@cdxgen/cdxgen 13.2.0 → 13.4.0

package/lib/inventory/auditCategories.js

@@ -23,6 +23,12 @@ export const GOLEM_AUDIT_CATEGORIES = Object.freeze([
   "golem-compliance",
 ]);
 
+/** Frozen list of Scala Evinse (scalasem) audit categories. */
+export const SCALA_AUDIT_CATEGORIES = Object.freeze([
+  "scala-security",
+  "scala-compliance",
+]);
+
 /** Frozen list of Cargo (Rust) audit categories. */
 export const CARGO_AUDIT_CATEGORIES = Object.freeze([
   "cargo-security",
@@ -64,6 +70,7 @@ export const BOM_AUDIT_CATEGORY_ALIASES = Object.freeze({
   golem: [...GOLEM_AUDIT_CATEGORIES],
   hbom: [...HBOM_AUDIT_CATEGORIES],
   rust: [...CARGO_AUDIT_CATEGORIES],
+  scala: [...SCALA_AUDIT_CATEGORIES],
   host: [...HBOM_AUDIT_CATEGORIES, ...HOST_TOPOLOGY_AUDIT_CATEGORIES],
 });
 

package/lib/inventory/buildToolRateLimit.js

@@ -0,0 +1,144 @@
+import { recordDegradation } from "../core/buildLedger.js";
+import { registerRunReset } from "../core/runState.js";
+
+/**
+ * Text a build tool prints when its Maven repository answers HTTP 429, as
+ * recorded from each tool against a repository that rate limits. One small
+ * matcher per tool, plain substring tests on the combined output: the tools
+ * reword their messages between versions, so the matched fragment is the one
+ * every observed phrasing keeps (the status number in the tool's own wording).
+ *
+ * sbt, Mill and scala-cli resolve through Coursier, so they share the
+ * coursier matcher. The Coursier inside sbt 1.x reports the JDK's
+ * `Server returned HTTP response code: 429`; the one in sbt 2, Mill and
+ * scala-cli reports `retryable HTTP error: <url> (HTTP 429)`, with a
+ * `Retry-After` inside the parentheses when the server sent one.
+ *
+ * @type {Object<string, string[]>}
+ */
+const RATE_LIMIT_MARKERS = {
+  maven: ["status code: 429", "Too Many Requests"],
+  gradle: ["Received status code 429", "[HTTP 429: http"],
+  coursier: ["response code: 429", "(HTTP 429"],
+};
+
+/**
+ * The matcher family a tool belongs to.
+ *
+ * @type {Object<string, string>}
+ */
+const TOOL_MATCHER = {
+  maven: "maven",
+  gradle: "gradle",
+  sbt: "coursier",
+  mill: "coursier",
+  "scala-cli": "coursier",
+};
+
+/**
+ * How each tool is moved to a mirror, named in one hint per tool and scan.
+ * sbt reads its own repositories file; Mill and scala-cli read Coursier's
+ * mirror.properties, whose entry spells the semicolon-separated format
+ * because a comma list is silently ignored.
+ *
+ * @type {Object<string, string>}
+ */
+const MIRROR_SETTINGS = {
+  maven:
+    "Point Maven at a mirror with a <mirror> entry in the Maven settings.xml, or set MVNW_REPOURL for the Maven wrapper.",
+  gradle:
+    "Point Gradle at a mirror by declaring the repository in a Gradle init script.",
+  sbt: "Point sbt at a mirror by listing it in ~/.sbt/repositories and passing -Dsbt.override.build.repos=true in SBT_OPTS or .sbtopts.",
+  coursier:
+    "Point Coursier at a mirror with mirror.properties, setting central.from and central.to (separate several central.from URLs with semicolons, not commas).",
+};
+
+/**
+ * Tools whose later invocations or retries cdxgen skips once one met a rate
+ * limit. Mill and scala-cli resolve in a single invocation.
+ *
+ * @type {Set<string>}
+ */
+const STOPPED_TOOLS = new Set(["maven", "gradle", "sbt"]);
+
+/**
+ * Tools whose repository answered HTTP 429 during the current scan. Further
