@cdxgen/cdxgen 13.2.0 → 13.4.0

package/lib/inventory/source.js

@@ -7,7 +7,6 @@ import { Purl } from "@cdxgen/cdx-purl";
 import { coerce, diff, prerelease } from "semver";
 
 import {
-  cdxgenAgent,
   createDryRunError,
   DEBUG_MODE,
   hasDangerousUnicode,
@@ -24,12 +23,14 @@ import {
 } from "../core/fs.js";
 import { thoughtLog } from "../core/logger.js";
 import { isValidDriveRoot, isWin } from "../core/paths.js";
+import { registerRunReset } from "../core/runState.js";
 import {
+  gatedGet,
   prefetchEnabled,
   prefetchedResponse,
   prefetchJson,
-  withHostRateLimit,
 } from "./fetchBatch.js";
+import { canonicalPurlFromLooseString } from "./purl.js";
 
 /** Raised when a caller omits a registry helper that the purl type requires. */
 class MissingRegistryHelperError extends Error {}
@@ -954,6 +955,36 @@ function packageNameForLookup(purlObj) {
   return `${namespace}/${purlObj.name}`;
 }
 
+/**
+ * Read a purl supplied as a scan source.
+ *
+ * People type purls the way their package manager prints versions and URLs:
+ * `pkg:cargo/wasi@0.11.0+wasi-snapshot-preview1` or
+ * `pkg:npm/foo?vcs_url=git+https://...`. cdx-purl requires those `+` to be
+ * escaped, so a purl that does not parse strictly is split on its separators
+ * and rebuilt with every component escaped once. The rebuilt purl is then
+ * parsed strictly, so validation always inspects cdx-purl's reading of it.
+ *
+ * @param {string} purlString Package URL as supplied
+ * @returns {Purl|undefined} Parsed purl, or undefined when none can be recovered
+ */
+function parsePurlSourceInput(purlString) {
+  try {
+    return Purl.parse(purlString);
+  } catch {
+    // Fall through to the structural rebuild.
+  }
+  const canonical = canonicalPurlFromLooseString(purlString);
+  if (!canonical) {
+    return undefined;
+  }
+  try {
+    return Purl.parse(canonical);
+  } catch {
+    return undefined;
+  }
+}
+
 /**
  * Validate package URL source input and return an error object when invalid.
  *
@@ -964,10 +995,8 @@ export function validatePurlSource(purlString) {
   if (!maybePurlSource(purlString)) {
     return null;
   }
-  let purlObj;
-  try {
-    purlObj = Purl.parse(purlString);
-  } catch (_err) {
+  const purlObj = parsePurlSourceInput(purlString);
+  if (!purlObj) {
     return {
       status: 400,
       error: "Invalid purl source",
@@ -1136,6 +1165,8 @@ export function resetGitUrlSourcePrefetch() {
   gitUrlSourcePrefetch = new Map();
 }
 
+registerRunReset("source:registry-documents", resetGitUrlSourcePrefetch);
+
 /**
  * Prefetch the registry documents a list of purls will be resolved from.
  *
@@ -1189,12 +1220,10 @@ async function fetchRegistryDocument(lookup) {
   // whose policy is one request per second however the request was reached.
   return (
     prefetchedResponse(gitUrlSourcePrefetch, lookup.url) ||
-    (await withHostRateLimit(lookup.url, () =>
-      cdxgenAgent.get(lookup.url, {
-        ...(lookup.accept ? { headers: { Accept: lookup.accept } } : {}),
-        responseType: "json",
-      }),
-    ))
+    (await gatedGet(lookup.url, {
+      ...(lookup.accept ? { headers: { Accept: lookup.accept } } : {}),
+      responseType: "json",
+    }))
   );
 }
 
