@cdxgen/cdxgen 13.3.0 → 13.5.0

package/lib/server/server.js

@@ -14,7 +14,10 @@ import {
   isSecureMode,
   readEnvironmentVariable,
 } from "../core/activity.js";
+import { PROJECT_TYPE_ALIASES } from "../core/env.js";
 import { isWin } from "../core/paths.js";
+import { isSecureModeActive } from "../core/projectTooling.js";
+import { resetRunState } from "../core/runState.js";
 import { CDXGEN_VERSION } from "../core/state.js";
 import { installConsoleShim, ui } from "../core/ui.js";
 import { fetchPomXmlAsJson } from "../ecosystems/ecosystems.js";
@@ -26,6 +29,7 @@ import {
   getGitAllowProtocol,
   gitClone,
   isAllowedPath,
+  isAllowedRealPath,
   isAllowedWinPath,
   maybePurlSource,
   maybeRemotePath,
@@ -81,6 +85,11 @@ const ALLOWED_PARAMS = [
   "tlpClassification",
 ];
 
+// Options that install packages or run the scanned project's own build tools
+// (for example `cargo check`, which runs build.rs), and so execute code from
+// the scanned repository.
+const CODE_EXECUTION_PARAMS = ["installDeps", "deep"];
+
 const app = connect();
 
 export { isAllowedHttpHost };
@@ -155,6 +164,7 @@ export function parseValue(raw) {
  * @returns {Object} Populated options object
  */
 export function parseQueryString(q, body = {}, options = {}) {
+  const operatorOptions = { ...options };
   // Priority is query params followed by body
   for (const param of ALLOWED_PARAMS) {
     const raw = q[param] ?? body[param];
@@ -162,7 +172,7 @@ export function parseQueryString(q, body = {}, options = {}) {
       options[param] = parseValue(raw);
     }
   }
-  options.projectType = options.type?.split(",");
+  options.projectType = toProjectTypeList(options.type);
   delete options.type;
   if (options.lifecycle === "pre-build") {
     options.installDeps = false;
@@ -170,9 +180,170 @@ export function parseQueryString(q, body = {}, options = {}) {
   if (options.profile) {
     applyProfileOptions(options);
   }
+  // failOnError ends the process, so one failing request would stop the server
+  // for every client.
+  options.failOnError = false;
+  restrictRequestOptions(options, operatorOptions);
   return options;
 }
 
