@cdxgen/cdxgen 13.4.0 → 13.5.0

package/lib/ecosystems/parsers-misc.js

@@ -13,11 +13,16 @@ import {
 import { build, Purl } from "@cdxgen/cdx-purl";
 import { parse as _load } from "yaml";
 
-import { DEBUG_MODE, readEnvironmentVariable } from "../core/activity.js";
+import {
+  DEBUG_MODE,
+  hasDangerousUnicode,
+  readEnvironmentVariable,
+} from "../core/activity.js";
 import { recordDegradation } from "../core/buildLedger.js";
 import { deferFailOnError } from "../core/deferredExit.js";
 import { shouldFetchLicense } from "../core/env.js";
 import {
+  getTmpDir,
   safeExistsSync,
   safeSpawnSync,
   safeWriteSync,
@@ -25,6 +30,10 @@ import {
 } from "../core/fs.js";
 import { thoughtLog } from "../core/logger.js";
 import { isWin } from "../core/paths.js";
+import {
+  isProjectToolingAllowed,
+  reportProjectToolingSkipped,
+} from "../core/projectTooling.js";
 import { registerRunReset } from "../core/runState.js";
 import { mesonWrapDB } from "../core/state.js";
 import { isGitHubUrl } from "../core/urls.js";
@@ -44,6 +53,7 @@ import {
 } from "../inventory/purl.js";
 import { getLicenses, spdxLicenses } from "../inventory/spdx.js";
 import { cmakeFetchDependencies } from "../parsers/cmakeLists.js";
+import { isValidIdnEmail } from "../parsers/email.js";
 import { submodulePurlCoordinates } from "../parsers/gitmodules.js";
 import { getDartMetadata } from "./ecosystems.js";
 import { parsePkgJson } from "./parsers-js.js";
@@ -1555,11 +1565,146 @@ export function parseComposerJson(composerJsonFile) {
   return { rootRequires, moduleParent };
 }
 
