@cdxgen/cdxgen 13.4.0 → 13.5.0

package/lib/cli/nativeBom.js

@@ -23,11 +23,16 @@ import {
 import {
   checksumFile,
   getAllFiles,
+  getTmpDir,
   safeExistsSync,
   safeSpawnSync,
 } from "../core/fs.js";
 import { thoughtLog } from "../core/logger.js";
 import { dirNameStr, isMac } from "../core/paths.js";
+import {
+  isProjectToolingAllowed,
+  reportProjectToolingSkipped,
+} from "../core/projectTooling.js";
 import { readCrateArchiveValues } from "../ecosystems/cargoCache.js";
 import {
   buildDependentPurl,
@@ -55,6 +60,7 @@ import {
 } from "../ecosystems/parsers-elm.js";
 import { parseGleamProject } from "../ecosystems/parsers-gleam.js";
 import {
+  compareGoVersions,
   isGoModWhyNotNeeded,
   parseGoListDep,
   parseGoModData,
@@ -198,6 +204,30 @@ export function getCargoCacheDir() {
       );
 }
 
+/**
+ * Add a Go module of the project, a nested go.mod or a go.work member, under
+ * the parent component. A module that is already the parent, one of its
+ * subcomponents, or a component (a directory replacement inside the project)
+ * is not added again, so no bom-ref appears twice.
+ *
+ * @param {Object} parentComponent The project's parent component
+ * @param {Object} moduleComponent The module to add
+ * @param {Object[]} pkgList Components found so far
+ */
+function addGoSubComponent(parentComponent, moduleComponent, pkgList) {
+  const ref = moduleComponent?.["bom-ref"];
+  if (
+    !ref ||
+    ref === parentComponent["bom-ref"] ||
+    parentComponent.components?.some((c) => c["bom-ref"] === ref) ||
+    pkgList.some((c) => c["bom-ref"] === ref)
+  ) {
+    return;
+  }
+  parentComponent.components = parentComponent.components || [];
+  parentComponent.components.push(moduleComponent);
+}
+
 /**
  * Function to create bom string for Go projects
  *
@@ -313,6 +343,20 @@ export async function createGoBom(path, options) {
         }
       }
     }
+    // go mod why answers for a module path, but go.sum also names versions
+    // that only took part in version selection. Only a version whose content
+    // go.sum holds a checksum for was ever downloaded, and of those, MVS
+    // builds the highest.
+    const builtVersions = {};
+    for (const apkg of pkgList) {
+      const built = builtVersions[apkg.name];
+      if (
+        apkg._integrity &&
+        (!built || compareGoVersions(apkg.version, built) > 0)
+      ) {
+        builtVersions[apkg.name] = apkg.version;
+      }
+    }
     // A module go reports as unneeded is optional, but only when every module
     // was checked: once go mod why fails, the answers are incomplete, and a
     // tool failure is not evidence that a module is unused.
@@ -321,7 +365,9 @@ export async function createGoBom(path, options) {
         continue;
       }
       if (requiredModules.has(apkg.name)) {
-        apkg.scope = "required";
+        if (builtVersions[apkg.name] === apkg.version) {
+          apkg.scope = "required";
+        }
       } else if (!circuitBreak && unneededModules.has(apkg.name)) {
         apkg.scope = "optional";
       }
@@ -384,6 +430,9 @@ export async function createGoBom(path, options) {
     });
 
