@cdxgen/cdxgen 13.3.0 → 13.4.0

package/lib/inventory/tracedCrypto.js

@@ -0,0 +1,294 @@
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+
+import { thoughtLog } from "../core/logger.js";
+import { dirNameStr } from "../core/paths.js";
+import { applyAlgorithmProperties } from "./cryptoAlgorithmFamily.js";
+
+const cryptoOids = JSON.parse(
+  readFileSync(join(dirNameStr, "data", "crypto-oid.json"), "utf-8"),
+);
+
+// TLS key-exchange groups by their IANA registry name. A hybrid group pairs a
+// classical curve with ML-KEM: each half has an OID, the pair has none, so the
+// group is recorded as both algorithms.
+const GROUP_ALGORITHMS = {
+  X25519MLKEM768: ["x25519", "ml-kem-768"],
+  SecP256r1MLKEM768: ["secp256r1", "ml-kem-768"],
+  SecP384r1MLKEM1024: ["secp384r1", "ml-kem-1024"],
+  X25519Kyber768Draft00: ["x25519"],
+  MLKEM512: ["ml-kem-512"],
+  MLKEM768: ["ml-kem-768"],
+  MLKEM1024: ["ml-kem-1024"],
+  x448: ["curveX448"],
+};
+
+const MLKEM_SECURITY_LEVELS = {
+  "ml-kem-512": 1,
+  "ml-kem-768": 3,
+  "ml-kem-1024": 5,
+};
+
+// The curve each classical key-exchange algorithm is defined over.
+const KEY_AGREEMENT_CURVES = {
+  x25519: "x25519",
+  curveX448: "x448",
+};
+
+// Closed enums of cryptoProperties.algorithmProperties in bom-1.7.schema.json.
+const MODES = new Set(["cbc", "ecb", "ccm", "gcm", "cfb", "ofb", "ctr"]);
+const CRYPTO_FUNCTIONS = new Set([
+  "generate",
+  "keygen",
+  "encrypt",
+  "decrypt",
+  "digest",
+  "tag",
+  "keyderive",
+  "sign",
+  "verify",
+  "encapsulate",
+  "decapsulate",
+]);
+
+/**
+ * Names the bulk cipher of a TLS cipher suite as a crypto-oid.json key, from
+ * either its IANA name (TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) or its OpenSSL
+ * name (ECDHE-RSA-AES128-GCM-SHA256).
+ *
+ * @param {string} suiteName Cipher suite name
+ * @returns {{name: string, bits: number, mode: string|undefined}|undefined} The cipher, when it has an OID
+ */
+export function suiteCipher(suiteName) {
+  const tokens = String(suiteName || "")
+    .toUpperCase()
+    .split(/[-_]/);
+  let cipher;
+  if (tokens.includes("CHACHA20")) {
+    cipher = { name: "chaCha20Poly1305", bits: 256, mode: undefined };
+  } else if (tokens.includes("3DES") || tokens.includes("CBC3")) {
+    cipher = { name: "des-EDE3-CBC", bits: 112, mode: "cbc" };
+  } else {
+    const aesIdx = tokens.findIndex((t) => t.startsWith("AES"));
+    if (aesIdx < 0) {
+      return undefined;
+    }
+    const bits =
+      Number.parseInt(tokens[aesIdx].substring(3), 10) ||
+      Number.parseInt(tokens[aesIdx + 1], 10);
+    const mode = ["GCM", "CCM"].find((m) => tokens.includes(m)) || "CBC";
+    cipher = { name: `aes${bits}-${mode}`, bits, mode: mode.toLowerCase() };
+  }
+  return cryptoOids[cipher.name]?.oid ? cipher : undefined;
+}
+
+function oidKey(name) {
+  if (!name) {
+    return undefined;
+  }
+  if (cryptoOids[name]?.oid) {
+    return name;
+  }
+  const lower = String(name).toLowerCase();
+  return cryptoOids[lower]?.oid ? lower : undefined;
+}
+
+function cipherProperties(cipher) {
+  const props = {
+    primitive: cipher.mode === "cbc" ? "block-cipher" : "ae",
+    parameterSetIdentifier: String(cipher.bits),
+    cryptoFunctions: ["encrypt", "decrypt"],
+    classicalSecurityLevel: cipher.bits,
+  };
+  if (cipher.mode) {
+    props.mode = cipher.mode;
+  }
+  return props;
+}
+
+function keyExchangeProperties(name) {
+  const level = MLKEM_SECURITY_LEVELS[name];
+  if (level) {
+    return {
+      primitive: "kem",
+      cryptoFunctions: ["keygen", "encapsulate", "decapsulate"],
+      nistQuantumSecurityLevel: level,
+    };
+  }
+  return { primitive: "key-agree", cryptoFunctions: ["keygen"] };
+}
+
+// Keeps the values of an algorithm the traced CBOM described that fit the
+// schema; the primitive itself is checked by applyAlgorithmProperties.
+function knownAlgorithmProperties(props) {
+  const known = {};
+  if (typeof props?.primitive === "string") {
+    known.primitive = props.primitive === "aead" ? "ae" : props.primitive;
+  }
+  const mode = String(props?.mode || "").toLowerCase();
+  if (MODES.has(mode)) {
+    known.mode = mode;
+  }
+  const functions = (props?.cryptoFunctions || []).filter((f) =>
+    CRYPTO_FUNCTIONS.has(f),
+  );
+  if (functions.length) {
+    known.cryptoFunctions = functions;
+  }
+  for (const level of ["classicalSecurityLevel", "nistQuantumSecurityLevel"]) {
+    if (Number.isInteger(props?.[level])) {
+      known[level] = props[level];
+    }
+  }
+  return known;
+}
+
+/**
+ * Turns the CBOM safer-exec writes for a traced command into components that
+ * cdxgen can merge and validate:
+ *
+ * - every asset gets a bom-ref, without which the assets merge into one