+/**
+ * Normalise a `type` value from the request or the start-up options, which may
+ * be a comma separated string or an array, into a list of project types.
+ *
+ * @param {string|string[]|undefined} type Project type value
+ * @returns {string[]|undefined} Project types, or undefined when none are given
+ */
+function toProjectTypeList(type) {
+  if (type === undefined || type === null || type === "") {
+    return undefined;
+  }
+  const types = (Array.isArray(type) ? type : [type])
+    .flatMap((t) => String(t).split(","))
+    .map((t) => t.trim())
+    .filter(Boolean);
+  return types.length ? types : undefined;
+}
+
+/**
+ * Stop a request from turning on options that execute code from the scanned
+ * repository when the operator has not. In secure mode, or when the server was
+ * started with --no-install-deps, a request may turn these options off but
+ * never on.
+ *
+ * @param {Object} options Options parsed from the request
+ * @param {Object} operatorOptions Options the server was started with
+ * @returns {void}
+ */
+function restrictRequestOptions(options, operatorOptions) {
+  if (!isSecureModeActive() && operatorOptions.installDeps !== false) {
+    return;
+  }
+  for (const param of CODE_EXECUTION_PARAMS) {
+    // Only an explicit false from the request changes the operator's choice.
+    // Values such as "" or 0 would otherwise pass gates that test `!== false`.
+    options[param] =
+      operatorOptions[param] === true && options[param] !== false;
+  }
+}
+
+// Project types that inventory the host the server runs on, such as installed
+// packages, users, shell history, IDE and browser extensions, or the Maven,
+// Gradle, sbt, Cargo and Helm caches in the server user's home directory.
+// They ignore the scan path, so the path allowlist does not limit them.
+const HOST_SCOPE_PROJECT_TYPES = new Set(
+  [
+    "os",
+    "hbom",
+    "cargo-cache",
+    "helm-index",
+    "gradle-index",
+    "sbt-index",
+    "maven-index",
+    "vscode-extension",
+    "chrome-extension",
+    "agentic",
+  ]
+    .flatMap((key) => PROJECT_TYPE_ALIASES[key] || [key])
+    .concat(["maven-repo"]),
+);
+
+/**
+ * Check request options that the server must refuse outright.
+ *
+ * @param {Object} reqOptions Options parsed from the request
+ * @param {Object} operatorOptions Options the server was started with
+ * @returns {Object|null} Error object with status, error and details, or null
+ */
+export function validateRequestOptions(reqOptions, operatorOptions = {}) {
+  const operatorTypes = new Set(
+    toProjectTypeList(operatorOptions.type ?? operatorOptions.projectType) ||
+      [],
+  );
+  const hostScopeType = (reqOptions.projectType || []).find(
+    (t) => HOST_SCOPE_PROJECT_TYPES.has(t) && !operatorTypes.has(t),
+  );
+  if (hostScopeType) {
+    return {
+      status: 403,
+      error: "Project Type Not Allowed",
+      details: `The '${hostScopeType}' project type scans the server host. Start the server with this type to allow it.`,
+    };
+  }
+  const excludes = Array.isArray(reqOptions.exclude)
+    ? reqOptions.exclude
+    : [reqOptions.exclude];
+  // Brace patterns expand before matching, so one short pattern such as
+  // {1..100000} can keep the server busy for minutes.
+  if (
+    reqOptions.exclude !== operatorOptions.exclude &&
+    excludes.some(
+      (e) => typeof e === "string" && (e.includes("{") || e.length > 512),
+    )
+  ) {
+    return {
+      status: 400,
+      error: "Invalid Exclude Pattern",
+      details:
+        "Exclude patterns sent to the server cannot use braces or exceed 512 characters.",
+    };
+  }
+  if (
+    reqOptions.serverUrl &&
+    reqOptions.serverUrl !== operatorOptions.serverUrl
+  ) {
+    const requestedOrigin = urlOrigin(reqOptions.serverUrl);
+    if (!requestedOrigin) {
+      return {
+        status: 400,
+        error: "Invalid Server URL",
+        details: "The Dependency-Track server URL is invalid.",
+      };
+    }
+    if (requestedOrigin !== urlOrigin(operatorOptions.serverUrl)) {
+      // The operator's API key only ever goes to the operator's server.
+      if (
+        operatorOptions.apiKey &&
+        reqOptions.apiKey === operatorOptions.apiKey
+      ) {
+        return {
+          status: 400,
+          error: "API Key Required",
+          details:
+            "A request that names its own Dependency-Track server must send its own API key.",
+        };
+      }
+      // CDXGEN_SERVER_ALLOWED_HOSTS only covers git hosts, so in secure mode a
+      // server the operator did not configure must be on CDXGEN_ALLOWED_HOSTS.
+      if (isSecureMode && !readEnvironmentVariable("CDXGEN_ALLOWED_HOSTS")) {
+        return {
+          status: 403,
+          error: "Host Not Allowed",
+          details:
+            "Set CDXGEN_ALLOWED_HOSTS to let requests choose a Dependency-Track server.",
+        };
+      }
+    }
+  }
+  if (isSecureMode && reqOptions.includeFormulation && reqOptions.serverUrl) {
+    return {
+      status: 400,
+      error: "Formulation Not Allowed",
+      details:
+        "Formulation data may contain secrets and is not submitted to Dependency-Track in secure mode.",
+    };
+  }
+  return null;
+}
+
+function urlOrigin(value) {
+  try {
+    return new URL(value).origin;
+  } catch (_err) {
+    return undefined;
+  }
+}
+
 /**
  * Extracts query parameters from an incoming HTTP request object.
  * Handles repeated keys by collecting their values into an array.
@@ -244,6 +415,26 @@ const configureServer = (cdxgenServer) => {
 
 const ALL_INTERFACES = new Set(["0.0.0.0", "::", "::/128", "::/0"]);
 