     let rootParentComponent = null;
+    // Whether the go toolchain resolved a module graph. A module without
+    // dependencies resolves to no components, and that is a complete answer.
+    let resolvedByToolchain = false;
     // Use the go list -deps and go mod why commands to generate a good quality BOM for non-docker invocations
     if (
       !hasAnyProjectType(["docker", "oci", "container", "os"], options, false)
@@ -403,13 +452,15 @@ export async function createGoBom(path, options) {
           console.log("Executing go list -deps in", basePath);
         }
         // TODO: Replacing this with -json gives us more interesting data points such as GoFiles, Imports, and Deps
+        // The fields after Dir name the module content checksum and, for a
+        // module a replace directive swapped out, the replacement Go builds.
         let result = safeSpawnSync(
           "go",
           [
             "list",
             "-deps",
             "-f",
-            "'{{with .Module}}{{.Path}}|{{.Version}}|{{.Indirect}}|{{.GoMod}}|{{.GoVersion}}|{{.Main}}|{{.Time}}|{{.Deprecated}}|{{.GoModSum}}|{{.Dir}}{{end}}'",
+            "'{{with .Module}}{{.Path}}|{{.Version}}|{{.Indirect}}|{{.GoMod}}|{{.GoVersion}}|{{.Main}}|{{.Time}}|{{.Deprecated}}|{{.GoModSum}}|{{.Dir}}|{{.Sum}}|{{with .Replace}}{{.Path}}{{end}}|{{with .Replace}}{{.Version}}{{end}}|{{with .Replace}}{{.Sum}}{{end}}{{end}}'",
             "./...",
           ],
           {
@@ -453,7 +504,9 @@ export async function createGoBom(path, options) {
         const stdout = result.stdout;
         if (stdout) {
           let cmdOutput = Buffer.from(stdout).toString();
-          const retMap = await parseGoListDep(cmdOutput, gosumMap);
+          const retMap = await parseGoListDep(cmdOutput, gosumMap, {
+            mainModuleDir: basePath,
+          });
           if (retMap.pkgList?.length) {
             pkgList = pkgList.concat(retMap.pkgList);
           }
@@ -462,6 +515,7 @@ export async function createGoBom(path, options) {
             retMap.parentComponent &&
             Object.keys(retMap.parentComponent).length
           ) {
+            resolvedByToolchain = true;
             if (!rootParentComponent) {
               // First (shallowest) module becomes the root
               rootParentComponent = retMap.parentComponent;
@@ -469,12 +523,18 @@ export async function createGoBom(path, options) {
               parentComponent = rootParentComponent;
             } else {
               // Subsequent modules become subcomponents
-              if (!parentComponent.components) {
-                parentComponent.components = [];
-              }
-              parentComponent.components.push(retMap.parentComponent);
+              addGoSubComponent(
+                parentComponent,
+                retMap.parentComponent,
+                pkgList,
+              );
             }
           }
+          // The other members of a go.work workspace are modules of the same
+          // project, which no registry holds.
+          for (const workspaceModule of retMap.workspaceModules || []) {
+            addGoSubComponent(parentComponent, workspaceModule, pkgList);
+          }
           if (DEBUG_MODE) {
             console.log("Executing go mod graph in", basePath);
           }
@@ -524,8 +584,11 @@ export async function createGoBom(path, options) {
             }
             // Retain the parent component hierarchy
             if (Object.keys(retMap.parentComponent).length) {
-              parentComponent.components = parentComponent.components || [];
-              parentComponent.components.push(retMap.parentComponent);
+              addGoSubComponent(
+                parentComponent,
+                retMap.parentComponent,
+                pkgList,
+              );
             }
           }
         } else {
@@ -538,6 +601,7 @@ export async function createGoBom(path, options) {
