@cdxgen/cdxgen 13.3.0 → 13.5.0

package/lib/managers/docker.js

@@ -18,10 +18,11 @@ import process from "node:process";
 import stream from "node:stream/promises";
 import { URL } from "node:url";
 
-import { x } from "tar";
+import { t as listTar, x } from "tar";
 
 import {
   DEBUG_MODE,
+  isAllowedHttpHost,
   isDryRun,
   readEnvironmentVariable,
   recordActivity,
@@ -1081,6 +1082,36 @@ const isSafeImageReference = (fullImageName) =>
   fullImageName === fullImageName.trim() &&
   isImageReference(fullImageName);
 
+/**
+ * Whether an image named in a scanned manifest, such as a docker-compose file
+ * or a Kubernetes spec, may be pulled and inventoried. The name comes from the
+ * scanned project, so a local archive path would read files outside the
+ * allowed paths and a registry outside CDXGEN_ALLOWED_HOSTS would bypass the
+ * host allowlist.
+ *
+ * @param {string} fullImageName Image name from the manifest
+ * @param {Object} [imageObj] Result of parseImageName for the same name
+ * @returns {boolean} true when the image may be followed
+ */
+export const isFollowableManifestImage = (fullImageName, imageObj) => {
+  if (!isSafeImageReference(fullImageName)) {
+    return false;
+  }
+  const allowedHostsEnv = readEnvironmentVariable("CDXGEN_ALLOWED_HOSTS");
+  if (!allowedHostsEnv) {
+    return true;
+  }
+  const registry =
+    (imageObj || parseImageName(fullImageName)).registry || "docker.io";
+  let registryHost;
+  try {
+    registryHost = new URL(`https://${registry}`).hostname;
+  } catch (_err) {
+    return false;
+  }
+  return isAllowedHttpHost(registryHost, allowedHostsEnv);
+};
+
 /**
  * Parse image name
  *
@@ -1336,58 +1367,59 @@ export const getImage = async (fullImageName) => {
   let dockerCmd;
   if (needsCliFallback()) {
     dockerCmd = getContainerCliCmd();
-    let needsPull = true;
-    // Let's check the local cache first
-    let result = safeSpawnSync(dockerCmd, ["images", "--format=json"]);
-    if (result.status === 0 && result.stdout) {
-      for (const imgLine of result.stdout.split("\n")) {
-        try {
-          const imgObj = JSON.parse(Buffer.from(imgLine).toString());
-          if (`${imgObj.Repository}:${imgObj.Tag}` === fullImageName) {
-            needsPull = false;
-            break;
-          }
-        } catch (_err) {
-          // continue regardless of error
-        }
-      }
-    }
-    if (needsPull) {
-      result = safeSpawnSync(dockerCmd, ["pull", fullImageName]);
-      if (result.status !== 0 || result.error) {
+    // The local image is checked with the reference itself. `image inspect`
+    // resolves the reference exactly as the pull below would, so a fully
+    // qualified docker.io/library/... name and a digest reference both find
+    // a local image. The `images` listing compared Repository:Tag strings
+    // and missed both. docker, podman, nerdctl and wslc all implement
+    // `image inspect`.
+    let inspectResult = safeSpawnSync(dockerCmd, [
+      "image",
+      "inspect",
+      fullImageName,
+    ]);
+    if (inspectResult.status !== 0 || inspectResult.error) {
+      const pullResult = safeSpawnSync(dockerCmd, ["pull", fullImageName]);
+      if (pullResult.status !== 0 || pullResult.error) {
         if (isWslcCmd(dockerCmd)) {
           // wslc runs Docker Engine inside its own VM, so its errors may
           // mention a docker daemon; the Docker Desktop and DOCKER_CMD hints
           // below do not apply. Show wslc's own error instead.
-          if (isWslcSessionFailure(result.stderr)) {
+          if (isWslcSessionFailure(pullResult.stderr)) {
             printWslcSessionFailureHint();
-          } else if (result.stderr) {
-            console.log(result.stderr);
+          } else if (pullResult.stderr) {
+            console.log(pullResult.stderr);
           }
-        } else if (result.stderr?.includes("docker daemon is not running")) {
+        } else if (
+          pullResult.stderr?.includes("docker daemon is not running")
+        ) {
           console.log(
             "Ensure Docker for Desktop is running as an administrator with 'Exposing daemon on TCP without TLS' setting turned on.",
           );
-        } else if (result.stderr?.includes("not found")) {
+        } else if (pullResult.stderr?.includes("not found")) {
           console.log(
             "Set the environment variable DOCKER_CMD to use an alternative command such as nerdctl or podman.",
           );
-        } else if (result.stderr) {
-          console.log(result.stderr);
+        } else if (pullResult.stderr) {
+          console.log(pullResult.stderr);
         }
       }
-    }
-    result = safeSpawnSync(dockerCmd, ["inspect", fullImageName]);
-    if (result.status !== 0 || result.error) {
-      if (result.stderr) {
-        console.log(result.stderr);
+      inspectResult = safeSpawnSync(dockerCmd, [
+        "image",
+        "inspect",
+        fullImageName,
+      ]);
+    }
+    if (inspectResult.status !== 0 || inspectResult.error) {
+      if (inspectResult.stderr) {
+        console.log(inspectResult.stderr);
       }
       suggestWslcAlternative(dockerCmd);
       // Continue with the daemon client when the CLI fallback is unavailable
       // or unable to inspect the image.
     } else {
       try {
-        const stdout = result.stdout;
+        const stdout = inspectResult.stdout;
         if (stdout) {
           const inspectData = JSON.parse(Buffer.from(stdout).toString());
           if (inspectData && Array.isArray(inspectData)) {
@@ -1585,19 +1617,20 @@ function handleTarWarning(code, message) {
   }
 }
 