+ * invocations of that tool would only pay the same back-off for the same
+ * empty answer.
+ *
+ * @type {Set<string>}
+ */
+const rateLimitedTools = new Set();
+
+registerRunReset("inventory.buildToolRateLimit", () => {
+  rateLimitedTools.clear();
+});
+
+/**
+ * Whether a tool's combined output names a rate limit from its repository.
+ * The answer text is treated as untrusted: only fixed substrings are looked
+ * for, nothing from the output is kept.
+ *
+ * @param {string} output Combined stdout and stderr of one invocation.
+ * @param {string} tool One of maven, gradle, sbt, mill, scala-cli.
+ * @returns {boolean} True when the output names an HTTP 429 answer.
+ */
+export function detectBuildToolRateLimit(output, tool) {
+  const markers = RATE_LIMIT_MARKERS[TOOL_MATCHER[tool]];
+  if (!markers || typeof output !== "string" || !output) {
+    return false;
+  }
+  return markers.some((marker) => output.includes(marker));
+}
+
+/**
+ * Whether a tool was already found rate limited in this scan, so the caller
+ * can skip its remaining invocations.
+ *
+ * @param {string} tool One of maven, gradle, sbt, mill, scala-cli.
+ * @returns {boolean}
+ */
+export function isBuildToolRateLimited(tool) {
+  return rateLimitedTools.has(tool);
+}
+
+/**
+ * Read a completed invocation's output for a rate limit. When one is found,
+ * the tool is remembered for the scan, one hint naming the tool's mirror
+ * setting is printed, and the `build.rate-limited` degradation is recorded.
+ * The first invocation that shows the rate limit is the one recorded; later
+ * ones add nothing, because the same answer ends them all.
+ *
+ * @param {string} tool One of maven, gradle, sbt, mill, scala-cli.
+ * @param {string|undefined} output Combined output, as commandOutputText
+ *   returns it for a spawn result.
+ * @param {Object} [context] Call-site facts for the degradation event.
+ * @param {string} [context.command] The redacted command that was attempted.
+ * @param {number} [context.exitCode] The invocation's exit status.
+ * @returns {boolean} True when this output names a rate limit.
+ */
+export function noteBuildToolRateLimit(tool, output, context = {}) {
+  if (!detectBuildToolRateLimit(output, tool)) {
+    return false;
+  }
+  if (isBuildToolRateLimited(tool)) {
+    return true;
+  }
+  rateLimitedTools.add(tool);
+  const stopped = STOPPED_TOOLS.has(tool)
+    ? `, so cdxgen runs no further ${tool} resolution in this scan and`
+    : ", so";
+  console.warn(
+    `The repository ${tool} downloads from is rate limiting this machine (HTTP 429)${stopped} its dependency tree is incomplete. ${MIRROR_SETTINGS[tool] || MIRROR_SETTINGS[TOOL_MATCHER[tool]]} cdxgen's own lookups can be moved with MAVEN_CENTRAL_URL.`,
+  );
+  recordDegradation("build.rate-limited", {
+    ecosystem: "java",
+    tool,
+    impact: "transitive-deps",
+    command: context.command,
+    exitCode: context.exitCode,
+    detail: `The repository ${tool} downloads from answered HTTP 429, so ${tool} resolved no dependencies.`,
+    outputExcerpt: output,
+  });
+  return true;
+}

package/lib/inventory/cacheCommands.js

@@ -1,5 +1,6 @@
 /**
- * `cdxgen cache` subcommand — inspect and purge the metadata fetch cache.
+ * `cdxgen cache` subcommand — inspect and purge the metadata fetch cache that
+ * cdxrs and the JS batch pool share.
  *
  * This module operates directly on the filesystem because JS is the authority
  * for the cache directory. The cache layout is:

