@cdxgen/cdxgen 13.3.0 → 13.5.0

package/lib/inventory/traceRunner.js

@@ -77,6 +77,7 @@ export function parseCommand(cmdStr) {
 export function resolveSaferExecBinary() {
   const currentPlatform = platform();
   const currentArch = arch();
+  const isWindows = currentPlatform === "win32";
   let pkgName = "";
 
   if (currentPlatform === "darwin") {
@@ -91,6 +92,14 @@ export function resolveSaferExecBinary() {
     } else if (currentArch === "arm64") {
       pkgName = "@cdxgen/safer-exec-linux-arm64";
     }
+  } else if (isWindows) {
+    // The Windows packages ship the MXC executor (wxc-exec.exe) next to the
+    // engine, which is where the engine looks for it.
+    if (currentArch === "x64") {
+      pkgName = "@cdxgen/safer-exec-windows-amd64";
+    } else if (currentArch === "arm64") {
+      pkgName = "@cdxgen/safer-exec-windows-arm64";
+    }
   }
 
   if (!pkgName) {
@@ -117,9 +126,14 @@ export function resolveSaferExecBinary() {
 
     for (const modulesDir of searchDirs) {
       // Direct structure under node_modules. The Go runtime inside the
-      // platform package is bin/safer-exec-rt; "safer-exec" is the JS
+      // platform package is bin/safer-exec-rt(.exe); "safer-exec" is the JS
       // dispatcher's npm bin name, not a file on disk.
-      const directPath = join(modulesDir, pkgName, "bin", "safer-exec-rt");
+      const directPath = join(
+        modulesDir,
+        pkgName,
+        "bin",
+        isWindows ? "safer-exec-rt.exe" : "safer-exec-rt",
+      );
       let realDirectPath;
       try {
         realDirectPath = realpathSync(directPath);
@@ -127,10 +141,12 @@ export function resolveSaferExecBinary() {
         realDirectPath = directPath;
       }
       if (existsSync(realDirectPath)) {
-        try {
-          chmodSync(realDirectPath, 0o755);
-        } catch (_err) {
-          // ignore
+        if (!isWindows) {
+          try {
+            chmodSync(realDirectPath, 0o755);
+          } catch (_err) {
+            // ignore
+          }
         }
         return realDirectPath;
       }
@@ -179,7 +195,7 @@ export function resolveSaferExecBinary() {
  * @param {boolean} [options.denyPersistenceWrites] - Deny writes to auto-execution and persistence locations
  * @param {boolean} [options.privateTmp] - Private tmpfs /tmp and /var/tmp (Linux)
  * @param {string} [options.protectHome] - Home isolation: read-only, tmpfs, or off (Linux)
- * @returns {Promise<{libPaths: string[], httpAccessEntries: Object[], egressEntries?: Object[], dryRunSummary?: Object}>} Collected libraries, HTTP URLs, proxy egress decisions, and the dry-run summary
+ * @returns {Promise<{libPaths: string[], httpAccessEntries: Object[], cryptoEntries?: Object[], cryptoComponents?: Object[], cryptoResult?: Object, egressEntries?: Object[], dryRunSummary?: Object}>} Collected libraries, HTTP URLs, crypto observations, proxy egress decisions, and the dry-run summary
  * @throws {Error} When the @cdxgen/safer-exec tracing runtime is not installed
  *   (for example after pruning it from a standalone payload), since the traced
  *   command could never run and the BOM would silently be empty
@@ -252,6 +268,14 @@ export async function executeAndTrace(commandStr, workingDir, options = {}) {
     if (options.dryRun) {
       exec.enableDryRun();
     }
+    if (platform() === "win32" && options.blockInterpreters) {
+      // safer-exec reports --private-tmp and --protect-home on Windows when a
+      // grant defeats them, but --block-interpreters is macOS-only and stays
+      // silent (cdxgen/safer-exec#4).