-// These paths are known to cause extract errors
+// These paths are known to cause extract errors. CA-store directories
+// (etc/ssl/certs, etc/pki/ca-trust, ssl/certs, cacerts,
+// var/lib/ca-certificates) are deliberately NOT excluded any more: their
+// original extract failures came from the hash-named symlink farms, and
+// symlinks/hardlinks are excluded by type below, while the regular
+// certificate files are exactly what a CBOM must inventory.
 const EXTRACT_EXCLUDE_PATHS = [
   "etc/machine-id",
   "etc/gshadow",
   "etc/shadow",
   "etc/passwd",
-  "etc/ssl/certs",
-  "etc/pki/ca-trust",
   "usr/lib/systemd/",
   "usr/lib64/libdevmapper.so",
   "usr/sbin/",
-  "cacerts",
-  "ssl/certs",
   "logs/",
   "dev/",
   "proc/",
@@ -1607,7 +1640,6 @@ const EXTRACT_EXCLUDE_PATHS = [
   "usr/share/man/",
   "usr/share/icons/",
   "usr/share/i18n/",
-  "var/lib/ca-certificates",
   "root/.gnupg",
   "root/.dotnet",
   "usr/share/licenses/device-mapper-libs",
@@ -1633,16 +1665,18 @@ const MEDIA_EXTENSIONS = new Set([
   ".eot",
 ]);
 
-// These device types are known to cause extract errors
+// These entry types are known to cause extract errors. The names are the
+// ones node-tar's header parser assigns (types.js in the tar package):
+// symlinks and hardlinks ("SymbolicLink", "Link") are how CA-store
+// hash-named entries appear, which is why the CA paths could be un-excluded
+// above once these were dropped by type.
 const EXTRACT_EXCLUDE_TYPES = new Set([
   "BlockDevice",
   "CharacterDevice",
   "FIFO",
-  "MultiVolume",
-  "TapeVolume",
+  "ContinuationFile",
+  "TapeVolumeHeader",
   "SymbolicLink",
-  "RenamedOrSymlinked",
-  "HardLink",
   "Link",
 ]);
 