@@ -1209,24 +1238,13 @@ function parsePurlForSourceResolution(purlString) {
   if (!maybePurlSource(purlString) || validatePurlSource(purlString)) {
     return undefined;
   }
-  let purlObj;
-  try {
-    // Some purls in the wild use unencoded + in qualifier values (e.g.
-    // git+https:// in vcs_url). cdx-purl requires percent-encoding; normalize
-    // the qualifier section before parsing so real-world purls resolve.
-    const qIdx = purlString.indexOf("?");
-    const safePurlString =
-      qIdx >= 0
-        ? purlString.slice(0, qIdx + 1) +
-          purlString.slice(qIdx + 1).replaceAll("+", "%2B")
-        : purlString;
-    purlObj = Purl.parse(safePurlString);
-  } catch (err) {
+  // Purls in the wild leave `+` unescaped in versions and in qualifier values
+  // such as `vcs_url=git+https://`; the shared reader rebuilds them.
+  const purlObj = parsePurlSourceInput(purlString);
+  if (!purlObj) {
     if (DEBUG_MODE) {
-      const errorMessage = err?.message || String(err);
       thoughtLog("Unable to resolve repository URL for purl.", {
         purlString,
-        errorMessage,
       });
     }
     return undefined;

package/lib/inventory/spdx.js

@@ -343,12 +343,113 @@ export function findLicenseId(name) {
     : name;
 }
 
+/**
+ * Identify a license from the title and opening of its full text. A license
+ * text quotes other licenses (the GNU GPL's text names the GNU Lesser GPL),
+ * so the substring scan of `guessLicenseId` alone can name the wrong one.
+ *
+ * @param {string} content License file contents
+ * @returns {string|undefined} SPDX license id or expression
+ */
+export function licenseIdFromText(content) {
+  if (typeof content !== "string" || !content.trim()) {
+    return undefined;
+  }
+  const head = content.slice(0, 4000).replace(/\s+/g, " ").trim().toUpperCase();
+  const version = (prefix) => {
+    const at = head.indexOf(prefix);
+    if (at < 0) {
+      return undefined;
+    }
+    const tail = head.slice(at + prefix.length, at + prefix.length + 60);
+    const match = tail.match(/VERSION (\d(?:\.\d)?)/);
+    return match?.[1];
+  };
+  // the first lines name the license; quotations of others come later, so
+  // of the GNU licenses the one named first is the one the text is
+  const title = head.slice(0, 200);
+  const gnu = [
+    ["GNU AFFERO GENERAL PUBLIC LICENSE", { 3: "AGPL-3.0-only" }],
+    [
+      "GNU LESSER GENERAL PUBLIC LICENSE",
+      { 3: "LGPL-3.0-only", 2.1: "LGPL-2.1-only", 2: "LGPL-2.0-only" },
+    ],
+    [
+      "GNU LIBRARY GENERAL PUBLIC LICENSE",
+      { 2.1: "LGPL-2.1-only", 2: "LGPL-2.0-only" },
+    ],
+    [
+      "GNU GENERAL PUBLIC LICENSE",
+      { 3: "GPL-3.0-only", 2: "GPL-2.0-only", 1: "GPL-1.0-only" },
+    ],
+  ]
+    .map(([name, ids]) => ({ name, ids, at: title.indexOf(name) }))
+    .filter((t) => t.at >= 0)
+    .sort((a, b) => a.at - b.at)[0];
+  if (gnu) {
+    return gnu.ids[version(gnu.name)];
+  }
+  if (head.includes("APACHE LICENSE") && head.includes("VERSION 2.0")) {
+    return head.includes("LLVM EXCEPTION")
+      ? "Apache-2.0 WITH LLVM-exception"
+      : "Apache-2.0";
+  }
+  if (
+    title.includes("MOZILLA PUBLIC LICENSE") &&
+    head.includes("VERSION 2.0")
+  ) {
+    return "MPL-2.0";
+  }
+  if (title.includes("BOOST SOFTWARE LICENSE - VERSION 1.0")) {
+    return "BSL-1.0";
+  }
+  if (
+    head.includes(
+      "THIS IS FREE AND UNENCUMBERED SOFTWARE RELEASED INTO THE PUBLIC DOMAIN",
+    )
+  ) {
+    return "Unlicense";
+  }
+  if (head.includes("PERMISSION IS HEREBY GRANTED, FREE OF CHARGE")) {
+    return "MIT";
+  }
+  if (
+    head.includes(
+      "PERMISSION TO USE, COPY, MODIFY, AND/OR DISTRIBUTE THIS SOFTWARE FOR ANY PURPOSE WITH OR WITHOUT FEE IS HEREBY GRANTED",
+    )
+  ) {
+    return "ISC";
+  }
+  if (
+    head.includes("THIS SOFTWARE IS PROVIDED 'AS-IS'") &&
+    head.includes(
+      "PERMISSION IS GRANTED TO ANYONE TO USE THIS SOFTWARE FOR ANY PURPOSE",
+    )
+  ) {
+    return "Zlib";
+  }
+  if (head.includes("REDISTRIBUTION AND USE IN SOURCE AND BINARY FORMS")) {
+    if (head.includes("ALL ADVERTISING MATERIALS MENTIONING")) {
+      return "BSD-4-Clause";
+    }
+    return head.includes("NEITHER THE NAME") ||
+      head.includes("THE NAME OF THE AUTHOR MAY NOT BE USED")
+      ? "BSD-3-Clause"
+      : "BSD-2-Clause";
+  }
+  return undefined;
+}
+
 /**
  * Method to guess the spdx license id from license contents
  *
  * @param {string} content License file contents
  */
 export function guessLicenseId(content) {
+  const fromText = licenseIdFromText(content);
+  if (fromText) {
+    return fromText;
+  }
   content = content.replace(/\n/g, " ");
   for (const l of licenseMapping) {
     for (const j in l.names) {

