@cdxgen/cdxgen 13.3.0 → 13.5.0

package/lib/ecosystems/parsers-misc.js

@@ -4,6 +4,7 @@ import {
   sep as _sep,
   basename,
   dirname,
+  isAbsolute,
   join,
   relative,
   resolve,
@@ -13,14 +14,15 @@ import { build, Purl } from "@cdxgen/cdx-purl";
 import { parse as _load } from "yaml";
 
 import {
-  cdxgenAgent,
   DEBUG_MODE,
+  hasDangerousUnicode,
   readEnvironmentVariable,
 } from "../core/activity.js";
 import { recordDegradation } from "../core/buildLedger.js";
 import { deferFailOnError } from "../core/deferredExit.js";
 import { shouldFetchLicense } from "../core/env.js";
 import {
+  getTmpDir,
   safeExistsSync,
   safeSpawnSync,
   safeWriteSync,
@@ -28,10 +30,16 @@ import {
 } from "../core/fs.js";
 import { thoughtLog } from "../core/logger.js";
 import { isWin } from "../core/paths.js";
+import {
+  isProjectToolingAllowed,
+  reportProjectToolingSkipped,
+} from "../core/projectTooling.js";
+import { registerRunReset } from "../core/runState.js";
 import { mesonWrapDB } from "../core/state.js";
 import { isGitHubUrl } from "../core/urls.js";
 import { parseWorkflowFile } from "../inventory/ciParsers/githubActions.js";
 import {
+  gatedGet,
   prefetchEnabled,
   prefetchedResponse,
   prefetchJson,
@@ -45,6 +53,7 @@ import {
 } from "../inventory/purl.js";
 import { getLicenses, spdxLicenses } from "../inventory/spdx.js";
 import { cmakeFetchDependencies } from "../parsers/cmakeLists.js";
+import { isValidIdnEmail } from "../parsers/email.js";
 import { submodulePurlCoordinates } from "../parsers/gitmodules.js";
 import { getDartMetadata } from "./ecosystems.js";
 import { parsePkgJson } from "./parsers-js.js";
@@ -59,6 +68,22 @@ import { parsePkgJson } from "./parsers-js.js";
  */
 const MAX_FLAKE_INPUTS_BLOCK_LENGTH = 16 * 1024;
 
+/**
+ * Whether a package registry can hold a pubspec.lock entry.
+ *
+ * The entry's `source` names where the package comes from. `sdk` packages ship
+ * with the Dart or Flutter SDK, `path` packages live in the working tree, and
+ * `git` packages come from a repository. None is published on a registry, and
+ * asking about them leaks their names and imports a look-alike's metadata.
+ *
+ * @param {Object} packageData One pubspec.lock `packages` entry.
+ * @returns {boolean}
+ */
+function canPubRegistryServe(packageData) {
+  const source = packageData?.source;
+  return source === undefined || source === "hosted";
+}
+
 /**
  * Method to parse pubspec.lock files.
  *
@@ -71,10 +96,11 @@ export async function parsePubLockData(pubLockData, lockFile) {
   if (!pubLockData) {
     return [];
   }
-  let pkgList = [];
+  const pkgList = [];
   const rootList = [];
   const data = _load(pubLockData);
   const packages = data.packages;
+  const lookupList = [];
   for (const [packageName, packageData] of Object.entries(packages)) {
     const pkg = {
       name: packageName,
@@ -131,9 +157,15 @@ export async function parsePubLockData(pubLockData, lockFile) {
       };
     }
     pkgList.push(pkg);
+    if (canPubRegistryServe(packageData)) {
+      lookupList.push(pkg);
+    }
   }
   if (shouldFetchLicense()) {
-    pkgList = await getDartMetadata(pkgList);
+    // getDartMetadata enriches in place, so the sdk, path and git packages
+    // stay in pkgList with the lockfile's answers and are simply not handed
+    // to it.
+    await getDartMetadata(lookupList);
   }
   return { rootList, pkgList };
 }
@@ -1533,11 +1565,146 @@ export function parseComposerJson(composerJsonFile) {
   return { rootRequires, moduleParent };
 }
 
+// Composer's platform packages stand for what the runtime provides, and none
+// is installable, so none has a purl or an edge in the dependency graph. These
+// are the ones that describe PHP: PHP and its build flavours, HHVM, and the
+// extensions and system libraries PHP was built with. composer,
+// composer-plugin-api and composer-runtime-api are platform packages too, but
+// they describe Composer, so they are left out.
