@cdxgen/cdxgen 13.4.0 → 13.5.0

package/lib/inventory/rootfsCerts.js

@@ -0,0 +1,426 @@
+import {
+  closeSync,
+  lstatSync,
+  openSync,
+  readdirSync,
+  readSync,
+  realpathSync,
+} from "node:fs";
+import { basename, join, relative, sep } from "node:path";
+
+import {
+  androidNetworkSecurityConfigPins,
+  CertificateCollector,
+  certRecordFromDer,
+  classifyCryptoFile,
+  kubernetesTlsSecretRecords,
+  linkFallbackIssuers,
+} from "./certificates.js";
+
+// Bounds mirror trustinspector's rootfs mode (PLAN section 4.1): 16 MiB per
+// file, 20,000 files read and 500,000 entries visited per tree, depth 12.
+export const ROOTFS_CERT_LIMITS = Object.freeze({
+  maxFileBytes: 16 * 1024 * 1024,
+  maxFiles: 20000,
+  maxEntries: 500000,
+  maxDepth: 12,
+});
+
+// Coverage table: the same locations and sourceTypes as trustinspector's
+// rootfs mode (thirdparty/trustinspector/rootfs.go candidateDirs).
+const CA_STORE_DIRS = [
+  "etc/ssl/certs",
+  "usr/local/share/ca-certificates",
+  "usr/share/ca-certificates",
+  "etc/pki/tls/certs",
+  "etc/pki/ca-trust/source/anchors",
+  "etc/pki/ca-trust/extracted",
+  "var/lib/ca-certificates",
+  "usr/share/pki/ca-trust-source/anchors",
+];
+const CA_STORE_FILES = ["etc/ssl/cert.pem"];
+const CA_BLOCKLIST_DIRS = [
+  "etc/pki/ca-trust/source/blocklist",
+  "etc/pki/ca-trust/source/blacklist",
+  "usr/share/pki/ca-trust-source/blocklist",
+  "usr/share/pki/ca-trust-source/blacklist",
+];
+const SERVER_CONFIG_DIRS = [
+  "etc/nginx",
+  "etc/apache2",
+  "etc/httpd",
+  "etc/haproxy",
+  "etc/letsencrypt/live",
+  "etc/letsencrypt/archive",
+  "etc/kubernetes/pki",
+  "var/lib/kubelet/pki",
+  "etc/docker/certs.d",
+  "etc/containerd/certs.d",
+  "etc/envoy",
+  "etc/traefik",
+];
+const JAVA_DIRS = [
+  "usr/lib/jvm",
+  "opt",
+  "etc/ssl/certs/java",
+  "etc/pki/java",
+  "usr/share/elasticsearch",
+];
+const LANGUAGE_BUNDLE_DIRS = ["usr/lib", "usr/local/lib", "opt"];
+// Kubernetes secrets and Android configs are cdxgen-side producers: the
+// plugin has no YAML or Android parser.
+const SECRET_YAML_DIRS = [
+  "etc/kubernetes",
+  "var/run/secrets",
+  "run/secrets",
+  "var/lib/kubelet",
+  "srv",
+  "app",
+  "opt",
+  "home",
+  "root",
+];
+const ANDROID_DIRS = ["app", "opt", "srv", "data", "home", "root"];
+
+const CERT_SUFFIXES = [
+  ".pem",
+  ".crt",
+  ".cer",
+  ".der",
+  ".p7b",
+  ".p7c",
+  ".p12",
+  ".pfx",
+  ".jks",
+  ".jceks",
+  ".truststore",
+  ".key",
+];
+
+function isJavaKeystoreName(base) {
+  if (base === "cacerts" || base === "jssecacerts") {
+    return true;
+  }
+  return [".jks", ".jceks", ".truststore", ".p12", ".pfx"].some((suffix) =>
+    base.endsWith(suffix),
+  );
+}
+
+// Mirrors looksLikeTrustMaterialPath in trustinspector: private-key
+// directories are never read.
