServices(httpAccessEntries) {
         servicesMap[serviceName].properties.push(methodProp);
       }
     }
-    if (entry.query) {
-      const queryProp = { name: "cdx:dynamic:httpQuery", value: entry.query };
+    // Query values can carry tokens and signatures, so only the parameter
+    // names are recorded.
+    const queryParams = queryParameterNames(entry.query);
+    if (queryParams) {
+      const queryProp = {
+        name: "cdx:dynamic:httpQueryParams",
+        value: queryParams,
+      };
       if (
         !servicesMap[serviceName].properties.some(
           (p) => p.name === queryProp.name && p.value === queryProp.value,

package/lib/managers/binary.js

@@ -7,6 +7,7 @@ import {
 } from "node:fs";
 import { platform as _platform, homedir } from "node:os";
 import { basename, dirname, extname, join, relative, resolve } from "node:path";
+import process from "node:process";
 
 import { build, Purl } from "@cdxgen/cdx-purl";
 
@@ -54,7 +55,11 @@ import {
   resolvePluginBinary,
   setPluginsPathEnv,
 } from "../inventory/plugins.js";
-import { genericPurl, tryBuildPurl } from "../inventory/purl.js";
+import {
+  genericPurl,
+  parsePurlLoose,
+  tryBuildPurl,
+} from "../inventory/purl.js";
 import {
   adjustLicenseInformation,
   findLicenseId,
@@ -531,28 +536,89 @@ export function getCargoAuditableInfo(src) {
   return undefined;
 }
 
+/**
+ * Check that sourcekitten (bundled plugin or SOURCEKITTEN_CMD) answers a
+ * trivial syntax request.
+ *
+ * @param env {Object} Optional environment overrides merged over process.env
+ * @returns {String} `ok`; `unavailable` when there is no bundled plugin and
+ *   SOURCEKITTEN_CMD is unset; `not-found` when the configured executable does
+ *   not exist; `failed` when it ran but could not answer
+ */
+export function probeSourcekitten(env) {
+  if (!SOURCEKITTEN_BIN) {
+    return "unavailable";
+  }
+  const result = safeSpawnSync(
+    SOURCEKITTEN_BIN,
+    ["syntax", "--text", "import Swift"],
+    env ? { env: { ...process.env, ...env } } : undefined,
+  );
+  if (result?.error?.code === "ENOENT") {
+    return "not-found";
+  }
+  if (result?.status === 0 && result.stdout) {
+    try {
+      JSON.parse(result.stdout);
+      return "ok";
+    } catch (_e) {
+      // Plain-text errors on stdout are failures
+    }
+  }
+  if (DEBUG_MODE) {
+    console.log(
+      "sourcekitten syntax probe failed:",
+      `${result?.stderr || result?.error || ""}`
+        .split("\n")
+        .slice(0, 5)
+        .map((l) => l.slice(0, 400))
+        .join("\n"),
+    );
+  }
+  return "failed";
+}
+
 /**
  * Execute sourcekitten plugin with the given arguments
  *
  * @param args {Array} Arguments
+ * @param env {Object} Optional environment overrides merged over process.env,
+ *   used to align sourcekitten with a specific Swift toolchain
  * @returns {undefined|Object} Command output
  */
-export function executeSourcekitten(args) {
-  if (SOURCEKITTEN_BIN) {
-    const result = safeSpawnSync(SOURCEKITTEN_BIN, args);
-    if (result.status !== 0 || result.error) {
-      if (result.stdout || result.stderr) {
-        console.error(result.stdout, result.stderr);
-      }
-    }
-    if (result) {
-      const stdout = result.stdout;
-      if (stdout) {
-        return JSON.parse(stdout);
-      }
+export function executeSourcekitten(args, env) {
+  if (!SOURCEKITTEN_BIN) {
+    return undefined;
+  }
+  const result = safeSpawnSync(
+    SOURCEKITTEN_BIN,
+    args,
+    env ? { env: { ...process.env, ...env } } : undefined,
+  );
+  if ((result.status !== 0 || result.error) && DEBUG_MODE) {
+    // Failures echo whole clang invocations, so only the first diagnostic
+    // lines are worth showing
+    const diagnostics = `${result.stderr || ""}`.split("\n").slice(0, 5);
+    console.log(
+      `sourcekitten ${args?.[0]} failed:`,
+      diagnostics.map((l) => l.slice(0, 400)).join("\n"),
+    );
+  }
+  if (!result?.stdout) {
+    return undefined;
+  }
+  try {
+    return JSON.parse(result.stdout);
+  } catch (_e) {
+    // Oversized outputs are truncated at the spawn buffer limit, and
+    // sourcekitten prints plain-text errors to stdout on some failures
+    if (DEBUG_MODE) {
+      console.log(
+        `Ignoring unparseable sourcekitten ${args?.[0]} output of ${result.stdout.length} bytes.`,
+      );
     }
+    return undefined;
   }
-  return undefined;
 }
 