@@ -1993,6 +2027,126 @@ const resolveContainedArchivePath = (tempDir, archiveRef, kind) => {
   return join(tempDir, archiveRef);
 };
 
+const WHITEOUT_PREFIX = ".wh.";
+const WHITEOUT_OPAQUE = ".wh..wh..opq";
+
+/**
+ * Split an untrusted tar entry path into safe segments. Returns undefined when
+ * the path contains a parent-directory segment.
+ *
+ * @param {string} entryPath Raw entry path from a layer
+ * @returns {string[]|undefined} Path segments, or undefined when unsafe
+ */
+const safeEntrySegments = (entryPath) => {
+  const stripped = stripAbsolutePath(String(entryPath).replaceAll("\\", "/"));
+  const parts = stripped.split("/").filter((p) => p && p !== ".");
+  return parts.includes("..") ? undefined : parts;
+};
+
+/**
+ * Walk down from rootDir through real directories only. A symlink or a
+ * missing component stops the walk, so removals never leave rootDir.
+ *
+ * @param {string} rootDir Extraction root
+ * @param {string[]} parts Directory segments below the root
+ * @returns {string|undefined} The directory path, or undefined
+ */
+const resolveRealDir = (rootDir, parts) => {
+  let current = rootDir;
+  for (const part of parts) {
+    current = join(current, part);
+    let st;
+    try {
+      st = lstatSync(current);
+    } catch (_err) {
+      return undefined;
+    }
+    if (!st.isDirectory()) {
+      return undefined;
+    }
+  }
+  return current;
+};
+
+/**
+ * Apply the OCI/Docker whiteouts of one layer to the merged extraction
+ * directory. `.wh.<name>` removes <name>, and `.wh..wh..opq` empties the
+ * directory it sits in, both only for content from earlier layers, so call
+ * this before extracting the layer itself. Matches
+ * ci/reconstruct-staged-rootfs.py.
+ * https://github.com/opencontainers/image-spec/blob/v1.1.0/layer.md#whiteouts
+ *
+ * @param {string} layerPath Layer tar (optionally compressed)
+ * @param {string} rootDir Merged extraction directory
+ */
+// Applies one whiteout entry of a layer to the merged root.
+const applyWhiteout = (entryPath, rootDir) => {
+  const parts = safeEntrySegments(entryPath);
+  if (!parts?.length) {
+    return;
+  }
+  const name = parts[parts.length - 1];
+  const parentParts = parts.slice(0, -1);
+  if (name === WHITEOUT_OPAQUE) {
+    const dir = resolveRealDir(rootDir, parentParts);
+    if (!dir) {
+      return;
+    }
+    for (const child of readdirSync(dir)) {
+      safeRmSync(join(dir, child), { recursive: true, force: true });
+    }
+    return;
+  }
+  // Other .wh..wh.* names are AUFS metadata, not deletions.
+  if (name.startsWith(".wh..wh.")) {
+    return;
+  }
+  const target = name.slice(WHITEOUT_PREFIX.length);
+  if (!target || target === "." || target === "..") {
+    return;
+  }
+  const dir = resolveRealDir(rootDir, parentParts);
+  if (dir) {
+    safeRmSync(join(dir, target), { recursive: true, force: true });
+  }
+};
+
+const applyLayerWhiteouts = async (layerPath, rootDir) => {
+  const whiteouts = [];
+  try {
+    await listTar({
+      file: layerPath,
+      strict: false,
+      onwarn: () => {
+        // extractTar reports damaged layers
+      },
+      onReadEntry: (entry) => {
+        if (
+          basename(String(entry.path).replaceAll("\\", "/")).startsWith(
+            WHITEOUT_PREFIX,
+          )
+        ) {
+          whiteouts.push(entry.path);
+        }
+        entry.resume();
+      },
+    });
+  } catch (_err) {
+    // extractTar reports unreadable layers
+  }
+  for (const entryPath of whiteouts) {
+    // One whiteout that cannot be applied (name too long, EACCES) must not
+    // abort the layer's extraction, which would hide everything it adds.
+    try {
+      applyWhiteout(entryPath, rootDir);
+    } catch (err) {
+      if (DEBUG_MODE) {
+        console.log(`Skipping whiteout ${entryPath}: ${err.message}`);
+      }
+    }
+  }
+};
+
 /**
  * Parse a Docker/containerd manifest file and extract all image layers into a
  * single merged directory. Resolves the last layer's config to determine the
@@ -2073,6 +2227,7 @@ export const extractFromManifest = async (
         console.log(`Extracting layer ${layer} to ${allLayersExplodedDir}`);
       }
       try {
+        await applyLayerWhiteouts(containedLayerPath, allLayersExplodedDir);
         await extractTar(containedLayerPath, allLayersExplodedDir, options);
       } catch (err) {
         if (err.code === "TAR_BAD_ARCHIVE") {

