@cdxgen/cdxgen 13.3.0 → 13.5.0

package/lib/inventory/rootfsCerts.js

@@ -0,0 +1,426 @@
+import {
+  closeSync,
+  lstatSync,
+  openSync,
+  readdirSync,
+  readSync,
+  realpathSync,
+} from "node:fs";
+import { basename, join, relative, sep } from "node:path";
+
+import {
+  androidNetworkSecurityConfigPins,
+  CertificateCollector,
+  certRecordFromDer,
+  classifyCryptoFile,
+  kubernetesTlsSecretRecords,
+  linkFallbackIssuers,
+} from "./certificates.js";
+
+// Bounds mirror trustinspector's rootfs mode (PLAN section 4.1): 16 MiB per
+// file, 20,000 files read and 500,000 entries visited per tree, depth 12.
+export const ROOTFS_CERT_LIMITS = Object.freeze({
+  maxFileBytes: 16 * 1024 * 1024,
+  maxFiles: 20000,
+  maxEntries: 500000,
+  maxDepth: 12,
+});
+
+// Coverage table: the same locations and sourceTypes as trustinspector's
+// rootfs mode (thirdparty/trustinspector/rootfs.go candidateDirs).
+const CA_STORE_DIRS = [
+  "etc/ssl/certs",
+  "usr/local/share/ca-certificates",
+  "usr/share/ca-certificates",
+  "etc/pki/tls/certs",
+  "etc/pki/ca-trust/source/anchors",
+  "etc/pki/ca-trust/extracted",
+  "var/lib/ca-certificates",
+  "usr/share/pki/ca-trust-source/anchors",
+];
+const CA_STORE_FILES = ["etc/ssl/cert.pem"];
+const CA_BLOCKLIST_DIRS = [
+  "etc/pki/ca-trust/source/blocklist",
+  "etc/pki/ca-trust/source/blacklist",
+  "usr/share/pki/ca-trust-source/blocklist",
+  "usr/share/pki/ca-trust-source/blacklist",
+];
+const SERVER_CONFIG_DIRS = [
+  "etc/nginx",
+  "etc/apache2",
+  "etc/httpd",
+  "etc/haproxy",
+  "etc/letsencrypt/live",
+  "etc/letsencrypt/archive",
+  "etc/kubernetes/pki",
+  "var/lib/kubelet/pki",
+  "etc/docker/certs.d",
+  "etc/containerd/certs.d",
+  "etc/envoy",
+  "etc/traefik",
+];
+const JAVA_DIRS = [
+  "usr/lib/jvm",
+  "opt",
+  "etc/ssl/certs/java",
+  "etc/pki/java",
+  "usr/share/elasticsearch",
+];
+const LANGUAGE_BUNDLE_DIRS = ["usr/lib", "usr/local/lib", "opt"];
+// Kubernetes secrets and Android configs are cdxgen-side producers: the
+// plugin has no YAML or Android parser.
+const SECRET_YAML_DIRS = [
+  "etc/kubernetes",
+  "var/run/secrets",
+  "run/secrets",
+  "var/lib/kubelet",
+  "srv",
+  "app",
+  "opt",
+  "home",
+  "root",
+];
+const ANDROID_DIRS = ["app", "opt", "srv", "data", "home", "root"];
+
+const CERT_SUFFIXES = [
+  ".pem",
+  ".crt",
+  ".cer",
+  ".der",
+  ".p7b",
+  ".p7c",
+  ".p12",
+  ".pfx",
+  ".jks",
+  ".jceks",
+  ".truststore",
+  ".key",
+];
+
+function isJavaKeystoreName(base) {
+  if (base === "cacerts" || base === "jssecacerts") {
+    return true;
+  }
+  return [".jks", ".jceks", ".truststore", ".p12", ".pfx"].some((suffix) =>
+    base.endsWith(suffix),
+  );
+}
+
+// Mirrors looksLikeTrustMaterialPath in trustinspector: private-key
+// directories are never read.
+function looksLikeTrustMaterialPath(rel, sourceType) {
+  const lower = rel.toLowerCase();
+  if (
+    lower.startsWith("etc/ssl/private/") ||
+    lower.startsWith("etc/pki/tls/private/")
+  ) {
+    return false;
+  }
+  const base = basename(lower);
+  if (sourceType === "language-bundle") {
+    return base === "cacert.pem";
+  }
+  if (sourceType === "java-truststore") {
+    return isJavaKeystoreName(base);
+  }
+  if (isJavaKeystoreName(base)) {
+    return true;
+  }
+  return (
+    CERT_SUFFIXES.some((suffix) => lower.endsWith(suffix)) ||
+    lower.includes("/certs/")
+  );
+}
+
+/**
+ * Read at most `maxBytes` of a regular file. The cap applies to the read
+ * itself, so a file that grows after the size check cannot exceed it. Files
+ * that are not regular (FIFOs, devices, sockets) are never opened.
