@cdxgen/cdxgen 13.3.0 → 13.5.0

package/lib/inventory/display.js

@@ -14,6 +14,7 @@ import { readReachablesSlices } from "./atomUtils.js";
 import { formatOccurrenceEvidence } from "./evidenceUtils.js";
 import {
   formatHbomHardwareClassSummary,
+  getHbomPrivilegeGuidance,
   getHbomSummary,
   isHbomLikeBom,
 } from "./hbomAnalysis.js";
@@ -475,7 +476,9 @@ export const buildTableSummaryLines = (
       );
       if (hbomSummary.requiresPrivilegedEnrichment) {
         summaryLines.push(
-          "Permission-sensitive enrichments were skipped or blocked. Re-run with --privileged where policy allows.",
+          hbomSummary.platform === "windows"
+            ? getHbomPrivilegeGuidance(hbomSummary.platform)
+            : "Permission-sensitive enrichments were skipped or blocked. Re-run with --privileged where policy allows.",
         );
       }
     }
@@ -526,6 +529,7 @@ const HBOM_COLUMN_PRIORITY = Object.freeze([
   ["cdx:hbom:securityMode", "securityMode"],
   ["cdx:hbom:health", "health"],
   ["cdx:hbom:smartStatus", "smartStatus"],
+  ["cdx:hbom:healthStatus", "healthStatus"],
   ["cdx:hbom:powerSource", "powerSource"],
   ["cdx:hbom:maximumCapacity", "maximumCapacity"],
   ["cdx:hbom:chargePercent", "chargePercent"],
@@ -546,6 +550,7 @@ const HBOM_COLUMN_PRIORITY = Object.freeze([
   ["cdx:hostview:kernel_modules:count", "kernelMods"],
   ["cdx:hostview:mount_hardening:count", "runtimeMounts"],
   ["cdx:hostview:runtime-storage:count", "runtimeStorage"],
+  ["cdx:hostview:logical_drives:count", "runtimeDrives"],
   ["cdx:hostview:linkedRuntimeCategoryCount", "runtimeLinks"],
 ]);
 