+// Registry answers, recorded misses and local cache lookups last for one scan.
+// They are emptied whenever no scan is running, so a scan neither starts from
+// an earlier scan's answers, which would hide new releases and new downloads,
+// nor has its own emptied by a scan running alongside it.
+let activeScans = 0;
+
+function beginScan() {
+  if (activeScans === 0) {
+    resetRunState();
+  }
+  activeScans++;
+}
+
+function endScan() {
+  activeScans--;
+  if (activeScans === 0) {
+    resetRunState();
+  }
+}
+
 /**
  * Boot the cdxgen HTTP server.
  *
@@ -370,6 +561,18 @@ const start = (options) => {
         }),
       );
     }
+    const optionsError = validateRequestOptions(reqOptions, options);
+    if (optionsError) {
+      res.writeHead(optionsError.status, {
+        "Content-Type": "application/json",
+      });
+      return res.end(
+        JSON.stringify({
+          error: optionsError.error,
+          details: optionsError.details,
+        }),
+      );
+    }
     // Enforce the v13 CycloneDX spec floor on the HTTP entry point too, so the
     // server cannot be used to request a generation target the CLI rejects.
     if (reqOptions.specVersion !== undefined) {
@@ -393,6 +596,7 @@ const start = (options) => {
     }
     let cloneDir;
     let srcDir;
+    beginScan();
     try {
       let sourcePath = filePath;
       let purlResolution;
@@ -480,8 +684,11 @@ const start = (options) => {
         cleanup = true;
       } else {
         srcDir = sourcePath;
+        // Check where a symlinked path really points as well, so a link inside
+        // an allowed directory cannot open a scan of a directory outside it.
         if (
           !isAllowedPath(path.resolve(srcDir)) ||
+          !isAllowedRealPath(srcDir) ||
           (isWin && !isAllowedWinPath(srcDir))
         ) {
           res.writeHead(403, { "Content-Type": "application/json" });
@@ -606,6 +813,7 @@ const start = (options) => {
       }
       console.log("Error while generating SBOM response", err);
     } finally {
+      endScan();
       if (cleanup && cloneDir) {
         cleanupSourceDir(cloneDir);
       }

package/lib/stages/postgen/annotator.js

@@ -463,6 +463,15 @@ export function textualMetadata(bomJson) {
   const swidCount = bomJson?.components?.filter((c) =>
     c?.purl?.startsWith("pkg:swid"),
   ).length;
+  // Homebrew packages are pkg:brew, not pkg:swid, so they are not counted as
+  // applications; formulae and casks are told apart by a property.
+  const brewComponents =
+    bomJson?.components?.filter((c) => c?.purl?.startsWith("pkg:brew/")) || [];
+  const brewCaskCount = brewComponents.filter((c) =>
+    c.properties?.some(
+      (p) => p.name === "cdx:homebrew:type" && p.value === "cask",
+    ),
+  ).length;
   const { unpackagedExecutableCount, unpackagedSharedLibraryCount } =
     getContainerFileInventoryStats(bomJson?.components);
   const githubStats = getGitHubWorkflowStats(bomJson?.components);
@@ -711,7 +720,14 @@ export function textualMetadata(bomJson) {
       text = `${text} The system appears to be set up for remote development, with ${vsixCount} Visual Studio Code extensions installed.`;
     }
     if (swidCount > 0) {
-      text = `${text} In addition, there are ${swidCount} applications installed on the system.`;
+      text = `${text} In addition, there ${swidCount === 1 ? "is 1 application" : `are ${swidCount} applications`} installed on the system.`;
+    }
+    if (brewComponents.length > 0) {
+      const brewCount = brewComponents.length;
+      const casks = brewCaskCount
+        ? `, of which ${brewCaskCount} ${brewCaskCount === 1 ? "is a cask" : "are casks"}`
+        : "";
+      text = `${text} The system also has ${brewCount} Homebrew package${brewCount === 1 ? "" : "s"} installed${casks}.`;
     }
   }
   if (bomType === "HBOM" && hbomSummary) {