             shell: isWin,
           });
           if (result.stdout) {
+            resolvedByToolchain = true;
             const cmdOutput = Buffer.from(result.stdout).toString();
             // The arguments to parseGoModGraph are slightly different to force inclusion of all packages
             const retMap = await parseGoModGraph(
@@ -566,8 +630,11 @@ export async function createGoBom(path, options) {
                 parentComponent = rootParentComponent;
               } else {
                 // Subsequent modules become subcomponents
-                parentComponent.components = parentComponent.components || [];
-                parentComponent.components.push(retMap.parentComponent);
+                addGoSubComponent(
+                  parentComponent,
+                  retMap.parentComponent,
+                  pkgList,
+                );
               }
             }
           } else {
@@ -589,7 +656,7 @@ export async function createGoBom(path, options) {
           }
         }
       }
-      if (pkgList.length && !shouldManuallyParse) {
+      if ((pkgList.length || resolvedByToolchain) && !shouldManuallyParse) {
         return buildBomNSData(options, pkgList, "golang", {
           dependencies,
           parentComponent,
@@ -732,11 +799,19 @@ function cargoAnswersVersion(cwd) {
  * @param {string} [filterPlatform] Target triple to resolve the graph for
  * @returns {object|undefined} Parsed `cargo metadata` output
  */
-function runCargoMetadata(cargoTomlFile, filterPlatform) {
-  const basePath = dirname(cargoTomlFile);
+function runCargoMetadata(cargoTomlFile, filterPlatform, options = {}) {
+  // cargo reads `.cargo/config.toml` (rustc, rustc-wrapper, [env]) and rustup
+  // reads `rust-toolchain.toml` from the working directory, and `cargo
+  // metadata` runs rustc to learn the target. Without permission to run the
+  // project's tooling, cargo starts outside the project and stays offline.
+  const toolingAllowed = isProjectToolingAllowed(options);
+  const basePath = toolingAllowed ? dirname(cargoTomlFile) : getTmpDir();
   const platformArgs = filterPlatform
     ? ["--filter-platform", filterPlatform]
     : [];
+  if (!toolingAllowed) {
+    platformArgs.push("--offline");
+  }
   // `--locked` keeps the user's lock file untouched; a workspace that is out of
   // date with its lock file needs the retry without it.
   for (const lockArgs of [["--locked"], []]) {
@@ -810,7 +885,7 @@ function annotateCargoDependencyKinds(
     let anyMetadata = false;
     let everyMetadata = true;
     for (const cargoTomlFile of cargoFiles) {
-      const metadata = runCargoMetadata(cargoTomlFile);
+      const metadata = runCargoMetadata(cargoTomlFile, undefined, options);
       if (!metadata) {
         everyMetadata = false;
         continue;
@@ -824,7 +899,11 @@ function annotateCargoDependencyKinds(
       visitedWorkspaceRoots.add(workspaceRoot);
       anyMetadata = true;
       if (CARGO_TARGET) {
-        const targetMetadata = runCargoMetadata(cargoTomlFile, CARGO_TARGET);
+        const targetMetadata = runCargoMetadata(
+          cargoTomlFile,
+          CARGO_TARGET,
+          options,
+        );
         if (targetMetadata) {
           for (const key of parseCargoMetadataResolve(targetMetadata)
             .resolvedKeys) {
@@ -962,13 +1041,31 @@ export async function createRustBom(path, options) {
     `${options.multiProject ? "**/" : ""}Cargo.toml`,
     options,
   );
+  // `cargo check` compiles the project, running its build scripts and
+  // procedural macros, so --deep runs it only when the project's own tooling
+  // may run.
+  const cargoToolingAllowed = isProjectToolingAllowed(options);
+  if (
+    options.deep &&
+    cargoFiles.length &&
+    !cargoToolingAllowed &&
+    !hasAnyProjectType(["oci"], options, false)
+  ) {
+    reportProjectToolingSkipped(
+      options,
+      null,