@@ -616,6 +621,7 @@ const HBOM_CLASS_PROPERTY_PRIORITY = Object.freeze({
   storage: Object.freeze([
     ["cdx:hbom:capacity", "capacity"],
     ["cdx:hbom:smartStatus", "smart"],
+    ["cdx:hbom:healthStatus", "healthStatus"],
     ["cdx:hbom:wearPercentageUsed", "wearUsed"],
     ["cdx:hbom:transport", "transport"],
     ["cdx:hbom:firmwareVersion", "firmware"],
@@ -630,6 +636,7 @@ const HBOM_CLASS_PROPERTY_PRIORITY = Object.freeze({
     ["cdx:hbom:isRemovable", "removable"],
     ["cdx:hostview:mount_hardening:count", "runtimeMounts"],
     ["cdx:hostview:runtime-storage:count", "runtimeStorage"],
+    ["cdx:hostview:logical_drives:count", "runtimeDrives"],
   ]),
   sensor: Object.freeze([
     ["cdx:hbom:temperatureCelsius", "tempC"],
@@ -870,8 +877,13 @@ export function printTable(
   }
   if (
     bomJson.metadata?.component &&
-    ["operating-system", "platform"].includes(bomJson.metadata.component.type)
+    ["operating-system", "platform"].includes(
+      bomJson.metadata.component.type,
+    ) &&
+    !filterTypes?.includes("cryptographic-asset")
   ) {
+    // A filtered crypto view stays a crypto view even on an OS BOM; only the
+    // unfiltered component listing falls through to the OS table.
     return printOSTable(bomJson);
   }
   if (isHbomLikeBom(bomJson) && !filterTypes?.includes("cryptographic-asset")) {
@@ -1037,7 +1049,13 @@ const locationComparator = (a, b) => {
     const tmpB = b.split("#");
     if (tmpA.length === 2 && tmpB.length === 2) {
       if (tmpA[0] === tmpB[0]) {
-        return tmpA[1] - tmpB[1];
+        // Line numbers sort numerically; other fragments (a secret key such
+        // as data.tls.crt) by text, never NaN.
+        const lineA = Number(tmpA[1]);
+        const lineB = Number(tmpB[1]);
+        return Number.isNaN(lineA) || Number.isNaN(lineB)
+          ? tmpA[1].localeCompare(tmpB[1])
+          : lineA - lineB;
       }
     }
   }
@@ -2125,3 +2143,182 @@ export function displaySelfThreatModel(
     process.exit(1);
   }
 }
+
+function certificateComponents(bomJson) {
+  return (bomJson?.components || []).filter(
+    (component) => component?.cryptoProperties?.assetType === "certificate",
+  );
+}
+
+function auditedBomRefs(bomJson) {
+  // Audit findings land as document annotations whose location names the
+  // component; a certificate listed there is flagged in the table. The
+  // annotation text is rendered as a markdown property table, so the rows
+  // are parsed back out of it (the same way the REPL's audit view does).
+  const refs = new Set();
+  for (const annotation of bomJson?.annotations || []) {
+    const text = typeof annotation?.text === "string" ? annotation.text : "";
+    for (const line of text.split(/\r?\n/)) {
+      if (!line.includes("cdx:audit:location:bomRef")) {
+        continue;
+      }
+      const cells = line.split("|").map((cell) => cell.trim());
+      if (
+        cells.length >= 2 &&
+        cells[1] === "cdx:audit:location:bomRef" &&
+        cells[2]
+      ) {
+        refs.add(cells[2]);
+      }
+    }
+  }
+  return refs;
+}
+
+/**
+ * Print a table of the BOM's certificate components: role, name, issuer,
+ * expiry, the SPKI prefix and how many locations each certificate appears
+ * in, with a marker when the audit flagged it.
+ *
+ * @param {Object} bomJson CycloneDX BOM JSON object
+ * @returns {void}
+ */
+export function printCertificatesTable(bomJson) {
+  const certificates = certificateComponents(bomJson);
+  if (!certificates.length) {
+    console.log(
+      "No certificate components found. Generate a CBOM with --include-crypto to use this view.",
+    );
+    return;
+  }
+  const flagged = auditedBomRefs(bomJson);
+  const stream = createStream({
+    columnDefault: { width: 24 },
+    columnCount: 6,
+    columns: [
+      { width: 13 },
+      { width: 30 },
+      { width: 30 },
+      { width: 21 },
+      { width: 18 },
+      { width: 5, alignment: "center" },
+    ],
+  });
+  stream.write([
+    "Role",
+    "Name",
+    "Issuer CN",
+    "Not valid after",
+    "SPKI (first 16)",
+    "Locs",
+  ]);
+  for (const certificate of certificates) {
+    const issuerCn = commonNameFromIssuer(certificate);
+    stream.write([
+      getPropertyValue(certificate, "cdx:crypto:certRole") || "?",
+      certificate.name || "",
+      issuerCn ||
+        certificate.cryptoProperties?.certificateProperties?.issuerName ||
+        "",
+      certificate.cryptoProperties?.certificateProperties?.notValidAfter || "",
+      (getPropertyValue(certificate, "cdx:crypto:spkiSha256") || "").slice(
+        0,
+        16,
+      ),
+      `${certificate.evidence?.occurrences?.length || 0}${flagged.has(certificate["bom-ref"]) ? " ⚠" : ""}`,
+    ]);
+  }
+  stream.end();
+  console.log();
+  console.log(`Found ${certificates.length} certificate component(s).`);
+}
+
+function commonNameFromIssuer(certificate) {
+  const issuer =
+    certificate.cryptoProperties?.certificateProperties?.issuerName || "";
+  const parts = issuer.split(",").map((part) => part.trim());
+  const cn = parts.find((part) => part.startsWith("CN="));
+  return cn ? cn.slice(3) : parts[0];
+}
+
+/**
+ * Print the issuer chain above a certificate and the certificates issued
+ * under it, walking the verified `dependsOn` edges.
+ *
+ * @param {Object} bomJson CycloneDX BOM JSON object
+ * @param {string} selector bom-ref, SPKI hex prefix or certificate ref prefix
+ * @returns {void}
+ */
+export function printCertificateChain(bomJson, selector) {
+  const query = String(selector || "").trim();
+  if (!query) {
+    console.log("Usage: .certchain <bom-ref|spki-prefix|cert-prefix>");
+    return;
+  }
+  const certificates = certificateComponents(bomJson);
+  const byRef = new Map(certificates.map((c) => [c["bom-ref"], c]));
+  const edges = new Map(
+    (bomJson?.dependencies || []).map((dep) => [
+      dep.ref,
+      (dep.dependsOn || []).filter((ref) => byRef.has(ref)),
+    ]),
+  );
+  const issuersOf = new Map();
+  for (const [ref, issuerRefs] of edges) {
+    for (const issuerRef of issuerRefs) {
+      if (!issuersOf.has(issuerRef)) {
+        issuersOf.set(issuerRef, []);
+      }
+      issuersOf.get(issuerRef).push(ref);
+    }
+  }
+  let target;
+  if (byRef.has(query)) {
+    target = byRef.get(query);
+  } else {
+    target = certificates.find(
+      (certificate) =>
+        certificate["bom-ref"].includes(query) ||
+        (
+          getPropertyValue(certificate, "cdx:crypto:spkiSha256") || ""
+        ).startsWith(query.toLowerCase()),
+    );
+  }
+  if (!target) {
+    console.log(`No certificate matches '${query}'.`);
+    return;
+  }
+  const describe = (certificate) =>
+    `${getPropertyValue(certificate, "cdx:crypto:certRole") || "?"} ${certificate.name} (${(getPropertyValue(certificate, "cdx:crypto:spkiSha256") || "").slice(0, 16)}…)`;
+  const chain = [];
+  let cursor = target["bom-ref"];
+  const seen = new Set([cursor]);
+  while (edges.has(cursor)) {
+    const next = (edges.get(cursor) || []).filter((ref) => !seen.has(ref));
+    if (!next.length) {
+      break;
+    }
+    cursor = next[0];
+    seen.add(cursor);
+    chain.push(byRef.get(cursor));
+  }
+  console.log(`Chain above ${describe(target)}:`);
+  if (chain.length) {
+    chain.forEach((certificate, index) => {
+      console.log(`${"  ".repeat(index + 1)}← ${describe(certificate)}`);
+    });
+  } else {
+    console.log("  (no verified issuer in this BOM)");
+  }
+  const issued = (issuersOf.get(target["bom-ref"]) || []).filter((ref) =>
+    byRef.has(ref),
+  );
+  console.log(`Issued under ${describe(target)}:`);
+  if (issued.length) {
+    for (const ref of issued) {
+      console.log(`  → ${describe(byRef.get(ref))}`);
+    }
+  } else {
+    console.log("  (none in this BOM)");
+  }
+}