@cdxgen/cdxgen 13.2.0 → 13.3.0

package/lib/inventory/cdxrs.js

@@ -3,9 +3,9 @@
  *
  * This module is the ONLY place that spawns the `cdxrs` binary. It enforces
  * the governing invariant: **no failure mode may abort SBOM generation.**
- * Every failure (missing binary, non-zero exit, timeout, malformed stdout,
- * version-major mismatch, CDXGEN_RS_DISABLE) logs once at `warn` and returns
- * a sentinel that makes the caller take the JS path.
+ * Every failure (missing binary, non-zero exit, timeout, oversized stdout,
+ * malformed stdout, version-major mismatch, CDXGEN_RS_DISABLE) logs once at
+ * `warn` and returns a sentinel that makes the caller take the JS path.
  *
  * Protocol:
  *   cdxrs <subcommand> --input <file|-> --output <file|-> --format json
@@ -42,6 +42,45 @@ const DEFAULT_TIMEOUT_MS = 30_000;
  */
 const MAX_STDIN_BYTES = 32 * 1024 * 1024;
 
+/**
+ * V8's maximum string length on 64-bit builds (2^29 − 24). Node exposes no
+ * API for it, so it is stated exactly as the runtime's own ERR_STRING_TOO_LONG
+ * message does. `Buffer#toString()` throws above it — the crash from issue
+ * 4393, where a pnpm workspace's registry fetch crossed the ceiling.
+ */
+const V8_MAX_STRING_CHARS = 0x1fffffe8;
+
+/**
+ * Ceiling on the stdout bytes collected from a cdxrs child. stdout must end up
+ * as a single JS string, so a payload above V8's string limit can never be
+ * delivered no matter how long the child runs: buffering it only burns memory
+ * until the concat throws. Past the ceiling the child is killed and the caller
+ * takes the JS path. Counting bytes (never smaller than the decoded character
+ * count) keeps the boundary safe for multibyte output.
+ */
+const DEFAULT_MAX_STDOUT_BYTES = V8_MAX_STRING_CHARS;
+
+/**
+ * Resolve the stdout ceiling for a run. CDXGEN_RS_MAX_STDOUT_BYTES lowers (or
+ * raises) it — used by tests and by hosts that want the failover earlier.
+ *
+ * @returns {number} Maximum stdout bytes to collect before failing over.
+ */
+function maxStdoutBytes() {
+  const raw = readEnvironmentVariable("CDXGEN_RS_MAX_STDOUT_BYTES");
+  if (!raw) {
+    return DEFAULT_MAX_STDOUT_BYTES;
+  }
+  const parsed = Number.parseInt(raw, 10);
+  if (Number.isInteger(parsed) && parsed > 0) {
+    return parsed;
+  }
+  console.warn(
+    `cdxrs: ignoring malformed CDXGEN_RS_MAX_STDOUT_BYTES "${raw}"; using the default ${DEFAULT_MAX_STDOUT_BYTES} bytes.`,
+  );
+  return DEFAULT_MAX_STDOUT_BYTES;
+}
+
 /** Sentinel returned when the Rust path is unavailable. Callers take JS path. */
 export const CDXRS_FALLBACK = Object.freeze({
   ok: false,
@@ -164,6 +203,11 @@ function probeVersion(binPath) {
  *
  * Passing `content` is the normal case, since cdxgen holds BOMs in memory.
  *
+ * Collected stdout is bounded: it must become a single JS string, so a child
+ * that would exceed V8's string limit (by default; see
+ * CDXGEN_RS_MAX_STDOUT_BYTES) is killed and reported as a fallback instead of
+ * crashing the process at the concat.
+ *
  * @param {string} subcommand The subcommand to run (e.g. "info").
  * @param {Object} opts
  * @param {string|Buffer} [opts.content] BOM data to feed over stdin.
@@ -284,6 +328,9 @@ export async function runCdxrs(subcommand, opts = {}) {
     let timedOut = false;
     const stdoutChunks = [];
     const stderrChunks = [];
+    const stdoutLimit = maxStdoutBytes();
+    let stdoutBytes = 0;
+    let stdoutOverflow = false;
 
     const pluginRuntime = getDefaultPluginRuntime();
     const env = { ...process.env };
@@ -313,6 +360,17 @@ export async function runCdxrs(subcommand, opts = {}) {
       child.stdin.end(stdinContent);
     }
 