+// https://github.com/composer/composer/blob/2.10.3/src/Composer/Repository/PlatformRepository.php#L39
+const COMPOSER_PLATFORM_NAMES = new Set([
+  "php",
+  "php-64bit",
+  "php-ipv6",
+  "php-zts",
+  "php-debug",
+  "hhvm",
+]);
+
+function isComposerPlatformRequirement(name) {
+  return (
+    COMPOSER_PLATFORM_NAMES.has(name) ||
+    name.startsWith("ext-") ||
+    name.startsWith("lib-")
+  );
+}
+
+// What the lock records about the platform is a constraint, or the version a
+// project told Composer to assume. It is a fact about the project's
+// requirements, never the version of anything that runs, so it is kept as a
+// property and never becomes a component.
+const COMPOSER_PLATFORM_SECTIONS = [
+  ["platform", "cdx:composer:platform:"],
+  ["platform-dev", "cdx:composer:platformDev:"],
+  ["platform-overrides", "cdx:composer:platformOverride:"],
+];
+const COMPOSER_REQUIRE_PREFIX = "cdx:composer:require:";
+const MAX_COMPOSER_PLATFORM_VALUE_LENGTH = 256;
+// A real lock names a few dozen platform packages per map at most; the cap
+// keeps a crafted one from turning each map into thousands of properties.
+const MAX_COMPOSER_PLATFORM_ENTRIES = 128;
+
+function isComposerPlatformKey(key) {
+  return /^[A-Za-z0-9._-]{1,100}$/.test(key);
+}
+
+/**
+ * The value a platform entry carries as a property: a constraint or version
+ * string, or `false`, which `config.platform` uses to disable a package:
+ * https://github.com/composer/composer/blob/2.10.3/src/Composer/Repository/PlatformRepository.php#L125
+ *
+ * @param {unknown} value value from the lock
+ * @returns {string|undefined} property value, or undefined when it is not one
+ */
+function composerPlatformValue(value) {
+  if (value === false) {
+    return "false";
+  }
+  if (typeof value !== "string") {
+    return undefined;
+  }
+  const trimmed = value.trim();
+  if (
+    !trimmed ||
+    trimmed.length > MAX_COMPOSER_PLATFORM_VALUE_LENGTH ||
+    hasDangerousUnicode(trimmed) ||
+    /[\t\n\r]/.test(trimmed)
+  ) {
+    return undefined;
+  }
+  return trimmed;
+}
+
+/**
+ * Turn a map of platform entries into properties named `<prefix><name>`, in
+ * name order, at most MAX_COMPOSER_PLATFORM_ENTRIES of them. Over the cap the
+ * PHP and HHVM entries are kept first, since `ext-*` sorts before `php`. An
+ * array (Composer writes an empty section as `[]`) or any other shape holds no
+ * entries.
+ *
+ * @param {unknown} entries map of requirement name to constraint
+ * @param {string} prefix property name prefix
+ * @param {function(string): boolean} [keep] which names to keep
+ * @returns {{name: string, value: string}[]} properties
+ */
+function composerPlatformProperties(entries, prefix, keep = () => true) {
+  if (!entries || typeof entries !== "object" || Array.isArray(entries)) {
+    return [];
+  }
+  const kept = [];
+  for (const key of Object.keys(entries).sort()) {
+    const value = composerPlatformValue(entries[key]);
+    if (value !== undefined && isComposerPlatformKey(key) && keep(key)) {
+      kept.push({ key, value });
+    }
+  }
+  let selected = kept;
+  if (kept.length > MAX_COMPOSER_PLATFORM_ENTRIES) {
+    const runtimes = kept.filter(({ key }) => COMPOSER_PLATFORM_NAMES.has(key));
+    const others = kept
+      .filter(({ key }) => !COMPOSER_PLATFORM_NAMES.has(key))
+      .slice(0, MAX_COMPOSER_PLATFORM_ENTRIES - runtimes.length);
+    const chosen = new Set([...runtimes, ...others]);
+    selected = kept.filter((entry) => chosen.has(entry));
+  }
+  return selected.map(({ key, value }) => ({ name: `${prefix}${key}`, value }));
+}
+
+/**
+ * A CycloneDX `organizationalContact` from an author record in package
+ * metadata. The schema asserts `idn-email` on the address, so one that is not
+ * a valid address is dropped rather than failing BOM validation; an author with
+ * neither a name nor a valid address yields nothing.