+function looksLikeTrustMaterialPath(rel, sourceType) {
+  const lower = rel.toLowerCase();
+  if (
+    lower.startsWith("etc/ssl/private/") ||
+    lower.startsWith("etc/pki/tls/private/")
+  ) {
+    return false;
+  }
+  const base = basename(lower);
+  if (sourceType === "language-bundle") {
+    return base === "cacert.pem";
+  }
+  if (sourceType === "java-truststore") {
+    return isJavaKeystoreName(base);
+  }
+  if (isJavaKeystoreName(base)) {
+    return true;
+  }
+  return (
+    CERT_SUFFIXES.some((suffix) => lower.endsWith(suffix)) ||
+    lower.includes("/certs/")
+  );
+}
+
+/**
+ * Read at most `maxBytes` of a regular file. The cap applies to the read
+ * itself, so a file that grows after the size check cannot exceed it. Files
+ * that are not regular (FIFOs, devices, sockets) are never opened.
+ */
+function readCapped(absolute, maxBytes) {
+  const before = lstatSync(absolute);
+  if (!before.isFile() || before.size > maxBytes) {
+    return undefined;
+  }
+  const fd = openSync(absolute, "r");
+  try {
+    const buffer = Buffer.alloc(Math.min(before.size, maxBytes) + 1);
+    let total = 0;
+    while (total < buffer.length) {
+      const n = readSync(fd, buffer, total, buffer.length - total, null);
+      if (n === 0) {
+        break;
+      }
+      total += n;
+    }
+    if (total > maxBytes) {
+      return undefined;
+    }
+    return buffer.subarray(0, total);
+  } finally {
+    closeSync(fd);
+  }
+}
+
+/**
+ * Pure-JS inventory of the certificate locations trustinspector's rootfs
+ * mode covers, plus Kubernetes TLS secrets and Android pins. Used when the
+ * plugin is not available. Produces components through the shared
+ * CertificateCollector, so bom-refs, names and deduplication match the other
+ * producers; locations are root-relative ("/etc/ssl/certs/x.crt").
+ *
+ * Every access stays inside the root: symlinks (files or directories) are
+ * skipped, only regular files are opened, and the walk is bounded by entry,
+ * file, size and depth limits.
+ *
+ * @param {string} rootDir extracted root filesystem
+ * @param {object} [limits] overrides for ROOTFS_CERT_LIMITS (tests)
+ * @returns {{components: object[], dependencies: object[], warnings: string[]}}
+ */
+export function collectRootfsCertificates(rootDir, limits = {}) {
+  const bounds = { ...ROOTFS_CERT_LIMITS, ...limits };
+  const warnings = [];
+  let realRoot;
+  try {
+    realRoot = realpathSync(rootDir);
+  } catch {
+    return { components: [], dependencies: [], warnings };
+  }
+  const collector = new CertificateCollector();
+  const records = [];
+  const components = [];
+  const seenFiles = new Set();
+  let filesRead = 0;
+
+  // Resolve a root-relative directory to an absolute path that is proven to
+  // stay inside the root; undefined when it does not exist, is not a
+  // directory, or any symlink on the way leaves the root.
+  const resolveInside = (rel) => {
+    const absolute = join(realRoot, rel);
+    let real;
+    try {
+      real = realpathSync(absolute);
+    } catch {
+      return undefined;
+    }
+    const inside = relative(realRoot, real);
+    if (inside.startsWith("..") || inside.split(sep).includes("..")) {
+      return undefined;
+    }
+    return real;
+  };
+
+  const walk = (relBase, visit) => {
+    const start = resolveInside(relBase);
+    if (!start) {
+      return;
+    }
+    let startStat;
+    try {
+      startStat = lstatSync(start);
+    } catch {
+      return;
+    }
+    if (!startStat.isDirectory()) {
+      return;
+    }
+    let entries = 0;
+    const stack = [{ abs: start, rel: relBase, depth: 0 }];
+    while (stack.length) {
+      const { abs, rel, depth } = stack.pop();
+      let dirents;
+      try {
+        dirents = readdirSync(abs, { withFileTypes: true });
+      } catch {
+        continue;
+      }
+      dirents.sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
+      for (const dirent of dirents) {
+        entries += 1;
+        if (entries > bounds.maxEntries) {
+          warnings.push(
+            `entry limit (${bounds.maxEntries}) reached in /${relBase}`,
+          );
+          return;
+        }
+        // Symlinks and special files are skipped outright.