+// Composer's platform packages stand for what the runtime provides, and none
+// is installable, so none has a purl or an edge in the dependency graph. These
+// are the ones that describe PHP: PHP and its build flavours, HHVM, and the
+// extensions and system libraries PHP was built with. composer,
+// composer-plugin-api and composer-runtime-api are platform packages too, but
+// they describe Composer, so they are left out.
+// https://github.com/composer/composer/blob/2.10.3/src/Composer/Repository/PlatformRepository.php#L39
+const COMPOSER_PLATFORM_NAMES = new Set([
+  "php",
+  "php-64bit",
+  "php-ipv6",
+  "php-zts",
+  "php-debug",
+  "hhvm",
+]);
+
+function isComposerPlatformRequirement(name) {
+  return (
+    COMPOSER_PLATFORM_NAMES.has(name) ||
+    name.startsWith("ext-") ||
+    name.startsWith("lib-")
+  );
+}
+
+// What the lock records about the platform is a constraint, or the version a
+// project told Composer to assume. It is a fact about the project's
+// requirements, never the version of anything that runs, so it is kept as a
+// property and never becomes a component.
+const COMPOSER_PLATFORM_SECTIONS = [
+  ["platform", "cdx:composer:platform:"],
+  ["platform-dev", "cdx:composer:platformDev:"],
+  ["platform-overrides", "cdx:composer:platformOverride:"],
+];
+const COMPOSER_REQUIRE_PREFIX = "cdx:composer:require:";
+const MAX_COMPOSER_PLATFORM_VALUE_LENGTH = 256;
+// A real lock names a few dozen platform packages per map at most; the cap
+// keeps a crafted one from turning each map into thousands of properties.
+const MAX_COMPOSER_PLATFORM_ENTRIES = 128;
+
+function isComposerPlatformKey(key) {
+  return /^[A-Za-z0-9._-]{1,100}$/.test(key);
+}
+
+/**
+ * The value a platform entry carries as a property: a constraint or version
+ * string, or `false`, which `config.platform` uses to disable a package:
+ * https://github.com/composer/composer/blob/2.10.3/src/Composer/Repository/PlatformRepository.php#L125
+ *
+ * @param {unknown} value value from the lock
+ * @returns {string|undefined} property value, or undefined when it is not one
+ */
+function composerPlatformValue(value) {
+  if (value === false) {
+    return "false";
+  }
+  if (typeof value !== "string") {
+    return undefined;
+  }
+  const trimmed = value.trim();
+  if (
+    !trimmed ||
+    trimmed.length > MAX_COMPOSER_PLATFORM_VALUE_LENGTH ||
+    hasDangerousUnicode(trimmed) ||
+    /[\t\n\r]/.test(trimmed)
+  ) {
+    return undefined;
+  }
+  return trimmed;
+}
+
+/**
+ * Turn a map of platform entries into properties named `<prefix><name>`, in
+ * name order, at most MAX_COMPOSER_PLATFORM_ENTRIES of them. Over the cap the
+ * PHP and HHVM entries are kept first, since `ext-*` sorts before `php`. An
+ * array (Composer writes an empty section as `[]`) or any other shape holds no
+ * entries.
+ *
+ * @param {unknown} entries map of requirement name to constraint
+ * @param {string} prefix property name prefix
+ * @param {function(string): boolean} [keep] which names to keep
+ * @returns {{name: string, value: string}[]} properties
+ */
+function composerPlatformProperties(entries, prefix, keep = () => true) {
+  if (!entries || typeof entries !== "object" || Array.isArray(entries)) {
+    return [];
+  }
+  const kept = [];
+  for (const key of Object.keys(entries).sort()) {
+    const value = composerPlatformValue(entries[key]);
+    if (value !== undefined && isComposerPlatformKey(key) && keep(key)) {
+      kept.push({ key, value });
+    }
+  }
+  let selected = kept;
+  if (kept.length > MAX_COMPOSER_PLATFORM_ENTRIES) {
+    const runtimes = kept.filter(({ key }) => COMPOSER_PLATFORM_NAMES.has(key));
+    const others = kept
+      .filter(({ key }) => !COMPOSER_PLATFORM_NAMES.has(key))
+      .slice(0, MAX_COMPOSER_PLATFORM_ENTRIES - runtimes.length);
+    const chosen = new Set([...runtimes, ...others]);
+    selected = kept.filter((entry) => chosen.has(entry));
+  }
+  return selected.map(({ key, value }) => ({ name: `${prefix}${key}`, value }));
+}
+
+/**
+ * A CycloneDX `organizationalContact` from an author record in package
+ * metadata. The schema asserts `idn-email` on the address, so one that is not
+ * a valid address is dropped rather than failing BOM validation; an author with
+ * neither a name nor a valid address yields nothing.
+ *
+ * @param {{name?: string, email?: unknown}} author Author as the manifest has it
+ * @returns {Array<{name?: string, email?: string}>} Zero or one contact
+ */
+function contactFromAuthor(author) {
+  const contact = {};
+  if (typeof author?.name === "string" && author.name.trim()) {
+    contact.name = author.name;
+  }
+  const email = typeof author?.email === "string" ? author.email.trim() : "";
+  if (isValidIdnEmail(email)) {
+    contact.email = email;
+  }
+  return Object.keys(contact).length ? [contact] : [];
+}
+
 /**
  * Parse composer lock file
  *
  * @param {string} pkgLockFile composer.lock file
  * @param {array} rootRequires require section from composer.json
+ * @returns {{pkgList: Object[], dependenciesList: Object[], rootList: Object[], platformProperties: {name: string, value: string}[]}|Array}
+ *   The locked packages, the dependency edges between them, the packages the
+ *   root requires, and the lock's `platform`, `platform-dev` and
+ *   `platform-overrides` entries as `cdx:composer:*` properties. The platform
+ *   entries are constraints and assumed versions, not the PHP that runs; the
+ *   caller puts them on the module component. Every locked package carries its
+ *   own `php`, `hhvm`, `ext-*` and `lib-*` requirements as
+ *   `cdx:composer:require:<name>` properties. A lock that is not valid JSON
+ *   gives an empty array.
  */
 export function parseComposerLock(pkgLockFile, rootRequires) {
   const pkgList = [];
@@ -1568,16 +1713,12 @@ export function parseComposerLock(pkgLockFile, rootRequires) {
   const pkgNamePurlMap = {};
   const rootList = [];
   const rootRequiresMap = {};
+  let platformProperties = [];
   if (rootRequires) {
     for (const rr of Object.keys(rootRequires)) {
       // Skip platform requirements (php, hhvm, ext-*, lib-*) — they are never
       // Composer package names and must not be used to identify root packages.
-      if (
-        rr === "php" ||
-        rr === "hhvm" ||
-        rr.startsWith("ext-") ||
-        rr.startsWith("lib-")
-      ) {
+      if (isComposerPlatformRequirement(rr)) {
         continue;
       }
       rootRequiresMap[rr] = true;
@@ -1592,6 +1733,11 @@ export function parseComposerLock(pkgLockFile, rootRequires) {
       return [];
     }
     if (lockData) {
+      for (const [section, prefix] of COMPOSER_PLATFORM_SECTIONS) {
+        platformProperties = platformProperties.concat(
+          composerPlatformProperties(lockData[section], prefix),
+        );
+      }
       const packages = {};
       if (lockData["packages"]) {
         packages["required"] = lockData["packages"];
@@ -1664,9 +1810,10 @@ export function parseComposerLock(pkgLockFile, rootRequires) {
             apkg.distribution = { url: distUrl };
           }
           if (pkg?.authors?.length) {
-            apkg.authors = pkg.authors.map((a) => {
-              return { name: a.name, email: a.email };
-            });
+            const authors = pkg.authors.flatMap(contactFromAuthor);
+            if (authors.length) {
+              apkg.authors = authors;
+            }
           }
           if (pkg?.keywords?.length) {
             apkg.tags = pkg.keywords;
@@ -1687,6 +1834,13 @@ export function parseComposerLock(pkgLockFile, rootRequires) {
               });
             }
           }
+          apkg.properties.push(
+            ...composerPlatformProperties(
+              pkg.require,
+              COMPOSER_REQUIRE_PREFIX,
+              isComposerPlatformRequirement,
+            ),
+          );
           pkgList.push(apkg);
           dependenciesMap[purl] = new Set();
           pkgNamePurlMap[pkg.name] = purl;
@@ -1726,6 +1880,7 @@ export function parseComposerLock(pkgLockFile, rootRequires) {
     pkgList,
     dependenciesList,
     rootList,
+    platformProperties,
   };
 }
 
