@cdxgen/cdxgen 13.4.0 → 13.5.0

package/lib/inventory/auditCategories.js

@@ -1,4 +1,4 @@
-import { shouldRunPredictiveBomAudit } from "../core/env.js";
+import { getCommandName, shouldRunPredictiveBomAudit } from "../core/env.js";
 
 /** Frozen list of hardware-bill-of-materials (HBOM) audit categories. */
 export const HBOM_AUDIT_CATEGORIES = Object.freeze([
@@ -186,11 +186,11 @@ export function validateBomAuditCategories(categories, rules) {
  * @returns {string | undefined} Default category string, if any
  */
 export function getDefaultBomAuditCategories(options, commandPath) {
-  const normalizedCommandPath = `${commandPath || ""}`.toLowerCase();
+  const commandName = getCommandName(commandPath);
   const defaultHbomCategories = options?.includeRuntime
     ? `${DEFAULT_HBOM_AUDIT_CATEGORIES},host-topology`
     : DEFAULT_HBOM_AUDIT_CATEGORIES;
-  if (normalizedCommandPath.includes("hbom")) {
+  if (commandName.startsWith("hbom")) {
     return defaultHbomCategories;
   }
   const projectTypes = Array.isArray(options?.projectType)

package/lib/inventory/cacheDir.js

@@ -28,13 +28,21 @@ import { isMac, isWin } from "../core/paths.js";
  * rather than reading `isWin`/`isMac` here, or the Windows and Linux branches
  * become untestable on a macOS developer machine.
  *
+ * Every environment-derived root must be absolute by the *target* platform's
+ * rules, never the host's (`path.isAbsolute` would accept `\cache` on a
+ * Windows host): a relative value is ignored, so it cannot point inside the
+ * working directory. XDG requires this of `XDG_CACHE_HOME`; the home and
+ * `LOCALAPPDATA` roots get the same treatment for the same reason.
+ *
  * @param {Object} inputs Resolution inputs.
  * @param {"linux"|"macos"|"windows"} inputs.platform Which convention to apply.
- * @param {string} [inputs.cdxgenCacheDir] `CDXGEN_CACHE_DIR`.
+ * @param {string} [inputs.cdxgenCacheDir] `CDXGEN_CACHE_DIR`, an explicit
+ *   override taken as given.
  * @param {string} [inputs.xdgCacheHome] `XDG_CACHE_HOME`. Ignored unless
- *   absolute, per the XDG spec, so it cannot point inside the working directory.
- * @param {string} [inputs.home] Home directory.
- * @param {string} [inputs.localAppData] `LOCALAPPDATA`.
+ *   `/`-rooted.
+ * @param {string} [inputs.home] Home directory. Ignored unless absolute.
+ * @param {string} [inputs.localAppData] `LOCALAPPDATA`. Ignored unless drive-
+ *   or UNC-rooted; the home profile is the fallback.
  * @returns {string|null} Absolute path, or null when nothing resolves.
  */
 export function resolveCacheDirFor({
@@ -48,20 +56,55 @@ export function resolveCacheDirFor({
     return path.resolve(cdxgenCacheDir);
   }
   if (platform === "windows") {
-    if (localAppData?.trim()) {
+    if (isWindowsAbsolute(localAppData)) {
       return path.join(localAppData, "cdxgen", "cache");
     }
-    return home?.trim()
+    return isWindowsAbsolute(home)
       ? path.join(home, "AppData", "Local", "cdxgen", "cache")
       : null;
   }
   if (platform === "macos") {
-    return home?.trim() ? path.join(home, "Library", "Caches", "cdxgen") : null;
+    return isPosixAbsolute(home)
+      ? path.join(home, "Library", "Caches", "cdxgen")
+      : null;
   }
-  if (xdgCacheHome?.trim() && path.isAbsolute(xdgCacheHome)) {
+  if (isPosixAbsolute(xdgCacheHome)) {
     return path.join(xdgCacheHome, "cdxgen");
   }
-  return home?.trim() ? path.join(home, ".cache", "cdxgen") : null;
+  return isPosixAbsolute(home) ? path.join(home, ".cache", "cdxgen") : null;
+}
+
+/**
+ * Absolute by POSIX rules: `/`-rooted.
+ *
+ * @param {string} [value] Candidate path
+ * @returns {boolean} Whether the path is absolute
+ */
+function isPosixAbsolute(value) {
+  return typeof value === "string" && value.startsWith("/");
+}
+
+/**
+ * Absolute by Windows rules: a drive letter followed by a separator (`C:\` or
+ * `C:/`), or a UNC path (`\\server\share`). `C:cache` (relative to the drive's
+ * current directory) and `\cache` (relative to the current drive) are not.
+ * Mirrors `is_windows_absolute` in cdxrs.
+ *
+ * @param {string} [value] Candidate path
+ * @returns {boolean} Whether the path is absolute
+ */
+function isWindowsAbsolute(value) {
+  if (typeof value !== "string" || value.length < 3) {
+    return false;
+  }
+  const isSeparator = (char) => char === "\\" || char === "/";
+  const driveRooted = /^[a-zA-Z]$/.test(value[0]) && value[1] === ":";
+  if (driveRooted) {
+    return isSeparator(value[2]);
+  }
+  return (
+    isSeparator(value[0]) && isSeparator(value[1]) && !isSeparator(value[2])
+  );
 }
 
 /**