@cdxgen/cdxgen 13.4.0 → 13.5.0

package/lib/core/httpClient.js

@@ -3,12 +3,7 @@ import { createHash } from "node:crypto";
 import process from "node:process";
 import { brotliDecompressSync, gunzipSync, inflateSync } from "node:zlib";
 
-import {
-  Agent,
-  EnvHttpProxyAgent,
-  interceptors,
-  request as undiciRequest,
-} from "undici";
+import { Agent, EnvHttpProxyAgent, request as undiciRequest } from "undici";
 
 import { registerRunReset } from "./runState.js";
 
@@ -534,20 +529,13 @@ function cacheKeyFor(method, url, headers = {}, responseType = undefined) {
 // The maximum number of redirects to follow when `followRedirect` is enabled.
 const MAX_REDIRECTIONS = 10;
 
-// Bun ships its own bundled implementation of the `undici` module which, as of
-// Bun 1.2, does not expose the `Agent.prototype.compose` composition API nor the
-// `interceptors.redirect` interceptor that undici v7 uses for redirect handling
-// (see cdxgen issue #4245). Detect the Bun runtime so we can fall back to plain
-// dispatchers and follow redirects manually instead of crashing at module load.
+// Bun ships its own bundled implementation of the `undici` module, which lacks
+// `EnvHttpProxyAgent` (see cdxgen issue #4245).
 const isBun = typeof globalThis.Bun !== "undefined";
 
-// Reusable pooled dispatchers. On Node.js, undici composes redirect handling as
-// an interceptor (there is no per-request `maxRedirections` option in undici v7),
-// so we pre-build the small set of dispatcher variants we need instead of
-// allocating a fresh Agent per request (which would defeat connection pooling).
-// On Bun, `compose`/`interceptors.redirect` are unavailable, so the redirect
-// dispatchers are just the plain agents and redirects are handled in
-// `requestWithRedirects` below.
+// Reusable pooled dispatchers, one per TLS verification setting, so requests
+// share connections instead of allocating a fresh Agent each time. Redirects
+// are followed in `requestWithRedirects` below on every runtime.
 // Whether standard proxy environment variables are set. When they are, requests
 // must be routed through the proxy. Because this client always passes an
 // explicit per-request `dispatcher`, it overrides Node's global (potentially
@@ -584,51 +572,72 @@ const defaultAgent = createBaseAgent();
 const insecureAgent = createBaseAgent({
   connect: { rejectUnauthorized: false },
 });
-const redirectDispatcher = isBun
-  ? defaultAgent
-  : defaultAgent.compose(
-      interceptors.redirect({ maxRedirections: MAX_REDIRECTIONS }),
-    );
-const insecureRedirectDispatcher = isBun
-  ? insecureAgent
-  : insecureAgent.compose(
-      interceptors.redirect({ maxRedirections: MAX_REDIRECTIONS }),
-    );
 
 /**
- * Pick the undici dispatcher matching the request's redirect and TLS
- * verification preferences.
+ * Pick the undici dispatcher matching the request's TLS verification
+ * preference. Redirects are followed by `requestWithRedirects`, not by the
+ * dispatcher.
  *
- * @param {boolean} followRedirect Whether HTTP redirects should be followed.
  * @param {boolean} insecure Whether TLS certificate verification is disabled.
  * @returns {import("undici").Dispatcher} The dispatcher to use for the request.
  */
-function selectDispatcher(followRedirect, insecure) {
-  if (insecure) {
-    return followRedirect ? insecureRedirectDispatcher : insecureAgent;
-  }
-  return followRedirect ? redirectDispatcher : defaultAgent;
+function selectDispatcher(insecure) {
+  return insecure ? insecureAgent : defaultAgent;
 }
 
 // HTTP status codes that represent a redirect with a `location` header.
 const REDIRECT_STATUS_CODES = new Set([301, 302, 303, 307, 308]);
 