+    // Kill the process group (-pid) so any child processes of cdxrs die too.
+    // Best effort: the process may have already exited, in which case the
+    // close/error handlers take over.
+    const killProcessGroup = () => {
+      try {
+        process.kill(-child.pid, "SIGKILL");
+      } catch {
+        child.kill("SIGKILL");
+      }
+    };
+
     const timer = setTimeout(() => {
       timedOut = true;
       if (DEBUG_MODE) {
@@ -320,16 +378,21 @@ export async function runCdxrs(subcommand, opts = {}) {
           `cdxrs: timeout after ${timeoutMs}ms, killing process group.`,
         );
       }
-      try {
-        // Kill the process group (-pid) so any child processes of cdxrs die too.
-        process.kill(-child.pid, "SIGKILL");
-      } catch {
-        // Process may have already exited; fall through to error handling.
-        child.kill("SIGKILL");
-      }
+      killProcessGroup();
     }, timeoutMs);
 
     child.stdout?.on("data", (chunk) => {
+      if (stdoutOverflow) {
+        return;
+      }
+      stdoutBytes += chunk.length;
+      if (stdoutBytes > stdoutLimit) {
+        // The payload can never become a deliverable string, so stop
+        // buffering, kill the child, and let the close handler fall back.
+        stdoutOverflow = true;
+        killProcessGroup();
+        return;
+      }
       stdoutChunks.push(chunk);
     });
 
@@ -365,8 +428,36 @@ export async function runCdxrs(subcommand, opts = {}) {
         return;
       }
 
-      const stdout = Buffer.concat(stdoutChunks).toString();
-      const stderr = Buffer.concat(stderrChunks).toString();
+      // Checked before the exit code: the child was killed mid-stream for
+      // producing more stdout than can ever be delivered as a string, so even
+      // an exit-0 result is an undeliverable truncation (issue 4393).
+      if (stdoutOverflow) {
+        console.warn(
+          `cdxrs: stdout passed ${stdoutLimit} bytes (a string cannot exceed ${V8_MAX_STRING_CHARS} characters), so the child was stopped.`,
+        );
+        resolve({ ...CDXRS_FALLBACK, reason: "stdout-too-large" });
+        return;
+      }
+
+      let stdout;
+      try {
+        stdout = Buffer.concat(stdoutChunks).toString();
+      } catch (err) {
+        // The byte cap above should make this unreachable; it is kept so that
+        // no failure inside this handler can abort SBOM generation.
+        console.warn(
+          `cdxrs: could not collect child stdout (${err.message}), falling back to JS path.`,
+        );
+        resolve({ ...CDXRS_FALLBACK, reason: "stdout-collect-failed" });
+        return;
+      }
+      let stderr = "";
+      try {
+        stderr = Buffer.concat(stderrChunks).toString();
+      } catch {
+        // stderr carries NDJSON logs, already forwarded as they arrived;
+        // dropping the raw tail must not fail a run with valid stdout.
+      }
 
       // For the validate subcommand, exit code 3 means "validation failure
       // with findings on stdout" — the operation succeeded, the BOM just has

package/lib/inventory/depsUtils.js

@@ -215,6 +215,112 @@ export function propagateRequiredScopeFromDependencies(
   return components;
 }
 
