@cdxgen/cdxgen 13.4.0 → 13.5.0

package/lib/ecosystems/gradleutils.js

@@ -23,6 +23,7 @@ import {
 import { getAllFiles, safeExistsSync, safeSpawnSync } from "../core/fs.js";
 import { thoughtLog } from "../core/logger.js";
 import { isWin } from "../core/paths.js";
+import { isProjectToolingAllowed } from "../core/projectTooling.js";
 import { parseToml } from "../core/toml.js";
 import {
   isBuildToolRateLimited,
@@ -44,13 +45,16 @@ function isJvmToolPinned() {
   );
 }
 
+// The gate lives in lib/core so that every layer can reach it; it stays
+// exported here for existing callers.
+export { isProjectToolingAllowed };
+
 /**
  * Method to return the gradle command to use.
  *
  * Project-local wrapper scripts (`gradlew`) are attacker-controlled files in
- * the scanned project, so they are only used when dependency tooling is
- * allowed (`options.installDeps !== false`); otherwise the system Gradle is
- * used.
+ * the scanned project, so they are only used when the project's own tooling
+ * may run (see isProjectToolingAllowed); otherwise the system Gradle is used.
  *
  * @param {string} srcPath Path to look for gradlew wrapper
  * @param {string|null} rootPath Root directory to look for gradlew wrapper
@@ -59,10 +63,7 @@ function isJvmToolPinned() {
 export function getGradleCommand(srcPath, rootPath, options = {}) {
   let gradleCmd = "gradle";
   const pinnedToolSelected = isJvmToolPinned();
-  // Introspection mode exists to observe the project's own toolchain, so it
-  // keeps using wrappers even when dependency installation is disabled.
-  const allowProjectWrappers =
-    options.installDeps !== false || options.introspect === true;
+  const allowProjectWrappers = isProjectToolingAllowed(options);
 
   let findGradleFile = "gradlew";
   if (platform() === "win32") {
@@ -1349,15 +1350,18 @@ export async function collectGradleDependencies(
  * Method to return the mill command to use.
  *
  * The project-local `mill` script is an attacker-controlled file in the
- * scanned project, so it is only used when dependency tooling is allowed
- * (`options.installDeps !== false`).
+ * scanned project, so it is only used when the project's own tooling may run
+ * (see isProjectToolingAllowed).
  *
  * @param {string} srcPath Path to look for mill wrapper
  * @param {Object} [options] CLI options (`installDeps` gates wrapper use)
  */
 export function getMillCommand(srcPath, options = {}) {
   let millCmd = `mill${platform() === "win32" ? ".bat" : ""}`;
-  if (options.installDeps !== false && safeExistsSync(join(srcPath, millCmd))) {
+  if (
+    isProjectToolingAllowed(options) &&
+    safeExistsSync(join(srcPath, millCmd))
+  ) {
     // Use local mill wrapper if available
     // Enable execute permission
     try {
@@ -1510,16 +1514,25 @@ function isProcessAlive(pid) {
  * @param {string} rootPath Scanned tree
  * @param {Map<string, Set<number>>} [runningBefore] Result of
  *   {@link findMillDaemons} taken before the scan
+ * @param {Object} [options] CLI options
  */
-export function stopMillDaemons(rootPath, runningBefore = new Map()) {
+export function stopMillDaemons(
+  rootPath,
+  runningBefore = new Map(),
+  options = {},
+) {
+  // The daemon PID files live in the scanned tree. When the scan was not
+  // allowed to run Mill it started no daemon, and running the build's own
+  // launcher here would execute a script from the scanned project.
+  if (!isProjectToolingAllowed(options)) {
+    return;
+  }
   for (const [buildRoot, pids] of findMillDaemons(rootPath)) {
     const before = runningBefore.get(buildRoot) || new Set();
     if ([...pids].every((pid) => before.has(pid))) {
       continue;
     }
-    const launcher = safeExistsSync(join(buildRoot, "mill"))
-      ? join(buildRoot, "mill")
-      : "mill";
+    const launcher = getMillCommand(buildRoot, options);
     console.log("Stopping the Mill daemon the scan started in", buildRoot);
     safeSpawnSync(launcher, ["shutdown"], {
       cwd: buildRoot,
@@ -1532,8 +1545,8 @@ export function stopMillDaemons(rootPath, runningBefore = new Map()) {
  * Method to return the maven command to use.
  *
  * Project-local wrapper scripts (`mvnw`) are attacker-controlled files in the
- * scanned project, so they are only used when dependency tooling is allowed
- * (`options.installDeps !== false`); otherwise the installed Maven is used.
+ * scanned project, so they are only used when the project's own tooling may
+ * run (see isProjectToolingAllowed); otherwise the installed Maven is used.
  *
  * @param {string} srcPath Path to look for maven wrapper
  * @param {string} rootPath Root directory to look for maven wrapper
@@ -1545,10 +1558,7 @@ export function getMavenCommand(srcPath, rootPath, options = {}) {
   let isWrapperReady = false;
   let isWrapperFound = false;
   const pinnedToolSelected = isJvmToolPinned();
-  // Introspection mode exists to observe the project's own toolchain, so it
-  // keeps using wrappers even when dependency installation is disabled.
-  const allowProjectWrappers =
-    options.installDeps !== false || options.introspect === true;
+  const allowProjectWrappers = isProjectToolingAllowed(options);
   let findMavenFile = "mvnw";
   let mavenWrapperCmd = null;
   if (platform() === "win32") {