package/lib/inventory/traceRunner.js

@@ -20,6 +20,17 @@ try {
   SaferExec = undefined;
 }
 
+/**
+ * Whether the @cdxgen/safer-exec tracing runtime could be loaded. When false,
+ * dynamic tracing cannot run at all, and every trace would otherwise exit 0
+ * with a valid but empty BOM, hiding the broken installation (#4378).
+ *
+ * @returns {boolean} True when the tracing runtime is available
+ */
+export function isSaferExecAvailable() {
+  return Boolean(SaferExec);
+}
+
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
 
@@ -66,6 +77,7 @@ export function parseCommand(cmdStr) {
 export function resolveSaferExecBinary() {
   const currentPlatform = platform();
   const currentArch = arch();
+  const isWindows = currentPlatform === "win32";
   let pkgName = "";
 
   if (currentPlatform === "darwin") {
@@ -80,6 +92,14 @@ export function resolveSaferExecBinary() {
     } else if (currentArch === "arm64") {
       pkgName = "@cdxgen/safer-exec-linux-arm64";
     }
+  } else if (isWindows) {
+    // The Windows packages ship the MXC executor (wxc-exec.exe) next to the
+    // engine, which is where the engine looks for it.
+    if (currentArch === "x64") {
+      pkgName = "@cdxgen/safer-exec-windows-amd64";
+    } else if (currentArch === "arm64") {
+      pkgName = "@cdxgen/safer-exec-windows-arm64";
+    }
   }
 
   if (!pkgName) {
@@ -105,8 +125,15 @@ export function resolveSaferExecBinary() {
     }
 