+      console.warn(
+        "[cdxgen trace] --block-interpreters has no effect on Windows.",
+      );
+    }
     if (options.blockInterpreters) {
       exec.blockInterpreters();
     }
@@ -376,8 +400,41 @@ export async function executeAndTrace(commandStr, workingDir, options = {}) {
 
     const result = await exec.run(cmd, args);
     const stderr = result?.stderr || "";
+    const { warnings, error: engineError } = engineMessages(stderr);
+    // Windows records DLL loads through an ETW session, which only an
+    // elevated process (or a Performance Log Users member) may start.
+    const etwDenied =
+      platform() === "win32" &&
+      warnings.some(
+        (line) =>
+          line.includes("DLL tracing:") &&
+          line.includes("administrator rights"),
+      );
+    // run() captures the engine's stderr, so a control the sandbox could not
+    // apply would otherwise read like one it did.
+    for (const line of warnings) {
+      if (etwDenied && line.includes("DLL tracing:")) {
+        continue;
+      }
+      console.warn(line);
+    }
+    if (etwDenied) {
+      console.warn(
+        "[cdxgen trace] library tracing on Windows needs an elevated prompt (or membership in the Performance Log Users group); the BOM has no library components. Egress services from --proxy-egress are still recorded.",
+      );
+    }
     if (result && result.exitCode !== 0) {
-      if (stderr.includes("[safer-exec] Error:")) {
+      if (engineError) {
+        console.error(engineError);
+        if (options.strict) {
+          // Under --strict the sandbox refused the run; an empty BOM would
+          // read as a command that loaded nothing.
+          throw Object.assign(
+            new Error(`Tracing refused under --strict: ${engineError}`),
+            { strictRefusal: true },
+          );
+        }
+      } else if (stderr.includes("[safer-exec] Error:")) {
         console.error("Tracing launcher execution failed:", stderr.trim());
       } else {
         // A failing command usually means a partial trace (for example a
@@ -474,6 +531,9 @@ export async function executeAndTrace(commandStr, workingDir, options = {}) {
         httpAccessEntries: [...collectedUrls, ...urls],
         cryptoEntries: [...collectedCrypto, ...cryptoLogs],
         cryptoComponents,
+        // The CRYPTO result from the report channel: the cipher entries carry
+        // the certificate chains servers presented (safer-exec ≥ 1.2.0).
+        cryptoResult: result?.crypto,
         egressEntries: parseEgressEntries(result.auditLog),
         dryRunSummary,
       };
@@ -484,15 +544,40 @@ export async function executeAndTrace(commandStr, workingDir, options = {}) {
       httpAccessEntries: collectedUrls,
       cryptoEntries: collectedCrypto,
       cryptoComponents,
+      cryptoResult: result?.crypto,
       egressEntries: [],
       dryRunSummary,
     };
   } catch (err) {
+    if (err?.strictRefusal) {
+      throw err;
+    }
     console.error("Tracing command execution failed:", err);
   }
   return emptyResult;
 }
 
+/**
+ * Picks the safer-exec engine's own lines out of the stderr it shares with the
+ * traced command. Warnings start with "safer-exec: warning:"; when the engine
+ * stops a run, its error is the last other "safer-exec: " line it prints.
+ *
+ * @param {string} stderr Captured stderr of a safer-exec run
+ * @returns {{warnings: string[], error: string|undefined}} Unique engine warnings, and the engine's error if any
+ */
+export function engineMessages(stderr) {
+  const lines = String(stderr || "")
+    .split(/\r?\n/)
+    .filter((line) => line.startsWith("safer-exec: "));
+  const warnings = [
+    ...new Set(lines.filter((line) => line.startsWith("safer-exec: warning:"))),
+  ];
+  const others = lines.filter(
+    (line) => !line.startsWith("safer-exec: warning:"),
+  );
+  return { warnings, error: others.at(-1) };
+}
+
 /**
  * Returns the sorted, de-duplicated parameter names of a query string.