+ */
+function readCapped(absolute, maxBytes) {
+  const before = lstatSync(absolute);
+  if (!before.isFile() || before.size > maxBytes) {
+    return undefined;
+  }
+  const fd = openSync(absolute, "r");
+  try {
+    const buffer = Buffer.alloc(Math.min(before.size, maxBytes) + 1);
+    let total = 0;
+    while (total < buffer.length) {
+      const n = readSync(fd, buffer, total, buffer.length - total, null);
+      if (n === 0) {
+        break;
+      }
+      total += n;
+    }
+    if (total > maxBytes) {
+      return undefined;
+    }
+    return buffer.subarray(0, total);
+  } finally {
+    closeSync(fd);
+  }
+}
+
+/**
+ * Pure-JS inventory of the certificate locations trustinspector's rootfs
+ * mode covers, plus Kubernetes TLS secrets and Android pins. Used when the
+ * plugin is not available. Produces components through the shared
+ * CertificateCollector, so bom-refs, names and deduplication match the other
+ * producers; locations are root-relative ("/etc/ssl/certs/x.crt").
+ *
+ * Every access stays inside the root: symlinks (files or directories) are
+ * skipped, only regular files are opened, and the walk is bounded by entry,
+ * file, size and depth limits.
+ *
+ * @param {string} rootDir extracted root filesystem
+ * @param {object} [limits] overrides for ROOTFS_CERT_LIMITS (tests)
+ * @returns {{components: object[], dependencies: object[], warnings: string[]}}
+ */
+export function collectRootfsCertificates(rootDir, limits = {}) {
+  const bounds = { ...ROOTFS_CERT_LIMITS, ...limits };
+  const warnings = [];
+  let realRoot;
+  try {
+    realRoot = realpathSync(rootDir);
+  } catch {
+    return { components: [], dependencies: [], warnings };
+  }
+  const collector = new CertificateCollector();
+  const records = [];
+  const components = [];
+  const seenFiles = new Set();
+  let filesRead = 0;
+
+  // Resolve a root-relative directory to an absolute path that is proven to
+  // stay inside the root; undefined when it does not exist, is not a
+  // directory, or any symlink on the way leaves the root.
+  const resolveInside = (rel) => {
+    const absolute = join(realRoot, rel);
+    let real;
+    try {
+      real = realpathSync(absolute);
+    } catch {
+      return undefined;
+    }
+    const inside = relative(realRoot, real);
+    if (inside.startsWith("..") || inside.split(sep).includes("..")) {
+      return undefined;
+    }
+    return real;
+  };
+
+  const walk = (relBase, visit) => {
+    const start = resolveInside(relBase);
+    if (!start) {
+      return;
+    }
+    let startStat;
+    try {
+      startStat = lstatSync(start);
+    } catch {
+      return;
+    }
+    if (!startStat.isDirectory()) {
+      return;
+    }
+    let entries = 0;
+    const stack = [{ abs: start, rel: relBase, depth: 0 }];
+    while (stack.length) {
+      const { abs, rel, depth } = stack.pop();
+      let dirents;
+      try {
+        dirents = readdirSync(abs, { withFileTypes: true });
+      } catch {
+        continue;
+      }
+      dirents.sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
+      for (const dirent of dirents) {
+        entries += 1;
+        if (entries > bounds.maxEntries) {
+          warnings.push(
+            `entry limit (${bounds.maxEntries}) reached in /${relBase}`,
+          );
+          return;
+        }
+        // Symlinks and special files are skipped outright.