+ * - algorithms carry their OID, and those without one are left out
+ * - hybrid key-exchange groups become their classical and ML-KEM halves
+ * - cipher suites become their bulk cipher, which the protocol's suites refer
+ *   to by bom-ref
+ * - algorithm properties keep only values the schema allows
+ * - crypto libraries are left out: they are the traced library components,
+ *   marked with cdx:dynamic:cryptoLibrary
+ *
+ * @param {Object[]} cbomComponents Components of the safer-exec CBOM
+ * @returns {Object[]} Normalized cryptographic-asset components
+ */
+export function normalizeTracedCryptoComponents(cbomComponents) {
+  const byRef = new Map();
+  const addAlgorithm = (name, algorithmProperties, curve) => {
+    const oid = cryptoOids[name].oid;
+    const ref = `crypto/algorithm/${encodeURIComponent(name)}@${oid}`;
+    if (!byRef.has(ref)) {
+      const component = {
+        type: "cryptographic-asset",
+        name,
+        "bom-ref": ref,
+        description: cryptoOids[name].description,
+        cryptoProperties: {
+          assetType: "algorithm",
+          algorithmProperties,
+          oid,
+        },
+      };
+      applyAlgorithmProperties(component, { name, curve });
+      byRef.set(ref, component);
+    }
+    return ref;
+  };
+  const protocols = [];
+  for (const comp of cbomComponents || []) {
+    const props = comp?.cryptoProperties;
+    if (comp?.type !== "cryptographic-asset" || !props) {
+      continue;
+    }
+    if (props.assetType === "protocol") {
+      protocols.push(comp);
+      continue;
+    }
+    if (props.assetType !== "algorithm") {
+      continue;
+    }
+    const groupHalves = GROUP_ALGORITHMS[comp.name];
+    if (groupHalves) {
+      for (const half of groupHalves) {
+        addAlgorithm(
+          half,
+          keyExchangeProperties(half),
+          KEY_AGREEMENT_CURVES[half] ||
+            (MLKEM_SECURITY_LEVELS[half] ? "" : half),
+        );
+      }
+      continue;
+    }
+    const name = oidKey(comp.name);
+    if (name) {
+      addAlgorithm(
+        name,
+        MLKEM_SECURITY_LEVELS[name] || KEY_AGREEMENT_CURVES[name]
+          ? keyExchangeProperties(name)
+          : knownAlgorithmProperties(props.algorithmProperties),
+        KEY_AGREEMENT_CURVES[name] ||
+          (/^(secp|brainpool)/.test(name) ? name : ""),
+      );
+      continue;
+    }
+    const cipher = suiteCipher(comp.name);
+    if (cipher) {
+      addAlgorithm(cipher.name, cipherProperties(cipher));
+      continue;
+    }
+    thoughtLog(`Skipping traced algorithm '${comp.name}' without an OID.`);
+  }
+  for (const comp of protocols) {
+    const ref = `crypto/protocol/${encodeURIComponent(comp.name)}@${encodeURIComponent(comp.version || "unknown")}`;
+    const protocolProperties = {
+      ...comp.cryptoProperties.protocolProperties,
+    };
+    // The traced suites list algorithm names; the schema wants bom-refs.
+    const cipherSuites = (protocolProperties.cipherSuites || []).map(
+      ({ algorithms: _names, ...suite }) => {
+        const cipher = suiteCipher(suite.name);
+        return cipher
+          ? {
+              ...suite,
+              algorithms: [addAlgorithm(cipher.name, cipherProperties(cipher))],
+            }
+          : suite;
+      },
+    );
+    const existing = byRef.get(ref);
+    if (existing) {
+      const suites = existing.cryptoProperties.protocolProperties.cipherSuites;
+      for (const suite of cipherSuites) {
+        if (!suites.some((s) => s.name === suite.name)) {
+          suites.push(suite);
+        }
+      }
+      continue;
+    }
+    protocolProperties.cipherSuites = cipherSuites;
+    const component = {
+      type: "cryptographic-asset",
+      name: comp.name,
+      "bom-ref": ref,
+      cryptoProperties: {
+        assetType: "protocol",
+        protocolProperties,
+      },
+    };
+    if (comp.version) {
+      component.version = comp.version;
+    }
+    byRef.set(ref, component);
+  }
+  return Array.from(byRef.values());
+}
+
+/**
+ * Maps the crypto libraries safer-exec reported to the paths they were loaded
+ * from.
+ *
+ * @param {Object[]} cryptoEntries safer-exec crypto-library and crypto-cipher audit entries
+ * @returns {Map<string, {name: string, version: string}>} Crypto libraries by path
+ */
+export function cryptoLibrariesByPath(cryptoEntries) {
+  const libraries = new Map();
+  for (const entry of cryptoEntries || []) {
+    if (entry?.type !== "crypto-library" || !entry.path || !entry.name) {
+      continue;
+    }
+    if (!libraries.has(entry.path)) {
+      libraries.set(entry.path, {
+        name: String(entry.name),
+        version: entry.version ? String(entry.version) : "",
+      });
+    }
+  }
+  return libraries;
+}

