@cdxgen/cdxgen 13.2.0 → 13.4.0

package/lib/ecosystems/parsers-julia.js

@@ -1,7 +1,6 @@
 import { readFileSync } from "node:fs";
 
-import * as toml from "smol-toml";
-
+import { parseToml } from "../core/toml.js";
 import { tryBuildPurl } from "../inventory/purl.js";
 
 /**
@@ -260,7 +259,7 @@ const JULIA_STDLIBS = new Set([
  */
 function readTomlFile(filePath) {
   try {
-    return toml.parse(readFileSync(filePath, "utf-8"));
+    return parseToml(readFileSync(filePath, "utf-8"));
   } catch (error) {
     console.warn(`Failed to parse ${filePath}: ${error.message}`);
     return undefined;

package/lib/ecosystems/parsers-jvm.js

@@ -1,14 +1,23 @@
-import { readFileSync } from "node:fs";
-import { basename, dirname, resolve } from "node:path";
+import { readdirSync, readFileSync } from "node:fs";
+import {
+  basename,
+  dirname,
+  isAbsolute,
+  join,
+  relative,
+  resolve,
+} from "node:path";
 
 import { build } from "@cdxgen/cdx-purl";
 import { parseEDNString } from "edn-data";
 
-import { readEnvironmentVariable } from "../core/activity.js";
+import { DEBUG_MODE, readEnvironmentVariable } from "../core/activity.js";
 import { recordDegradation } from "../core/buildLedger.js";
 import { includeMavenTestScope } from "../core/env.js";
+import { safeExistsSync } from "../core/fs.js";
 import { thoughtLog } from "../core/logger.js";
 import { applyPurl } from "../inventory/purl.js";
+import { parseScalaArtifact } from "../inventory/scalaCoords.js";
 import { xml2js } from "../parsers/xml.js";
 
 /**
@@ -173,6 +182,158 @@ export function parsePom(pomFile) {
   return { isQuarkus, pomPurl, modules, properties, dependencies: deps };
 }
 