 /**
@@ -796,8 +862,16 @@ export async function getOSPackages(src, imageConfig, options = {}) {
       );
     }
   }
-  if (TRIVY_BIN) {
-    let imageType = "image";
+  // trivy-cdxgen only scans a root filesystem; it has no `image` command. The
+  // caller hands over the exported image directory, so a missing path means
+  // the export failed and there is nothing for trivy to scan.
+  const rootfsPresent = TRIVY_BIN ? safeExistsSync(src) : false;
+  if (TRIVY_BIN && !rootfsPresent) {
+    console.warn(
+      `Skipping the trivy OS package scan: the root filesystem ${src} does not exist.`,
+    );
+  }
+  if (TRIVY_BIN && rootfsPresent) {
     const trivyCacheDir = join(homedir(), ".cache", "trivy");
     try {
       safeMkdirSync(join(trivyCacheDir, "db"), { recursive: true });
@@ -805,13 +879,10 @@ export async function getOSPackages(src, imageConfig, options = {}) {
     } catch (_err) {
       // ignore errors
     }
-    if (safeExistsSync(src)) {
-      imageType = "rootfs";
-    }
     const tempDir = safeMkdtempSync(join(getTmpDir(), "trivy-cdxgen-"));
     const bomJsonFile = join(tempDir, "trivy-bom.json");
     const args = [
-      imageType,
+      "rootfs",
       "--cache-dir",
       trivyCacheDir,
       "--output",
@@ -932,7 +1003,7 @@ export async function getOSPackages(src, imageConfig, options = {}) {
           ? tmpBom.metadata.tools
           : tmpBom?.metadata?.tools?.components || []
         ).filter((tool) => tool?.["bom-ref"] && tool?.name !== "cdxgen"),
-        ["trivy"].concat(imageType === "rootfs" ? ["trustinspector"] : []),
+        ["trivy", "trustinspector"],
       );
       const toolRefs = extractToolRefs(
         { components: tools },
@@ -2977,7 +3048,20 @@ function detectSdksRuntimes(comp, bundledSdks, bundledRuntimes) {
   }
 }
 
-const retrieveDependencies = (tmpDependencies, origBomRef, comp) => {
+/**
+ * Collect the dependency edges trivy recorded for one OS package component.
+ *
+ * Trivy keys its `dependencies` by its own bom-refs, which may leave the `+` of
+ * an rpm or deb version unescaped (`...libstdc%2B%2B6@14.2.0+git10526-...`), so
+ * each ref is read structurally and re-rendered in cdxgen's decoded bom-ref
+ * form with the component's type, namespace and distro qualifiers.
+ *
+ * @param {Object<string, string[]>} tmpDependencies Trivy's refs mapped to the refs they depend on
+ * @param {string} origBomRef The component's bom-ref as trivy wrote it
+ * @param {object} comp The component after cdxgen rewrote its purl and bom-ref
+ * @returns {{ref: string, dependsOn: string[]}|undefined} Dependency entry for the component
+ */
+export const retrieveDependencies = (tmpDependencies, origBomRef, comp) => {
   try {
     const tmpDependsOn =
       tmpDependencies[origBomRef] || tmpDependencies[comp["bom-ref"]] || [];
@@ -2985,7 +3069,14 @@ const retrieveDependencies = (tmpDependencies, origBomRef, comp) => {
     tmpDependsOn.forEach((d) => {
       try {
         const compPurl = Purl.parse(comp.purl);
-        const tmpPurl = Purl.parse(d.replace("none", compPurl.type));
+        // Trivy's dependency refs are its bom-refs, which can leave the `+` of
+        // an rpm or deb version unescaped; read them structurally so the edge
+        // survives.
+        const depParts = parsePurlLoose(d.replace("none", compPurl.type));
+        if (!depParts) {
+          return;
+        }
+        const tmpPurl = new Purl(depParts);
         tmpPurl.type = compPurl.type;
         // FIXME: Check if this hack is still needed with the latest trivy
         if (OS_PURL_TYPES.includes(compPurl.type)) {