+function isTypeOnlyExcludedComponent(component) {
+  if (component?.scope !== "excluded") {
+    return false;
+  }
+  return (
+    isNpmTypesOnlyComponent(component) ||
+    (component.properties || []).some(
+      (property) =>
+        property.name === "cdx:npm:package:type-only" &&
+        property.value === "true",
+    )
+  );
+}
+
+/**
+ * Scopes the dependencies of type-only npm packages as optional.
+ *
+ * A package imported only for its TypeScript types, like an `@types` package,
+ * is erased at compile time, and so is what it depends on unless a runtime
+ * package depends on it too. A component below a type-only package becomes
+ * optional when no dependency path from a root of the graph reaches it without
+ * passing through a type-only package. A component that already has a scope,
+ * from its manifest or from usage evidence, keeps it.
+ *
+ * @param {Object[]} components CycloneDX component objects
+ * @param {Object[]} dependencies CycloneDX dependency entries
+ * @returns {Object[]} The same component array with scopes updated in place
+ */
+export function markTypeOnlyDependenciesOptional(
+  components = [],
+  dependencies = [],
+) {
+  if (!components?.length || !dependencies?.length) {
+    return components;
+  }
+  const componentByRef = new Map();
+  const typeOnlyRefs = new Set();
+  for (const component of components) {
+    for (const ref of [component?.["bom-ref"], component?.purl]) {
+      if (!ref) {
+        continue;
+      }
+      const normalizedRef = normalizeBomRef(ref);
+      componentByRef.set(normalizedRef, component);
+      if (isTypeOnlyExcludedComponent(component)) {
+        typeOnlyRefs.add(normalizedRef);
+      }
+    }
+  }
+  if (!typeOnlyRefs.size) {
+    return components;
+  }
+  const childrenByRef = new Map();
+  const dependentRefs = new Set();
+  for (const dependency of dependencies) {
+    const ref = normalizeBomRef(dependency?.ref);
+    if (!ref) {
+      continue;
+    }
+    if (!childrenByRef.has(ref)) {
+      childrenByRef.set(ref, new Set());
+    }
+    for (const dependsOnRef of dependency.dependsOn || []) {
+      const childRef = normalizeBomRef(dependsOnRef);
+      if (childRef && childRef !== ref) {
+        childrenByRef.get(ref).add(childRef);
+        dependentRefs.add(childRef);
+      }
+    }
+  }
+  const walk = (startRefs) => {
+    const seen = new Set();
+    const stack = [...startRefs];
+    while (stack.length) {
+      const ref = stack.pop();
+      if (seen.has(ref)) {
+        continue;
+      }
+      seen.add(ref);
+      for (const childRef of childrenByRef.get(ref) || []) {
+        if (!typeOnlyRefs.has(childRef)) {
+          stack.push(childRef);
+        }
+      }
+    }
+    return seen;
+  };
+  // Every ref nothing depends on is a root, so a partial graph errs towards
+  // keeping a component rather than scoping it optional.
+  const runtimeRefs = walk(
+    [...childrenByRef.keys()].filter(
+      (ref) => !dependentRefs.has(ref) && !typeOnlyRefs.has(ref),
+    ),
+  );
+  for (const ref of walk(typeOnlyRefs)) {
+    if (typeOnlyRefs.has(ref) || runtimeRefs.has(ref)) {
+      continue;
+    }
+    const component = componentByRef.get(ref);
+    if (component && !component.scope) {
+      component.scope = "optional";
+    }
+  }
+  return components;
+}
+
 function serviceIdentityKey(service) {
   if (service?.["bom-ref"]) {
     return service["bom-ref"].toLowerCase();
@@ -395,6 +501,71 @@ export function mergeServices(services, newServices) {
   return Array.from(serviceMap.values());
 }
 