+        if (dirent.isSymbolicLink()) {
+          continue;
+        }
+        const childRel = `${rel}/${dirent.name}`;
+        if (dirent.isDirectory()) {
+          if (depth + 1 >= bounds.maxDepth) {
+            warnings.push(
+              `depth limit (${bounds.maxDepth}) exceeded in /${relBase}`,
+            );
+            continue;
+          }
+          stack.push({
+            abs: join(abs, dirent.name),
+            rel: childRel,
+            depth: depth + 1,
+          });
+        } else if (dirent.isFile()) {
+          if (visit(childRel, join(abs, dirent.name)) === false) {
+            return;
+          }
+        }
+      }
+    }
+  };
+
+  const readRel = (rel, abs) => {
+    if (filesRead >= bounds.maxFiles) {
+      warnings.push(`file count limit (${bounds.maxFiles}) reached`);
+      return undefined;
+    }
+    filesRead += 1;
+    try {
+      const bytes = readCapped(abs, bounds.maxFileBytes);
+      if (!bytes) {
+        warnings.push(
+          `file over ${bounds.maxFileBytes} bytes skipped: /${rel}`,
+        );
+      }
+      return bytes;
+    } catch {
+      return undefined;
+    }
+  };
+
+  const consumeMaterial = (rel, abs, sourceType) => {
+    if (seenFiles.has(rel) || !looksLikeTrustMaterialPath(rel, sourceType)) {
+      return;
+    }
+    const bytes = readRel(rel, abs);
+    if (!bytes?.length) {
+      return;
+    }
+    seenFiles.add(rel);
+    const location = `/${rel}`;
+    const classification = classifyCryptoFile(bytes);
+    if (classification.kind === "certificates") {
+      const dot = basename(rel).lastIndexOf(".");
+      for (const der of classification.ders) {
+        const record = certRecordFromDer(der, { location, sourceType });
+        if (record) {
+          record.fileExtension =
+            dot > 0 ? basename(rel).slice(dot + 1) : undefined;
+          records.push(record);
+        }
+      }
+    } else if (classification.kind === "private-key") {
+      components.push(
+        rootfsMaterialComponent("private-key", location, {
+          format: classification.format,
+          sourceType,
+        }),
+      );
+    } else if (classification.kind === "keystore") {
+      components.push(
+        rootfsMaterialComponent("keystore", location, {
+          format: classification.format,
+          sourceType,
+        }),
+      );
+    }
+  };
+
+  // Most specific location first, so a file under two candidates takes the
+  // sourceType of the narrower one (same rule as the plugin).
+  const candidates = [
+    ...CA_STORE_DIRS.map((rel) => ({ rel, sourceType: "ca-store" })),
+    ...CA_BLOCKLIST_DIRS.map((rel) => ({ rel, sourceType: "ca-blocklist" })),
+    ...SERVER_CONFIG_DIRS.map((rel) => ({ rel, sourceType: "server-config" })),
+    ...JAVA_DIRS.map((rel) => ({ rel, sourceType: "java-truststore" })),
+    ...LANGUAGE_BUNDLE_DIRS.map((rel) => ({
+      rel,
+      sourceType: "language-bundle",
+    })),
+  ].sort((a, b) => b.rel.split("/").length - a.rel.split("/").length);
+  for (const file of CA_STORE_FILES) {
+    const abs = resolveInside(file);
+    if (abs && lstatSync(abs).isFile()) {
+      consumeMaterial(file, abs, "ca-store");
+    }
+  }
+  for (const { rel, sourceType } of candidates) {
+    walk(rel, (childRel, abs) => {
+      consumeMaterial(childRel, abs, sourceType);
+    });
+  }
+
+  const secretFiles = new Set();
+  for (const dir of SECRET_YAML_DIRS) {
+    walk(dir, (childRel, abs) => {
+      if (/\.ya?ml$/i.test(childRel) && !secretFiles.has(childRel)) {
+        secretFiles.add(childRel);
+        const bytes = readRel(childRel, abs);
+        const text = bytes?.toString("utf-8");
+        // Cheap pre-filter, as in the source scan.
+        if (text?.includes("kubernetes.io/tls")) {
+          records.push(
+            ...kubernetesTlsSecretRecords(text, { file: `/${childRel}` }),
+          );
+        }
+      }
+    });
+  }
+  const androidFiles = new Set();
+  for (const dir of ANDROID_DIRS) {
+    walk(dir, (childRel, abs) => {
+      if (
+        /\/res\/xml\/[^/]+\.xml$/i.test(childRel) &&
+        !androidFiles.has(childRel)
+      ) {
+        androidFiles.add(childRel);
+        const text = readRel(childRel, abs)?.toString("utf-8");
+        if (text?.includes("<network-security-config")) {
+          for (const pin of androidNetworkSecurityConfigPins(text, {
+            file: `/${childRel}`,
+          })) {
+            collector.addPin(pin);
+          }
+        }
+      }
+    });
+  }
+
+  if (records.length) {
+    linkFallbackIssuers(records);
+    collector.addRecords(records);
+  }
+  const built = collector.build();
+  return {
+    components: [...built.components, ...components],
+    dependencies: built.dependencies,
+    warnings,
+  };
+}
+
+// Same shape as the keystore and private-key components the other producers
+// emit (managedBom sourceKeystoreComponent / sourcePrivateKeyComponent).