  *

package/lib/inventory/tracedCrypto.js

@@ -0,0 +1,423 @@
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+
+import { thoughtLog } from "../core/logger.js";
+import { dirNameStr } from "../core/paths.js";
+import {
+  CertificateCollector,
+  certRecordFromObservedChainEntry,
+  toWellFormedText,
+} from "./certificates.js";
+import { applyAlgorithmProperties } from "./cryptoAlgorithmFamily.js";
+
+const cryptoOids = JSON.parse(
+  readFileSync(join(dirNameStr, "data", "crypto-oid.json"), "utf-8"),
+);
+
+// TLS key-exchange groups by their IANA registry name. A hybrid group pairs a
+// classical curve with ML-KEM: each half has an OID, the pair has none, so the
+// group is recorded as both algorithms.
+const GROUP_ALGORITHMS = {
+  X25519MLKEM768: ["x25519", "ml-kem-768"],
+  SecP256r1MLKEM768: ["secp256r1", "ml-kem-768"],
+  SecP384r1MLKEM1024: ["secp384r1", "ml-kem-1024"],
+  X25519Kyber768Draft00: ["x25519"],
+  MLKEM512: ["ml-kem-512"],
+  MLKEM768: ["ml-kem-768"],
+  MLKEM1024: ["ml-kem-1024"],
+  x448: ["curveX448"],
+};
+
+const MLKEM_SECURITY_LEVELS = {
+  "ml-kem-512": 1,
+  "ml-kem-768": 3,
+  "ml-kem-1024": 5,
+};
+
+// The curve each classical key-exchange algorithm is defined over.
+const KEY_AGREEMENT_CURVES = {
+  x25519: "x25519",
+  curveX448: "x448",
+};
+
+// Closed enums of cryptoProperties.algorithmProperties in bom-1.7.schema.json.
+const MODES = new Set(["cbc", "ecb", "ccm", "gcm", "cfb", "ofb", "ctr"]);
+const CRYPTO_FUNCTIONS = new Set([
+  "generate",
+  "keygen",
+  "encrypt",
+  "decrypt",
+  "digest",
+  "tag",
+  "keyderive",
+  "sign",
+  "verify",
+  "encapsulate",
+  "decapsulate",
+]);
+
+/**
+ * Names the bulk cipher of a TLS cipher suite as a crypto-oid.json key, from
+ * either its IANA name (TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) or its OpenSSL
+ * name (ECDHE-RSA-AES128-GCM-SHA256).
+ *
+ * @param {string} suiteName Cipher suite name
+ * @returns {{name: string, bits: number, mode: string|undefined}|undefined} The cipher, when it has an OID
+ */
+export function suiteCipher(suiteName) {
+  const tokens = String(suiteName || "")
+    .toUpperCase()
+    .split(/[-_]/);
+  let cipher;
+  if (tokens.includes("CHACHA20")) {
+    cipher = { name: "chaCha20Poly1305", bits: 256, mode: undefined };
+  } else if (tokens.includes("3DES") || tokens.includes("CBC3")) {
+    cipher = { name: "des-EDE3-CBC", bits: 112, mode: "cbc" };
+  } else {
+    const aesIdx = tokens.findIndex((t) => t.startsWith("AES"));
+    if (aesIdx < 0) {
+      return undefined;
+    }
+    const bits =
+      Number.parseInt(tokens[aesIdx].substring(3), 10) ||
+      Number.parseInt(tokens[aesIdx + 1], 10);
+    const mode = ["GCM", "CCM"].find((m) => tokens.includes(m)) || "CBC";
+    cipher = { name: `aes${bits}-${mode}`, bits, mode: mode.toLowerCase() };
+  }
+  return cryptoOids[cipher.name]?.oid ? cipher : undefined;
+}
+
+function oidKey(name) {
+  if (!name) {
+    return undefined;
+  }
+  if (cryptoOids[name]?.oid) {
+    return name;
+  }
+  const lower = String(name).toLowerCase();
+  return cryptoOids[lower]?.oid ? lower : undefined;
+}
+
+function cipherProperties(cipher) {
+  const props = {
+    primitive: cipher.mode === "cbc" ? "block-cipher" : "ae",
+    parameterSetIdentifier: String(cipher.bits),
+    cryptoFunctions: ["encrypt", "decrypt"],
+    classicalSecurityLevel: cipher.bits,
+  };
+  if (cipher.mode) {
+    props.mode = cipher.mode;
+  }
+  return props;
+}
+
+function keyExchangeProperties(name) {
+  const level = MLKEM_SECURITY_LEVELS[name];
+  if (level) {
+    return {
+      primitive: "kem",
+      cryptoFunctions: ["keygen", "encapsulate", "decapsulate"],
+      nistQuantumSecurityLevel: level,
+    };
+  }
+  return { primitive: "key-agree", cryptoFunctions: ["keygen"] };
+}
+
+// Keeps the values of an algorithm the traced CBOM described that fit the
+// schema; the primitive itself is checked by applyAlgorithmProperties.