package/lib/managers/docker.js

@@ -1336,58 +1336,59 @@ export const getImage = async (fullImageName) => {
   let dockerCmd;
   if (needsCliFallback()) {
     dockerCmd = getContainerCliCmd();
-    let needsPull = true;
-    // Let's check the local cache first
-    let result = safeSpawnSync(dockerCmd, ["images", "--format=json"]);
-    if (result.status === 0 && result.stdout) {
-      for (const imgLine of result.stdout.split("\n")) {
-        try {
-          const imgObj = JSON.parse(Buffer.from(imgLine).toString());
-          if (`${imgObj.Repository}:${imgObj.Tag}` === fullImageName) {
-            needsPull = false;
-            break;
-          }
-        } catch (_err) {
-          // continue regardless of error
-        }
-      }
-    }
-    if (needsPull) {
-      result = safeSpawnSync(dockerCmd, ["pull", fullImageName]);
-      if (result.status !== 0 || result.error) {
+    // The local image is checked with the reference itself. `image inspect`
+    // resolves the reference exactly as the pull below would, so a fully
+    // qualified docker.io/library/... name and a digest reference both find
+    // a local image. The `images` listing compared Repository:Tag strings
+    // and missed both. docker, podman, nerdctl and wslc all implement
+    // `image inspect`.
+    let inspectResult = safeSpawnSync(dockerCmd, [
+      "image",
+      "inspect",
+      fullImageName,
+    ]);
+    if (inspectResult.status !== 0 || inspectResult.error) {
+      const pullResult = safeSpawnSync(dockerCmd, ["pull", fullImageName]);
+      if (pullResult.status !== 0 || pullResult.error) {
         if (isWslcCmd(dockerCmd)) {
           // wslc runs Docker Engine inside its own VM, so its errors may
           // mention a docker daemon; the Docker Desktop and DOCKER_CMD hints
           // below do not apply. Show wslc's own error instead.
-          if (isWslcSessionFailure(result.stderr)) {
+          if (isWslcSessionFailure(pullResult.stderr)) {
             printWslcSessionFailureHint();
-          } else if (result.stderr) {
-            console.log(result.stderr);
+          } else if (pullResult.stderr) {
+            console.log(pullResult.stderr);
           }
-        } else if (result.stderr?.includes("docker daemon is not running")) {
+        } else if (
+          pullResult.stderr?.includes("docker daemon is not running")
+        ) {
           console.log(
             "Ensure Docker for Desktop is running as an administrator with 'Exposing daemon on TCP without TLS' setting turned on.",
           );
-        } else if (result.stderr?.includes("not found")) {
+        } else if (pullResult.stderr?.includes("not found")) {
           console.log(
             "Set the environment variable DOCKER_CMD to use an alternative command such as nerdctl or podman.",
           );
-        } else if (result.stderr) {
-          console.log(result.stderr);
+        } else if (pullResult.stderr) {
+          console.log(pullResult.stderr);
         }
       }
-    }
-    result = safeSpawnSync(dockerCmd, ["inspect", fullImageName]);
-    if (result.status !== 0 || result.error) {
-      if (result.stderr) {
-        console.log(result.stderr);
+      inspectResult = safeSpawnSync(dockerCmd, [
+        "image",
+        "inspect",
+        fullImageName,
+      ]);
+    }
+    if (inspectResult.status !== 0 || inspectResult.error) {
+      if (inspectResult.stderr) {
+        console.log(inspectResult.stderr);
       }
       suggestWslcAlternative(dockerCmd);
       // Continue with the daemon client when the CLI fallback is unavailable
       // or unable to inspect the image.
     } else {
       try {
-        const stdout = result.stdout;
+        const stdout = inspectResult.stdout;
         if (stdout) {
           const inspectData = JSON.parse(Buffer.from(stdout).toString());
           if (inspectData && Array.isArray(inspectData)) {