+      "Skipping 'cargo check' since dependency installation is disabled. Build scripts and procedural macros are not run, so the files each crate uses are not recorded.",
+    );
+  }
   // Attempt to build or generate lock files automatically
   for (const f of cargoFiles) {
     // If there are no cargo.lock files, we can attempt a cargo install when
     //    options.deep is true or options.lifecycle == build or post-build with installDeps
     // Why the need for installDeps? It currently defaults to true, so let's obey if someone wants no installs
     if (
-      (options.deep && !hasAnyProjectType(["oci"], options, false)) ||
+      (options.deep &&
+        cargoToolingAllowed &&
+        !hasAnyProjectType(["oci"], options, false)) ||
       (options.installDeps &&
         !safeExistsSync(f.replace(".toml", ".lock")) &&
         ["build", "post-build"].includes(options.lifecycle))
@@ -1870,11 +1967,35 @@ export function createClojureBom(path, options) {
     if (readEnvironmentVariable("LEIN_ARGS")) {
       LEIN_ARGS = readEnvironmentVariable("LEIN_ARGS").split(" ");
     }
+    // `lein deps :tree-data` evaluates project.clj, which is a Clojure
+    // program, so it belongs to the dependency-tooling surface disabled by
+    // --no-install-deps and the pre-build lifecycle.
+    const leinToolingAllowed = isProjectToolingAllowed(options);
     for (const f of leinFiles) {
       if (DEBUG_MODE) {
         console.log(`Parsing ${f}`);
       }
       const basePath = dirname(f);
+      if (!leinToolingAllowed) {
+        reportProjectToolingSkipped(
+          options,
+          "clojure.lein.tooling-disabled",
+          "Skipping 'lein deps :tree-data' since dependency installation is disabled. Only the dependencies declared in project.clj will be used.",
+          {
+            ecosystem: "clojure",
+            tool: "lein",
+            impact: "transitive-deps",
+            detail:
+              "Dependency installation is disabled, so project.clj was not evaluated and only its directly declared dependencies are available.",
+          },
+        );
+        const leinData = readFileSync(f, { encoding: "utf-8" });
+        const dlist = parseLeiningenData(leinData);
+        if (dlist?.length) {
+          pkgList = pkgList.concat(dlist);
+        }
+        continue;
+      }
       console.log("Executing", LEIN_CMD, "in", basePath);
       const result = safeSpawnSync(LEIN_CMD, LEIN_ARGS, {
         cwd: basePath,
@@ -2235,7 +2356,39 @@ export async function createSwiftBom(path, options) {
     );
   }
   if (swiftFiles.length) {
+    // A SwiftPM manifest is a Swift program, so `swift package dump-package`
+    // and `show-dependencies` execute the scanned project's code (and fetch
+    // missing dependencies). They belong to the dependency-tooling surface
+    // disabled by --no-install-deps and the pre-build lifecycle; the BOM then
+    // comes from Package.resolved alone.
+    const swiftToolingAllowed = isProjectToolingAllowed(options);
+    if (!swiftToolingAllowed) {
+      reportProjectToolingSkipped(
+        options,
+        "swift.tooling-disabled",
+        "Skipping 'swift package show-dependencies' since dependency installation is disabled. Only the packages in Package.resolved will be used.",
+        {
+          ecosystem: "swift",
+          tool: "swift",
+          impact: "transitive-deps",
+          detail:
+            "Dependency installation is disabled, so the Package.swift manifest was not evaluated and only the packages from Package.resolved are available.",
+        },
+      );
+      // The manifest is not run, so a project without Package.resolved still
+      // gets a parent component named after its directory.
+      if (!Object.keys(parentComponent).length) {
+        parentComponent = createDefaultParentComponent(
+          swiftFiles[0],
+          "swift",
+          options,
+        );
+      }
+    }
     for (const f of swiftFiles) {
+      if (!swiftToolingAllowed) {