package/lib/managers/oci.js

@@ -283,7 +283,10 @@ async function getOciToken(registry, repository, scope) {
           if (params.service)
             reqUrl.searchParams.set("service", params.service);
           reqUrl.searchParams.set("scope", `repository:${repository}:${scope}`);
+          // Tokens expire within minutes, so a cached one would be replayed
+          // after it stopped working.
           const options = {
+            cache: false,
             responseType: "json",
             timeout: getOciTimeoutMs(),
           };
@@ -410,11 +413,18 @@ async function pullBlob(registry, repository, digest, token) {
  *
  * @param {string} image OCI image reference (e.g. `"registry.example.com/org/app:tag"`)
  * @param {string} [platform] OCI platform string (e.g. `"linux/amd64"`); no-op for JS implementation
+ * @param {Object} [options]
+ * @param {function(Buffer): void} [options.checkBytes] Called with the raw bytes of the BOM layer that is about to be returned. An error it throws is rethrown, and no other referrer is tried.
  * @returns {Promise<Object|undefined>} Parsed CycloneDX BOM JSON object, or `undefined` if not found
  */
-export async function getBomWithOras(image, _platform = undefined) {
+export async function getBomWithOras(
+  image,
+  _platform = undefined,
+  options = {},
+) {
   const { registry, repository, reference } = parseImageRef(image);
   const token = await getOciToken(registry, repository, "pull");
+  let rejection;
 
   try {
     const targetManifest = await fetchManifest(
@@ -488,9 +498,10 @@ export async function getBomWithOras(image, _platform = undefined) {
         bomLayer.digest,
         token,
       );
+      const text = blob.toString("utf8");
       let bomJson;
       try {
-        bomJson = JSON.parse(blob.toString("utf8"));
+        bomJson = JSON.parse(text);
       } catch {
         // Defensive: the mediaType claimed JSON but the layer did not parse
         // (truncated/corrupt blob). Skip it and try the next candidate.
@@ -509,6 +520,14 @@ export async function getBomWithOras(image, _platform = undefined) {
       }
 
       if (isCycloneDxBom(bomJson)) {
+        if (options.checkBytes) {
+          try {
+            options.checkBytes(blob);
+          } catch (err) {
+            rejection = err;
+            break;
+          }
+        }
         return bomJson;
       }
     }
@@ -517,6 +536,9 @@ export async function getBomWithOras(image, _platform = undefined) {
       `Unable to pull the SBOM attachment for ${image} natively! ${e.message}`,
     );
   }
+  if (rejection) {
+    throw rejection;
+  }
   return undefined;
 }
 