@@ -3608,6 +3763,12 @@ async function fullScanCocoaPod(dependency, component, options) {
         value: podspecLocation,
       });
     }
+    // A Ruby podspec is a program that only `pod` can read, and it comes from
+    // the scanned project or a repository its lockfile names. Without
+    // permission to run the project's tooling, only JSON podspecs are read,
+    // directly and without `pod`.
+    const toolingAllowed = isProjectToolingAllowed(options);
+    const isRemote = podspecLocation.startsWith("http");
     let replacements = [];
     if (
       podspecLocation.endsWith(".podspec") &&
@@ -3624,34 +3785,50 @@ async function fullScanCocoaPod(dependency, component, options) {
         "COCOA_PODSPEC_JSON_REPLACEMENTS",
       ).split(";");
     }
-    if (replacements || podspecLocation.startsWith("http")) {
-      let podspecContent;
-      if (podspecLocation.startsWith("http")) {
-        let httpResult;
-        for (const candidate of podspecCandidates(podspecLocation)) {
-          try {
-            httpResult =
-              prefetchedResponse(cocoaPodspecPrefetch, candidate) ||
-              (await gatedGet(candidate, { responseType: "text" }));
-            podspecLocation = candidate;
-          } catch (_err) {
-            continue;
-          }
-          component.properties.find(
-            ({ name }) => name === "cdx:pods:podspecLocation",
-          ).value = podspecLocation;
-          podspecLocation = `${randomUUID()}.${podspecLocation.substring(podspecLocation.lastIndexOf(".") + 1)}`;
-          podspecContent = httpResult.body;
-          break;
+    let podspecContent;
+    if (isRemote) {
+      let httpResult;
+      for (const candidate of podspecCandidates(podspecLocation)) {
+        if (!toolingAllowed && !candidate.endsWith(".json")) {
+          continue;
         }
-      } else {
-        podspecContent = readFileSync(podspecLocation, "utf-8");
+        try {
+          httpResult =
+            prefetchedResponse(cocoaPodspecPrefetch, candidate) ||
+            (await gatedGet(candidate, { responseType: "text" }));
+          podspecLocation = candidate;
+        } catch (_err) {
+          continue;
+        }
+        component.properties.find(
+          ({ name }) => name === "cdx:pods:podspecLocation",
+        ).value = podspecLocation;
+        podspecContent = httpResult.body;
+        break;
       }
       // A location none of the candidates served contributes nothing: the
       // component keeps what the lockfile already said about the pod.
       if (podspecContent === undefined) {
         return;
       }
+    } else if (!toolingAllowed && !podspecLocation.endsWith(".json")) {
+      reportProjectToolingSkipped(
+        options,
+        "cocoa.podspec.tooling-disabled",
+        "Skipping 'pod ipc spec' for Ruby podspecs since dependency installation is disabled. Their pods keep the details from Podfile.lock.",
+        {
+          ecosystem: "cocoa",
+          tool: "pod",
+          impact: "licenses",
+          detail:
+            "Dependency installation is disabled, so Ruby podspecs were not evaluated and their pods lack license and author details.",
+        },
+      );
+      return;
+    } else if (replacements.length || !toolingAllowed) {
+      podspecContent = readFileSync(podspecLocation, "utf-8");
+    }
+    if (podspecContent !== undefined) {
       for (const replacement of replacements) {
         const replacementPair = replacement.split("=");
         let match = replacementPair[0].replaceAll("<NEWLINE>", "\n");
@@ -3661,18 +3838,28 @@ async function fullScanCocoaPod(dependency, component, options) {
         const repl = replacementPair[1].replaceAll("<NEWLINE>", "\n");
         podspecContent = podspecContent.replaceAll(match, repl);
       }
-      podspecLocation = join(
-        dirname(podspecLocation),
-        `${randomUUID()}.${podspecLocation.substring(podspecLocation.lastIndexOf(".") + 1)}`,
+    }
+    if (!toolingAllowed) {
+      // Only JSON podspecs reach this point, and they need no `pod`
+      result = { stdout: podspecContent };
+    } else {
+      if (podspecContent !== undefined) {
+        // A downloaded podspec goes to the temporary directory; a local one
+        // with replacements stays beside the original, whose relative paths
+        // its Ruby may read.
+        podspecLocation = join(
+          isRemote ? getTmpDir() : dirname(podspecLocation),
+          `${randomUUID()}.${podspecLocation.substring(podspecLocation.lastIndexOf(".") + 1)}`,
+        );
+        safeWriteSync(podspecLocation, podspecContent);
+        temporaryFiles.add(podspecLocation);
+      }
+      result = executePodCommand(
+        ["ipc", "spec", "--silent", podspecLocation],
+        undefined,
+        options,
       );
-      safeWriteSync(podspecLocation, podspecContent);
-      temporaryFiles.add(podspecLocation);
     }
-    result = executePodCommand(
-      ["ipc", "spec", "--silent", podspecLocation],
-      undefined,
-      options,
-    );
   } else {
     let dependencyName = dependency.name;
     if (dependencyName.includes("/")) {
@@ -3737,9 +3924,7 @@ async function fullScanCocoaPod(dependency, component, options) {
     component.authors = [];
     if (podspec.authors.constructor === Object) {
       Object.entries(podspec.authors).forEach(([name, email]) => {
-        email.includes("@")
-          ? component.authors.push({ name, email })
-          : component.authors.push({ name });
+        component.authors.push(...contactFromAuthor({ name, email }));
       });
     } else if (podspec.authors.constructor === Array) {
       podspec.authors.forEach((name) => {