+/** Bound on the reactor walk. A pom's module list is untrusted input, so the
+ * walk cannot trust it to stay finite. */
+const REACTOR_MODULE_LIMIT = 500;
+
+/**
+ * Every pom file of the reactor an aggregator pom builds: its own modules,
+ * recursively through nested aggregators. A recursive dependency:tree run
+ * from the aggregator resolves all of them, so their own runs repeat it.
+ *
+ * A module entry names a directory relative to its pom, sometimes a direct
+ * path to a pom file. Entries that are absolute, or that climb out of the
+ * aggregator's directory, are ignored: the scan never listed them, and the
+ * walk must not follow a pom's pointers outside its own tree.
+ *
+ * @param {string} rootPom Path of the aggregator pom.
+ * @returns {Set<string>} Pom files of the reactor, excluding the aggregator.
+ */
+export function resolveReactorPomFiles(rootPom) {
+  const pomFiles = new Set();
+  const visited = new Set();
+  const rootDir = dirname(resolve(rootPom));
+  const queue = [resolve(rootPom)];
+  while (queue.length > 0 && pomFiles.size < REACTOR_MODULE_LIMIT) {
+    const pom = queue.shift();
+    if (visited.has(pom)) {
+      continue;
+    }
+    visited.add(pom);
+    let modules;
+    try {
+      modules = parsePom(pom)?.modules;
+    } catch (_err) {
+      // An unreadable module pom ends this branch of the walk.
+      continue;
+    }
+    for (const module of modules || []) {
+      if (typeof module !== "string") {
+        continue;
+      }
+      const cleaned = module.trim().replaceAll("\\", "/");
+      if (
+        !cleaned ||
+        cleaned.includes("\0") ||
+        cleaned.startsWith("/") ||
+        /^[A-Za-z]:/.test(cleaned)
+      ) {
+        continue;
+      }
+      const modulePom = resolve(
+        dirname(pom),
+        cleaned.endsWith(".xml") ? cleaned : join(cleaned, "pom.xml"),
+      );
+      const withinRoot = relative(rootDir, modulePom);
+      if (
+        !withinRoot ||
+        withinRoot.startsWith("..") ||
+        isAbsolute(withinRoot) ||
+        !safeExistsSync(modulePom)
+      ) {
+        continue;
+      }
+      if (visited.has(modulePom)) {
+        continue;
+      }
+      pomFiles.add(modulePom);
+      queue.push(modulePom);
+    }
+  }
+  return pomFiles;
+}
+
+/**
+ * File name stem for the trees of one recursive dependency:tree run. Maven
+ * expands the project expressions for each reactor module, so every module
+ * writes its own file; a fixed name would hold only the last module's tree.
+ */
+export const MAVEN_MODULE_TREE_STEM =
+  // biome-ignore lint/suspicious/noTemplateCurlyInString: Maven expands these project expressions itself
+  "${project.groupId}-${project.artifactId}";
+
+/**
+ * The groupId-artifactId key a module's tree file is named by.
+ *
+ * @param {string} pomFile Path of the module pom.
+ * @returns {string|undefined} The key, or undefined when the pom cannot be read.
+ */
+function moduleTreeKey(pomFile) {
+  try {
+    const { groupId, artifactId } = parsePom(pomFile)?.properties || {};
+    return groupId && artifactId ? `${groupId}-${artifactId}` : undefined;
+  } catch (_err) {
+    return undefined;
+  }
+}
+
+/**
+ * Read the trees one dependency:tree run wrote, one file per reactor module
+ * (see MAVEN_MODULE_TREE_STEM), and tell which of the reactor's pom files
+ * they cover. The pom the run started from comes first, then its modules in
+ * reactor order. A module pom counts as covered only when its own tree is
+ * among the files, so a module the run left out still runs on its own.
+ *
+ * @param {string} treeDir Directory the run wrote its trees into.
+ * @param {string} rootPom The pom file the run started from.
+ * @returns {{trees: Array<{pomFile: string, text: string}>, covered: Set<string>}}
+ */
+export function readMavenModuleTrees(treeDir, rootPom) {
+  const trees = [];
+  const covered = new Set();
+  let names;
+  try {
+    names = readdirSync(treeDir).sort();
+  } catch (_err) {
+    return { trees, covered };
+  }
+  const byKey = new Map();
+  for (const name of names) {
+    const stem = name.replace(/\.(json|txt)$/, "");
+    if (stem !== name && !byKey.has(stem)) {
+      byKey.set(stem, name);
+    }
+  }
+  const take = (key, pomFile) => {
+    const name = byKey.get(key);
+    if (!name) {
+      return false;
+    }
+    byKey.delete(key);
+    trees.push({
+      pomFile,
+      text: readFileSync(join(treeDir, name), { encoding: "utf-8" }),
+    });
+    return true;
+  };
+  const rootKey = moduleTreeKey(rootPom);
+  if (rootKey) {
+    take(rootKey, rootPom);
+  }
+  for (const modulePom of resolveReactorPomFiles(rootPom)) {
+    const key = moduleTreeKey(modulePom);
+    if (key && take(key, modulePom)) {
+      covered.add(modulePom);
+    }
+  }
+  // Trees no pom of the reactor names, such as the single file of a Maven
+  // that did not expand the expressions, are kept under the root pom.
+  for (const key of [...byKey.keys()]) {
+    take(key, rootPom);
+  }
+  return { trees, covered };
+}
+
 function mapMavenScope(componentScope, isOptional = false) {
   if (isOptional || componentScope === "test") {
     return "optional";
@@ -471,10 +632,16 @@ export function parseMavenTree(rawOutput, pomFile) {
 /**
  * Parse mill dependencies from file
  *
+ * Scala artifacts are emitted in the sbt purl form: the Scala binary suffix
+ * is stripped from the artifact name and the version it carried is recorded
+ * in the cdx:scala:compilerVersion property, so one library keeps a single
+ * purl whichever build tool reported it.
+ *
  * @param {string} module name of the module
  * @param {map} dependencies the parsed dependencies
  * @param {map} relations a map containing all relations
  * @param {string} millRootPath root of the project
+ * @param {string} logFileName name of the tree log the module wrote
  *
  * @returns the bom-ref of the module
  */
@@ -483,6 +650,7 @@ export function parseMillDependency(
   dependencies,
   relations,
   millRootPath,
+  logFileName = "ivyDepsTree.log",
 ) {
   const treeRegex = /^(?<treeIndentation>(?:[?├│└─ ]{3})+)(?<dependency>.*)/m;
   const ESC = "\\x1B";
@@ -522,12 +690,7 @@ export function parseMillDependency(
     // Now put the versions we removed above back into the path and replace the brackets at the same time
     moduleFilePath = moduleFilePath.replace("[]", `/${versionNumber}/`);
   }
-  moduleFilePath = resolve(
-    millRootPath,
-    "out",
-    moduleFilePath,
-    "ivyDepsTree.log",
-  );
+  moduleFilePath = resolve(millRootPath, "out", moduleFilePath, logFileName);
   moduleComponent.properties = [
     {
       name: "internal:SrcFile",
@@ -547,7 +710,27 @@ export function parseMillDependency(
       ],
     },
   };
-  const dependencyTreeLog = readFileSync(moduleFilePath, "utf-8");
+  let dependencyTreeLog;
+  try {
+    dependencyTreeLog = readFileSync(moduleFilePath, "utf-8");
+  } catch (_err) {
+    // A cross-published module writes its log under the dotted version
+    // directory (0.23.38) while the resolve output prints it with
+    // underscores (0_23_38)
+    try {
+      dependencyTreeLog = readFileSync(
+        moduleFilePath.replace(/(\d+)_(\d+)_(\d+)/, "$1.$2.$3"),
+        "utf-8",
+      );
+    } catch (_err2) {
+      if (DEBUG_MODE) {
+        console.log(
+          `No Mill dependency tree log was written for the module ${module}.`,
+        );
+      }
+      return moduleComponent["bom-ref"];
+    }
+  }
   const dependencyTreeLines = dependencyTreeLog
     .trim()
     .split("\n")
@@ -568,11 +751,20 @@ export function parseMillDependency(
       [group, name, version] = match.groups.dependency.split(":");
       version = versionRegex.exec(version).groups.version;
     }
+    const scalaInfo = parseScalaArtifact(name);
     const component = completeComponent({
       group,
-      name,
+      name: scalaInfo.purlName,
       version,
     });
+    if (scalaInfo.binaryVersion) {
+      component.properties = [
+        {
+          name: "cdx:scala:compilerVersion",
+          value: scalaInfo.binaryVersion,
+        },
+      ];
+    }
     if (!dependencies.has(component["bom-ref"])) {
       dependencies.set(component["bom-ref"], component);
       relations.set(component["bom-ref"], []);
@@ -587,7 +779,7 @@ export function parseMillDependency(
   return moduleComponent["bom-ref"];
 }
 
-function completeComponent(component) {
+export function completeComponent(component) {
   component["type"] = component.group ? "library" : "application";
   try {
     const purl = build({