+        if (dirent.isSymbolicLink()) {
+          continue;
+        }
+        const childRel = `${rel}/${dirent.name}`;
+        if (dirent.isDirectory()) {
+          if (depth + 1 >= bounds.maxDepth) {
+            warnings.push(
+              `depth limit (${bounds.maxDepth}) exceeded in /${relBase}`,
+            );
+            continue;
+          }
+          stack.push({
+            abs: join(abs, dirent.name),
+            rel: childRel,
+            depth: depth + 1,
+          });
+        } else if (dirent.isFile()) {
+          if (visit(childRel, join(abs, dirent.name)) === false) {
+            return;
+          }
+        }
+      }
+    }
+  };
+
+  const readRel = (rel, abs) => {
+    if (filesRead >= bounds.maxFiles) {
+      warnings.push(`file count limit (${bounds.maxFiles}) reached`);
+      return undefined;
+    }
+    filesRead += 1;
+    try {
+      const bytes = readCapped(abs, bounds.maxFileBytes);
+      if (!bytes) {
+        warnings.push(
+          `file over ${bounds.maxFileBytes} bytes skipped: /${rel}`,
+        );
+      }
+      return bytes;
+    } catch {
+      return undefined;
+    }
+  };
+
+  const consumeMaterial = (rel, abs, sourceType) => {
+    if (seenFiles.has(rel) || !looksLikeTrustMaterialPath(rel, sourceType)) {
+      return;
+    }
+    const bytes = readRel(rel, abs);
+    if (!bytes?.length) {
+      return;
+    }
+    seenFiles.add(rel);
+    const location = `/${rel}`;
+    const classification = classifyCryptoFile(bytes);
+    if (classification.kind === "certificates") {
+      const dot = basename(rel).lastIndexOf(".");
+      for (const der of classification.ders) {
+        const record = certRecordFromDer(der, { location, sourceType });
+        if (record) {
+          record.fileExtension =
+            dot > 0 ? basename(rel).slice(dot + 1) : undefined;
+          records.push(record);
+        }
+      }
+    } else if (classification.kind === "private-key") {
+      components.push(
+        rootfsMaterialComponent("private-key", location, {
+          format: classification.format,
+          sourceType,
+        }),
+      );
+    } else if (classification.kind === "keystore") {
+      components.push(
+        rootfsMaterialComponent("keystore", location, {
+          format: classification.format,
+          sourceType,
+        }),
+      );
+    }
+  };
+
+  // Most specific location first, so a file under two candidates takes the
+  // sourceType of the narrower one (same rule as the plugin).
+  const candidates = [
+    ...CA_STORE_DIRS.map((rel) => ({ rel, sourceType: "ca-store" })),
+    ...CA_BLOCKLIST_DIRS.map((rel) => ({ rel, sourceType: "ca-blocklist" })),
+    ...SERVER_CONFIG_DIRS.map((rel) => ({ rel, sourceType: "server-config" })),
+    ...JAVA_DIRS.map((rel) => ({ rel, sourceType: "java-truststore" })),
+    ...LANGUAGE_BUNDLE_DIRS.map((rel) => ({
+      rel,
+      sourceType: "language-bundle",
+    })),
+  ].sort((a, b) => b.rel.split("/").length - a.rel.split("/").length);
+  for (const file of CA_STORE_FILES) {
+    const abs = resolveInside(file);
+    if (abs && lstatSync(abs).isFile()) {
+      consumeMaterial(file, abs, "ca-store");
+    }
+  }
+  for (const { rel, sourceType } of candidates) {
+    walk(rel, (childRel, abs) => {
+      consumeMaterial(childRel, abs, sourceType);
+    });
+  }
+
+  const secretFiles = new Set();
+  for (const dir of SECRET_YAML_DIRS) {
+    walk(dir, (childRel, abs) => {
+      if (/\.ya?ml$/i.test(childRel) && !secretFiles.has(childRel)) {
+        secretFiles.add(childRel);
+        const bytes = readRel(childRel, abs);
+        const text = bytes?.toString("utf-8");
+        // Cheap pre-filter, as in the source scan.
