@cdxgen/cdxgen 13.3.0 → 13.4.0

package/lib/inventory/dosai.js

@@ -20,7 +20,9 @@ import {
   safeSpawnSync,
   safeWriteChunksSync,
   safeWriteSync,
+  TIMEOUT_MS,
 } from "../core/fs.js";
+import { formatDuration, reapProcessTree } from "../core/processTree.js";
 import {
   indexJsonObject,
   MAX_JSON_TEXT_BYTES,
@@ -675,6 +677,69 @@ export function readDosaiDataFlowReport(reportFile, options = {}) {
   });
 }
 
+/**
+ * Whether a dosai run ended because it ran out of time.
+ *
+ * dosai has no limit of its own: cdxgen's spawn timeout
+ * (CDXGEN_TIMEOUT_MS) stops the process, which reaches the caller only as an
+ * ETIMEDOUT error looking like any other failure (issue 4438).
+ *
+ * @param {Object} result spawnSync result
+ * @returns {boolean} true when the run was stopped by the spawn timeout
+ */
+export function dosaiRunTimedOut(result) {
+  return result?.error?.code === "ETIMEDOUT";
+}
+
+/**
+ * How a dosai run was stopped before it could finish, if it was.
+ *
+ * Besides the spawn timeout, a run is stopped when its console output outgrows
+ * CDXGEN_MAX_BUFFER (ENOBUFS) or a signal ends it, such as the kernel's
+ * out-of-memory killer. A stopped run can leave its slice half written.
+ *
+ * @param {Object} result spawnSync result
+ * @returns {"timeout"|"buffer"|"signal"|undefined} Why the run was stopped, or undefined when it ended by itself
+ */
+export function dosaiRunStopReason(result) {
+  if (dosaiRunTimedOut(result)) {
+    return "timeout";
+  }
+  if (result?.error?.code === "ENOBUFS") {
+    return "buffer";
+  }
+  if (result?.signal) {
+    return "signal";
+  }
+  return undefined;
+}
+
+// The output files of the dosai runs of this process that were stopped, so a
+// caller does not follow the stop warning with advice for another failure.
+const stoppedDosaiOutputs = new Set();
+
+/**
+ * Whether the dosai run that should have written a file was stopped (by the
+ * time limit, the output buffer limit, or a signal) and already reported so.
+ *
+ * @param {string} outputFile Output file passed to the dosai run
+ * @returns {boolean} true when the run was stopped
+ */
+export function dosaiRunWasStopped(outputFile) {
+  const outputPath = safeDosaiPath(outputFile);
+  return Boolean(outputPath && stoppedDosaiOutputs.has(outputPath));
+}
+
+function dosaiStopMessage(reason, signal) {
+  if (reason === "timeout") {
+    return `WARN: dosai did not finish within ${formatDuration(TIMEOUT_MS)} and was stopped, so its slices are missing or incomplete. Allow more time with CDXGEN_TIMEOUT_MS (milliseconds, every external command).`;
+  }
+  if (reason === "buffer") {
+    return "WARN: dosai wrote more console output than CDXGEN_MAX_BUFFER allows and was stopped, so its slices are missing or incomplete. Raise CDXGEN_MAX_BUFFER (bytes).";
+  }
+  return `WARN: dosai was stopped by ${signal || "a signal"} before it finished, so its slices are missing or incomplete. A SIGKILL usually means the system ran out of memory.`;
+}
+
 /**
  * Run a dosai subcommand ("methods", "dataflows", or "crypto") against a source
  * tree and write its JSON output to the given file.
@@ -720,6 +785,8 @@ export function runDosaiCommand(command, src, outputFile, options = {}) {
   if (DEBUG_MODE) {
     console.log("Executing", executable, [...args, ...excludeArgs].join(" "));
   }
+  stoppedDosaiOutputs.delete(outputPath);
+  let startedAt = Date.now();
   let result = safeSpawnSync(executable, [...args, ...excludeArgs], {
     cwd: srcPath,
     shell: false,
@@ -735,6 +802,7 @@ export function runDosaiCommand(command, src, outputFile, options = {}) {
     warnDosaiOnce(
       "This dosai build does not support --exclude, so it runs without the exclude patterns. Upgrade dosai or set DOSAI_CMD to a newer build to honour them.",
     );
+    startedAt = Date.now();
     result = safeSpawnSync(executable, args, {
       cwd: srcPath,
       shell: false,
@@ -756,6 +824,22 @@ export function runDosaiCommand(command, src, outputFile, options = {}) {
       "Alternatively, download the dosai self-contained binary (-full suffix) from https://github.com/owasp-dep-scan/dosai/releases and set DOSAI_CMD to its location.",
     );
   }
+  const stopReason = dosaiRunStopReason(result);
+  if (stopReason) {
+    // Visible without debug output: otherwise a stopped dosai reads like any
+    // other failure while the scan silently loses its .NET evidence.
+    console.warn(dosaiStopMessage(stopReason, result.signal));
+    // Windows kills only the dosai process itself, and the build hosts it
+    // started would keep running.
+    reapProcessTree(result.pid, startedAt, Date.now(), "dosai");
+    // A stopped dosai can leave its output half written, and the caller would
+    // read the truncated file back as a slice.
+    if (safeExistsSync(outputPath)) {
+      safeRmSync(outputPath, { force: true });
+    }
+    stoppedDosaiOutputs.add(outputPath);
+    return false;
+  }
   if (result?.status !== 0 || result?.error || !safeExistsSync(outputPath)) {
     if (DEBUG_MODE) {
       if (result?.stderr || result?.stdout) {
@@ -958,21 +1042,63 @@ export function persistDosaiSemanticsReport(
  * Build a purl alias map for a list of components.
  *
  * @param {Object[]} [components] Component objects with purl fields
- * @returns {Map<string, string>} Map of exact purls and normalized type/namespace/name keys to canonical purls
+ * @param {Object} [options] Options passed to {@link buildDosaiPurlAliasMap} (`srcPath`)
+ * @returns {Map<string, string>} Map of component purls, carrying the version-free identity index
  */
-export function buildPurlAliasMap(components = []) {
-  return buildDosaiPurlAliasMap(components);
+export function buildPurlAliasMap(components = [], options = {}) {
+  return buildDosaiPurlAliasMap(components, options);
 }
 