+// Request headers that may follow a redirect to a different origin. Everything
+// else, such as Authorization, cookies and registry API keys like X-Api-Key or
+// PRIVATE-TOKEN, stays with the origin the caller addressed.
+const CROSS_ORIGIN_REDIRECT_HEADERS = new Set([
+  "accept",
+  "accept-encoding",
+  "accept-language",
+  "user-agent",
+]);
+
 /**
- * Issue an undici request, following redirects manually when running under Bun.
+ * Keep only the request headers that may be sent to a different origin.
  *
- * On Node.js the redirect-following interceptor baked into the dispatcher does
- * the work, so this simply forwards to `undiciRequest`. On Bun (where the
- * interceptor API is unavailable) we loop on 3xx responses, draining each
- * intermediate body and resolving relative `location` headers, up to
+ * @param {Object} headers Request headers.
+ * @returns {Object} Headers safe to send cross-origin.
+ */
+function crossOriginRedirectHeaders(headers = {}) {
+  const kept = {};
+  for (const [name, value] of Object.entries(headers)) {
+    if (CROSS_ORIGIN_REDIRECT_HEADERS.has(name.toLowerCase())) {
+      kept[name] = value;
+    }
+  }
+  return kept;
+}
+
+/**
+ * Issue an undici request and follow redirects one hop at a time.
+ *
+ * Redirects are followed here rather than by undici's redirect interceptor so
+ * that every hop goes through `beforeRedirect`, which runs the same host
+ * allowlist, protocol and dry-run checks as the first request, and so that
+ * credentials are not forwarded to another origin. Each intermediate body is
+ * drained and relative `location` headers are resolved, up to
  * `MAX_REDIRECTIONS` hops.
  *
  * @param {URL} url Request URL.
  * @param {Object} requestOptions Options passed to `undiciRequest`.
  * @param {boolean} followRedirect Whether redirects should be followed.
+ * @param {function(URL): Promise<void>} beforeRedirect Called with the next URL
+ *   before each hop; throws to stop the request.
  * @returns {Promise<Object>} The final undici response.
  */
-async function requestWithRedirects(url, requestOptions, followRedirect) {
-  if (!isBun || !followRedirect) {
+async function requestWithRedirects(
+  url,
+  requestOptions,
+  followRedirect,
+  beforeRedirect,
+) {
+  if (!followRedirect) {
     return await undiciRequest(url, requestOptions);
   }
   let currentUrl = url;
@@ -649,7 +658,14 @@ async function requestWithRedirects(url, requestOptions, followRedirect) {
     } catch {
       // Ignore drain failures; the socket will be discarded.
     }
-    currentUrl = new URL(location, currentUrl);
+    const nextUrl = new URL(location, currentUrl);
+    await beforeRedirect(nextUrl);
+    if (nextUrl.origin !== currentUrl.origin) {
+      requestOptions.headers = crossOriginRedirectHeaders(
+        requestOptions.headers,
+      );
+    }
+    currentUrl = nextUrl;
     redirections += 1;
     // 303, and 301/302 for anything other than GET/HEAD, must switch to GET
     // without a body, matching how undici's redirect interceptor behaves.
@@ -738,9 +754,21 @@ async function doRequest(mergedOptions) {
     method,
     headers,
     body: method === "GET" || method === "HEAD" ? undefined : body,
-    dispatcher: selectDispatcher(followRedirect, insecure),
+    dispatcher: selectDispatcher(insecure),
     signal,
   };
+  // A redirect target must pass the same beforeRequest checks, such as the
+  // host allowlist, as the URL the caller asked for.
+  const beforeRedirect = async (nextUrl) => {
+    const hopOptions = {
+      ...options,
+      url: nextUrl,
+      context: { ...options.context },
+    };
+    for (const hook of options.hooks?.beforeRequest || []) {
+      await hook(hopOptions);
+    }
+  };
 
   let undiciResponse;
   try {
@@ -748,6 +776,7 @@ async function doRequest(mergedOptions) {
       url,
       requestOptions,
       followRedirect,
+      beforeRedirect,
     );
   } catch (err) {
     const requestError = new RequestError(err, options);

package/lib/core/projectConfig.js

@@ -45,6 +45,7 @@ const ANNOUNCED_OPTIONS = new Set([
   "api-key",
   "include-formulation",
   "install-deps",
+  "introspect",
   "deep",
   "tea-publish",
   "tea-fetch",