package/lib/stages/postgen/introspection/markers.js

@@ -137,7 +137,7 @@ export const ECOSYSTEM_MARKERS = Object.freeze({
   ocaml: { names: ["dune-project"], suffixes: [".opam"] },
   lua: { names: ["luarocks.lock"], suffixes: [".rockspec"] },
   spack: { names: ["spack.yaml", "spack.lock"], suffixes: [] },
-  terraform: { names: [".terraform.lock.hcl"], suffixes: [] },
+  terraform: { names: [".terraform.lock.hcl"], suffixes: [".tf", ".tofu"] },
 });
 
 /** Marker file name → ecosystems claiming it, and marker suffix → claiming

package/lib/stages/postgen/introspection/reflect.js

@@ -36,6 +36,7 @@ import {
   isVersionedJvmToolProjectType,
   PROJECT_TYPE_ALIASES,
 } from "../../../core/env.js";
+import { safeExistsSync } from "../../../core/fs.js";
 import { dirNameStr } from "../../../core/paths.js";
 import { CDXGEN_VERSION } from "../../../core/state.js";
 import { evaluateRules, loadRules } from "../ruleEngine.js";
@@ -389,7 +390,9 @@ function resolveLedgerEvents(context) {
     };
   }
   const sidecarPath = readEnvironmentVariable("CDXGEN_INTROSPECT_LEDGER");
-  if (sidecarPath) {
+  // A sidecar the run could not create (the permission model denies writes
+  // outside the granted paths) holds nothing; the buffer still has the events.
+  if (sidecarPath && safeExistsSync(sidecarPath)) {
     return { events: loadLedgerFile(sidecarPath), source: "sidecar" };
   }
   const events = getLedgerEvents();

package/lib/stages/postgen/postgen.js

@@ -1,5 +1,5 @@
 import { readFileSync } from "node:fs";
-import { basename, join, relative, sep } from "node:path";
+import { join, relative } from "node:path";
 import process from "node:process";
 
 import { Purl } from "@cdxgen/cdx-purl";
@@ -756,6 +756,12 @@ export function applyMetadata(bomJson, options) {
       return;
     }
     if (comp.properties) {
+      // internal:LocalNodeModulesPath is a lookup path on the scanning host.
+      // Collectors outside the JS evidence pass (caxa, scalasem) keep it, so
+      // it is removed here for every component.
+      comp.properties = comp.properties.filter(
+        (aprop) => aprop.name !== "internal:LocalNodeModulesPath",
+      );
       for (const aprop of comp.properties) {
         if (aprop.name === "internal:SrcFile" && aprop.value) {
           const rdir = relativeDir(aprop.value, options);
@@ -822,7 +828,15 @@ export function applyMetadata(bomJson, options) {
     }
     collectSrcFiles(comp);
   }
-  collectSrcFiles(bomJson.metadata?.component);
+  // The project's sub-components, the modules of a multi-module build, name
+  // their manifests the same way, at any depth.
+  const collectSrcFilesTree = (comp) => {
+    collectSrcFiles(comp);
+    for (const subComponent of comp?.components || []) {
+      collectSrcFilesTree(subComponent);
+    }
+  };
+  collectSrcFilesTree(bomJson.metadata?.component);
   if (!bomJson.metadata.properties) {
     bomJson.metadata.properties = [];
   }
@@ -929,10 +943,10 @@ function applyCustomMetadataProperties(bomJson, options) {
 export function applyStandards(bomJson, options) {
   if (options.standard && Array.isArray(options.standard)) {
     for (let astandard of options.standard) {
-      // See issue: #1953
-      if (astandard.includes(sep)) {
-        astandard = basename(astandard);
-      }
+      // See issue: #1953. Server requests can send either separator, and on
+      // Windows both "/" and "\" separate path segments, so keep only the
+      // last segment of either kind.
+      astandard = String(astandard).split(/[\\/]/).pop();
       const templateFile = join(
         dirNameStr,
         "data",