 /**
- * Resolve a possibly-aliased purl to the canonical component purl.
+ * Resolve a dosai purl to the canonical component purl, by version, and for a
+ * package the BOM holds in several versions by the record's location.
  *
  * @param {string} purl Purl from a dosai report
  * @param {Map<string, string>} purlAliasMap Alias map built by buildPurlAliasMap
- * @returns {string|undefined} Canonical component purl, the input purl when unaliased, or undefined when empty
+ * @param {string} [location] Source location of the dosai record
+ * @returns {string|undefined} Canonical component purl, the input purl when the BOM has no such package,
+ *          or undefined when empty or ambiguous
  */
-export function resolveComponentPurl(purl, purlAliasMap) {
-  return resolveDosaiComponentPurl(purl, purlAliasMap);
+export function resolveComponentPurl(purl, purlAliasMap, location) {
+  return resolveDosaiComponentPurl(purl, purlAliasMap, location);
+}
+
+/**
+ * The component purls one PackageReachability fact belongs to: each of its
+ * locations resolved in its own project (a versionless purl from unrestored
+ * projects spans several), else the purl alone.
+ *
+ * @param {Object} reachability dosai PackageReachability entry
+ * @param {Map<string, string>} purlAliasMap Alias map built by buildPurlAliasMap
+ * @param {Object} [graph] Call graph lookups `{ edgesById, nodesById }`
+ * @returns {string[]} Component purls
+ */
+function reachabilityComponentPurls(reachability, purlAliasMap, graph = {}) {
+  const locations = [
+    ...(reachability.SourceLocations || []).map((location) =>
+      dosaiSourceLocation(location),
+    ),
+    ...(reachability.EdgeIds || []).map((edgeId) =>
+      dosaiSourceLocation(graph.edgesById?.get(edgeId)),
+    ),
+    ...(reachability.NodeIds || []).map((nodeId) =>
+      dosaiSourceLocationFromNode(graph.nodesById?.get(nodeId)),
+    ),
+  ].filter(Boolean);
+  const purls = new Set(
+    locations
+      .map((location) =>
+        resolveComponentPurl(reachability.Purl, purlAliasMap, location),
+      )
+      .filter(Boolean),
+  );
+  if (!purls.size) {
+    const purl = resolveComponentPurl(reachability.Purl, purlAliasMap);
+    if (purl) {
+      purls.add(purl);
+    }
+  }
+  return [...purls];
 }
 