package/lib/ecosystems/parsers-dotnet.js

@@ -1,5 +1,13 @@
 import { readFileSync } from "node:fs";
-import { basename, dirname, join, resolve } from "node:path";
+import {
+  basename,
+  dirname,
+  isAbsolute,
+  join,
+  posix,
+  resolve,
+  win32,
+} from "node:path";
 
 import { build } from "@cdxgen/cdx-purl";
 
@@ -182,7 +190,10 @@ export function resolveInstalledNugetVersion(range, installedVersions = []) {
  * @returns {string} Project directory
  */
 export function dotnetManifestProjectDir(manifestFile, projectPath) {
-  if (projectPath) {
+  // A path recorded on another operating system, such as `D:\src\App.csproj`
+  // read on Linux, is not absolute here and would resolve against the working
+  // directory.
+  if (projectPath && isAbsolute(projectPath)) {
     const projectDir = dirname(resolve(projectPath));
     if (safeExistsSync(projectDir)) {
       return projectDir;
@@ -192,6 +203,55 @@ export function dotnetManifestProjectDir(manifestFile, projectPath) {
   return basename(dir) === "obj" ? dirname(dir) : dir;
 }
 
+/**
+ * The path, on this machine, of the project file a project.assets.json belongs to.
+ *
+ * Restore records the project file and the directory it wrote the assets file
+ * to (`outputPath`) as absolute paths on the machine that ran it, which can be
+ * a CI agent, a container, another operating system, or this tree reached
+ * through another path. Where the project file sits relative to that
+ * directory does not change when the tree moves, so the project file is that
+ * offset applied to the directory the assets file is in. An assets file that
+ * records no output path is taken to be in its project's `obj/`. The recorded
+ * path itself is used only when no offset can be worked out, as when restore
+ * wrote to another drive than the project's.
+ *
+ * Nothing is read from disk: the name is spelled as restore recorded it, which
+ * can differ in case from the file a case-insensitive file system holds.
+ *
+ * @param {string} assetsFile project.assets.json path
+ * @param {string} [projectPath] Project file restore recorded
+ * @param {string} [outputPath] Directory restore recorded writing the assets file to
+ * @returns {string|undefined} Project file path, or undefined when none can be named
+ */
+export function dotnetRestoredProjectFile(assetsFile, projectPath, outputPath) {
+  if (!assetsFile || typeof projectPath !== "string" || !projectPath.trim()) {
+    return undefined;
+  }
+  // Read the recorded paths the way the machine that wrote them would
+  const recorded =
+    win32.isAbsolute(projectPath) && !posix.isAbsolute(projectPath)
+      ? win32
+      : posix;
+  const assetsDir = dirname(resolve(assetsFile));
+  let offset;
+  if (typeof outputPath === "string" && outputPath.trim()) {
+    const relativePath = recorded.relative(outputPath, projectPath);
+    // Across two drives there is no relative path, only the recorded one
+    if (!recorded.isAbsolute(relativePath)) {
+      offset = relativePath.split(recorded.sep);
+    }
+  } else if (basename(assetsDir) === "obj") {
+    offset = ["..", recorded.basename(projectPath)];
+  }
+  // The offset must end at a file, not at the output directory or a parent
+  const fileName = offset?.at(-1);
+  if (fileName && fileName !== "." && fileName !== "..") {
+    return resolve(assetsDir, ...offset);
+  }
+  return isAbsolute(projectPath) ? resolve(projectPath) : undefined;
+}
+
 /**
  * Index the MSBuild properties that props files define, by the directory each
  * file sits in and across the whole scan, so the candidates for every project
@@ -853,8 +913,12 @@ function evaluateMsbuildProperties(projFile, names) {
  * @param {Object} restoredNames Package ids as this project's restore output spells them,
  *        keyed by lowercased id. NuGet ids are case-insensitive, so a reference spelled
  *        differently names the same package and takes the restored spelling.
+ * @param {{name: string, version: (string|undefined)}} [projectIdentity] Package id and
+ *        version this project's project.assets.json records for the project. They name the
+ *        project in place of what the project file states.
  *
- * @returns {Object} Containing parent component, package, and dependencies
+ * @returns {Object} Containing parent component, package, dependencies, and the
+ *   `$(Name)` version labels left unresolved without msbuild
  */
 export function parseCsProjData(
   csProjData,
@@ -865,6 +929,7 @@ export function parseCsProjData(
   centralVersions = {},
   fallbackVersions = {},
   restoredNames = {},
+  projectIdentity = undefined,
 ) {
   const pkgList = [];
   const parentComponent = { type: "application", properties: [] };