+ *
+ * @param {{name?: string, email?: unknown}} author Author as the manifest has it
+ * @returns {Array<{name?: string, email?: string}>} Zero or one contact
+ */
+function contactFromAuthor(author) {
+  const contact = {};
+  if (typeof author?.name === "string" && author.name.trim()) {
+    contact.name = author.name;
+  }
+  const email = typeof author?.email === "string" ? author.email.trim() : "";
+  if (isValidIdnEmail(email)) {
+    contact.email = email;
+  }
+  return Object.keys(contact).length ? [contact] : [];
+}
+
 /**
  * Parse composer lock file
  *
  * @param {string} pkgLockFile composer.lock file
  * @param {array} rootRequires require section from composer.json
+ * @returns {{pkgList: Object[], dependenciesList: Object[], rootList: Object[], platformProperties: {name: string, value: string}[]}|Array}
+ *   The locked packages, the dependency edges between them, the packages the
+ *   root requires, and the lock's `platform`, `platform-dev` and
+ *   `platform-overrides` entries as `cdx:composer:*` properties. The platform
+ *   entries are constraints and assumed versions, not the PHP that runs; the
+ *   caller puts them on the module component. Every locked package carries its
+ *   own `php`, `hhvm`, `ext-*` and `lib-*` requirements as
+ *   `cdx:composer:require:<name>` properties. A lock that is not valid JSON
+ *   gives an empty array.
  */
 export function parseComposerLock(pkgLockFile, rootRequires) {
   const pkgList = [];
@@ -1546,16 +1713,12 @@ export function parseComposerLock(pkgLockFile, rootRequires) {
   const pkgNamePurlMap = {};
   const rootList = [];
   const rootRequiresMap = {};
+  let platformProperties = [];
   if (rootRequires) {
     for (const rr of Object.keys(rootRequires)) {
       // Skip platform requirements (php, hhvm, ext-*, lib-*) — they are never
       // Composer package names and must not be used to identify root packages.
-      if (
-        rr === "php" ||
-        rr === "hhvm" ||
-        rr.startsWith("ext-") ||
-        rr.startsWith("lib-")
-      ) {
+      if (isComposerPlatformRequirement(rr)) {
         continue;
       }
       rootRequiresMap[rr] = true;
@@ -1570,6 +1733,11 @@ export function parseComposerLock(pkgLockFile, rootRequires) {
       return [];
     }
     if (lockData) {
+      for (const [section, prefix] of COMPOSER_PLATFORM_SECTIONS) {
+        platformProperties = platformProperties.concat(
+          composerPlatformProperties(lockData[section], prefix),
+        );
+      }
       const packages = {};
       if (lockData["packages"]) {
         packages["required"] = lockData["packages"];
@@ -1642,9 +1810,10 @@ export function parseComposerLock(pkgLockFile, rootRequires) {
             apkg.distribution = { url: distUrl };
           }
           if (pkg?.authors?.length) {
-            apkg.authors = pkg.authors.map((a) => {
-              return { name: a.name, email: a.email };
-            });
+            const authors = pkg.authors.flatMap(contactFromAuthor);
+            if (authors.length) {
+              apkg.authors = authors;
+            }
           }
           if (pkg?.keywords?.length) {
             apkg.tags = pkg.keywords;
@@ -1665,6 +1834,13 @@ export function parseComposerLock(pkgLockFile, rootRequires) {
               });
             }
           }
+          apkg.properties.push(
+            ...composerPlatformProperties(
+              pkg.require,
+              COMPOSER_REQUIRE_PREFIX,
+              isComposerPlatformRequirement,
+            ),
+          );
           pkgList.push(apkg);
           dependenciesMap[purl] = new Set();
           pkgNamePurlMap[pkg.name] = purl;
@@ -1704,6 +1880,7 @@ export function parseComposerLock(pkgLockFile, rootRequires) {
     pkgList,
     dependenciesList,
     rootList,
+    platformProperties,
   };
 }
 
@@ -3002,14 +3179,67 @@ export function parseMakeDFile(dfile) {
   return pkgFilesMap;
 }
 
+/**
+ * Resolve a path a lockfile names against the lockfile's directory, refusing
+ * absolute paths and any that leave the scanned directory. The value comes
+ * from the scanned project, so it must not steer the scan at files outside
+ * it. The bound is the scan root, not the lockfile's directory: a React
+ * Native `ios/Podfile` names its pods as `../node_modules/...`.