 /**
@@ -1021,24 +1147,51 @@ export function addDosaiReachabilityProperties(component, reachability) {
  *
  * @param {Object} methodsSlice Parsed dosai methods slice JSON
  * @param {Object[]} [components] BOM components used to resolve purl aliases and mutate
+ * @param {Object} [options] Options
+ * @param {string} [options.srcPath] Directory dosai analyzed; a package the BOM holds in several
+ *        versions is matched by the project of the record's file
  * @returns {number} Number of distinct components enriched
  */
-export function applyDosaiReachabilityEvidence(methodsSlice, components = []) {
-  const purlAliasMap = buildPurlAliasMap(components);
+export function applyDosaiReachabilityEvidence(
+  methodsSlice,
+  components = [],
+  options = {},
+) {
+  const purlAliasMap = buildPurlAliasMap(components, options);
   const componentsByPurl = new Map(
     components
       .filter((component) => component?.purl)
       .map((component) => [component.purl, component]),
   );
+  const graph = {
+    edgesById: new Map(
+      (methodsSlice?.CallGraph?.Edges || []).map((edge) => [edge.Id, edge]),
+    ),
+    nodesById: new Map(
+      (methodsSlice?.CallGraph?.Nodes || []).map((node) => [node.Id, node]),
+    ),
+  };
   const enriched = new Set();
-  for (const reachability of methodsSlice?.PackageReachability || []) {
-    const purl = resolveComponentPurl(reachability.Purl, purlAliasMap);
-    const component = purl && componentsByPurl.get(purl);
-    if (!component) {
-      continue;
+  // The first fact applied to a component wins, so a fact that names the
+  // component's exact purl goes before one that reached it by name.
+  const facts = [...(methodsSlice?.PackageReachability || [])].sort(
+    (a, b) =>
+      Number(!componentsByPurl.has(a.Purl)) -
+      Number(!componentsByPurl.has(b.Purl)),
+  );
+  for (const reachability of facts) {
+    for (const purl of reachabilityComponentPurls(
+      reachability,
+      purlAliasMap,
+      graph,
+    )) {
+      const component = componentsByPurl.get(purl);
+      if (!component) {
+        continue;
+      }
+      addDosaiReachabilityProperties(component, reachability);
+      enriched.add(component);
     }
-    addDosaiReachabilityProperties(component, reachability);
-    enriched.add(component);
   }
   return enriched.size;
 }
@@ -1051,10 +1204,17 @@ export function applyDosaiReachabilityEvidence(methodsSlice, components = []) {
  *
  * @param {Object} methodsSlice Parsed dosai methods slice JSON
  * @param {Object[]} [components] BOM components used to resolve purl aliases
+ * @param {Object} [options] Options
+ * @param {string} [options.srcPath] Directory dosai analyzed; a package the BOM holds in several
+ *        versions is matched by the project of the record's file
  * @returns {Object} Object with purlLocationMap, purlModulesMap, and purlMethodsMap keyed by purl
  */
-export function collectDosaiPurlEvidence(methodsSlice, components = []) {
-  const purlAliasMap = buildPurlAliasMap(components);
+export function collectDosaiPurlEvidence(
+  methodsSlice,
+  components = [],
+  options = {},
+) {
+  const purlAliasMap = buildPurlAliasMap(components, options);
   const purlLocationMap = {};
   const purlModulesMap = {};
   const purlMethodsMap = {};
@@ -1066,7 +1226,11 @@ export function collectDosaiPurlEvidence(methodsSlice, components = []) {
   );
 
   for (const dependency of methodsSlice?.Dependencies || []) {
-    const purl = resolveComponentPurl(dependency.Purl, purlAliasMap);
+    const purl = resolveComponentPurl(
+      dependency.Purl,
+      purlAliasMap,
+      dependency.Path,
+    );
     if (!purl) {
       continue;
     }
@@ -1079,42 +1243,61 @@ export function collectDosaiPurlEvidence(methodsSlice, components = []) {
   }
 
