@cdxgen/cdxgen 13.2.0 → 13.4.0

package/lib/inventory/mcpConfigParser.js

@@ -1,12 +1,11 @@
 import { readFileSync } from "node:fs";
 import { basename } from "node:path";
 
-import * as toml from "smol-toml";
-
 import {
   sanitizeBomPropertyValue,
   sanitizeBomUrl,
 } from "../core/propertySanitizer.js";
+import { parseToml } from "../core/toml.js";
 import { parseJsonLike } from "./jsonLike.js";
 import { classifyMcpReference } from "./mcp.js";
 import {
@@ -813,7 +812,7 @@ export const mcpConfigParser = {
       let configJson;
       try {
         configJson = filePath.toLowerCase().endsWith(".toml")
-          ? toml.parse(raw)
+          ? parseToml(raw)
           : parseJsonLike(raw);
       } catch {
         continue;

package/lib/inventory/parentSelection.js

@@ -0,0 +1,146 @@
+/**
+ * Which detected project becomes the parent (`metadata.component`) when one
+ * scan covers several ecosystems and no parent was given.
+ *
+ * Each ecosystem detects its own project from its own manifest. The project
+ * whose manifest sits at the scan root describes the repository; one found
+ * deeper is a part of it (a web client in `tools/ui/`, a helper script's
+ * `pyproject.toml`). So candidates are ordered by how deep their ecosystem's
+ * manifests sit, the scan root first, and ties keep the ecosystem order the
+ * scan ran in.
+ */
+
+import { readdirSync } from "node:fs";
+import { dirname, relative, resolve, sep } from "node:path";
+
+import { getAllFiles } from "../core/fs.js";
+
+/**
+ * Manifest file names (or `*.ext` suffixes) per purl type: the files a
+ * project of that ecosystem is described by.
+ */
+const MANIFESTS_BY_PURL_TYPE = {
+  npm: ["package.json"],
+  pypi: [
+    "pyproject.toml",
+    "setup.py",
+    "setup.cfg",
+    "Pipfile",
+    "requirements.txt",
+    "uv.lock",
+    "poetry.lock",
+    "pixi.toml",
+  ],
+  generic: [
+    "CMakeLists.txt",
+    "meson.build",
+    "conanfile.txt",
+    "conanfile.py",
+    "vcpkg.json",
+    "xmake.lua",
+  ],
+  maven: ["pom.xml", "build.gradle", "build.gradle.kts", "build.sbt"],
+  golang: ["go.mod"],
+  cargo: ["Cargo.toml"],
+  composer: ["composer.json"],
+  gem: ["Gemfile", "*.gemspec"],
+  nuget: ["*.csproj", "*.fsproj", "*.vbproj", "*.sln", "packages.config"],
+  pub: ["pubspec.yaml"],
+  hex: ["mix.exs"],
+  hackage: ["*.cabal", "stack.yaml"],
+  swift: ["Package.swift"],
+  cocoapods: ["Podfile"],
+  clojars: ["deps.edn", "project.clj"],
+};
+
+/** The purl type of a component, or `undefined`. */
+function purlTypeOf(component) {
+  const purl = `${component?.purl || ""}`;
+  if (!purl.startsWith("pkg:")) {
+    return undefined;
+  }
+  const rest = purl.slice(4);
+  const end = rest.search(/[/@?#]/);
+  return (end < 0 ? rest : rest.slice(0, end)).toLowerCase();
+}
+
+function matchesManifest(name, patterns) {
+  return patterns.some((p) =>
+    p.startsWith("*.") ? name.endsWith(p.slice(1)) : name === p,
+  );
+}
+
+/**
+ * How deep the shallowest manifest of an ecosystem sits under a scan root:
+ * 0 for one at the root itself, `Infinity` when there is none (or the
+ * ecosystem is not one this module knows).
+ *
+ * @param {string} root Scan root
+ * @param {string} purlType Purl type of the ecosystem
+ * @param {Object} options CLI options (exclusions)
+ * @returns {number}
+ */
+export function manifestDepth(root, purlType, options = {}) {
+  const patterns = MANIFESTS_BY_PURL_TYPE[purlType];
+  if (!patterns || !root) {
+    return Number.POSITIVE_INFINITY;
+  }
+  const absRoot = resolve(root);
+  try {
+    if (readdirSync(absRoot).some((name) => matchesManifest(name, patterns))) {
+      return 0;
+    }
+  } catch (_err) {
+    return Number.POSITIVE_INFINITY;
+  }
+  const glob =
+    patterns.length === 1 ? `**/${patterns[0]}` : `**/{${patterns.join(",")}}`;
+  const files = getAllFiles(absRoot, glob, options);
+  let depth = Number.POSITIVE_INFINITY;
+  for (const f of files) {
+    const rel = relative(absRoot, dirname(resolve(f)));
+    if (!rel || rel.startsWith("..")) {
+      continue;
+    }
+    depth = Math.min(depth, rel.split(sep).length);
+  }
+  return depth;
+}
+
+/**
+ * Order parent candidates by the depth of their ecosystem's manifests under
+ * the scan roots (the shallowest first). The sort is stable, so candidates of
+ * equal depth keep the order the ecosystems were scanned in.
+ *
+ * @param {Object[]} candidates Detected parent components, in scan order
+ * @param {string[]} roots Scan roots
+ * @param {Object} options CLI options
+ * @returns {Object[]} The candidates, reordered
+ */
+export function orderParentCandidates(candidates, roots, options = {}) {
+  const depthByType = new Map();
+  const depthOf = (component) => {
+    const type = purlTypeOf(component);
+    if (!type) {
+      return Number.POSITIVE_INFINITY;
+    }
+    if (!depthByType.has(type)) {
+      depthByType.set(
+        type,
+        Math.min(
+          Number.POSITIVE_INFINITY,
+          ...(roots || []).map((r) => manifestDepth(r, type, options)),
+        ),
+      );
+    }
+    return depthByType.get(type);
+  };
+  return candidates
+    .map((component, index) => ({
+      component,
+      index,
+      depth: depthOf(component),
+    }))
+    .sort((a, b) => a.depth - b.depth || a.index - b.index)
+    .map((c) => c.component);
+}