+        break;
+      }
       const basePath = dirname(f);
       if (completedPath.includes(basePath)) {
         continue;
@@ -2461,10 +2614,33 @@ export async function createCocoaBom(path, options) {
       allDependencies.set(name, podDependencies);
     }
     const targetDependencies = new Map();
-    if (
-      !readEnvironmentVariable("COCOA_INCLUDED_TARGETS") &&
-      !readEnvironmentVariable("COCOA_EXCLUDED_TARGETS")
-    ) {
+    // `pod ipc podfile-json` evaluates the Podfile, which is a Ruby program,
+    // so per-target filtering through it belongs to the dependency-tooling
+    // surface disabled by --no-install-deps and the pre-build lifecycle. A
+    // gated scan then keeps every pod the lockfile resolved (the union across
+    // targets) instead of the configured target subset.
+    const cocoaTargetsConfigured =
+      readEnvironmentVariable("COCOA_INCLUDED_TARGETS") ||
+      readEnvironmentVariable("COCOA_EXCLUDED_TARGETS");
+    const cocoaToolingAllowed = isProjectToolingAllowed(options);
+    // True only when target names the Podfile actually resolved are known, so
+    // the include/exclude filters below can be applied to real targets.
+    let targetFilteringActive = false;
+    if (!cocoaTargetsConfigured || !cocoaToolingAllowed) {
+      if (cocoaTargetsConfigured) {
+        reportProjectToolingSkipped(
+          options,
+          "cocoa.podfile-json.tooling-disabled",
+          "Skipping 'pod ipc podfile-json' since dependency installation is disabled. Every pod from Podfile.lock is included without per-target filtering.",
+          {
+            ecosystem: "cocoa",
+            tool: "pod",
+            impact: "components",
+            detail:
+              "Dependency installation is disabled, so the Podfile was not evaluated and target filtering fell back to all pods resolved in Podfile.lock.",
+          },
+        );
+      }
       targetDependencies.set("Pods", podfileLock["DEPENDENCIES"]);
     } else {
       const result = executePodCommand(
@@ -2472,18 +2648,39 @@ export async function createCocoaBom(path, options) {
         projectPath,
         options,
       );
-      const resolvedPodFile = JSON.parse(result.stdout);
-      parsePodfileTargets(
-        resolvedPodFile["target_definitions"][0],
-        targetDependencies,
-      );
+      let resolvedPodFile;
+      try {
+        resolvedPodFile = JSON.parse(result.stdout);
+      } catch (_e) {
+        resolvedPodFile = undefined;
+      }
+      if (resolvedPodFile?.target_definitions?.length) {
+        parsePodfileTargets(
+          resolvedPodFile["target_definitions"][0],
+          targetDependencies,
+        );
+        targetFilteringActive = true;
+      } else {
+        // pod failed or printed nothing usable (it refuses to run as root,
+        // for one), and an unparseable Podfile used to abort the whole scan.
+        // Keep every locked pod rather than none.
+        console.log(
+          "The Podfile could not be resolved with CocoaPods, so all pods from Podfile.lock are included without per-target filtering.",
+        );
+        targetDependencies.set("Pods", podfileLock["DEPENDENCIES"]);
+      }
     }
     const usedTargets = new Set(
-      readEnvironmentVariable("COCOA_INCLUDED_TARGETS")
+      targetFilteringActive && readEnvironmentVariable("COCOA_INCLUDED_TARGETS")
         ? readEnvironmentVariable("COCOA_INCLUDED_TARGETS").split(",")
         : targetDependencies.keys(),
     );
-    if (readEnvironmentVariable("COCOA_EXCLUDED_TARGETS")) {
+    // Without the resolved Podfile there are no target names to exclude, and
+    // excluding the lockfile's stand-in "Pods" target would drop every pod.
+    if (
+      targetFilteringActive &&
+      readEnvironmentVariable("COCOA_EXCLUDED_TARGETS")
+    ) {
       readEnvironmentVariable("COCOA_EXCLUDED_TARGETS")
         .split(",")
         .forEach((excludedTarget) => {

