@cdxgen/cdxgen 13.3.0 → 13.5.0

package/lib/ecosystems/npmutils.js

@@ -6,6 +6,7 @@ import { clean } from "semver";
 
 import { safeExistsSync } from "../core/fs.js";
 import { parsePurlLoose } from "../inventory/purl.js";
+import { spdxLicenses } from "../inventory/spdx.js";
 import { parseNpmrc, parseNpmrcFromEnv } from "../parsers/npmrc.js";
 
 const npmPackageHydrationFields = [
@@ -19,6 +20,9 @@ const npmPackageHydrationFields = [
   "homepage",
   "keywords",
   "license",
+  // Legacy plural form kept by long-lived packages such as fuzzy 0.1.3: the
+  // manifest carries `licenses` instead of `license` (issue 4466).
+  "licenses",
   "repository",
 ];
 
@@ -310,6 +314,66 @@ export function collectNpmManifestSources(node) {
   return manifestSources;
 }
 
+/**
+ * Whether a value of the legacy `licenses` field names a license: a non-empty
+ * string, or an object with a non-empty `type`.
+ *
+ * @param {*} entry One value of the legacy field
+ * @returns {boolean} True when the entry names a license
+ */
+function isLegacyNpmLicenseEntry(entry) {
+  if (typeof entry === "string") {
+    return entry.trim() !== "";
+  }
+  return typeof entry?.type === "string" && entry.type.trim() !== "";
+}
+
+/**
+ * Resolve the license of an npm-style manifest, honouring the legacy plural
+ * `licenses` field that packages published before the SPDX convention still
+ * carry (issue 4466). A modern `license` value is returned unchanged. The
+ * legacy field may hold one entry or an array of them, each a string or a
+ * `{ type, url }` object; one entry is returned as it is. npm documents an
+ * array of several entries as a choice between them, so when every entry is an
+ * SPDX identifier the array becomes the equivalent `MIT OR Apache-2.0`
+ * expression, and otherwise stays a list for `getLicenses` to convert entry by
+ * entry.
+ *
+ * @param {object} pkgData Parsed package.json (or bower.json) manifest
+ * @returns {string|object|Array|undefined} The effective license value
+ */
+export function resolveNpmLicense(pkgData) {
+  if (!pkgData || typeof pkgData !== "object") {
+    return undefined;
+  }
+  const license = pkgData.license;
+  // An empty or null license is no declaration and defers to `licenses`.
+  if (
+    license !== undefined &&
+    license !== null &&
+    !(typeof license === "string" && license.trim() === "")
+  ) {
+    return license;
+  }
+  const legacyEntries = (
+    Array.isArray(pkgData.licenses) ? pkgData.licenses : [pkgData.licenses]
+  ).filter(isLegacyNpmLicenseEntry);
+  if (legacyEntries.length <= 1) {
+    return legacyEntries[0];
+  }
+  const licenseIds = [
+    ...new Set(
+      legacyEntries.map((entry) =>
+        (typeof entry === "string" ? entry : entry.type).trim(),
+      ),
+    ),
+  ];
+  if (licenseIds.every((licenseId) => spdxLicenses.includes(licenseId))) {
+    return licenseIds.join(" OR ");
+  }
+  return legacyEntries;
+}
+
 /**
  * Hydrates sparse npm package metadata from the installed package.json in deep mode.
  * Existing metadata on the Arborist node wins over on-disk values.