package/lib/inventory/protobom.js

@@ -143,7 +143,14 @@ export const readBinary = (binFile, asJson, specVersion) => {
       ? decodeBomBinary(specVersion, binaryData, BINARY_READ_OPTIONS)
       : parseBomBinary(binaryData, BINARY_READ_OPTIONS);
   if (asJson) {
-    return encodeBomJson(bomObject);
+    const bomJson = encodeBomJson(bomObject);
+    // Protobuf omits empty repeated fields, so a round-trip drops empty
+    // dependsOn lists. Restore them so JSON and protobuf inputs yield
+    // identical documents.
+    for (const adep of bomJson?.dependencies || []) {
+      adep.dependsOn ??= [];
+    }
+    return bomJson;
   }
   return bomObject;
 };

package/lib/inventory/purl.js

@@ -53,15 +53,30 @@ export function purlTypeIsRegisteredString(purlString) {
 }
 
 /**
- * Encode a string for safe inclusion in a PackageURL, percent-encoding special characters
- * while preserving already-encoded `%40` sequences and keeping `:` and `/` unencoded.
+ * Encode a string for inclusion in a hand-written PackageURL string,
+ * percent-encoding every character the purl grammar does not allow literally,
+ * while preserving already-encoded `%40` sequences and keeping `:` and `/`
+ * unencoded.
+ *
+ * `encodeURIComponent` alone leaves `!`, `'`, `(`, `)` and `*` literal, and the
+ * purl grammar requires them escaped, so they are escaped here as well.
+ *
+ * Only for comparing against or assembling purl text. Never pass the result to
+ * `build()`, `new Purl()` or one of the helpers in this module: they escape
+ * their inputs themselves, and escaping twice turns `+` into `%252B`.
  *
  * @param {string} s String to encode
  * @returns {string} Encoded string suitable for use in a PackageURL component
  */
 export function encodeForPurl(s) {
   return s && !s.includes("%40")
-    ? encodeURIComponent(s).replace(/%3A/g, ":").replace(/%2F/g, "/")
+    ? encodeURIComponent(s)
+        .replace(
+          /[!'()*]/g,
+          (c) => `%${c.charCodeAt(0).toString(16).toUpperCase()}`,
+        )
+        .replace(/%3A/g, ":")
+        .replace(/%2F/g, "/")
     : s;
 }
 