package/lib/ecosystems/parsers-python.js

@@ -1,6 +1,5 @@
 import { readFileSync } from "node:fs";
 import { basename, dirname, join, relative } from "node:path";
-import process from "node:process";
 import { URL } from "node:url";
 
 import { build } from "@cdxgen/cdx-purl";
@@ -2205,28 +2204,30 @@ export function parsePixiTomlFile(pixiToml) {
 }
 
 /**
- * Method to run cli command `pixi install`
- *
+ * Method to run cli command `pixi install` in the project directory.
  *
+ * @param {string} projectPath Directory containing pixi.toml
+ * @returns {boolean} true when pixi install succeeded
  */
-export function generatePixiLockFile(_path) {
-  const result = safeSpawnSync("pixi", ["install"]);
+export function generatePixiLockFile(projectPath) {
+  const result = safeSpawnSync("pixi", ["install"], { cwd: projectPath });
 
   if (result.status !== 0) {
-    // Handle errors
+    // Handle errors. The caller carries on without a lock file: exiting here
+    // would also stop a long-running cdxgen server.
     if (result.error && result.error.code === "ENOENT") {
       console.error(
         "Error: pixi command not found. Make sure pixi.js is installed globally.",
       );
     } else {
       console.error(
-        `Error executing pixi install: ${result.error || result.stderr.toString()}`,
+        `Error executing pixi install: ${result.error || result.stderr?.toString()}`,
       );
     }
-    process.exit(1);
-  } else {
-    console.log("Dependencies installed successfully.");
+    return false;
   }
+  console.log("Dependencies installed successfully.");
+  return true;
 }
 