package/lib/inventory/cdxrs.js

@@ -3,9 +3,9 @@
  *
  * This module is the ONLY place that spawns the `cdxrs` binary. It enforces
  * the governing invariant: **no failure mode may abort SBOM generation.**
- * Every failure (missing binary, non-zero exit, timeout, malformed stdout,
- * version-major mismatch, CDXGEN_RS_DISABLE) logs once at `warn` and returns
- * a sentinel that makes the caller take the JS path.
+ * Every failure (missing binary, non-zero exit, timeout, oversized stdout,
+ * malformed stdout, version-major mismatch, CDXGEN_RS_DISABLE) logs once at
+ * `warn` and returns a sentinel that makes the caller take the JS path.
  *
  * Protocol:
  *   cdxrs <subcommand> --input <file|-> --output <file|-> --format json
@@ -42,6 +42,45 @@ const DEFAULT_TIMEOUT_MS = 30_000;
  */
 const MAX_STDIN_BYTES = 32 * 1024 * 1024;
 
+/**
+ * V8's maximum string length on 64-bit builds (2^29 − 24). Node exposes no
+ * API for it, so it is stated exactly as the runtime's own ERR_STRING_TOO_LONG
+ * message does. `Buffer#toString()` throws above it — the crash from issue
+ * 4393, where a pnpm workspace's registry fetch crossed the ceiling.
+ */
+const V8_MAX_STRING_CHARS = 0x1fffffe8;
+
+/**
+ * Ceiling on the stdout bytes collected from a cdxrs child. stdout must end up
+ * as a single JS string, so a payload above V8's string limit can never be
+ * delivered no matter how long the child runs: buffering it only burns memory
+ * until the concat throws. Past the ceiling the child is killed and the caller
+ * takes the JS path. Counting bytes (never smaller than the decoded character
+ * count) keeps the boundary safe for multibyte output.
+ */
+const DEFAULT_MAX_STDOUT_BYTES = V8_MAX_STRING_CHARS;
+
+/**
+ * Resolve the stdout ceiling for a run. CDXGEN_RS_MAX_STDOUT_BYTES lowers (or
+ * raises) it — used by tests and by hosts that want the failover earlier.
+ *
+ * @returns {number} Maximum stdout bytes to collect before failing over.
+ */
+function maxStdoutBytes() {
+  const raw = readEnvironmentVariable("CDXGEN_RS_MAX_STDOUT_BYTES");
+  if (!raw) {
+    return DEFAULT_MAX_STDOUT_BYTES;
+  }
+  const parsed = Number.parseInt(raw, 10);
+  if (Number.isInteger(parsed) && parsed > 0) {
+    return parsed;
+  }
+  console.warn(
+    `cdxrs: ignoring malformed CDXGEN_RS_MAX_STDOUT_BYTES "${raw}"; using the default ${DEFAULT_MAX_STDOUT_BYTES} bytes.`,
+  );
+  return DEFAULT_MAX_STDOUT_BYTES;
+}
+
 /** Sentinel returned when the Rust path is unavailable. Callers take JS path. */
 export const CDXRS_FALLBACK = Object.freeze({
   ok: false,
@@ -164,6 +203,11 @@ function probeVersion(binPath) {
  *
  * Passing `content` is the normal case, since cdxgen holds BOMs in memory.
  *
+ * Collected stdout is bounded: it must become a single JS string, so a child
+ * that would exceed V8's string limit (by default; see
+ * CDXGEN_RS_MAX_STDOUT_BYTES) is killed and reported as a fallback instead of
+ * crashing the process at the concat.
+ *
  * @param {string} subcommand The subcommand to run (e.g. "info").
  * @param {Object} opts
  * @param {string|Buffer} [opts.content] BOM data to feed over stdin.
@@ -284,6 +328,9 @@ export async function runCdxrs(subcommand, opts = {}) {
     let timedOut = false;
     const stdoutChunks = [];
     const stderrChunks = [];
+    const stdoutLimit = maxStdoutBytes();
+    let stdoutBytes = 0;
+    let stdoutOverflow = false;
 
     const pluginRuntime = getDefaultPluginRuntime();
     const env = { ...process.env };
@@ -313,6 +360,17 @@ export async function runCdxrs(subcommand, opts = {}) {
       child.stdin.end(stdinContent);
     }
 