@@ -909,21 +974,21 @@ export function parseCsProjData(
       ? pkgVersionLabelCandidates[label][0]
       : undefined);
   let msbuildValues = {};
-  if (msbuildInstalled) {
-    const unresolved = new Set();
-    for (const item of project.ItemGroup || []) {
-      for (const reference of item.PackageReference || []) {
-        const label = labelOf(
-          reference.$?.VersionOverride ||
-            reference.VersionOverride?.[0]._?.[0] ||
-            reference.$?.Version ||
-            reference.Version?.[0]._?.[0],
-        );
-        if (label && staticLabelValue(label) === undefined) {
-          unresolved.add(label);
-        }
+  const unresolved = new Set();
+  for (const item of project.ItemGroup || []) {
+    for (const reference of item.PackageReference || []) {
+      const label = labelOf(
+        reference.$?.VersionOverride ||
+          reference.VersionOverride?.[0]._?.[0] ||
+          reference.$?.Version ||
+          reference.Version?.[0]._?.[0],
+      );
+      if (label && staticLabelValue(label) === undefined) {
+        unresolved.add(label);
       }
     }
+  }
+  if (msbuildInstalled) {
     msbuildValues = evaluateMsbuildProperties(projFile, [...unresolved].sort());
   }
   // SDK-style projects declare their version through the MSBuild properties
@@ -1351,6 +1416,32 @@ export function parseCsProjData(
     // version set from a build-time property is unknown, not 1.0.0.
     parentComponent.version = "1.0.0";
   }
+  // Only a build knows the value of a property that references another one
+  const literal = (value) =>
+    value && !value.includes("$(") ? value : undefined;
+  // NuGet names a project's package by its PackageId, which defaults to the
+  // assembly name, so a PackageId the project file states names the project.
+  const declaredPackageId = literal(ownProperties.PackageId);
+  if (declaredPackageId) {
+    parentComponent.name = declaredPackageId;
+  }
+  // Restore evaluated the project with everything MSBuild imports and every
+  // property it was given: a Version from Directory.Build.props, `-p:Version`
+  // or `$(BuildNumber)`, a PackageId. Its project.assets.json roots the
+  // restored dependency tree at that identity, so naming the project from its
+  // file alone would make it two components.
+  if (projectIdentity?.name) {
+    parentComponent.name = projectIdentity.name;
+    parentComponent.version = projectIdentity.version;
+  }
+  // The assembly the project builds keeps its name when the package differs
+  const declaredAssemblyName = literal(ownProperties.AssemblyName);
+  if (declaredAssemblyName && declaredAssemblyName !== parentComponent.name) {
+    parentComponent.properties.push({
+      name: "cdx:dotnet:assembly_name",
+      value: declaredAssemblyName,
+    });
+  }
   // The purl is built once every PropertyGroup has been read, so a version
   // declared after OutputType is not lost. A project that states no version
   // gets a versionless purl: "latest" is not a version.
@@ -1370,6 +1461,8 @@ export function parseCsProjData(
     pkgList,
     parentComponent,
     dependencies,
+    // Version labels no static source settled, which only msbuild could
+    unresolvedVersionLabels: msbuildInstalled ? [] : [...unresolved].sort(),
   };
 }
 
@@ -1417,8 +1510,10 @@ export function isReferencedDotnetPackageFile(packageFile) {
  *
  * @param {string} csProjData Raw JSON string of the project.assets.json file
  * @param {string} assetsJsonFile Path to the project.assets.json file, used for evidence properties
- * @returns {{ pkgList: Object[], dependenciesList: Object[], projectPath: (string|undefined) }}
- *          `projectPath` is the project file the restore output belongs to, as restore recorded it
+ * @returns {{ pkgList: Object[], dependenciesList: Object[], projectPath: (string|undefined), outputPath: (string|undefined), projectIdentity: ({name: string, version: (string|undefined)}|undefined) }}
+ *          `projectPath` is the project file the restore output belongs to and `outputPath` the
+ *          directory restore wrote it to, both as restore recorded them. `projectIdentity` is the
+ *          package id and version restore evaluated for the project, which root the dependency tree.
  */
 export function parseCsProjAssetsData(csProjData, assetsJsonFile) {
   // extract name, operator, version from .NET package representation
@@ -1646,6 +1741,10 @@ export function parseCsProjAssetsData(csProjData, assetsJsonFile) {
     pkgList,
     dependenciesList,
     projectPath,
+    outputPath: csProjData.project?.restore?.outputPath,
+    projectIdentity: rootRef
+      ? { name: rootPkg.name, version: rootPkg.version }
+      : undefined,
   };
 }