   for (const reachability of methodsSlice?.PackageReachability || []) {
-    const purl = resolveComponentPurl(reachability.Purl, purlAliasMap);
-    if (!purl) {
-      continue;
-    }
+    // Every location resolves in its own project: a versionless purl from
+    // unrestored projects spans projects restored at different versions.
+    const resolveAt = (location) =>
+      resolveComponentPurl(reachability.Purl, purlAliasMap, location);
+    const factPurls = new Set();
+    // Modules and methods of call-graph items that name no source file
+    // (frames inside the package), held for the fact's own version.
+    const unplaced = [];
     let hasExplicitSourceLocations = false;
     for (const sourceLocation of reachability.SourceLocations || []) {
       const location = dosaiSourceLocation(sourceLocation);
+      const purl = resolveAt(location);
       addDosaiSetValue(purlLocationMap, purl, location);
+      if (purl) {
+        factPurls.add(purl);
+      }
       hasExplicitSourceLocations ||= Boolean(location);
     }
     for (const edgeId of reachability.EdgeIds || []) {
       const edge = edgesById.get(edgeId);
+      const location = dosaiSourceLocation(edge);
+      const purl = resolveAt(location ?? edge?.Path);
+      const method = edge?.CalledMethodName || edge?.TargetName;
+      if (!purl) {
+        unplaced.push([purlMethodsMap, method]);
+        continue;
+      }
+      factPurls.add(purl);
       if (!hasExplicitSourceLocations) {
-        addDosaiSetValue(purlLocationMap, purl, dosaiSourceLocation(edge));
+        addDosaiSetValue(purlLocationMap, purl, location);
       }
-      addDosaiSetValue(
-        purlMethodsMap,
-        purl,
-        edge?.CalledMethodName || edge?.TargetName,
-      );
+      addDosaiSetValue(purlMethodsMap, purl, method);
     }
     for (const nodeId of reachability.NodeIds || []) {
       const node = nodesById.get(nodeId);
+      const location = dosaiSourceLocationFromNode(node);
+      const purl = resolveAt(location);
+      const module = node?.ClassName || node?.Module;
+      const method = node?.Name || node?.Identity?.MethodName;
+      if (!purl) {
+        unplaced.push([purlModulesMap, module], [purlMethodsMap, method]);
+        continue;
+      }
+      factPurls.add(purl);
       if (!hasExplicitSourceLocations) {
-        addDosaiSetValue(
-          purlLocationMap,
-          purl,
-          dosaiSourceLocationFromNode(node),
-        );
+        addDosaiSetValue(purlLocationMap, purl, location);
+      }
+      addDosaiSetValue(purlModulesMap, purl, module);
+      addDosaiSetValue(purlMethodsMap, purl, method);
+    }
+    if (factPurls.size === 1) {
+      const [purl] = factPurls;
+      for (const [map, value] of unplaced) {
+        addDosaiSetValue(map, purl, value);
       }
-      addDosaiSetValue(purlModulesMap, purl, node?.ClassName || node?.Module);
-      addDosaiSetValue(
-        purlMethodsMap,
-        purl,
-        node?.Name || node?.Identity?.MethodName,
-      );
     }
   }
   return { purlLocationMap, purlModulesMap, purlMethodsMap };
@@ -1128,17 +1311,38 @@ export function collectDosaiPurlEvidence(methodsSlice, components = []) {
  *
  * @param {Object} dataFlowResult Parsed dosai data-flow slice JSON
  * @param {Object[]} [components] BOM components used to resolve purl aliases
+ * @param {Object} [options] Options
+ * @param {string} [options.srcPath] Directory dosai analyzed; a package the BOM holds in several
+ *        versions is matched by the project of the record's file
  * @returns {Object} Map of canonical purl to arrays of call-stack frame objects
  */
-export function collectDosaiDataFlowFrames(dataFlowResult, components = []) {
-  const purlAliasMap = buildPurlAliasMap(components);
+export function collectDosaiDataFlowFrames(
+  dataFlowResult,
+  components = [],
+  options = {},
+) {
+  const purlAliasMap = buildPurlAliasMap(components, options);
   const nodesById = new Map(
     (dataFlowResult?.Nodes || []).map((node) => [node.Id, node]),
   );
   const dataFlowFrames = {};
   const addFramesForPurl = (purl, frames) => {
-    const componentPurl = resolveComponentPurl(purl, purlAliasMap);
-    if (!componentPurl || !frames.length) {
+    if (!frames.length) {
+      return;
+    }
+    // The flow runs in the project of its first frame that settles one.
+    let componentPurl;
+    for (const frame of frames) {
+      componentPurl = resolveComponentPurl(
+        purl,
+        purlAliasMap,
+        frame.fullFilename,
+      );
+      if (componentPurl) {
+        break;
+      }
+    }
+    if (!componentPurl) {
       return;
     }
     dataFlowFrames[componentPurl] ??= [];