package/lib/parsers/cmakeCache.js

@@ -197,3 +197,72 @@ export function resolveCmakeCacheFacts(map) {
     fetchContentBase,
   };
 }
+
+/** CMake's compiler ids, mapped to the family names the C/C++ toolchain uses. */
+const CMAKE_COMPILER_FAMILIES = {
+  GNU: "gcc",
+  Clang: "clang",
+  AppleClang: "apple-clang",
+  MSVC: "msvc",
+  IntelLLVM: "icx",
+  Intel: "icc",
+  NVIDIA: "nvcc",
+  NVHPC: "nvhpc",
+  PGI: "nvhpc",
+};
+
+/**
+ * Parse a compiler description CMake writes when it configures a build
+ * (`CMakeFiles/<cmake version>/CMake<LANG>Compiler.cmake`): the compiler's
+ * path, CMake's id for it and its version, all identified by CMake itself.
+ *
+ * @param {string} text File contents
+ * @returns {{language: string, compiler: string, family: string, id: string, version: string}|null}
+ *   `null` when the text names no compiler
+ */
+export function parseCmakeCompilerFile(text) {
+  if (!text || typeof text !== "string") {
+    return null;
+  }
+  const values = new Map();
+  for (const rawLine of text.split(/\r\n|\r|\n/)) {
+    const line = rawLine.trim();
+    if (!line.startsWith("set(CMAKE_") || !line.endsWith(")")) {
+      continue;
+    }
+    const body = line.slice(4, -1).trim();
+    const space = body.search(/\s/);
+    if (space < 0) {
+      continue;
+    }
+    const key = body.slice(0, space);
+    let value = body.slice(space).trim();
+    if (value.startsWith('"') && value.endsWith('"') && value.length >= 2) {
+      value = value.slice(1, -1);
+    }
+    if (!values.has(key)) {
+      values.set(key, value);
+    }
+  }
+  for (const [key, compiler] of values) {
+    const match = key.match(/^CMAKE_([A-Z]+)_COMPILER$/);
+    if (!match || !compiler) {
+      continue;
+    }
+    const language = match[1];
+    const id = values.get(`CMAKE_${language}_COMPILER_ID`) || "";
+    const variant = values.get(`CMAKE_${language}_COMPILER_FRONTEND_VARIANT`);
+    let family = CMAKE_COMPILER_FAMILIES[id] || id.toLowerCase() || "unknown";
+    if (id === "Clang" && variant === "MSVC") {
+      family = "clang-cl";
+    }
+    return {
+      language,
+      compiler,
+      family,
+      id,
+      version: values.get(`CMAKE_${language}_COMPILER_VERSION`) || "",
+    };
+  }
+  return null;
+}

package/lib/parsers/cmakeLists.js

@@ -188,10 +188,15 @@ export function parseCmakeCommands(text) {
   return commands;
 }
 
+// Upper bound on an expanded value; a set() chain that doubles a variable can
+// otherwise grow it beyond the maximum string length.
+const MAX_EXPANDED_LENGTH = 65536;
+
 /**
  * Replace `${VAR}` references with the values of simple `set()` calls. A
  * reference to an unknown variable is left in place, so callers can tell a
- * resolved value from an unresolved one.
+ * resolved value from an unresolved one. Expansion stops at the previous
+ * round once the text would exceed 64 KiB.
  *
  * @param {string} value Argument text
  * @param {Map<string,string>} variables Known variable values
@@ -203,6 +208,9 @@ export function expandCmakeVariables(value, variables) {
     let next = "";
     let i = 0;
     while (i < result.length) {
+      if (next.length > MAX_EXPANDED_LENGTH) {
+        return result;
+      }
       const start = result.indexOf("${", i);
       if (start === -1) {
         next += result.slice(i);
@@ -247,7 +255,13 @@ export function cmakeSetVariables(commands) {
       rest[0] === "CACHE" ||
       rest[0] === "PARENT_SCOPE"
     ) {
-      variables.set(key, expandCmakeVariables(value, variables));
+      // An appending set(FOO "${FOO} ...") of an undefined FOO starts from an
+      // empty value in CMake; dropping the self-reference also keeps it from
+      // being substituted into itself on every later expansion round.
+      variables.set(
+        key,
+        expandCmakeVariables(value, variables).replaceAll(`\${${key}}`, ""),
+      );
     }
   }
   return variables;