     for (const modulesDir of searchDirs) {
-      // Direct structure under node_modules
-      const directPath = join(modulesDir, pkgName, "bin", "safer-exec");
+      // Direct structure under node_modules. The Go runtime inside the
+      // platform package is bin/safer-exec-rt(.exe); "safer-exec" is the JS
+      // dispatcher's npm bin name, not a file on disk.
+      const directPath = join(
+        modulesDir,
+        pkgName,
+        "bin",
+        isWindows ? "safer-exec-rt.exe" : "safer-exec-rt",
+      );
       let realDirectPath;
       try {
         realDirectPath = realpathSync(directPath);
@@ -114,10 +141,12 @@ export function resolveSaferExecBinary() {
         realDirectPath = directPath;
       }
       if (existsSync(realDirectPath)) {
-        try {
-          chmodSync(realDirectPath, 0o755);
-        } catch (_err) {
-          // ignore
+        if (!isWindows) {
+          try {
+            chmodSync(realDirectPath, 0o755);
+          } catch (_err) {
+            // ignore
+          }
         }
         return realDirectPath;
       }
@@ -157,7 +186,19 @@ export function resolveSaferExecBinary() {
  * @param {boolean} [options.traceExec] - Log every child process spawned
  * @param {string[]} [options.allowExec] - Executables the command is allowed to run
  * @param {string[]} [options.blockExec] - Executables to block from running
- * @returns {Promise<{libPaths: string[], httpAccessEntries: Object[]}>} Collected libraries and HTTP URLs
+ * @param {boolean} [options.proxyEgress] - Route egress through safer-exec's hostname-pinning proxy (network stays enabled; only allowHosts are reachable)
+ * @param {boolean} [options.allowLoopback] - Allow loopback connections
+ * @param {boolean} [options.dryRun] - Deny every filesystem and network side effect and collect a dry-run report
+ * @param {string} [options.policy] - Named safer-exec ecosystem policy (npm, pypi, maven, ...)
+ * @param {string} [options.policyFile] - Path to a safer-exec JSON policy file
+ * @param {boolean} [options.blockInterpreters] - Block interpreters with sandbox or task-port exemptions (macOS)
+ * @param {boolean} [options.denyPersistenceWrites] - Deny writes to auto-execution and persistence locations
+ * @param {boolean} [options.privateTmp] - Private tmpfs /tmp and /var/tmp (Linux)
+ * @param {string} [options.protectHome] - Home isolation: read-only, tmpfs, or off (Linux)
+ * @returns {Promise<{libPaths: string[], httpAccessEntries: Object[], egressEntries?: Object[], dryRunSummary?: Object}>} Collected libraries, HTTP URLs, proxy egress decisions, and the dry-run summary
+ * @throws {Error} When the @cdxgen/safer-exec tracing runtime is not installed
+ *   (for example after pruning it from a standalone payload), since the traced
+ *   command could never run and the BOM would silently be empty
  */
 export async function executeAndTrace(commandStr, workingDir, options = {}) {
   const emptyResult = { libPaths: [], httpAccessEntries: [] };
@@ -174,11 +215,23 @@ export async function executeAndTrace(commandStr, workingDir, options = {}) {
   );
 
   if (!SaferExec) {
-    return emptyResult;
+    throw new Error(
+      "Dynamic tracing requires the @cdxgen/safer-exec package, which could not be loaded from this installation. Re-install with optional dependencies enabled, or use the official tracebom standalone binary.",
+    );
+  }
+
+  const exec = new SaferExec();
+  // Policies are applied first so explicit options below take precedence, and
+  // outside the try so an unknown policy or unreadable policy file fails the
+  // run instead of producing an empty BOM.
+  if (options.policy) {
+    exec.applyPolicy(options.policy);
+  }
+  if (options.policyFile) {
+    exec.applyPolicyFile(options.policyFile);
   }
 
   try {
-    const exec = new SaferExec();
     if (workingDir) {
       exec.workingDir(workingDir);
     }
@@ -192,9 +245,49 @@ export async function executeAndTrace(commandStr, workingDir, options = {}) {
     exec.traceLibraries().suppressLibLoadStderr(true).enableAudit();
 