+ *
+ * @param {String} projectPath Directory of the Podfile.lock
+ * @param {String} value Path as the lockfile writes it
+ * @param {String} [scanRoot] Directory the scan was asked for; the lockfile's
+ *   directory when not given
+ * @returns {String|undefined} The resolved path, or undefined when refused
+ */
+function resolveInsideScan(projectPath, value, scanRoot = projectPath) {
+  if (typeof value !== "string" || !value.length) {
+    return undefined;
+  }
+  if (
+    isAbsolute(value) ||
+    /^[a-zA-Z]:[\\/]/.test(value) ||
+    value.startsWith("\\\\")
+  ) {
+    return undefined;
+  }
+  const resolved = resolve(projectPath, value);
+  const back = relative(resolve(scanRoot), resolved);
+  if (back.startsWith("..") || isAbsolute(back)) {
+    return undefined;
+  }
+  return resolved;
+}
+
+/**
+ * Whether a pod name can be used as a file name. Pod names come from the
+ * lockfile and are joined onto directories.
+ *
+ * @param {String} podName Root pod name
+ * @returns {Boolean}
+ */
+function isSafePodFileName(podName) {
+  return (
+    typeof podName === "string" &&
+    podName.length > 0 &&
+    !podName.includes("/") &&
+    !podName.includes("\\") &&
+    !podName.includes("\0") &&
+    podName !== "." &&
+    podName !== ".."
+  );
+}
+
 /**
  * Parse the contents of a 'Podfile.lock'
  *
  * @param {Object} podfileLock The content of the podfile.lock as an Object
  * @param {String} projectPath The path to the project root
+ * @param {String} [scanRoot] Directory the scan was asked for. Local `:path`
+ *   and `:podspec` sources outside it are not read. Defaults to projectPath.
  * @returns {Map} Map of all dependencies with their direct dependencies
  */
-export async function parsePodfileLock(podfileLock, projectPath) {
+export async function parsePodfileLock(podfileLock, projectPath, scanRoot) {
   const dependencies = new Map();
   for (const pod of podfileLock["PODS"]) {
     const dependency = {};
@@ -3031,58 +3261,103 @@ export async function parsePodfileLock(podfileLock, projectPath) {
           dependency.metadata.name.indexOf("/"),
         )
       : dependency.metadata.name;
-    if (podfileLock["EXTERNAL SOURCES"]?.[podName]) {
+    if (
+      podfileLock["EXTERNAL SOURCES"]?.[podName] &&
+      isSafePodFileName(podName)
+    ) {
       const externalPod = podfileLock["EXTERNAL SOURCES"][podName];
       if (externalPod[":git"]) {
-        let projectRepo = externalPod[":git"];
-        if (isGitHubUrl(projectRepo)) {
-          projectRepo = projectRepo.replace(
-            "github.com",
-            "raw.githubusercontent.com",
-          );
-        }
-        if (projectRepo.endsWith(".git")) {
-          projectRepo = projectRepo.substring(0, projectRepo.length - 4);
+        // The podspec of a checked out pod, which `pod install` writes
+        // alongside the sources it downloaded. Reading it needs no request,
+        // so it answers before any raw repository URL.
+        const localPodspec = join(
+          projectPath,
+          "Pods",
+          "Local Podspecs",
+          `${podName}.podspec.json`,
+        );
+        if (safeExistsSync(localPodspec)) {
+          dependency.metadata.properties = [
+            {
+              name: "cdx:pods:podspecLocation",
+              value: localPodspec,
+            },
+          ];
+        } else {
+          let projectRepo = externalPod[":git"];
+          if (isGitHubUrl(projectRepo)) {
+            projectRepo = projectRepo.replace(
+              "github.com",
+              "raw.githubusercontent.com",
+            );
+          }
+          if (projectRepo.endsWith(".git")) {
+            projectRepo = projectRepo.substring(0, projectRepo.length - 4);
+          }
+          // The commit the lockfile recorded in CHECKOUT OPTIONS names the
+          // exact revision CocoaPods checked out, so its podspec is asked
+          // for directly instead of probing the default branch names. It
+          // wins over a branch, whose head may have moved since.