+function knownAlgorithmProperties(props) {
+  const known = {};
+  if (typeof props?.primitive === "string") {
+    known.primitive = props.primitive === "aead" ? "ae" : props.primitive;
+  }
+  const mode = String(props?.mode || "").toLowerCase();
+  if (MODES.has(mode)) {
+    known.mode = mode;
+  }
+  const functions = (props?.cryptoFunctions || []).filter((f) =>
+    CRYPTO_FUNCTIONS.has(f),
+  );
+  if (functions.length) {
+    known.cryptoFunctions = functions;
+  }
+  for (const level of ["classicalSecurityLevel", "nistQuantumSecurityLevel"]) {
+    if (Number.isInteger(props?.[level])) {
+      known[level] = props[level];
+    }
+  }
+  return known;
+}
+
+/**
+ * Turns the CBOM safer-exec writes for a traced command into components that
+ * cdxgen can merge and validate:
+ *
+ * - every asset gets a bom-ref, without which the assets merge into one
+ * - algorithms carry their OID, and those without one are left out
+ * - hybrid key-exchange groups become their classical and ML-KEM halves
+ * - cipher suites become their bulk cipher, which the protocol's suites refer
+ *   to by bom-ref
+ * - algorithm properties keep only values the schema allows
+ * - crypto libraries are left out: they are the traced library components,
+ *   marked with cdx:dynamic:cryptoLibrary
+ *
+ * @param {Object[]} cbomComponents Components of the safer-exec CBOM
+ * @returns {Object[]} Normalized cryptographic-asset components
+ */
+export function normalizeTracedCryptoComponents(cbomComponents) {
+  const byRef = new Map();
+  const addAlgorithm = (name, algorithmProperties, curve) => {
+    const oid = cryptoOids[name].oid;
+    const ref = `crypto/algorithm/${encodeURIComponent(name)}@${oid}`;
+    if (!byRef.has(ref)) {
+      const component = {
+        type: "cryptographic-asset",
+        name,
+        "bom-ref": ref,
+        description: cryptoOids[name].description,
+        cryptoProperties: {
+          assetType: "algorithm",
+          algorithmProperties,
+          oid,
+        },
+      };
+      applyAlgorithmProperties(component, { name, curve });
+      byRef.set(ref, component);
+    }
+    return ref;
+  };
+  const protocols = [];
+  for (const comp of cbomComponents || []) {
+    const props = comp?.cryptoProperties;
+    if (comp?.type !== "cryptographic-asset" || !props) {
+      continue;
+    }
+    if (props.assetType === "protocol") {
+      protocols.push(comp);
+      continue;
+    }
+    if (props.assetType !== "algorithm") {
+      continue;
+    }
+    const groupHalves = GROUP_ALGORITHMS[comp.name];
+    if (groupHalves) {
+      for (const half of groupHalves) {
+        addAlgorithm(
+          half,
+          keyExchangeProperties(half),
+          KEY_AGREEMENT_CURVES[half] ||
+            (MLKEM_SECURITY_LEVELS[half] ? "" : half),
+        );
+      }
+      continue;
+    }
+    const name = oidKey(comp.name);
+    if (name) {
+      addAlgorithm(
+        name,
+        MLKEM_SECURITY_LEVELS[name] || KEY_AGREEMENT_CURVES[name]
+          ? keyExchangeProperties(name)
+          : knownAlgorithmProperties(props.algorithmProperties),
+        KEY_AGREEMENT_CURVES[name] ||
+          (/^(secp|brainpool)/.test(name) ? name : ""),
+      );
+      continue;
+    }
+    const cipher = suiteCipher(comp.name);
+    if (cipher) {
+      addAlgorithm(cipher.name, cipherProperties(cipher));
+      continue;
+    }
+    thoughtLog(`Skipping traced algorithm '${comp.name}' without an OID.`);
+  }
+  for (const comp of protocols) {
+    const ref = `crypto/protocol/${encodeURIComponent(comp.name)}@${encodeURIComponent(comp.version || "unknown")}`;
+    const protocolProperties = {
+      ...comp.cryptoProperties.protocolProperties,
+    };
+    // The traced suites list algorithm names; the schema wants bom-refs.