+    // Kill the process group (-pid) so any child processes of cdxrs die too.
+    // Best effort: the process may have already exited, in which case the
+    // close/error handlers take over.
+    const killProcessGroup = () => {
+      try {
+        process.kill(-child.pid, "SIGKILL");
+      } catch {
+        child.kill("SIGKILL");
+      }
+    };
+
     const timer = setTimeout(() => {
       timedOut = true;
       if (DEBUG_MODE) {
@@ -320,16 +378,21 @@ export async function runCdxrs(subcommand, opts = {}) {
           `cdxrs: timeout after ${timeoutMs}ms, killing process group.`,
         );
       }
-      try {
-        // Kill the process group (-pid) so any child processes of cdxrs die too.
-        process.kill(-child.pid, "SIGKILL");
-      } catch {
-        // Process may have already exited; fall through to error handling.
-        child.kill("SIGKILL");
-      }
+      killProcessGroup();
     }, timeoutMs);
 
     child.stdout?.on("data", (chunk) => {
+      if (stdoutOverflow) {
+        return;
+      }
+      stdoutBytes += chunk.length;
+      if (stdoutBytes > stdoutLimit) {
+        // The payload can never become a deliverable string, so stop
+        // buffering, kill the child, and let the close handler fall back.
+        stdoutOverflow = true;
+        killProcessGroup();
+        return;
+      }
       stdoutChunks.push(chunk);
     });
 
@@ -365,8 +428,36 @@ export async function runCdxrs(subcommand, opts = {}) {
         return;
       }
 
-      const stdout = Buffer.concat(stdoutChunks).toString();
-      const stderr = Buffer.concat(stderrChunks).toString();
+      // Checked before the exit code: the child was killed mid-stream for
+      // producing more stdout than can ever be delivered as a string, so even
+      // an exit-0 result is an undeliverable truncation (issue 4393).
+      if (stdoutOverflow) {
+        console.warn(
+          `cdxrs: stdout passed ${stdoutLimit} bytes (a string cannot exceed ${V8_MAX_STRING_CHARS} characters), so the child was stopped.`,
+        );
+        resolve({ ...CDXRS_FALLBACK, reason: "stdout-too-large" });
+        return;
+      }
+
+      let stdout;
+      try {
+        stdout = Buffer.concat(stdoutChunks).toString();
+      } catch (err) {
+        // The byte cap above should make this unreachable; it is kept so that
+        // no failure inside this handler can abort SBOM generation.
+        console.warn(
+          `cdxrs: could not collect child stdout (${err.message}), falling back to JS path.`,
+        );
+        resolve({ ...CDXRS_FALLBACK, reason: "stdout-collect-failed" });
+        return;
+      }
+      let stderr = "";
+      try {
+        stderr = Buffer.concat(stderrChunks).toString();
+      } catch {
+        // stderr carries NDJSON logs, already forwarded as they arrived;
+        // dropping the raw tail must not fail a run with valid stdout.
+      }
 
