@cdxgen/cdxgen 13.2.0 → 13.3.0

package/lib/ecosystems/parsers-python.js

@@ -105,7 +105,9 @@ export async function parsePiplockData(lockData) {
       Object.keys(depBlock).forEach((p) => {
         const pkg = depBlock[p];
         if (Object.hasOwn(pkg, "version")) {
-          const versionStr = pkg.version.replace("==", "");
+          // `===` (arbitrary equality) pins as tightly as `==`, so both are
+          // stripped whole rather than leaving a stray `=` behind.
+          const versionStr = pkg.version.replace(/^\s*={2,3}\s*/, "");
           pkgList.push({ name: p, version: versionStr });
         }
       });
@@ -1427,6 +1429,16 @@ export async function parsePyLockData(lockData, lockFile, pyProjectFile) {
   };
 }
 
+/**
+ * First version clause of a PEP 508 requirement: an operator and the version
+ * that follows it.
+ *
+ * `===` (arbitrary equality) is tried before `==`, whitespace may separate the
+ * operator from the version, and a version may carry a PEP 440 epoch (`1!2.0`)
+ * or a local version label (`2.1.0+cpu`).
+ */
+const PEP440_VERSION_CLAUSE = /(===|==|!=|<=|>=|~=|<|>)\s*([0-9A-Za-z.*_+!-]*)/;
+
 /**
  * Method to parse requirements.txt file. This must be replaced with atom parsedeps.
  *
@@ -1513,10 +1525,13 @@ async function parseReqData(reqFile, reqData = null, fetchDepsInfo = false) {
       continue;
     }
     let comment = null;
-    const commentMatch = l.match(/\s+#(.*)$/);
-    if (commentMatch) {
-      comment = commentMatch[1].trim();
-      l = l.substring(0, commentMatch.index).trim();
+    // Equivalent to /\s+#(.*)$/ but linear: an unanchored `\s+` backtracks
+    // quadratically on long whitespace runs without a '#', which a crafted
+    // requirements.txt used to burn seconds of CPU per line.
+    const hashIndex = l.indexOf("#");
+    if (hashIndex > 0 && /\s/.test(l[hashIndex - 1])) {
+      comment = l.substring(hashIndex + 1).trim();
+      l = l.substring(0, hashIndex).trim();
     }
     const properties = reqFile
       ? [
@@ -1607,9 +1622,7 @@ async function parseReqData(reqFile, reqData = null, fetchDepsInfo = false) {
       if (PYTHON_STD_MODULES.includes(name)) {
         continue;
       }
-      const versionMatch = versionSpecifiers.match(
-        /(==|!=|<=|>=|<|>|~=)([0-9.a-zA-Z_*\-+]*)/,
-      );
+      const versionMatch = versionSpecifiers.match(PEP440_VERSION_CLAUSE);
       let version = null;
       if (versionMatch) {
         version = versionMatch[2].replaceAll("*", "0") || null;
@@ -1636,7 +1649,7 @@ async function parseReqData(reqFile, reqData = null, fetchDepsInfo = false) {
           value: extras.join(","),
         });
       }
-      if (versionSpecifiers && !versionSpecifiers.startsWith("==")) {
+      if (versionSpecifiers && !versionSpecifiers.trim().startsWith("==")) {
         properties.push({
           name: "cdx:pypi:versionSpecifiers",
           value: versionSpecifiers.trim(),
@@ -1673,9 +1686,7 @@ async function parseReqData(reqFile, reqData = null, fetchDepsInfo = false) {
       if (PYTHON_STD_MODULES.includes(name)) {
         continue;
       }
-      const versionMatch = versionSpecifiers.match(
-        /(==|!=|<=|>=|<|>|~=)([0-9.a-zA-Z_*\-+]*)/,
-      );
+      const versionMatch = versionSpecifiers.match(PEP440_VERSION_CLAUSE);
       let version = null;
       if (versionMatch) {
         version = versionMatch[2].replaceAll("*", "0") || null;
@@ -1691,7 +1702,7 @@ async function parseReqData(reqFile, reqData = null, fetchDepsInfo = false) {
       if (licenses) {
         apkg.licenses = licenses;
       }
-      if (versionSpecifiers && !versionSpecifiers.startsWith("==")) {
+      if (versionSpecifiers && !versionSpecifiers.trim().startsWith("==")) {
         properties.push({
           name: "cdx:pypi:versionSpecifiers",
           value: versionSpecifiers.trim(),
@@ -2201,6 +2212,7 @@ function normaliseMojoVersion(spec) {
   const trimmed = spec.trim();
   if (!trimmed) return undefined;
   // Strip common comparison operators and take the first concrete version.
-  const match = trimmed.match(/(\d+(?:\.\d+)*(?:[+-][A-Za-z0-9.]+)?)/);
+  // A PEP 440 epoch (`1!2.0`) is part of the version, not a separator.
+  const match = trimmed.match(/((?:\d+!)?\d+(?:\.\d+)*(?:[+-][A-Za-z0-9.]+)?)/);
   return match ? match[1] : undefined;
 }