+// Descriptive fields, each listed with the raw spellings that collectors set
+// before component conversion. Conversion prefers the converted `licenses`
+// over a raw `license`, and a raw `author` over `authors`, so a field is only
+// filled in, under the spelling the duplicate uses, when the retained
+// component has no spelling of it.
+const DESCRIPTIVE_FIELDS = [
+  ["description"],
+  ["publisher"],
+  ["copyright"],
+  ["authors", "author"],
+  ["licenses", "license"],
+];
+
+const hasFieldValue = (value) =>
+  value !== undefined &&
+  value !== null &&
+  value !== "" &&
+  !(Array.isArray(value) && !value.length);
+
+/**
+ * Carry the descriptive metadata of a duplicate sighting over to the retained
+ * component. A lockfile is usually parsed first and knows only the identity,
+ * while a manifest seen later, such as a gemspec, knows the description,
+ * authors, licenses, and project links (discussion 4389).
+ *
+ * The retained sighting keeps its own values. Lists are not unioned because
+ * two sightings spell the same fact differently: one license as an SPDX id and
+ * as a name, or as an expression that must never share the `licenses` array
+ * with license objects. External references are unioned, since each one is a
+ * distinct link.
+ *
+ * @param {object} existingComponent Retained component, updated in place
+ * @param {object} comp Duplicate sighting of the same component
+ */
+function mergeDescriptiveFields(existingComponent, comp) {
+  for (const spellings of DESCRIPTIVE_FIELDS) {
+    if (
+      spellings.some((spelling) => hasFieldValue(existingComponent[spelling]))
+    ) {
+      continue;
+    }
+    const spelling = spellings.find((aspelling) =>
+      hasFieldValue(comp[aspelling]),
+    );
+    if (spelling) {
+      existingComponent[spelling] = comp[spelling];
+    }
+  }
+  if (!comp.externalReferences?.length) {
+    return;
+  }
+  // A copy, as the array may be shared with another sighting
+  const existingRefs = [...(existingComponent.externalReferences || [])];
+  for (const newref of comp.externalReferences) {
+    if (
+      !existingRefs.some(
+        (ref) => ref.type === newref.type && ref.url === newref.url,
+      )
+    ) {
+      existingRefs.push(newref);
+    }
+  }
+  existingComponent.externalReferences = existingRefs;
+}
+
 /**
  * Trim duplicate components by retaining all the properties
  *
@@ -403,18 +574,21 @@ export function mergeServices(services, newServices) {
  * @returns {Array} Filtered components
  */
 export function trimComponents(components) {
-  const keyCache = {};
-  const filteredComponents = [];
+  // The keys come from the scanned manifests. In a plain object, a key such as
+  // `__proto__` would resolve to Object.prototype and the merge below would
+  // write to it.
+  const keyCache = new Map();
   for (const comp of components) {
     const key = (
       comp.purl ||
       comp["bom-ref"] ||
       comp.name + comp.version
     ).toLowerCase();
-    if (!keyCache[key]) {
-      keyCache[key] = comp;
+    if (!keyCache.has(key)) {
+      keyCache.set(key, comp);
     } else {
-      const existingComponent = keyCache[key];
+      const existingComponent = keyCache.get(key);
+      mergeDescriptiveFields(existingComponent, comp);
       // We need to retain any properties that differ
       if (comp.properties) {
         if (existingComponent.properties) {
@@ -530,10 +704,7 @@ export function trimComponents(components) {
       }
     }
   }
-  for (const akey of Object.keys(keyCache)) {
-    filteredComponents.push(keyCache[akey]);
-  }
-  return filteredComponents;
+  return Array.from(keyCache.values());
 }
 
 /**
@@ -603,7 +774,8 @@ export function isPartialTree(dependencies, componentsCount = 1) {
   let isCbom = false;
   let parentsWithChildsCount = 0;
   for (const adep of dependencies) {
-    if (adep?.dependsOn.length > 0) {
+    // Producers such as protobuf omit empty dependsOn lists
+    if (adep?.dependsOn?.length > 0) {
       parentsWithChildsCount++;
     }
     if (!isCbom && adep?.provides?.length > 0) {
@@ -640,7 +812,7 @@ export function recomputeScope(pkgList, dependencies) {
   }
   for (const adep of dependencies) {
     if (requiredPkgs[adep.ref]) {
-      for (const ado of adep.dependsOn) {
+      for (const ado of adep.dependsOn || []) {
         requiredPkgs[ado] = true;
       }
     }

package/lib/inventory/display.js

@@ -1,4 +1,3 @@
-import { readFileSync } from "node:fs";
 import path from "node:path";
 import process from "node:process";
 
@@ -11,6 +10,7 @@ import {
 import { safeExistsSync } from "../core/fs.js";
 import { toCamel } from "../core/paths.js";
 import { detectAiModelVariants } from "./aiModelVariants.js";
+import { readReachablesSlices } from "./atomUtils.js";
 import { formatOccurrenceEvidence } from "./evidenceUtils.js";
 import {
   formatHbomHardwareClassSummary,
@@ -1407,12 +1407,11 @@ export function printReachables(sliceArtefacts) {
     return;
   }
   const purlCounts = {};
-  const reachablesSlices = JSON.parse(
-    readFileSync(reachablesSlicesFile, "utf-8"),
-  );
+  const reachablesSlices = readReachablesSlices(reachablesSlicesFile);
+  // undefined when the slices file was unreadable; readReachablesSlices warned.
   const rflows = Array.isArray(reachablesSlices)
     ? reachablesSlices
-    : reachablesSlices.reachables || [];
+    : reachablesSlices?.reachables || [];
   for (const areachable of rflows) {
     const purls = areachable.purls || [];
     for (const apurl of purls) {