package/lib/managers/oci.js

@@ -283,7 +283,10 @@ async function getOciToken(registry, repository, scope) {
           if (params.service)
             reqUrl.searchParams.set("service", params.service);
           reqUrl.searchParams.set("scope", `repository:${repository}:${scope}`);
+          // Tokens expire within minutes, so a cached one would be replayed
+          // after it stopped working.
           const options = {
+            cache: false,
             responseType: "json",
             timeout: getOciTimeoutMs(),
           };
@@ -410,11 +413,18 @@ async function pullBlob(registry, repository, digest, token) {
  *
  * @param {string} image OCI image reference (e.g. `"registry.example.com/org/app:tag"`)
  * @param {string} [platform] OCI platform string (e.g. `"linux/amd64"`); no-op for JS implementation
+ * @param {Object} [options]
+ * @param {function(Buffer): void} [options.checkBytes] Called with the raw bytes of the BOM layer that is about to be returned. An error it throws is rethrown, and no other referrer is tried.
  * @returns {Promise<Object|undefined>} Parsed CycloneDX BOM JSON object, or `undefined` if not found
  */
-export async function getBomWithOras(image, _platform = undefined) {
+export async function getBomWithOras(
+  image,
+  _platform = undefined,
+  options = {},
+) {
   const { registry, repository, reference } = parseImageRef(image);
   const token = await getOciToken(registry, repository, "pull");
+  let rejection;
 
   try {
     const targetManifest = await fetchManifest(
@@ -488,9 +498,10 @@ export async function getBomWithOras(image, _platform = undefined) {
         bomLayer.digest,
         token,
       );
+      const text = blob.toString("utf8");
       let bomJson;
       try {
-        bomJson = JSON.parse(blob.toString("utf8"));
+        bomJson = JSON.parse(text);
       } catch {
         // Defensive: the mediaType claimed JSON but the layer did not parse
         // (truncated/corrupt blob). Skip it and try the next candidate.
@@ -509,6 +520,14 @@ export async function getBomWithOras(image, _platform = undefined) {
       }
 
       if (isCycloneDxBom(bomJson)) {
+        if (options.checkBytes) {
+          try {
+            options.checkBytes(blob);
+          } catch (err) {
+            rejection = err;
+            break;
+          }
+        }
         return bomJson;
       }
     }
@@ -517,6 +536,9 @@ export async function getBomWithOras(image, _platform = undefined) {
       `Unable to pull the SBOM attachment for ${image} natively! ${e.message}`,
     );
   }
+  if (rejection) {
+    throw rejection;
+  }
   return undefined;
 }
 