package/lib/stages/postgen/ruleEngine.js

@@ -165,7 +165,18 @@ function hasProperty(obj, propName, expectedValue) {
   if (expectedValue === undefined) {
     return value !== null;
   }
-  return value === String(expectedValue);
+  // A repeatable property (cdx:crypto:sourceType on a certificate found by
+  // several producers) matches when any of its values does.
+  return extractPropertyValues(obj, propName).includes(String(expectedValue));
+}
+
+function extractPropertyValues(obj, propName) {
+  if (!Array.isArray(obj?.properties)) {
+    return [];
+  }
+  return obj.properties
+    .filter((p) => p?.name === propName && p.value !== undefined)
+    .map((p) => String(p.value));
 }
 
 /**
@@ -315,6 +326,9 @@ function registerCdxHelpers(expression, helpers = {}) {
   expression.registerFunction("prop", (obj, propName) =>
     extractProperty(obj, propName),
   );
+  expression.registerFunction("propValues", (obj, propName) =>
+    extractPropertyValues(obj, propName),
+  );
   expression.registerFunction("nullSafeProp", (obj, propName) => {
     const value = extractProperty(obj, propName);
     return value === null ? "" : value;
@@ -385,6 +399,13 @@ function registerCdxHelpers(expression, helpers = {}) {
   expression.registerFunction("safeStr", (val) => {
     return val === null || val === undefined ? "" : String(val).trim();
   });
+  // End of validity in epoch milliseconds. A date-only value (2026-01-31)
+  // is valid through the end of that day in UTC; a full RFC 3339 timestamp
+  // is taken as is; anything else, or an impossible date, gives no value so
+  // the rule skips the component.
+  expression.registerFunction("certEndMillis", (val) =>
+    parseCertificateEndMillis(val),
+  );
   expression.registerFunction("parseSizeBytes", (val) => {
     if (val === null || val === undefined || val === "") {
       return null;
@@ -519,6 +540,42 @@ function registerCdxHelpers(expression, helpers = {}) {
  * @param {string} rulesDir - Path to directory containing .yaml rule files
  * @returns {Promise<Array>} Array of parsed rule objects
  */
+const FULL_TIMESTAMP_RE =
+  /^\d{4}-(0[1-9]|1[0-2])-(0[1-9]|[12]\d|3[01])T([01]\d|2[0-3]):[0-5]\d:[0-5]\d(\.\d+)?(Z|[+-]([01]\d|2[0-3]):[0-5]\d)$/;
+const DATE_ONLY_RE = /^(\d{4})-(\d{2})-(\d{2})$/;
+
+/**
+ * Parse a certificate notValidAfter value.
+ *
+ * @param {*} value timestamp or date-only string
+ * @returns {number|undefined} epoch milliseconds, or undefined when the value
+ *   does not parse
+ */
+export function parseCertificateEndMillis(value) {
+  if (typeof value !== "string") {
+    return undefined;
+  }
+  const text = value.trim();
+  const dateOnly = DATE_ONLY_RE.exec(text);
+  if (dateOnly) {
+    const [year, month, day] = dateOnly.slice(1).map(Number);
+    const start = new Date(Date.UTC(year, month - 1, day));
+    if (
+      start.getUTCFullYear() !== year ||
+      start.getUTCMonth() !== month - 1 ||
+      start.getUTCDate() !== day
+    ) {
+      return undefined;
+    }
+    return start.getTime() + 24 * 60 * 60 * 1000 - 1;
+  }
+  if (!FULL_TIMESTAMP_RE.test(text)) {
+    return undefined;
+  }
+  const millis = Date.parse(text);
+  return Number.isNaN(millis) ? undefined : millis;
+}
+
 export async function loadRules(rulesDir) {
   const rules = [];
   if (!safeExistsSync(rulesDir)) {