 /**

package/lib/ecosystems/rubyutils.js

@@ -29,6 +29,7 @@ import {
   recordPolicyDegradationFromError,
 } from "../inventory/fetchBatch.js";
 import { genericPurl } from "../inventory/purl.js";
+import { isValidIdnEmail } from "../parsers/email.js";
 
 // FIXME. This has to get removed, once we improve the module detection one-liner.
 // If you're a Rubyist, please help us improve this code.
@@ -1967,9 +1968,11 @@ export async function parseGemspecData(gemspecData, gemspecFile, options = {}) {
     // `spec.email` holds the contact addresses of the gem, not of an author.
     // An address can only be attributed when there is one per author, in the
     // same order, or when the gem has a single author.
-    const emails = (lists.email || []).filter(
-      (email) => email.includes("@") && !email.includes(" "),
-    );
+    // Only a valid `idn-email` may reach `organizationalContact.email`; the
+    // schema asserts the format, so anything else fails BOM validation.
+    const emails = (lists.email || [])
+      .map((email) => `${email}`.trim())
+      .filter(isValidIdnEmail);
     pkg.authors = lists.authors.map((name, i) => {
       let email;
       if (emails.length === lists.authors.length) {

package/lib/ecosystems/rusi.js

@@ -14,6 +14,7 @@ import {
   reportPluginRunFailure,
   resolvePluginSourceDir,
 } from "../core/pluginRun.js";
+import { isProjectToolingAllowed } from "../core/projectTooling.js";
 import { applyAlgorithmProperties } from "../inventory/cryptoAlgorithmFamily.js";
 import { resolvePluginBinary } from "../inventory/plugins.js";
 
@@ -821,6 +822,15 @@ export function runRusiAnalysis(src, outputFile, options = {}) {
   if (!executable || !src || !outputFile) {
     return false;
   }
+  // rusi runs cargo and rustc on the project, which follow its
+  // `.cargo/config.toml` and `rust-toolchain.toml` and can compile its build
+  // scripts, so it waits for permission to run the project's tooling.
+  if (!isProjectToolingAllowed(options)) {
+    console.log(
+      "Skipping rusi since dependency installation is disabled. Rust evidence needs cargo to run on the project.",
+    );
+    return false;
+  }
 
   // cdxgen may run with its working directory already inside the project
   // while the source argument is relative to a repository root; a plain

package/lib/ecosystems/scalacliutils.js

@@ -5,6 +5,7 @@ import { DEBUG_MODE } from "../core/activity.js";
 import { commandOutputText } from "../core/buildLedger.js";
 import { getAllFiles, safeExistsSync, safeSpawnSync } from "../core/fs.js";
 import { isWin } from "../core/paths.js";
+import { isProjectToolingAllowed } from "../core/projectTooling.js";
 import { noteBuildToolRateLimit } from "../inventory/buildToolRateLimit.js";
 import { parseScalaArtifact } from "../inventory/scalaCoords.js";
 import { completeComponent } from "./parsers-jvm.js";
@@ -283,7 +284,7 @@ export function collectScalaCliComponents(dirPath, options = {}) {
   // The transitive dependencies of the declared ones come from the class
   // path the tool itself resolves; the compile requires installs to be
   // allowed.
-  if (options.installDeps === false) {
+  if (!isProjectToolingAllowed(options)) {
     console.log(
       "Skipping the scala-cli class path resolution since dependency installation is disabled.",
     );

package/lib/ecosystems/scalasem.js

@@ -18,6 +18,7 @@ import {
 import { dirNameStr } from "../core/paths.js";
 import { resolvePluginSourceDir } from "../core/pluginRun.js";
 import { formatDuration } from "../core/processTree.js";
+import { isProjectToolingAllowed } from "../core/projectTooling.js";
 import { parsetoolsFile } from "../inventory/atomUtils.js";
 import { applyAlgorithmProperties } from "../inventory/cryptoAlgorithmFamily.js";
 import { getJarClasses } from "../inventory/deps.js";
@@ -341,7 +342,8 @@ function runScalasem(analysisDir, options, requestedFile, v1Slice, v1File) {
   const runDir = safeMkdtempSync(join(getTmpDir(), "scalasem-"));
   const runReportFile = join(runDir, "scalasem.slices.json");
   const args = [scalasem, analysisDir, runReportFile];
-  if (options.installDeps === false) {
+  // The build runs the project's sbt definitions
+  if (!isProjectToolingAllowed(options)) {
     args.push("--no-build");
   }
   if (options.scalasemIncludeTests && !options.requiredOnly) {