+function rootfsMaterialComponent(kind, location, { format, sourceType }) {
+  return {
+    name: basename(location),
+    type: "cryptographic-asset",
+    "bom-ref": `crypto/related-crypto-material/${kind}/${encodeURIComponent(location)}`,
+    cryptoProperties: {
+      assetType: "related-crypto-material",
+      relatedCryptoMaterialProperties: {
+        type: kind === "keystore" ? "other" : "private-key",
+        ...(format ? { format } : {}),
+      },
+    },
+    evidence: { occurrences: [{ location }] },
+    properties: [
+      { name: "internal:SrcFile", value: location },
+      ...(sourceType
+        ? [{ name: "cdx:crypto:sourceType", value: sourceType }]
+        : []),
+      ...(kind === "keystore"
+        ? [{ name: "cdx:crypto:keystoreReadable", value: "false" }]
+        : []),
+    ],
+  };
+}

package/lib/inventory/rustFormulationParser.js

@@ -1,9 +1,8 @@
 import { readFileSync } from "node:fs";
 import { basename, dirname, join } from "node:path";
 
-import * as toml from "smol-toml";
-
 import { safeExistsSync } from "../core/fs.js";
+import { parseToml } from "../core/toml.js";
 
 // Keep this list conservative and high-signal: it is meant to surface common
 // Rust native build helpers for audit triage, not to exhaustively model every
@@ -67,7 +66,7 @@ function createFormulationComponent(name, filePath, toolName) {
 function parseCargoManifest(filePath) {
   let cargoData;
   try {
-    cargoData = toml.parse(readFileSync(filePath, { encoding: "utf-8" }));
+    cargoData = parseToml(readFileSync(filePath, { encoding: "utf-8" }));
   } catch {
     return undefined;
   }
@@ -252,7 +251,7 @@ function parseCargoManifest(filePath) {
 function parsePyProject(filePath) {
   let pyprojectData;
   try {
-    pyprojectData = toml.parse(readFileSync(filePath, { encoding: "utf-8" }));
+    pyprojectData = parseToml(readFileSync(filePath, { encoding: "utf-8" }));
   } catch {
     return undefined;
   }

package/lib/inventory/scalaCoords.js

@@ -0,0 +1,153 @@
+import { Purl } from "@cdxgen/cdx-purl";
+
+// Scala libraries publish their Maven artifacts with a trailing Scala binary
+// version suffix (`jwt-core_3`, `coursier_2.13`), optionally preceded by a
+// platform suffix for Scala.js and Scala Native builds (`upickle_sjs1_3`,
+// `upickle_native0.5_3`). sbt components strip the binary suffix and keep the
+// platform suffix (`jwt-core`, `upickle_sjs1`), so the same library is named
+// differently depending on the build tool that reported it.
+const SCALA_BINARY_SUFFIX_REGEX = /_(2\.\d+|3)$/;
+const SCALA_PLATFORM_SUFFIX_REGEX = /_(sjs1|sjs0\.6|native0\.\d+)$/;
+
+/**
+ * Parse a Scala-published Maven artifact name into its coordinate parts.
+ *
+ * @param {string} name Maven artifactId, for example `upickle_sjs1_3`
+ * @returns {{ originalName: string, artifactBase: string, binaryVersion: string|null,
+ *   platformSuffix: string, purlName: string }} The artifact name without any
+ *   Scala suffix (`upickle`), the Scala binary version from the suffix (`3`),
+ *   the platform suffix including the underscore (`_sjs1`) or an empty string,
+ *   and the artifact name sbt-style purls emit (binary suffix dropped, platform
+ *   suffix kept).
+ */
+export function parseScalaArtifact(name) {
+  const result = {
+    originalName: name,
+    artifactBase: name,
+    binaryVersion: null,
+    platformSuffix: "",
+    purlName: name,
+  };
+  if (!name) {
+    return result;
+  }
+  let rest = name;
+  const binaryMatch = rest.match(SCALA_BINARY_SUFFIX_REGEX);
+  if (binaryMatch) {
+    result.binaryVersion = binaryMatch[1];
+    rest = rest.slice(0, rest.length - binaryMatch[0].length);
+  }
+  const platformMatch = rest.match(SCALA_PLATFORM_SUFFIX_REGEX);
+  if (platformMatch) {
+    result.platformSuffix = platformMatch[0];
+    rest = rest.slice(0, rest.length - platformMatch[0].length);
+  }
+  result.artifactBase = rest;
+  result.purlName = binaryMatch ? `${rest}${result.platformSuffix}` : name;
+  return result;
+}
+
+/**
+ * Build a qualifier-free coordinate key for a Scala-published artifact.