+    const cipherSuites = (protocolProperties.cipherSuites || []).map(
+      ({ algorithms: _names, ...suite }) => {
+        const cipher = suiteCipher(suite.name);
+        return cipher
+          ? {
+              ...suite,
+              algorithms: [addAlgorithm(cipher.name, cipherProperties(cipher))],
+            }
+          : suite;
+      },
+    );
+    const existing = byRef.get(ref);
+    if (existing) {
+      const suites = existing.cryptoProperties.protocolProperties.cipherSuites;
+      for (const suite of cipherSuites) {
+        if (!suites.some((s) => s.name === suite.name)) {
+          suites.push(suite);
+        }
+      }
+      continue;
+    }
+    protocolProperties.cipherSuites = cipherSuites;
+    const component = {
+      type: "cryptographic-asset",
+      name: comp.name,
+      "bom-ref": ref,
+      cryptoProperties: {
+        assetType: "protocol",
+        protocolProperties,
+      },
+    };
+    if (comp.version) {
+      component.version = comp.version;
+    }
+    byRef.set(ref, component);
+  }
+  return Array.from(byRef.values());
+}
+
+// safer-exec walks at most this many certificates of one server's chain
+// (tlsobserve maxChainCerts); a longer array did not come from it, so only the
+// first entries are read.
+const MAX_CHAIN_CERTS = 10;
+
+/**
+ * The bom-ref normalizeTracedCryptoComponents gives the protocol component of
+ * a negotiated TLS version: safer-exec's CBOM names it "TLSv1.2" with the
+ * version the prefix leaves ("1.2").
+ *
+ * @param {string} protocol negotiated protocol name from the crypto result
+ * @returns {string} protocol component bom-ref
+ */
+function tracedProtocolBomRef(protocol) {
+  const name = String(protocol || "");
+  const version = name.startsWith("TLSv") ? name.slice("TLSv".length) : name;
+  return `crypto/protocol/${encodeURIComponent(name)}@${encodeURIComponent(version || "unknown")}`;
+}
+
+/**
+ * Builds the shared certificate model for the chains servers presented in TLS
+ * ≤ 1.2 handshakes, from the `chain` arrays of safer-exec's crypto result
+ * (report channel, safer-exec ≥ 1.2.0; earlier releases and TLS 1.3 entries
+ * carry no chain and yield nothing). The records go through the shared
+ * certificate collector, so bom-refs, properties and dedup match certificates
+ * found on disk. A presented chain is untrusted server input: no issuer edges
+ * are inferred from it, and the certificate and public-key components link
+ * through the collector as every producer's do. Each TLS protocol component
+ * provides the certificates and keys presented under it — the edge safer-
+ * exec's own CBOM records — which answers which servers presented a key.
+ *
+ * @param {Object} cryptoResult safer-exec CRYPTO result (`result.crypto`)
+ * @param {Set<string>} protocolRefs bom-refs of the protocol components in the BOM;
+ *   a provides edge is only emitted for a protocol that is actually present
+ * @returns {{components: Object[], dependencies: Object[]}} certificate,
+ *   public-key and algorithm components, and the protocol provides edges
+ */
+export function observedChainComponents(
+  cryptoResult,
+  protocolRefs = new Set(),
+) {
+  const collector = new CertificateCollector();
+  // Protocol name -> {certSha256, spkiSha256} pairs in presentation order,
+  // leaf first; sorted to refs at the end so the output never depends on the
+  // connection order the engine happened to report.