+        if (text?.includes("kubernetes.io/tls")) {
+          records.push(
+            ...kubernetesTlsSecretRecords(text, { file: `/${childRel}` }),
+          );
+        }
+      }
+    });
+  }
+  const androidFiles = new Set();
+  for (const dir of ANDROID_DIRS) {
+    walk(dir, (childRel, abs) => {
+      if (
+        /\/res\/xml\/[^/]+\.xml$/i.test(childRel) &&
+        !androidFiles.has(childRel)
+      ) {
+        androidFiles.add(childRel);
+        const text = readRel(childRel, abs)?.toString("utf-8");
+        if (text?.includes("<network-security-config")) {
+          for (const pin of androidNetworkSecurityConfigPins(text, {
+            file: `/${childRel}`,
+          })) {
+            collector.addPin(pin);
+          }
+        }
+      }
+    });
+  }
+
+  if (records.length) {
+    linkFallbackIssuers(records);
+    collector.addRecords(records);
+  }
+  const built = collector.build();
+  return {
+    components: [...built.components, ...components],
+    dependencies: built.dependencies,
+    warnings,
+  };
+}
+
+// Same shape as the keystore and private-key components the other producers
+// emit (managedBom sourceKeystoreComponent / sourcePrivateKeyComponent).
+function rootfsMaterialComponent(kind, location, { format, sourceType }) {
+  return {
+    name: basename(location),
+    type: "cryptographic-asset",
+    "bom-ref": `crypto/related-crypto-material/${kind}/${encodeURIComponent(location)}`,
+    cryptoProperties: {
+      assetType: "related-crypto-material",
+      relatedCryptoMaterialProperties: {
+        type: kind === "keystore" ? "other" : "private-key",
+        ...(format ? { format } : {}),
+      },
+    },
+    evidence: { occurrences: [{ location }] },
+    properties: [
+      { name: "internal:SrcFile", value: location },
+      ...(sourceType
+        ? [{ name: "cdx:crypto:sourceType", value: sourceType }]
+        : []),
+      ...(kind === "keystore"
+        ? [{ name: "cdx:crypto:keystoreReadable", value: "false" }]
+        : []),
+    ],
+  };
+}

package/lib/inventory/source.js

@@ -1,7 +1,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import process from "node:process";
-import { URL } from "node:url";
+import { fileURLToPath, URL } from "node:url";
 
 import { Purl } from "@cdxgen/cdx-purl";
 import { coerce, diff, prerelease } from "semver";
@@ -111,6 +111,9 @@ function inferGitOperation(args = []) {
  * @param {string[]} args git arguments
  * @param {Object} options command options
  * @param {string|undefined} options.cwd working directory
+ * @param {boolean|undefined} options.noRepository run outside any repository,
+ *   so the config of a repository in the working directory, such as url.*.insteadOf
+ *   or core.sshCommand, cannot change where a remote command connects
  * @returns {Object} spawn result
  */
 export function hardenedGitCommand(args, options = {}) {
@@ -122,8 +125,14 @@ export function hardenedGitCommand(args, options = {}) {
     GIT_CONFIG_VALUE_0: "false",
     GIT_CONFIG_KEY_1: "safe.bareRepository",
     GIT_CONFIG_VALUE_1: "explicit",
+    GIT_NO_LAZY_FETCH: "1",
     GIT_TERMINAL_PROMPT: "0",
   };
+  if (options.noRepository) {
+    // ls-remote works without a repository. Pointing GIT_DIR at a path that
+    // does not exist stops git from discovering one in the working directory.
+    envConfigs.GIT_DIR = path.join(getTmpDir(), "cdxgen-no-repository.invalid");
+  }
   const env = isSecureMode
     ? {
         ...process.env,
@@ -275,10 +284,14 @@ export function buildReleaseNotesFromGit(repoPath, options = {}) {
     typeof remoteUrl === "string"
       ? validateAndRejectGitSource(remoteUrl)
       : null;
+  // remote.origin.url comes from the scanned repository. Only a remote that
+  // validateAndRejectGitSource recognises and checks may reach ls-remote; git
+  // also treats forms such as host:path as remotes, which skip that check.