package/lib/core/projectTooling.js

@@ -0,0 +1,97 @@
+/**
+ * Policy for running the scanned project's own build tooling.
+ *
+ * Build tools such as Maven, Gradle, Poetry, MSBuild, SwiftPM, Leiningen and
+ * CocoaPods read configuration or run code that ships with the project
+ * (`.mvn/jvm.config`, `.poetry/plugins`, `Directory.Build.rsp`, `Package.swift`,
+ * `project.clj`, podspecs). Running them on an untrusted project runs that
+ * project's code, so they belong to the same surface as dependency
+ * installation and are skipped whenever installation is disabled.
+ */
+import { isSecureMode, readEnvironmentVariable } from "./activity.js";
+import { recordDegradation } from "./buildLedger.js";
+
+/**
+ * Whether secure mode is on right now. `isSecureMode` is read once when the
+ * modules load, but the `cdxgen-secure` command turns secure mode on later,
+ * by setting CDXGEN_SECURE_MODE before the scan starts.
+ *
+ * @returns {boolean} true when secure mode is on
+ */
+export function isSecureModeActive() {
+  return (
+    isSecureMode ||
+    ["true", "1"].includes(readEnvironmentVariable("CDXGEN_SECURE_MODE"))
+  );
+}
+
+/**
+ * Whether the scan may run the scanned project's own build tooling, such as
+ * wrapper scripts or build definitions that Maven, Gradle, sbt, Mill, Poetry,
+ * PDM, MSBuild, SwiftPM, Leiningen and CocoaPods evaluate.
+ *
+ * Tooling follows `options.installDeps`, which defaults to off in secure mode
+ * when a caller does not set it. Introspection mode exists to observe the
+ * project's own toolchain, so it keeps that tooling on even when dependency
+ * installation is disabled, as long as the operator asked for it rather than
+ * a config file in the scanned project. Secure mode still wins:
+ * CDXGEN_INTROSPECT alone must not make a secure-mode scan run the scanned
+ * project's code.
+ *
+ * @param {Object} [options] CLI options
+ * @returns {boolean} true when project tooling may run
+ */
+export function isProjectToolingAllowed(options) {
+  const secureMode = isSecureModeActive();
+  const installDeps = options?.installDeps ?? !secureMode;
+  if (installDeps !== false) {
+    return true;
+  }
+  return (
+    options?.introspect === true &&
+    options?.introspectFromConfigFile !== true &&
+    !secureMode
+  );
+}
+
+// The skips already reported for each scan, keyed by the scan's options.
+// Callers without options share one key.
+const reportedSkips = new WeakMap();
+const noOptionsKey = {};
+
+/**
+ * Tell the user that a tool was skipped because project tooling is not
+ * allowed, and record the matching degradation for the fidelity report.
+ * Each skip is reported once per scan, however many manifests it applies to.
+ * A skip that only costs evidence, not BOM content, passes no remediation id
+ * and is only shown.
+ *
+ * @param {Object} options CLI options of the scan
+ * @param {string|null} remediationId Remediation id from
+ *   data/remediations.json, or null for a message only
+ * @param {string} message Console message shown to the user
+ * @param {Object} [fields] Degradation fields (ecosystem, tool, impact, detail)
+ * @returns {void}
+ */
+export function reportProjectToolingSkipped(
+  options,
+  remediationId,
+  message,
+  fields,
+) {
+  const key = options && typeof options === "object" ? options : noOptionsKey;
+  let reported = reportedSkips.get(key);
+  if (!reported) {
+    reported = new Set();
+    reportedSkips.set(key, reported);
+  }
+  const skipKey = remediationId || message;
+  if (reported.has(skipKey)) {
+    return;
+  }
+  reported.add(skipKey);
+  console.log(message);
+  if (remediationId) {
+    recordDegradation(remediationId, fields);
+  }
+}