package/lib/parsers/cmakeCache.js

@@ -197,3 +197,72 @@ export function resolveCmakeCacheFacts(map) {
     fetchContentBase,
   };
 }
+
+/** CMake's compiler ids, mapped to the family names the C/C++ toolchain uses. */
+const CMAKE_COMPILER_FAMILIES = {
+  GNU: "gcc",
+  Clang: "clang",
+  AppleClang: "apple-clang",
+  MSVC: "msvc",
+  IntelLLVM: "icx",
+  Intel: "icc",
+  NVIDIA: "nvcc",
+  NVHPC: "nvhpc",
+  PGI: "nvhpc",
+};
+
+/**
+ * Parse a compiler description CMake writes when it configures a build
+ * (`CMakeFiles/<cmake version>/CMake<LANG>Compiler.cmake`): the compiler's
+ * path, CMake's id for it and its version, all identified by CMake itself.
+ *
+ * @param {string} text File contents
+ * @returns {{language: string, compiler: string, family: string, id: string, version: string}|null}
+ *   `null` when the text names no compiler
+ */
+export function parseCmakeCompilerFile(text) {
+  if (!text || typeof text !== "string") {
+    return null;
+  }
+  const values = new Map();
+  for (const rawLine of text.split(/\r\n|\r|\n/)) {
+    const line = rawLine.trim();
+    if (!line.startsWith("set(CMAKE_") || !line.endsWith(")")) {
+      continue;
+    }
+    const body = line.slice(4, -1).trim();
+    const space = body.search(/\s/);
+    if (space < 0) {
+      continue;
+    }
+    const key = body.slice(0, space);
+    let value = body.slice(space).trim();
+    if (value.startsWith('"') && value.endsWith('"') && value.length >= 2) {
+      value = value.slice(1, -1);
+    }
+    if (!values.has(key)) {
+      values.set(key, value);
+    }
+  }
+  for (const [key, compiler] of values) {
+    const match = key.match(/^CMAKE_([A-Z]+)_COMPILER$/);
+    if (!match || !compiler) {
+      continue;
+    }
+    const language = match[1];
+    const id = values.get(`CMAKE_${language}_COMPILER_ID`) || "";
+    const variant = values.get(`CMAKE_${language}_COMPILER_FRONTEND_VARIANT`);
+    let family = CMAKE_COMPILER_FAMILIES[id] || id.toLowerCase() || "unknown";
+    if (id === "Clang" && variant === "MSVC") {
+      family = "clang-cl";
+    }
+    return {
+      language,
+      compiler,
+      family,
+      id,
+      version: values.get(`CMAKE_${language}_COMPILER_VERSION`) || "",
+    };
+  }
+  return null;
+}

package/lib/parsers/cmakeLists.js

@@ -188,10 +188,15 @@ export function parseCmakeCommands(text) {
   return commands;
 }
 
+// Upper bound on an expanded value; a set() chain that doubles a variable can
+// otherwise grow it beyond the maximum string length.
+const MAX_EXPANDED_LENGTH = 65536;
+
 /**
  * Replace `${VAR}` references with the values of simple `set()` calls. A
  * reference to an unknown variable is left in place, so callers can tell a
- * resolved value from an unresolved one.
+ * resolved value from an unresolved one. Expansion stops at the previous
+ * round once the text would exceed 64 KiB.
  *
  * @param {string} value Argument text
  * @param {Map<string,string>} variables Known variable values
@@ -203,6 +208,9 @@ export function expandCmakeVariables(value, variables) {
     let next = "";
     let i = 0;
     while (i < result.length) {
+      if (next.length > MAX_EXPANDED_LENGTH) {
+        return result;
+      }
       const start = result.indexOf("${", i);
       if (start === -1) {
         next += result.slice(i);
@@ -247,7 +255,13 @@ export function cmakeSetVariables(commands) {
       rest[0] === "CACHE" ||
       rest[0] === "PARENT_SCOPE"
     ) {
-      variables.set(key, expandCmakeVariables(value, variables));
+      // An appending set(FOO "${FOO} ...") of an undefined FOO starts from an
+      // empty value in CMake; dropping the self-reference also keeps it from
+      // being substituted into itself on every later expansion round.
+      variables.set(
+        key,
+        expandCmakeVariables(value, variables).replaceAll(`\${${key}}`, ""),
+      );
     }
   }
   return variables;