@@ -328,6 +343,140 @@ export function isValidPurl(candidate) {
   }
 }
 
+/**
+ * Split a purl into its components without requiring it to be well-formed.
+ *
+ * `Purl.parse` rejects a purl whose parts are not already escaped, which is the
+ * case this exists to handle: a `bom-ref` (cdxgen writes the decoded form of the
+ * purl there), a `go mod graph` token such as `github.com/Azure/go-autorest@v14.2.0+incompatible`,
+ * or a purl from a third-party document that left a `+` or a `://` unescaped.
+ * The separators (`:`, `/`, `@`, `?`, `#`, `&`, `=`) are structural and are read
+ * positionally; everything between them is decoded and handed back raw, ready
+ * for `build` to escape correctly.
+ *
+ * The version is taken after the last `@` of the path, so a scoped npm name
+ * (`@scope/name@1.0.0`) and a composer branch version (`dev-feature/x`) both
+ * split correctly.
+ *
+ * @param {string} purl Purl to split
+ * @returns {{type: string, namespace: (string|null), name: string, version: (string|null), qualifiers: (Object|null), subpath: (string|null)}|null} Parts, or null when the purl has no type and name
+ */
+export function splitPurlLoose(purl) {
+  if (typeof purl !== "string" || !purl.startsWith("pkg:")) {
+    return null;
+  }
+  const decode = (value) => {
+    try {
+      return decodeURIComponent(value);
+    } catch {
+      return value;
+    }
+  };
+  let rest = purl.slice("pkg:".length).replace(/^\/+/, "");
+  let subpath = null;
+  const hash = rest.indexOf("#");
+  if (hash !== -1) {
+    subpath = decode(rest.slice(hash + 1)) || null;
+    rest = rest.slice(0, hash);
+  }
+  let qualifiers = null;
+  const query = rest.indexOf("?");
+  if (query !== -1) {
+    qualifiers = {};
+    for (const pair of rest.slice(query + 1).split("&")) {
+      const equals = pair.indexOf("=");
+      if (equals <= 0) {
+        continue;
+      }
+      qualifiers[pair.slice(0, equals)] = decode(pair.slice(equals + 1));
+    }
+    if (!Object.keys(qualifiers).length) {
+      qualifiers = null;
+    }
+    rest = rest.slice(0, query);
+  }
+  const slash = rest.indexOf("/");
+  if (slash <= 0) {
+    return null;
+  }
+  const type = rest.slice(0, slash);
+  let path = rest.slice(slash + 1);
+  let version = null;
+  const at = path.lastIndexOf("@");
+  if (at > 0 && path[at - 1] !== "/") {
+    version = decode(path.slice(at + 1)) || null;
+    path = path.slice(0, at);
+  }
+  const segments = path.split("/").filter(Boolean).map(decode);
+  const name = segments.pop();
+  if (!name) {
+    return null;
+  }
+  return {
+    type,
+    namespace: segments.length ? segments.join("/") : null,
+    name,
+    version,
+    qualifiers,
+    subpath,
+  };
+}
+
+/**
+ * Parse a purl string that may carry unescaped reserved characters.
+ *
+ * A well-formed purl is parsed strictly, so its components come back exactly as
+ * cdx-purl reads them. Anything else is split structurally by
+ * {@link splitPurlLoose}. Use this where the input is known to be a decoded or
+ * hand-written purl (a `bom-ref`, a workspace reference, a package manager's
+ * `name@version` token), never to accept an invalid purl into a `purl` field:
+ * pass the parts to `build()` instead, which escapes them.
+ *
+ * @param {string} purlString Purl or decoded purl
+ * @returns {{type: string, namespace: (string|null), name: string, version: (string|null), qualifiers: (Object|null), subpath: (string|null)}|null} Raw components, or null when nothing purl-shaped remains
+ */
+export function parsePurlLoose(purlString) {
+  if (typeof purlString !== "string" || !purlString.startsWith("pkg:")) {
+    return null;
+  }
+  try {
+    const parsed = Purl.parse(purlString);
+    return {
+      type: parsed.type,
+      namespace: parsed.namespace || null,
+      name: parsed.name,
+      version: parsed.version || null,
+      qualifiers: parsed.qualifiers || null,
+      subpath: parsed.subpath || null,
+    };
+  } catch (err) {
+    if (!err?.code?.startsWith("E_")) {
+      throw err;
+    }
+  }
+  return splitPurlLoose(purlString);
+}
+
+/**
+ * Turn a decoded or hand-written purl into a canonical, correctly escaped one.
+ *
+ * `bom-ref` values are the decoded form of a purl
+ * (`pkg:npm/foo@1.0.0+build`), which cdx-purl rightly rejects as a purl. This
+ * recovers the purl the ref was made from by splitting it structurally and
+ * rebuilding it with `build()`, so every reserved character is escaped exactly
+ * once.
+ *
+ * @param {string} purlString Purl or decoded purl
+ * @returns {string|null} Canonical purl string, or `null` when no valid purl can be built
+ */
+export function canonicalPurlFromLooseString(purlString) {
+  const parts = parsePurlLoose(purlString);
+  if (!parts) {
+    return null;
+  }
+  return tryBuildPurl(parts);
+}
+
 /**
  * Parse a purl string, returning `null` instead of throwing when it is invalid.
  *