+          const checkoutCommit =
+            podfileLock["CHECKOUT OPTIONS"]?.[podName]?.[":commit"];
+          const projectRepoBranchOrTag =
+            typeof checkoutCommit === "string" &&
+            /^[0-9a-f]{7,64}$/i.test(checkoutCommit)
+              ? checkoutCommit
+              : externalPod[":tag"]
+                ? `refs/tags/${externalPod[":tag"]}`
+                : externalPod[":branch"]
+                  ? `refs/heads/${externalPod[":branch"]}`
+                  : "refs/heads/<DEFAULT>";
+          dependency.metadata.properties = [
+            {
+              name: "cdx:pods:podspecLocation",
+              value: `${projectRepo}/${projectRepoBranchOrTag}/${podName}.podspec`,
+            },
+          ];
         }
-        const projectRepoBranchOrTag = externalPod[":tag"]
-          ? `tags/${externalPod[":tag"]}`
-          : `heads/${externalPod[":branch"] ? externalPod[":branch"] : "<DEFAULT>"}`;
-        dependency.metadata.properties = [
-          {
-            name: "cdx:pods:podspecLocation",
-            value: `${projectRepo}/refs/${projectRepoBranchOrTag}/${podName}.podspec`,
-          },
-        ];
       } else if (externalPod[":path"]) {
-        const projectLocation = resolve(projectPath, externalPod[":path"]);
-        dependency.metadata.properties = [
-          {
-            name: "cdx:pods:projectDir",
-            value: projectLocation,
-          },
-        ];
-        let podspec = join(projectLocation, `${podName}.podspec`);
-        if (!safeExistsSync(podspec)) {
-          podspec = `${podspec}.json`;
-        }
-        if (safeExistsSync(podspec)) {
-          dependency.metadata.properties.push({
-            name: "cdx:pods:podspecLocation",
-            value: podspec,
-          });
+        const projectLocation = resolveInsideScan(
+          projectPath,
+          externalPod[":path"],
+          scanRoot,
+        );
+        if (projectLocation) {
+          dependency.metadata.properties = [
+            {
+              name: "cdx:pods:projectDir",
+              value: projectLocation,
+            },
+          ];
+          let podspec = join(projectLocation, `${podName}.podspec`);
+          if (!safeExistsSync(podspec)) {
+            podspec = `${podspec}.json`;
+          }
+          if (safeExistsSync(podspec)) {
+            dependency.metadata.properties.push({
+              name: "cdx:pods:podspecLocation",
+              value: podspec,
+            });
+          }
         }
       } else if (externalPod[":podspec"]) {
-        const podspecLocation = resolve(projectPath, externalPod[":podspec"]);
-        dependency.metadata.properties = [
-          {
-            name: "cdx:pods:projectDir",
-            value: dirname(podspecLocation),
-          },
-          {
-            name: "cdx:pods:podspecLocation",
-            value: podspecLocation,
-          },
-        ];
+        const podspecLocation = resolveInsideScan(
+          projectPath,
+          externalPod[":podspec"],
+          scanRoot,
+        );
+        if (podspecLocation) {
+          dependency.metadata.properties = [
+            {
+              name: "cdx:pods:projectDir",
+              value: dirname(podspecLocation),
+            },
+            {
+              name: "cdx:pods:podspecLocation",
+              value: podspecLocation,
+            },
+          ];
+        }
       }
     }
     dependencies.set(dependency.metadata.name, dependency);
@@ -3408,6 +3683,8 @@ export function resetCocoaPodspecPrefetch() {
   cocoaPodspecPrefetch = new Map();
 }
 
+registerRunReset("cocoapods:podspecs", resetCocoaPodspecPrefetch);
+
 /**
  * Prefetch the remote podspecs a full CocoaPods scan is about to read.
  *
@@ -3486,6 +3763,12 @@ async function fullScanCocoaPod(dependency, component, options) {
         value: podspecLocation,
       });
     }
+    // A Ruby podspec is a program that only `pod` can read, and it comes from
+    // the scanned project or a repository its lockfile names. Without
+    // permission to run the project's tooling, only JSON podspecs are read,
+    // directly and without `pod`.