       // For the validate subcommand, exit code 3 means "validation failure
       // with findings on stdout" — the operation succeeded, the BOM just has

package/lib/inventory/cmakeBuildDirs.js

@@ -0,0 +1,254 @@
+/**
+ * Where a C/C++ project's build trees are: the build directories its CMake
+ * presets configure, and the conventional ones (`build`, `build-<name>`,
+ * `out`, `builddir`, `cmake-build-<name>`). Shared by the lookups for
+ * `CMakeCache.txt` and for the compilation database, so both search the same
+ * places in the same order.
+ */
+
+import { readdirSync, readFileSync, statSync } from "node:fs";
+import { platform } from "node:os";
+import {
+  basename,
+  delimiter,
+  dirname,
+  isAbsolute,
+  join,
+  relative,
+  resolve,
+} from "node:path";
+
+import { isSecureMode, readEnvironmentVariable } from "../core/activity.js";
+import {
+  expandPresetMacros,
+  parseCmakePresets,
+  resolveConfigurePresets,
+} from "../parsers/cmakePresets.js";
+
+/** Presets files CMake reads from the source directory, in order. */
+const PRESETS_FILES = ["CMakePresets.json", "CMakeUserPresets.json"];
+
+/** A presets file larger than this is not read. */
+const MAX_PRESETS_FILE_BYTES = 4 * 1024 * 1024;
+
+/** At most this many presets files are read, includes counted. */
+const MAX_PRESETS_FILES = 64;
+
+/** At most this many build directories are proposed. */
+const MAX_BUILD_DIRS = 128;
+
+const HOST_SYSTEM_NAMES = {
+  darwin: "Darwin",
+  linux: "Linux",
+  win32: "Windows",
+  freebsd: "FreeBSD",
+  openbsd: "OpenBSD",
+  netbsd: "NetBSD",
+  sunos: "SunOS",
+  aix: "AIX",
+};
+
+/**
+ * Whether `child` is `parent` or inside it.
+ *
+ * @param {string} child Path to test
+ * @param {string} parent Directory
+ * @returns {boolean}
+ */
+export function isInsideDir(child, parent) {
+  const rel = relative(resolve(parent), resolve(child));
+  return rel === "" || (!rel.startsWith("..") && !isAbsolute(rel));
+}
+
+function isDirectory(p) {
+  try {
+    return statSync(p).isDirectory();
+  } catch (_err) {
+    return false;
+  }
+}
+
+function readSmallFile(p) {
+  try {
+    const stat = statSync(p);
+    if (!stat.isFile() || stat.size > MAX_PRESETS_FILE_BYTES) {
+      return undefined;
+    }
+    return readFileSync(p, "utf-8");
+  } catch (_err) {
+    return undefined;
+  }
+}
+
+/**
+ * CMake's `${hostSystemName}` for this host.
+ *
+ * @returns {string}
+ */
+export function hostSystemName() {
+  return HOST_SYSTEM_NAMES[platform()] || platform();
+}
+
+/**
+ * Read a project's presets documents: `CMakePresets.json` and
+ * `CMakeUserPresets.json`, each followed by the files it includes (schema
+ * version 4 and later). In secure mode an include outside the project is not
+ * read.
+ *
+ * @param {string} root Project source directory
+ * @returns {Array<{file: string, fileDir: string, document: Object}>}
+ */
+export function readCmakePresetDocuments(root) {
+  const sourceDir = resolve(root);
+  const documents = [];
+  const seen = new Set();
+  const visit = (file) => {
+    const abs = resolve(file);
+    if (seen.has(abs) || seen.size >= MAX_PRESETS_FILES) {
+      return;
+    }
+    seen.add(abs);
+    if (isSecureMode && !isInsideDir(abs, sourceDir)) {
+      return;
+    }
+    const document = parseCmakePresets(readSmallFile(abs));
+    if (!document) {
+      return;
+    }
+    const fileDir = dirname(abs);
+    documents.push({ file: abs, fileDir, document });
+    for (const include of document.include) {
+      const expanded = expandPresetMacros(include, {
+        sourceDir,
+        sourceParentDir: dirname(sourceDir),