+ *
+ * The key ignores purl qualifiers such as `repository_url` and `type`, so the
+ * POM-coordinate keys of the jar namespace mapping and the sbt-style purls of
+ * the components resolve to the same entry.
+ *
+ * @param {Object} parts Coordinate parts
+ * @param {string} [parts.type] Purl type, defaults to `maven`
+ * @param {string} [parts.group] Maven groupId
+ * @param {string} parts.artifactBase Artifact name without any Scala suffix
+ * @param {string} [parts.platformSuffix] `_sjs1`, `_native0.5` or empty
+ * @param {string} [parts.version] Package version
+ * @returns {string} The coordinate key
+ */
+export function scalaCoordinateKey({
+  type = "maven",
+  group = "",
+  artifactBase = "",
+  platformSuffix = "",
+  version = "",
+} = {}) {
+  return [type, group, artifactBase, platformSuffix, version].join(":");
+}
+
+/**
+ * Build the qualifier-free coordinate key of a purl string.
+ *
+ * The artifact name is normalized with {@link parseScalaArtifact}, so
+ * `pkg:maven/g/foo_3@1.0` and the sbt-style `pkg:maven/g/foo@1.0` share a key,
+ * while the Scala.js build `foo_sjs1_3` keeps its own key (`foo` plus the
+ * `_sjs1` platform suffix) and never joins the plain `foo` component.
+ *
+ * @param {string} purlString Package URL to normalize
+ * @returns {string|undefined} The coordinate key, or undefined when the string
+ *   is not a parseable purl
+ */
+export function coordinateKeyFromPurl(purlString) {
+  return scalaCoordinateOfPurl(purlString)?.key;
+}
+
+/**
+ * The coordinate key of a purl together with the Scala binary version its
+ * artifact name carries, if any.
+ *
+ * @param {string} purlString Package URL to normalize
+ * @returns {{ key: string, binaryVersion: string|null }|undefined} The key
+ *   and binary version, or undefined when the string is not a parseable purl
+ */
+export function scalaCoordinateOfPurl(purlString) {
+  if (!purlString?.startsWith("pkg:")) {
+    return undefined;
+  }
+  let purlObj;
+  try {
+    purlObj = Purl.parse(purlString);
+  } catch (_err) {
+    return undefined;
+  }
+  if (!purlObj?.name) {
+    return undefined;
+  }
+  const scalaInfo = parseScalaArtifact(purlObj.name);
+  return {
+    key: scalaCoordinateKey({
+      type: purlObj.type,
+      group: purlObj.namespace || "",
+      artifactBase: scalaInfo.artifactBase,
+      platformSuffix: scalaInfo.platformSuffix,
+      version: purlObj.version || "",
+    }),
+    binaryVersion: scalaInfo.binaryVersion,
+  };
+}
+
+// An artifact name that already ends in a full Scala version, as scala-cli
+// `:::` and sbt `CrossVersion.full` artifacts do (`_3.3.7`, `_2.13.16`). A
+// binary suffix such as `_3` left on a name is part of the name: the
+// component producers strip exactly one, into the compiler version.
+const SCALA_FULL_VERSION_SUFFIX_REGEX = /_\d+\.\d+\.\d+(?:-[A-Za-z0-9.]+)?$/;
+
+/**
+ * The artifactId the library is published under, for cache and repository
+ * lookups only. Components a Scala build tool reports carry the name with the
+ * Scala binary suffix stripped (the platform suffix kept) together with
+ * `cdx:scala:compilerVersion`; on disk and in the repository the artifact is
+ * `cats-core_2.13` or `upickle_sjs1_3`. Names that end in a full Scala version
+ * are used as they are.
+ *
+ * The component's own `name`, `purl` and `bom-ref` never change.
+ *
+ * @param {Object} pkg Package with `name` and `properties`.
+ * @returns {string} The artifactId to look up.
+ */
+export function publishedArtifactId(pkg) {
+  const name = pkg?.name;
+  if (!name || SCALA_FULL_VERSION_SUFFIX_REGEX.test(name)) {
+    return name;
+  }
+  const binaryVersion = (pkg.properties || []).find(
+    (property) => property.name === "cdx:scala:compilerVersion",
+  )?.value;
+  return binaryVersion ? `${name}_${binaryVersion}` : name;
+}