package/lib/stages/postgen/specVersionCompat.js

@@ -53,6 +53,17 @@ const DEPENDENCY_1_6_ONLY_FIELDS = new Set(["provides"]);
 // License and license expression objects gained these attributes only in the
 // given spec versions. CycloneDX forbids additional properties, so they must be
 // removed when downgrading. Ref: data/bom-1.{4,5,6}.schema.json
+// The protocol types CycloneDX 1.6 defines; 1.7 added more.
+const SPEC_1_6_PROTOCOL_TYPES = new Set([
+  "tls",
+  "ssh",
+  "ipsec",
+  "ike",
+  "sstp",
+  "wpa",
+  "other",
+  "unknown",
+]);
 const LICENSE_1_5_ONLY_FIELDS = new Set(["bom-ref", "licensing", "properties"]);
 const LICENSE_1_6_ONLY_FIELDS = new Set(["acknowledgement"]);
 const LICENSE_EXPRESSION_1_5_ONLY_FIELDS = new Set(["bom-ref"]);
@@ -593,17 +604,68 @@ function downgradeSubjectForSpecVersion(subject, specVersion, parentKey) {
       certificateProperties.certificateExtension =
         certificateProperties.certificateFileExtension;
     }
+    // `relatedCryptographicAssets` and `certificateExtensions` are 1.7-only;
+    // the deprecated `subjectPublicKeyRef`/`signatureAlgorithmRef` (valid in
+    // 1.6, see data/bom-1.6.schema.json) carry the same links, and the
+    // extension facts survive as `cdx:crypto:` properties.
+    const relatedAssets = certificateProperties.relatedCryptographicAssets;
+    if (Array.isArray(relatedAssets)) {
+      for (const asset of relatedAssets) {
+        if (
+          asset?.type === "publicKey" &&
+          !certificateProperties.subjectPublicKeyRef
+        ) {
+          certificateProperties.subjectPublicKeyRef = asset.ref;
+        } else if (
+          asset?.type === "algorithm" &&
+          !certificateProperties.signatureAlgorithmRef
+        ) {
+          certificateProperties.signatureAlgorithmRef = asset.ref;
+        }
+      }
+      delete certificateProperties.relatedCryptographicAssets;
+    }
+    delete certificateProperties.certificateExtensions;
     delete certificateProperties.serialNumber;
     delete certificateProperties.certificateFileExtension;
     delete certificateProperties.fingerprint;
+  } else if (
+    specVersion < 1.7 &&
+    subject.cryptoProperties?.assetType === "related-crypto-material" &&
+    subject.cryptoProperties.relatedCryptoMaterialProperties
+  ) {
+    // The public-key `fingerprint` object is 1.7-only; the SPKI digest stays
+    // available as the `cdx:crypto:spkiSha256` property.
+    delete subject.cryptoProperties.relatedCryptoMaterialProperties.fingerprint;
   }
   if (specVersion < 1.7 && subject.cryptoProperties?.algorithmProperties) {
     // `algorithmFamily` and `ellipticCurve` are CycloneDX 1.7 additions to
     // cryptoProperties.algorithmProperties. 1.6 keeps the deprecated free-text
     // `curve`, so that one is preserved. Ref: data/bom-1.6.schema.json.
     const algorithmProperties = subject.cryptoProperties.algorithmProperties;
+    // The curve stays known through the free-text field, by its name without
+    // the registry prefix (`secg/secp256r1` is `secp256r1`).
+    if (algorithmProperties.ellipticCurve && !algorithmProperties.curve) {
+      algorithmProperties.curve = String(algorithmProperties.ellipticCurve)
+        .split("/")
+        .pop();
+    }
     delete algorithmProperties.algorithmFamily;
     delete algorithmProperties.ellipticCurve;
+    // `key-wrap` joined the primitive enum in 1.7.
+    if (algorithmProperties.primitive === "key-wrap") {
+      algorithmProperties.primitive = "other";
+    }
+  }
+  if (
+    specVersion < 1.7 &&
+    subject.cryptoProperties?.protocolProperties?.type &&
+    !SPEC_1_6_PROTOCOL_TYPES.has(
+      subject.cryptoProperties.protocolProperties.type,
+    )
+  ) {
+    // 1.7 added protocol types such as `dtls` and `quic`.
+    subject.cryptoProperties.protocolProperties.type = "other";
   }
   Object.entries(subject).forEach(([key, value]) => {
     downgradeSubjectForSpecVersion(value, specVersion, key);