package/lib/core/env.js

@@ -1,4 +1,4 @@
-import { join } from "node:path";
+import { join, win32 } from "node:path";
 
 import {
   buildReadCountSuffix,
@@ -301,6 +301,13 @@ export const SWIFT_CMD = readEnvironmentVariable("SWIFT_CMD") || "swift";
 /** Resolved Ruby executable command (RUBY_CMD env var, or "ruby"). */
 export const RUBY_CMD = readEnvironmentVariable("RUBY_CMD") || "ruby";
 
+/** Resolved PHP executable command (PHP_CMD env var, or "php"). */
+export const PHP_CMD = readEnvironmentVariable("PHP_CMD") || "php";
+
+/** Resolved Composer executable command (COMPOSER_CMD env var, or "composer"). */
+export const COMPOSER_CMD =
+  readEnvironmentVariable("COMPOSER_CMD") || "composer";
+
 /** Python package components that can be excluded from the generated BOM. */
 export const PYTHON_EXCLUDED_COMPONENTS = [
   "pip",
@@ -707,23 +714,38 @@ export function hasAnyProjectType(projectTypes, options, defaultStatus = true) {
   return shouldInclude;
 }
 
+/**
+ * Extract the lowercase command name from an invoked command path, without
+ * directories or a trailing `.js`, `.cjs`, `.mjs` or `.exe` extension. Both
+ * `/` and `\\` separators are handled, so a Windows path is inspected the
+ * same way on any host.
+ *
+ * @param {string} [commandPath] Invoked command path or name
+ * @returns {string} Lowercase command name
+ */
+export function getCommandName(commandPath) {
+  return win32
+    .basename(`${commandPath || ""}`)
+    .toLowerCase()
+    .replace(/\.(?:[cm]?js|exe)$/u, "");
+}
+
 /**
  * Determine whether the predictive dependency audit should run for the current
  * CLI invocation.
  *
- * OBOM-focused runs (`obom` or explicit `-t os` / OS aliases only) should keep
- * the direct BOM audit findings but skip the predictive dependency audit.
+ * OBOM and HBOM runs (commands named `obom` or `hbom`, including `hbom-slim`)
+ * and explicit `-t os` / OS / hardware project types alone keep the direct BOM
+ * audit findings but skip the predictive dependency audit. Only the command
+ * name is tested, never the directories leading to it.
  *
  * @param {object} options CLI options
  * @param {string} [commandPath] Invoked command path or name
  * @returns {boolean} True when predictive dependency audit should run
  */
 export function shouldRunPredictiveBomAudit(options, commandPath) {
-  const normalizedCommandPath = `${commandPath || ""}`.toLowerCase();
-  if (normalizedCommandPath.includes("obom")) {
-    return false;
-  }
-  if (normalizedCommandPath.includes("hbom")) {
+  const commandName = getCommandName(commandPath);
+  if (commandName.startsWith("obom") || commandName.startsWith("hbom")) {
     return false;
   }
   const projectTypes = Array.isArray(options?.projectType)

package/lib/core/fs.js

@@ -522,8 +522,13 @@ function isWindowsShellHijackRisk(command, options) {
   const absCwd = resolve(cwd);
   for (const candidate of candidates) {
     const candidatePath = path.join(absCwd, candidate);
-    if (existsSync(candidatePath)) {
-      return true;
+    // cmd.exe only runs files, so a directory named like the tool is harmless.
+    try {
+      if (statSync(candidatePath).isFile()) {
+        return true;
+      }
+    } catch (_err) {
+      // Not present.
     }
   }
   return false;
@@ -831,24 +836,28 @@ export function safeSpawnSync(command, args, options) {
       error: new Error("No execute permission"),
     };
   }
+  // cmd.exe looks in the working directory before PATH, so a scanned project
+  // could otherwise replace the tool cdxgen means to run. This holds outside
+  // secure mode too, since --no-install-deps scans still run version probes
+  // and read-only tools with the project as the working directory.
+  if (isWindowsShellHijackRisk(command, options)) {
+    const blockedReason = `${command} matches local file in cwd (Windows shell hijack risk)`;
+    console.warn(`\x1b[1;31mSecurity Alert: ${blockedReason}\x1b[0m`);
+    recordActivity({
+      kind: activityDescriptor.kind,
+      ...activityDescriptor.metadata,
+      reason: blockedReason,
+      status: "blocked",
+      target: activityDescriptor.target,
+    });
+    return {
+      status: 1,
+      stdout: undefined,
+      stderr: undefined,
+      error: new Error(blockedReason),
+    };
+  }
   if (isSecureMode) {
-    if (isWindowsShellHijackRisk(command, options)) {
-      const blockedReason = `${command} matches local file in cwd (Windows shell hijack risk)`;
-      console.warn(`\x1b[1;31mSecurity Alert: ${blockedReason}\x1b[0m`);
-      recordActivity({
-        kind: activityDescriptor.kind,
-        ...activityDescriptor.metadata,
-        reason: blockedReason,
-        status: "blocked",
-        target: activityDescriptor.target,
-      });
-      return {
-        status: 1,
-        stdout: undefined,
-        stderr: undefined,
-        error: new Error(blockedReason),
-      };
-    }
     if (options?.cwd && options.cwd !== resolve(options.cwd)) {
       if (DEBUG_MODE) {
         console.log(