+    const toolingAllowed = isProjectToolingAllowed(options);
+    const isRemote = podspecLocation.startsWith("http");
     let replacements = [];
     if (
       podspecLocation.endsWith(".podspec") &&
@@ -3502,29 +3785,50 @@ async function fullScanCocoaPod(dependency, component, options) {
         "COCOA_PODSPEC_JSON_REPLACEMENTS",
       ).split(";");
     }
-    if (replacements || podspecLocation.startsWith("http")) {
-      let podspecContent;
-      if (podspecLocation.startsWith("http")) {
-        let httpResult;
-        for (const candidate of podspecCandidates(podspecLocation)) {
-          try {
-            httpResult =
-              prefetchedResponse(cocoaPodspecPrefetch, candidate) ||
-              (await cdxgenAgent.get(candidate));
-            podspecLocation = candidate;
-          } catch (_err) {
-            continue;
-          }
-          component.properties.find(
-            ({ name }) => name === "cdx:pods:podspecLocation",
-          ).value = podspecLocation;
-          podspecLocation = `${randomUUID()}.${podspecLocation.substring(podspecLocation.lastIndexOf(".") + 1)}`;
-          podspecContent = httpResult.body;
-          break;
+    let podspecContent;
+    if (isRemote) {
+      let httpResult;
+      for (const candidate of podspecCandidates(podspecLocation)) {
+        if (!toolingAllowed && !candidate.endsWith(".json")) {
+          continue;
         }
-      } else {
-        podspecContent = readFileSync(podspecLocation, "utf-8");
+        try {
+          httpResult =
+            prefetchedResponse(cocoaPodspecPrefetch, candidate) ||
+            (await gatedGet(candidate, { responseType: "text" }));
+          podspecLocation = candidate;
+        } catch (_err) {
+          continue;
+        }
+        component.properties.find(
+          ({ name }) => name === "cdx:pods:podspecLocation",
+        ).value = podspecLocation;
+        podspecContent = httpResult.body;
+        break;
       }
+      // A location none of the candidates served contributes nothing: the
+      // component keeps what the lockfile already said about the pod.
+      if (podspecContent === undefined) {
+        return;
+      }
+    } else if (!toolingAllowed && !podspecLocation.endsWith(".json")) {
+      reportProjectToolingSkipped(
+        options,
+        "cocoa.podspec.tooling-disabled",
+        "Skipping 'pod ipc spec' for Ruby podspecs since dependency installation is disabled. Their pods keep the details from Podfile.lock.",
+        {
+          ecosystem: "cocoa",
+          tool: "pod",
+          impact: "licenses",
+          detail:
+            "Dependency installation is disabled, so Ruby podspecs were not evaluated and their pods lack license and author details.",
+        },
+      );
+      return;
+    } else if (replacements.length || !toolingAllowed) {
+      podspecContent = readFileSync(podspecLocation, "utf-8");
+    }
+    if (podspecContent !== undefined) {
       for (const replacement of replacements) {
         const replacementPair = replacement.split("=");
         let match = replacementPair[0].replaceAll("<NEWLINE>", "\n");
@@ -3534,18 +3838,28 @@ async function fullScanCocoaPod(dependency, component, options) {
         const repl = replacementPair[1].replaceAll("<NEWLINE>", "\n");
         podspecContent = podspecContent.replaceAll(match, repl);
       }
-      podspecLocation = join(
-        dirname(podspecLocation),
-        `${randomUUID()}.${podspecLocation.substring(podspecLocation.lastIndexOf(".") + 1)}`,
+    }
+    if (!toolingAllowed) {
+      // Only JSON podspecs reach this point, and they need no `pod`
+      result = { stdout: podspecContent };
+    } else {
+      if (podspecContent !== undefined) {
+        // A downloaded podspec goes to the temporary directory; a local one
+        // with replacements stays beside the original, whose relative paths
+        // its Ruby may read.
+        podspecLocation = join(
+          isRemote ? getTmpDir() : dirname(podspecLocation),
+          `${randomUUID()}.${podspecLocation.substring(podspecLocation.lastIndexOf(".") + 1)}`,
+        );
+        safeWriteSync(podspecLocation, podspecContent);
+        temporaryFiles.add(podspecLocation);
+      }
+      result = executePodCommand(
+        ["ipc", "spec", "--silent", podspecLocation],
+        undefined,
+        options,
       );
-      safeWriteSync(podspecLocation, podspecContent);
-      temporaryFiles.add(podspecLocation);
     }
-    result = executePodCommand(
-      ["ipc", "spec", "--silent", podspecLocation],
-      undefined,
-      options,
-    );
   } else {
     let dependencyName = dependency.name;
     if (dependencyName.includes("/")) {
@@ -3610,9 +3924,7 @@ async function fullScanCocoaPod(dependency, component, options) {
     component.authors = [];
     if (podspec.authors.constructor === Object) {
       Object.entries(podspec.authors).forEach(([name, email]) => {
-        email.includes("@")
-          ? component.authors.push({ name, email })
-          : component.authors.push({ name });
+        component.authors.push(...contactFromAuthor({ name, email }));
       });
     } else if (podspec.authors.constructor === Array) {
       podspec.authors.forEach((name) => {