package/lib/inventory/rustFormulationParser.js

@@ -1,9 +1,8 @@
 import { readFileSync } from "node:fs";
 import { basename, dirname, join } from "node:path";
 
-import * as toml from "smol-toml";
-
 import { safeExistsSync } from "../core/fs.js";
+import { parseToml } from "../core/toml.js";
 
 // Keep this list conservative and high-signal: it is meant to surface common
 // Rust native build helpers for audit triage, not to exhaustively model every
@@ -67,7 +66,7 @@ function createFormulationComponent(name, filePath, toolName) {
 function parseCargoManifest(filePath) {
   let cargoData;
   try {
-    cargoData = toml.parse(readFileSync(filePath, { encoding: "utf-8" }));
+    cargoData = parseToml(readFileSync(filePath, { encoding: "utf-8" }));
   } catch {
     return undefined;
   }
@@ -252,7 +251,7 @@ function parseCargoManifest(filePath) {
 function parsePyProject(filePath) {
   let pyprojectData;
   try {
-    pyprojectData = toml.parse(readFileSync(filePath, { encoding: "utf-8" }));
+    pyprojectData = parseToml(readFileSync(filePath, { encoding: "utf-8" }));
   } catch {
     return undefined;
   }

package/lib/inventory/sbomDocument.js

@@ -14,6 +14,7 @@
 import { build, Purl } from "@cdxgen/cdx-purl";
 
 import { isSpdxJsonLd } from "./bomUtils.js";
+import { splitPurlLoose } from "./purl.js";
 import { toCycloneDxLikeBom } from "./spdxUtils.js";
 
 // A document larger than this is not a plausible SBOM for a single
@@ -150,75 +151,6 @@ function encodeVersionBuildMetadata(purl) {
   return `${head.slice(0, at + 1)}${head.slice(at + 1).replaceAll("+", "%2B")}${tail}`;
 }
 