+  const chainEntriesByProtocol = new Map();
+  // The collector keeps the first record's fields for a certSha256, so two
+  // servers presenting one hash with conflicting text would otherwise make
+  // the name (and bom-ref) depend on connection order; sort first.
+  const ciphers = (
+    Array.isArray(cryptoResult?.ciphers) ? cryptoResult.ciphers : []
+  )
+    .map((cipher) => [JSON.stringify(cipher) ?? "", cipher])
+    .sort(([left], [right]) => (left < right ? -1 : left > right ? 1 : 0))
+    .map(([, cipher]) => cipher);
+  for (const cipher of ciphers) {
+    const chain = cipher?.chain;
+    if (!Array.isArray(chain) || chain.length === 0) {
+      // safer-exec ≤ 1.1.2, or a TLS 1.3 handshake (encrypted Certificate
+      // message): no chain was observed.
+      continue;
+    }
+    const host = typeof cipher.host === "string" ? cipher.host : "";
+    for (const entry of chain.slice(0, MAX_CHAIN_CERTS)) {
+      const record = certRecordFromObservedChainEntry(entry, { host });
+      if (record) {
+        collector.addRecord(record);
+      }
+    }
+    // A protocol name is free text from the report channel; it only reaches a
+    // bom-ref through encodeURIComponent, so it must be well-formed.
+    const protocol = toWellFormedText(cipher.protocol);
+    if (protocol) {
+      let entries = chainEntriesByProtocol.get(protocol);
+      if (!entries) {
+        entries = [];
+        chainEntriesByProtocol.set(protocol, entries);
+      }
+      for (const entry of chain.slice(0, MAX_CHAIN_CERTS)) {
+        const certSha256 = String(entry?.certSha256 || "").toLowerCase();
+        const spkiSha256 = String(entry?.spkiSha256 || "").toLowerCase();
+        if (certSha256.length === 64) {
+          entries.push({ certSha256, spkiSha256 });
+        }
+      }
+    }
+  }
+  const { components, dependencies } = collector.build();
+  // The collector's components identify their asset by the hash in `version`
+  // (certSha256 for certificates, spkiSha256 for public keys).
+  const certRefBySha = new Map();
+  const keyRefBySpki = new Map();
+  for (const component of components) {
+    const assetType = component.cryptoProperties?.assetType;
+    if (assetType === "certificate") {
+      certRefBySha.set(component.version, component["bom-ref"]);
+    } else if (assetType === "related-crypto-material") {
+      keyRefBySpki.set(component.version, component["bom-ref"]);
+    }
+  }
+  const outputDependencies = [...dependencies];
+  for (const [protocol, entries] of chainEntriesByProtocol) {
+    const protocolRef = tracedProtocolBomRef(protocol);
+    if (!protocolRefs.has(protocolRef)) {
+      continue;
+    }
+    const provides = [
+      ...new Set(
+        entries.flatMap(({ certSha256, spkiSha256 }) => [
+          certRefBySha.get(certSha256),
+          keyRefBySpki.get(spkiSha256),
+        ]),
+      ),
+    ]
+      .filter((ref) => ref)
+      .sort();
+    if (provides.length) {
+      outputDependencies.push({ ref: protocolRef, provides });
+    }
+  }
+  outputDependencies.sort((left, right) => left.ref.localeCompare(right.ref));
+  return { components, dependencies: outputDependencies };
+}
+
+/**
+ * Maps the crypto libraries safer-exec reported to the paths they were loaded
+ * from.
+ *
+ * @param {Object[]} cryptoEntries safer-exec crypto-library and crypto-cipher audit entries
+ * @returns {Map<string, {name: string, version: string}>} Crypto libraries by path
+ */
+export function cryptoLibrariesByPath(cryptoEntries) {
+  const libraries = new Map();
+  for (const entry of cryptoEntries || []) {
+    if (entry?.type !== "crypto-library" || !entry.path || !entry.name) {
+      continue;
+    }
+    if (!libraries.has(entry.path)) {
+      libraries.set(entry.path, {
+        name: String(entry.name),
+        version: entry.version ? String(entry.version) : "",
+      });
+    }
+  }
+  return libraries;
+}