     // Apply sandbox options
-    if (options.disableNetwork !== false && !options.traceHTTPURLs) {
+    // The egress proxy runs on the host side and must be reachable, so it
+    // needs the network enabled (an isolated namespace would bypass it).
+    if (
+      options.disableNetwork !== false &&
+      !options.traceHTTPURLs &&
+      !options.proxyEgress
+    ) {
       exec.disableNetwork();
     }
+    if (options.proxyEgress) {
+      if (!options.allowHosts?.length && !options.allowUrls?.length) {
+        console.warn(
+          "[cdxgen trace] egress proxy enabled without --allow-host: every outbound connection will be denied.",
+        );
+      }
+      exec.proxyEgress();
+    }
+    if (options.allowLoopback) {
+      exec.allowLoopback();
+    }
+    if (options.dryRun) {
+      exec.enableDryRun();
+    }
+    if (platform() === "win32" && options.blockInterpreters) {
+      // safer-exec reports --private-tmp and --protect-home on Windows when a
+      // grant defeats them, but --block-interpreters is macOS-only and stays
+      // silent (cdxgen/safer-exec#4).
+      console.warn(
+        "[cdxgen trace] --block-interpreters has no effect on Windows.",
+      );
+    }
+    if (options.blockInterpreters) {
+      exec.blockInterpreters();
+    }
+    if (options.denyPersistenceWrites) {
+      exec.denyPersistenceWrites();
+    }
+    if (options.privateTmp) {
+      exec.privateTmp();
+    }
+    if (options.protectHome && options.protectHome !== "off") {
+      exec.protectHome(options.protectHome);
+    }
     if (options.readPaths?.length) {
       exec.readPaths(options.readPaths);
     }
@@ -306,25 +399,86 @@ export async function executeAndTrace(commandStr, workingDir, options = {}) {
     }
 
     const result = await exec.run(cmd, args);
-    if (result && result.exitCode !== 0 && result.stderr) {
-      if (result.stderr.includes("[safer-exec] Error:")) {
-        console.error(
-          "Tracing launcher execution failed:",
-          result.stderr.trim(),
+    const stderr = result?.stderr || "";
+    const { warnings, error: engineError } = engineMessages(stderr);
+    // Windows records DLL loads through an ETW session, which only an
+    // elevated process (or a Performance Log Users member) may start.
+    const etwDenied =
+      platform() === "win32" &&
+      warnings.some(
+        (line) =>
+          line.includes("DLL tracing:") &&
+          line.includes("administrator rights"),
+      );
+    // run() captures the engine's stderr, so a control the sandbox could not
+    // apply would otherwise read like one it did.
+    for (const line of warnings) {
+      if (etwDenied && line.includes("DLL tracing:")) {
+        continue;
+      }
+      console.warn(line);
+    }
+    if (etwDenied) {
+      console.warn(
+        "[cdxgen trace] library tracing on Windows needs an elevated prompt (or membership in the Performance Log Users group); the BOM has no library components. Egress services from --proxy-egress are still recorded.",
+      );
+    }
+    if (result && result.exitCode !== 0) {
+      if (engineError) {
+        console.error(engineError);
+        if (options.strict) {
+          // Under --strict the sandbox refused the run; an empty BOM would
+          // read as a command that loaded nothing.
+          throw Object.assign(
+            new Error(`Tracing refused under --strict: ${engineError}`),
+            { strictRefusal: true },
+          );
+        }
+      } else if (stderr.includes("[safer-exec] Error:")) {
+        console.error("Tracing launcher execution failed:", stderr.trim());
+      } else {
+        // A failing command usually means a partial trace (for example a
+        // sandbox denial), so the BOM may be incomplete.
+        console.warn(
+          `[cdxgen trace] traced command exited with code ${result.exitCode}; the BOM may be incomplete.`,
         );
       }
-    } else if (options.traceHTTPURLs && result?.stderr) {
-      // Surface eBPF/http-trace warnings even when exit code is 0
-      const stderr = result.stderr || "";
+    }
+    if (options.traceHTTPURLs) {
+      // eBPF URL tracing needs CAP_BPF/CAP_PERFMON. Surface why it was not
+      // available whatever the command's exit code, since the BOM otherwise
+      // silently lacks services.
+      const httpLines = stderr
+        .split("\n")
+        .filter(
+          (line) =>
+            line.includes("http-trace") ||
+            line.includes("httptrace") ||
+            line.includes("SSL/TLS libraries"),
+        );
       if (
-        stderr.includes("http-trace") ||
-        stderr.includes("httptrace") ||
-        stderr.includes("SSL/TLS libraries")
+        httpLines.some((line) => /warning|not supported|failed/i.test(line))
       ) {
-        console.warn("[cdxgen trace] HTTP URL tracing warning:", stderr.trim());
+        console.warn(
+          "[cdxgen trace] HTTP URL tracing unavailable or degraded (it needs root or CAP_BPF and CAP_PERFMON):",
+          httpLines.join("\n"),
+        );
       }
     }
 