+        sourceDirName: basename(sourceDir),
+        fileDir,
+        pathListSep: delimiter,
+        hostSystemName: hostSystemName(),
+        penv: readEnvironmentVariable,
+      });
+      visit(isAbsolute(expanded) ? expanded : join(fileDir, expanded));
+    }
+  };
+  for (const name of PRESETS_FILES) {
+    visit(join(sourceDir, name));
+  }
+  return documents;
+}
+
+/**
+ * The visible configure presets of a project, resolved and with their macros
+ * expanded for this host.
+ *
+ * @param {string} root Project source directory
+ * @returns {Object[]} See `resolveConfigurePresets`
+ */
+export function readCmakeConfigurePresets(root) {
+  const sourceDir = resolve(root);
+  const documents = readCmakePresetDocuments(sourceDir);
+  if (!documents.length) {
+    return [];
+  }
+  return resolveConfigurePresets(documents, {
+    sourceDir,
+    sourceParentDir: dirname(sourceDir),
+    sourceDirName: basename(sourceDir),
+    hostSystemName: hostSystemName(),
+    pathListSep: delimiter,
+    penv: readEnvironmentVariable,
+  });
+}
+
+function childDirs(dir, accept = () => true) {
+  try {
+    return readdirSync(dir, { withFileTypes: true })
+      .filter((e) => e.isDirectory() && accept(e.name))
+      .map((e) => join(dir, e.name))
+      .sort();
+  } catch (_err) {
+    return [];
+  }
+}
+
+/** The order conventional build directories are searched in. */
+function conventionalRank(dir) {
+  const name = basename(dir);
+  if (name === "build") {
+    return 0;
+  }
+  if (name === "out") {
+    return 2;
+  }
+  if (name === "builddir") {
+    return 3;
+  }
+  if (name.startsWith("cmake-build-")) {
+    return 4;
+  }
+  return 1;
+}
+
+/**
+ * The directories a project's build trees may be in, most specific first:
+ * the directory of an explicit `--cmake-cache`, the build directories of its
+ * configure presets, then the `build`, `build-<name>`, `out`, `builddir` and
+ * `cmake-build-<name>` directories at the project root, and the directories
+ * one level below `build`, `out` and `out/build` (where Visual Studio puts
+ * preset builds). Only existing directories are listed; in secure mode, only
+ * those inside the project.
+ *
+ * @param {string} root Project source directory
+ * @param {Object} [options] CLI options (`cmakeCache`)
+ * @returns {string[]} Absolute directories, without duplicates
+ */
+export function cmakeBuildDirCandidates(root, options = {}) {
+  const sourceDir = resolve(root);
+  const dirs = [];
+  const add = (d) => {
+    if (!d || dirs.length >= MAX_BUILD_DIRS) {
+      return;
+    }
+    const abs = resolve(d);
+    if (dirs.includes(abs) || abs === sourceDir) {
+      return;
+    }
+    if (isSecureMode && !isInsideDir(abs, sourceDir)) {
+      return;
+    }
+    if (isDirectory(abs)) {
+      dirs.push(abs);
+    }
+  };
+  if (options.cmakeCache) {
+    add(dirname(resolve(`${options.cmakeCache}`)));
+  }
+  if (!isDirectory(sourceDir)) {
+    return dirs;
+  }
+  for (const preset of readCmakeConfigurePresets(sourceDir)) {
+    add(preset.binaryDir);
+  }
+  const rootBuildDirs = childDirs(
+    sourceDir,
+    (name) =>
+      name.startsWith("build") ||
+      name === "out" ||
+      name.startsWith("cmake-build-"),
+  );
+  rootBuildDirs.sort(
+    (a, b) => conventionalRank(a) - conventionalRank(b) || a.localeCompare(b),
+  );
+  for (const d of rootBuildDirs) {
+    add(d);
+  }
+  for (const parent of [
+    join(sourceDir, "build"),
+    join(sourceDir, "out"),
+    join(sourceDir, "out", "build"),
+  ]) {
+    for (const d of childDirs(parent)) {
+      add(d);
+    }
+  }
+  return dirs;
+}