package/lib/ecosystems/parsers-rust.js

@@ -1309,15 +1309,20 @@ export function parseCargoDependencyData(cargoLockData) {
       );
     }
   });
-  // Create a map of package names to package objects
-  const pkgMap = pkgList.reduce((acc, item) => {
-    acc[item.name] = item;
-    return acc;
-  }, {});
-  const result = [];
-  // parse dependency version
-  Object.values(pkgMap).forEach((pkg) => {
-    const dependsOn = new Set();
+  // A lock file can hold several versions of one crate. Cargo then names the
+  // version in every reference to it (`getrandom 0.3.4`), and a bare name is
+  // left only for crates with a single version.
+  const pkgsByName = new Map();
+  for (const pkg of pkgList) {
+    pkgsByName.set(pkg.name, [...(pkgsByName.get(pkg.name) || []), pkg]);
+  }
+  // Every package gets its own entry, so each version keeps its edges. The
+  // same name and version from two sources share a purl; their edges merge.
+  const edgesByRef = new Map();
+  for (const pkg of pkgList) {
+    const ref = purlFromPackageInfo(pkg);
+    const dependsOn = edgesByRef.get(ref) || new Set();
+    edgesByRef.set(ref, dependsOn);
     pkg.dependencies?.forEach((dep) => {
       if (dep.indexOf(" ") !== -1) {
         // fill version in dependency definition like `libc 0.2.79`
@@ -1328,20 +1333,21 @@ export function parseCargoDependencyData(cargoLockData) {
             version: depSplit[1].trim(),
           }),
         );
-      } else if (pkgMap[dep]) {
-        dependsOn.add(purlFromPackageInfo(pkgMap[dep]));
+      } else if (pkgsByName.get(dep)?.length === 1) {
+        dependsOn.add(purlFromPackageInfo(pkgsByName.get(dep)[0]));
       } else if (DEBUG_MODE) {
         console.warn(
-          `The package "${dep.name}" appears as a dependency to "${pkg.name}" but is not itself listed in the Cargo.lock file. The Cargo.lock file is invalid! The produced SBOM will not list ${dep.name} as a dependency.`,
+          pkgsByName.has(dep)
+            ? `The package "${dep}" appears as a dependency to "${pkg.name}" without a version, but the Cargo.lock file lists more than one version of it. The produced SBOM will not list ${dep} as a dependency.`
+            : `The package "${dep}" appears as a dependency to "${pkg.name}" but is not itself listed in the Cargo.lock file. The Cargo.lock file is invalid! The produced SBOM will not list ${dep} as a dependency.`,
         );
       }
     });
-    result.push({
-      ref: purlFromPackageInfo(pkg),
-      dependsOn: [...dependsOn],
-    });
-  });
-  return result;
+  }
+  return [...edgesByRef].map(([ref, dependsOn]) => ({
+    ref,
+    dependsOn: [...dependsOn],
+  }));
 }
 
 /**