+    // Without an event source (strace on Linux) a dry run still denies every
+    // side effect but reports nothing, which must not read as "no activity".
+    let dryRunSummary = result?.dryRun?.summary;
+    if (
+      options.dryRun &&
+      result?.stderr?.includes("dry-run cannot capture attempted operations")
+    ) {
+      console.warn(
+        "[cdxgen trace] dry run could not capture attempted operations on this host (install strace or relax ptrace_scope); the BOM records no counts.",
+      );
+      dryRunSummary = { captured: false };
+    }
+
     // Read and parse CBOM file if temp/explicit path was used
     let cryptoComponents = [];
     const cbomPathToRead = options.cbom || tempCbomPath;
@@ -377,6 +531,8 @@ export async function executeAndTrace(commandStr, workingDir, options = {}) {
         httpAccessEntries: [...collectedUrls, ...urls],
         cryptoEntries: [...collectedCrypto, ...cryptoLogs],
         cryptoComponents,
+        egressEntries: parseEgressEntries(result.auditLog),
+        dryRunSummary,
       };
     }
 
@@ -385,13 +541,119 @@ export async function executeAndTrace(commandStr, workingDir, options = {}) {
       httpAccessEntries: collectedUrls,
       cryptoEntries: collectedCrypto,
       cryptoComponents,
+      egressEntries: [],
+      dryRunSummary,
     };
   } catch (err) {
+    if (err?.strictRefusal) {
+      throw err;
+    }
     console.error("Tracing command execution failed:", err);
   }
   return emptyResult;
 }
 