-/**
- * Split a purl into its components without requiring it to be well-formed.
- *
- * `Purl.parse` rejects a purl whose parts are not already escaped, which is the
- * case this exists to handle. The separators (`:`, `/`, `@`, `?`, `#`, `&`,
- * `=`) are structural and are read positionally; everything between them is
- * decoded and handed back raw, ready for `build` to escape correctly.
- *
- * @param {string} purl Purl to split
- * @returns {{type: string, namespace: (string|null), name: string, version: (string|null), qualifiers: (Object|null), subpath: (string|null)}|null} Parts, or null when the purl has no type and name
- */
-function splitPurl(purl) {
-  const decode = (value) => {
-    try {
-      return decodeURIComponent(value);
-    } catch {
-      return value;
-    }
-  };
-  let rest = purl.slice("pkg:".length).replace(/^\/+/, "");
-  let subpath = null;
-  const hash = rest.indexOf("#");
-  if (hash !== -1) {
-    subpath = decode(rest.slice(hash + 1)) || null;
-    rest = rest.slice(0, hash);
-  }
-  let qualifiers = null;
-  const query = rest.indexOf("?");
-  if (query !== -1) {
-    qualifiers = {};
-    for (const pair of rest.slice(query + 1).split("&")) {
-      const equals = pair.indexOf("=");
-      if (equals <= 0) {
-        continue;
-      }
-      qualifiers[pair.slice(0, equals)] = decode(pair.slice(equals + 1));
-    }
-    if (!Object.keys(qualifiers).length) {
-      qualifiers = null;
-    }
-    rest = rest.slice(0, query);
-  }
-  const slash = rest.indexOf("/");
-  if (slash <= 0) {
-    return null;
-  }
-  const type = rest.slice(0, slash);
-  let path = rest.slice(slash + 1);
-  let version = null;
-  const at = path.lastIndexOf("@");
-  if (at > 0) {
-    version = decode(path.slice(at + 1)) || null;
-    path = path.slice(0, at);
-  }
-  const segments = path.split("/").filter(Boolean).map(decode);
-  const name = segments.pop();
-  if (!name) {
-    return null;
-  }
-  return {
-    type,
-    namespace: segments.length ? segments.join("/") : null,
-    name,
-    version,
-    qualifiers,
-    subpath,
-  };
-}
-
 /**
  * Repair the purl of a component read from a third-party document.
  *
@@ -247,7 +179,7 @@ export function repairPurl(component) {
   } catch {
     // Fall through to the structural rebuild below.
   }
-  const parts = splitPurl(repaired);
+  const parts = splitPurlLoose(repaired);
   if (!parts) {
     return;
   }