   const canDiscoverRemoteTags =
     (!currentTag || !previousTag) &&
     typeof remoteUrl === "string" &&
     !remoteUrl.startsWith("-") &&
+    maybeRemotePath(remoteUrl) &&
     !remoteUrlValidationError &&
     /github\.com[:/]/i.test(remoteUrl);
   if (canDiscoverRemoteTags) {
@@ -298,7 +311,7 @@ export function buildReleaseNotesFromGit(repoPath, options = {}) {
         "--",
         remoteUrl,
       ],
-      {},
+      { noRepository: true },
     );
     const remoteTags = parseLsRemoteTags(remoteTagsResult.stdout);
     if (!currentTag && remoteTags.length) {
@@ -508,6 +521,59 @@ export function isAllowedPath(p) {
   });
 }
 
+/**
+ * Resolve symlinks in a path. When the path does not exist yet, the nearest
+ * existing parent is resolved and the remaining segments are appended, so
+ * /tmp/new on macOS still becomes /private/tmp/new.
+ *
+ * @param {string} p Path string
+ * @returns {string} real path
+ */
+function realPathOrResolved(p) {
+  let current = path.resolve(p);
+  const missing = [];
+  while (true) {
+    try {
+      return path.join(fs.realpathSync(current), ...missing);
+    } catch (_err) {
+      const parent = path.dirname(current);
+      if (parent === current) {
+        return path.resolve(p);
+      }
+      missing.unshift(path.basename(current));
+      current = parent;
+    }
+  }
+}
+
+/**
+ * Checks where the given path really points, after following symlinks, against
+ * where the allowed paths really point. Both sides are resolved, so an allowed
+ * directory that is itself reached through a link (such as /tmp on macOS) still
+ * matches, while a link inside an allowed directory that leads outside it does
+ * not.
+ *
+ * @param {string} p Path string to check
+ * @returns {boolean} true if the real path is inside a real allowed path
+ */
+export function isAllowedRealPath(p) {
+  if (typeof p !== "string" || hasDangerousUnicode(p)) {
+    return false;
+  }
+  const allowedPaths = getAllowedPaths();
+  if (!allowedPaths.length) {
+    return true;
+  }
+  const realP = realPathOrResolved(p);
+  return allowedPaths.some((ap) => {
+    const relativePath = path.relative(realPathOrResolved(ap), realP);
+    return (
+      relativePath === "" ||
+      (!relativePath.startsWith("..") && !path.isAbsolute(relativePath))
+    );
+  });
+}
+
 /**
  * Determine if the path could be a package URL.
  *
@@ -586,6 +652,49 @@ export function validateAndRejectGitSource(filePath) {
       };
     }
 
+    if (hasAmbiguousRemoteCharacters(filePath)) {
+      return {
+        status: 400,
+        error: "Invalid URL Format",
+        details:
+          "The provided Git URL contains backslashes, whitespace or control characters.",
+      };
+    }
+
+    // git reads file:// URLs from the local disk, so they get the path
+    // allowlist rather than the host allowlist.
+    if (gitUrlObj.protocol === "file:") {
+      let localPath;
+      try {
+        localPath = fileURLToPath(gitUrlObj);
+      } catch (_err) {
+        localPath = undefined;
+      }
+      if (
+        gitUrlObj.hostname ||
+        !localPath ||
+        !isAllowedPath(localPath) ||
+        (isWin && !isAllowedWinPath(localPath))
+      ) {
+        return {
+          status: 403,
+          error: "Path Not Allowed",
+          details: "Path is not allowed as per the allowlist.",
+        };
+      }
+      return null;
+    }
+
+    // git, libcurl and OpenSSH must connect to the host that was checked.
+    const gitRemoteHost = getGitRemoteHost(filePath);
+    if (!gitRemoteHost || gitUrlObj.hostname.toLowerCase() !== gitRemoteHost) {
+      return {
+        status: 400,
+        error: "Invalid URL Format",
+        details: "The host of the provided Git URL is ambiguous.",
+      };
+    }
+
     if (!isAllowedHost(gitUrlObj.hostname)) {
       return {
         status: 403,
@@ -598,6 +707,94 @@ export function validateAndRejectGitSource(filePath) {
   return null;
 }
 
+/**
+ * Detect characters that git, libcurl or OpenSSH read differently from the
+ * WHATWG URL parser. A backslash ends the host for new URL() but is part of
+ * the user name for git, and new URL() silently drops tabs and newlines.