package/lib/core/propertySanitizer.js

@@ -26,6 +26,15 @@ const JSON_PROPERTY_NAMES = new Set([
 ]);
 const URL_PATTERN = /https?:\/\/[^\s<>"'),\]}]+/giu;
 const MAX_STRUCTURE_DEPTH = 6;
+// What an RFC 3986 path may hold as it is: unreserved characters, sub-delims,
+// ":", "@", "/" and well-formed percent-escapes. A query or fragment may also
+// hold "?". Everything else is percent-encoded.
+const URI_PATH_UNSAFE =
+  /%(?![0-9A-Fa-f]{2})|[^A-Za-z0-9\-._~!$&'()*+,;=:@/%]/gu;
+const URI_QUERY_UNSAFE =
+  /%(?![0-9A-Fa-f]{2})|[^A-Za-z0-9\-._~!$&'()*+,;=:@/?%]/gu;
+const URI_SCHEME_AUTHORITY = /^[A-Za-z][A-Za-z0-9+.-]*:\/\/[^/?#]*/u;
+const UTF8_ENCODER = new TextEncoder();
 
 function sanitizeUrlForBom(value) {
   const input = String(value || "").trim();
@@ -146,6 +155,69 @@ export function sanitizeBomUrl(value) {
   return sanitizeUrlForBom(value);
 }
 
+function percentEncodeUnsafe(text, unsafe) {
+  return text.replace(unsafe, (character) =>
+    Array.from(
+      UTF8_ENCODER.encode(character),
+      (byte) => `%${byte.toString(16).toUpperCase().padStart(2, "0")}`,
+    ).join(""),
+  );
+}
+
+/**
+ * Percent-encode what an RFC 3986 URI reference cannot hold as it is, so a
+ * route template or URL can be emitted where CycloneDX expects an
+ * iri-reference, such as `services[].endpoints[]`. The braces of a route
+ * template, spaces, `<>`, `[]` outside an IPv6 host, `|`, `^`, non-ASCII
+ * characters and a `%` that starts no escape are encoded:
+ * `/users/{id}` becomes `/users/%7Bid%7D`. The scheme and authority of an
+ * absolute URL are kept as written, the query and fragment stay a query and
+ * fragment, and existing escapes are kept, so encoding twice changes
+ * nothing. Nothing is removed; strip credentials with {@link sanitizeBomUrl}
+ * first.
+ *
+ * @param {unknown} value Route template, path or URL
+ * @returns {string} The encoded reference
+ */
+export function encodeUriReference(value) {
+  const text = String(value ?? "");
+  const authority = URI_SCHEME_AUTHORITY.exec(text)?.[0] ?? "";
+  const rest = text.slice(authority.length);
+  const queryStart = rest.indexOf("?");
+  const fragmentStart = rest.indexOf("#");
+  const pathEnd = Math.min(
+    queryStart < 0 ? rest.length : queryStart,
+    fragmentStart < 0 ? rest.length : fragmentStart,
+  );
+  let encoded =
+    authority + percentEncodeUnsafe(rest.slice(0, pathEnd), URI_PATH_UNSAFE);
+  if (pathEnd === queryStart) {
+    const queryEnd = fragmentStart > queryStart ? fragmentStart : rest.length;
+    encoded += `?${percentEncodeUnsafe(rest.slice(queryStart + 1, queryEnd), URI_QUERY_UNSAFE)}`;
+  }
+  if (fragmentStart >= 0) {
+    encoded += `#${percentEncodeUnsafe(rest.slice(fragmentStart + 1), URI_QUERY_UNSAFE)}`;
+  }
+  return encoded;
+}
+
+/**
+ * Whether a value carries a token shape the BOM sanitizer redacts: cloud
+ * access keys, bearer tokens, GitHub, Slack and npm tokens, JWTs and the
+ * like. Callers that cannot splice a `[redacted]` marker into the value, such
+ * as a URL path segment, use it to drop the value instead.
+ *
+ * @param {unknown} value Value to check
+ * @returns {boolean} true when the value holds an inline credential
+ */
+export function hasInlineCredential(value) {
+  const text = String(value ?? "");
+  return INLINE_CREDENTIAL_PATTERNS.some((pattern) => {
+    pattern.lastIndex = 0;
+    return pattern.test(text);
+  });
+}
+
 /**
  * Sanitize a property value before serializing it into BOM properties.
  *