package/lib/inventory/scalaCoords.js

@@ -0,0 +1,153 @@
+import { Purl } from "@cdxgen/cdx-purl";
+
+// Scala libraries publish their Maven artifacts with a trailing Scala binary
+// version suffix (`jwt-core_3`, `coursier_2.13`), optionally preceded by a
+// platform suffix for Scala.js and Scala Native builds (`upickle_sjs1_3`,
+// `upickle_native0.5_3`). sbt components strip the binary suffix and keep the
+// platform suffix (`jwt-core`, `upickle_sjs1`), so the same library is named
+// differently depending on the build tool that reported it.
+const SCALA_BINARY_SUFFIX_REGEX = /_(2\.\d+|3)$/;
+const SCALA_PLATFORM_SUFFIX_REGEX = /_(sjs1|sjs0\.6|native0\.\d+)$/;
+
+/**
+ * Parse a Scala-published Maven artifact name into its coordinate parts.
+ *
+ * @param {string} name Maven artifactId, for example `upickle_sjs1_3`
+ * @returns {{ originalName: string, artifactBase: string, binaryVersion: string|null,
+ *   platformSuffix: string, purlName: string }} The artifact name without any
+ *   Scala suffix (`upickle`), the Scala binary version from the suffix (`3`),
+ *   the platform suffix including the underscore (`_sjs1`) or an empty string,
+ *   and the artifact name sbt-style purls emit (binary suffix dropped, platform
+ *   suffix kept).
+ */
+export function parseScalaArtifact(name) {
+  const result = {
+    originalName: name,
+    artifactBase: name,
+    binaryVersion: null,
+    platformSuffix: "",
+    purlName: name,
+  };
+  if (!name) {
+    return result;
+  }
+  let rest = name;
+  const binaryMatch = rest.match(SCALA_BINARY_SUFFIX_REGEX);
+  if (binaryMatch) {
+    result.binaryVersion = binaryMatch[1];
+    rest = rest.slice(0, rest.length - binaryMatch[0].length);
+  }
+  const platformMatch = rest.match(SCALA_PLATFORM_SUFFIX_REGEX);
+  if (platformMatch) {
+    result.platformSuffix = platformMatch[0];
+    rest = rest.slice(0, rest.length - platformMatch[0].length);
+  }
+  result.artifactBase = rest;
+  result.purlName = binaryMatch ? `${rest}${result.platformSuffix}` : name;
+  return result;
+}
+
+/**
+ * Build a qualifier-free coordinate key for a Scala-published artifact.
+ *
+ * The key ignores purl qualifiers such as `repository_url` and `type`, so the
+ * POM-coordinate keys of the jar namespace mapping and the sbt-style purls of
+ * the components resolve to the same entry.
+ *
+ * @param {Object} parts Coordinate parts
+ * @param {string} [parts.type] Purl type, defaults to `maven`
+ * @param {string} [parts.group] Maven groupId
+ * @param {string} parts.artifactBase Artifact name without any Scala suffix
+ * @param {string} [parts.platformSuffix] `_sjs1`, `_native0.5` or empty
+ * @param {string} [parts.version] Package version
+ * @returns {string} The coordinate key
+ */
+export function scalaCoordinateKey({
+  type = "maven",
+  group = "",
+  artifactBase = "",
+  platformSuffix = "",
+  version = "",
+} = {}) {
+  return [type, group, artifactBase, platformSuffix, version].join(":");
+}
+
+/**
+ * Build the qualifier-free coordinate key of a purl string.
+ *
+ * The artifact name is normalized with {@link parseScalaArtifact}, so
+ * `pkg:maven/g/foo_3@1.0` and the sbt-style `pkg:maven/g/foo@1.0` share a key,
+ * while the Scala.js build `foo_sjs1_3` keeps its own key (`foo` plus the
+ * `_sjs1` platform suffix) and never joins the plain `foo` component.
+ *
+ * @param {string} purlString Package URL to normalize
+ * @returns {string|undefined} The coordinate key, or undefined when the string
+ *   is not a parseable purl
+ */
+export function coordinateKeyFromPurl(purlString) {
+  return scalaCoordinateOfPurl(purlString)?.key;
+}
+
+/**
+ * The coordinate key of a purl together with the Scala binary version its
+ * artifact name carries, if any.
+ *
+ * @param {string} purlString Package URL to normalize
+ * @returns {{ key: string, binaryVersion: string|null }|undefined} The key
+ *   and binary version, or undefined when the string is not a parseable purl
+ */
+export function scalaCoordinateOfPurl(purlString) {
+  if (!purlString?.startsWith("pkg:")) {
+    return undefined;
+  }
+  let purlObj;
+  try {
+    purlObj = Purl.parse(purlString);
+  } catch (_err) {
+    return undefined;
+  }
+  if (!purlObj?.name) {
+    return undefined;
+  }
+  const scalaInfo = parseScalaArtifact(purlObj.name);
+  return {
+    key: scalaCoordinateKey({
+      type: purlObj.type,
+      group: purlObj.namespace || "",
+      artifactBase: scalaInfo.artifactBase,
+      platformSuffix: scalaInfo.platformSuffix,
+      version: purlObj.version || "",
+    }),
+    binaryVersion: scalaInfo.binaryVersion,
+  };
+}
+
+// An artifact name that already ends in a full Scala version, as scala-cli
+// `:::` and sbt `CrossVersion.full` artifacts do (`_3.3.7`, `_2.13.16`). A
+// binary suffix such as `_3` left on a name is part of the name: the
+// component producers strip exactly one, into the compiler version.
+const SCALA_FULL_VERSION_SUFFIX_REGEX = /_\d+\.\d+\.\d+(?:-[A-Za-z0-9.]+)?$/;
+
+/**
+ * The artifactId the library is published under, for cache and repository
+ * lookups only. Components a Scala build tool reports carry the name with the
+ * Scala binary suffix stripped (the platform suffix kept) together with
+ * `cdx:scala:compilerVersion`; on disk and in the repository the artifact is
+ * `cats-core_2.13` or `upickle_sjs1_3`. Names that end in a full Scala version
+ * are used as they are.
+ *
+ * The component's own `name`, `purl` and `bom-ref` never change.
+ *
+ * @param {Object} pkg Package with `name` and `properties`.
+ * @returns {string} The artifactId to look up.
+ */
+export function publishedArtifactId(pkg) {
+  const name = pkg?.name;
+  if (!name || SCALA_FULL_VERSION_SUFFIX_REGEX.test(name)) {
+    return name;
+  }
+  const binaryVersion = (pkg.properties || []).find(
+    (property) => property.name === "cdx:scala:compilerVersion",
+  )?.value;
+  return binaryVersion ? `${name}_${binaryVersion}` : name;
+}