+/**
+ * Picks the safer-exec engine's own lines out of the stderr it shares with the
+ * traced command. Warnings start with "safer-exec: warning:"; when the engine
+ * stops a run, its error is the last other "safer-exec: " line it prints.
+ *
+ * @param {string} stderr Captured stderr of a safer-exec run
+ * @returns {{warnings: string[], error: string|undefined}} Unique engine warnings, and the engine's error if any
+ */
+export function engineMessages(stderr) {
+  const lines = String(stderr || "")
+    .split(/\r?\n/)
+    .filter((line) => line.startsWith("safer-exec: "));
+  const warnings = [
+    ...new Set(lines.filter((line) => line.startsWith("safer-exec: warning:"))),
+  ];
+  const others = lines.filter(
+    (line) => !line.startsWith("safer-exec: warning:"),
+  );
+  return { warnings, error: others.at(-1) };
+}
+
+/**
+ * Returns the sorted, de-duplicated parameter names of a query string.
+ *
+ * @param {string} query - Raw query string, with or without a leading "?"
+ * @returns {string} Comma-separated parameter names, or "" when there are none
+ */
+function queryParameterNames(query) {
+  if (!query) {
+    return "";
+  }
+  const names = new Set();
+  for (const pair of String(query).replace(/^\?/, "").split("&")) {
+    const eqIdx = pair.indexOf("=");
+    const name = (eqIdx >= 0 ? pair.substring(0, eqIdx) : pair).trim();
+    if (name) {
+      names.add(name);
+    }
+  }
+  return Array.from(names).sort().join(",");
+}
+
+/**
+ * Extracts the egress proxy's decisions from a safer-exec audit log.
+ * "proxy-connect" targets are "host:port"; "proxy-violation" targets are
+ * "CONNECT host:port" or "METHOD http://host[:port]/path". Only the authority
+ * is kept, never a path or query.
+ *
+ * @param {Object[]} auditLog - safer-exec audit entries
+ * @returns {{host: string, port: number, protocol: string, decision: string}[]} Unique egress decisions
+ */
+export function parseEgressEntries(auditLog) {
+  const seen = new Set();
+  const entries = [];
+  for (const e of auditLog || []) {
+    if (e?.type !== "proxy-connect" && e?.type !== "proxy-violation") {
+      continue;
+    }
+    const target = String(e.target || "");
+    let authority = target;
+    let protocol = "https";
+    if (e.type === "proxy-connect") {
+      protocol = e.details === "http" ? "http" : "https";
+    } else {
+      const spaceIdx = target.indexOf(" ");
+      authority = spaceIdx >= 0 ? target.substring(spaceIdx + 1) : target;
+      const schemeIdx = authority.indexOf("://");
+      if (schemeIdx >= 0) {
+        protocol = authority.substring(0, schemeIdx);
+        authority = authority.substring(schemeIdx + 3);
+        const slashIdx = authority.indexOf("/");
+        if (slashIdx >= 0) {
+          authority = authority.substring(0, slashIdx);
+        }
+      }
+    }
+    let host = authority;
+    let port = protocol === "http" ? 80 : 443;
+    const colonIdx = authority.lastIndexOf(":");
+    if (colonIdx > 0 && !authority.endsWith("]")) {
+      const parsedPort = Number.parseInt(authority.substring(colonIdx + 1), 10);
+      if (!Number.isNaN(parsedPort)) {
+        port = parsedPort;
+        host = authority.substring(0, colonIdx);
+      }
+    }
+    host = host.replace(/^\[|\]$/g, "").toLowerCase();
+    if (!host) {
+      continue;
+    }
+    const decision = e.type === "proxy-connect" ? "allowed" : "denied";
+    const key = `${decision}|${protocol}|${host}|${port}`;
+    if (seen.has(key)) {
+      continue;
+    }
+    seen.add(key);
+    entries.push({ host, port, protocol, decision });
+  }
+  return entries;
+}
+
 /**
  * Groups HTTP access entries into a CycloneDX services-ready map.
  * Each unique (host, port, protocol) combination becomes a service.
@@ -409,7 +671,9 @@ export function groupHttpEntriesToServices(httpAccessEntries) {
         properties: [],
       };
     }
-    const endpoint = `https://${entry.host}${entry.port && entry.port !== 443 ? `:${entry.port}` : ""}${entry.path || "/"}`;
+    const scheme = entry.protocol === "http" ? "http" : "https";
+    const defaultPort = scheme === "http" ? 80 : 443;
+    const endpoint = `${scheme}://${entry.host}${entry.port && entry.port !== defaultPort ? `:${entry.port}` : ""}${entry.path || "/"}`;
     servicesMap[serviceName].endpoints.add(endpoint);
     if (entry.method) {
       const methodProp = {
@@ -424,8 +688,14 @@ export function groupHttpEntriesToServices(httpAccessEntries) {
         servicesMap[serviceName].properties.push(methodProp);
       }
     }
-    if (entry.query) {
-      const queryProp = { name: "cdx:dynamic:httpQuery", value: entry.query };
+    // Query values can carry tokens and signatures, so only the parameter
+    // names are recorded.
+    const queryParams = queryParameterNames(entry.query);
+    if (queryParams) {
+      const queryProp = {
+        name: "cdx:dynamic:httpQueryParams",
+        value: queryParams,
+      };
       if (
         !servicesMap[serviceName].properties.some(
           (p) => p.name === queryProp.name && p.value === queryProp.value,