+ *
+ * @param {string} remote Git URL or SCP-like address
+ * @returns {boolean} true if the remote contains such characters
+ */
+function hasAmbiguousRemoteCharacters(remote) {
+  if (hasDangerousUnicode(remote)) {
+    return true;
+  }
+  for (const ch of remote) {
+    const code = ch.codePointAt(0);
+    if (ch === "\\" || code <= 0x20 || (code >= 0x7f && code <= 0x9f)) {
+      return true;
+    }
+  }
+  return false;
+}
+
+/**
+ * Return the host a git client connects to for a remote, read the way git,
+ * libcurl and OpenSSH read it rather than the way new URL() does. git ends the
+ * authority of ssh:// and git:// URLs only at the first slash, percent-decodes
+ * it before splitting off the host, and reads a leading "[...]" as the host.
+ * OpenSSH takes the host after the last "@". So a "?" or "#" before the first
+ * slash, a second "@", brackets in the user name, or a percent sign in an
+ * ssh:// or git:// authority make the host ambiguous.
+ *
+ * @param {string} remote Git URL or SCP-like address
+ * @returns {string|undefined} lower-cased host, or undefined when it is ambiguous
+ */
+export function getGitRemoteHost(remote) {
+  if (typeof remote !== "string") {
+    return undefined;
+  }
+  let authority;
+  const schemeEnd = remote.indexOf("://");
+  if (schemeEnd > -1) {
+    const scheme = remote.slice(0, schemeEnd).toLowerCase();
+    const rest = remote.slice(schemeEnd + 3);
+    const slash = rest.indexOf("/");
+    authority = slash > -1 ? rest.slice(0, slash) : rest;
+    // libcurl reads the http(s) authority as written. git decodes the others.
+    if (!["http", "https"].includes(scheme) && authority.includes("%")) {
+      return undefined;
+    }
+  } else {
+    // git reads user@host:path as SCP-like only when the colon comes before
+    // any slash. Otherwise it is a local path.
+    const colon = remote.indexOf(":");
+    const slash = remote.indexOf("/");
+    if (colon < 0 || (slash > -1 && slash < colon)) {
+      return undefined;
+    }
+    authority = remote.slice(0, colon);
+  }
+  if (authority.includes("?") || authority.includes("#")) {
+    return undefined;
+  }
+  const at = authority.indexOf("@");
+  if (at !== authority.lastIndexOf("@")) {
+    return undefined;
+  }
+  const userInfo = at > -1 ? authority.slice(0, at) : "";
+  if (userInfo.includes("[") || userInfo.includes("]")) {
+    return undefined;
+  }
+  let host = authority.slice(at + 1);
+  if (host.startsWith("[")) {
+    const close = host.indexOf("]");
+    if (close < 0) {
+      return undefined;
+    }
+    host = host.slice(0, close + 1);
+  } else {
+    const portSep = host.indexOf(":");
+    if (portSep > -1) {
+      host = host.slice(0, portSep);
+    }
+  }
+  if (!host || host.startsWith("-")) {
+    return undefined;
+  }
+  return host.toLowerCase();
+}
+
 /**
  * Clone a git repository into a temporary directory.
  *
@@ -606,6 +803,11 @@ export function validateAndRejectGitSource(filePath) {
  * @returns {string} cloned directory path
  */
 export function gitClone(repoUrl, branch = null) {
+  // Callers validate first, but git must never see a remote that fails it.
+  const validationError = validateAndRejectGitSource(repoUrl);
+  if (validationError) {
+    throw new Error(`${validationError.error}: ${validationError.details}`);
+  }
   let baseDirName = path.basename(repoUrl);
   if (!/^[a-zA-Z0-9_-]+$/.test(baseDirName)) {
     baseDirName = "repo-";
@@ -635,6 +837,8 @@ export function gitClone(repoUrl, branch = null) {
     "safe.bareRepository=explicit",
     "-c",
     "core.hooksPath=/dev/null",
+    "-c",
+    "core.symlinks=false",
     "clone",
     "--template=",
     repoUrl,
@@ -735,7 +939,7 @@ export function findGitRefForPurlVersion(repoUrl, purlResolution) {
       "--",
       repoUrl,
     ],
-    {},
+    { noRepository: true },
   );
   if (result.status !== 0 || !result.stdout) {
     return undefined;