@cdxgen/cdxgen 13.4.0 → 13.6.0

package/lib/inventory/agentSkillSpec.js

@@ -0,0 +1,17 @@
+/**
+ * Whether the frontmatter of a SKILL.md satisfies the open Agent Skills
+ * constraints (agentskills.io): a name of 1-64 lowercase letters, digits and
+ * hyphens, and a description of 1-1024 characters.
+ *
+ * @param {{name?: unknown, description?: unknown}|undefined} metadata Frontmatter values
+ * @returns {boolean} true when both constraints hold
+ */
+export function isAgentSkillSpecValid(metadata) {
+  return (
+    typeof metadata?.name === "string" &&
+    /^[a-z0-9-]{1,64}$/u.test(metadata.name) &&
+    typeof metadata?.description === "string" &&
+    metadata.description.length >= 1 &&
+    metadata.description.length <= 1024
+  );
+}

package/lib/inventory/apkInstalledDb.js

@@ -0,0 +1,243 @@
+// Bounded, read-only reader of the apk installed database.
+//
+// osquery has no apk table, so an Alpine, Wolfi or Chainguard host would have no
+// OS package inventory in an OBOM, and the PHP host probe needs the same
+// database to tell which PHP files a package owns. Both read it through here, so
+// what the OBOM lists and what the probe treats as owned follow one parser: the
+// same file, location order, caps and record rules.
+//
+// The database is `/lib/apk/db/installed`. A usr-merged system keeps it at
+// `/usr/lib/apk/db/installed` (and `/lib` is a link to `/usr/lib`, so the two
+// names are one file), and Alpaquita keeps it under `/var/lib/apk/db`. The first
+// of those that exists is the database. One that exists but cannot be read
+// leaves the packages unknown: it is reported as unreadable, never read in part
+// and never skipped for the next name.
+//
+// A record is a run of `<letter>:<value>` lines ended by a blank line. P: names
+// the package, V: its version, A: its architecture, o: its origin (the source
+// package), m: its maintainer, L: its licence, U: its home page and T: its
+// description. F: names a directory and each R: after it a file in that
+// directory. A record may start with C: (Alpine) or P: (Wolfi).
+
+import { statSync } from "node:fs";
+import { join } from "node:path";
+import process from "node:process";
+
+import { isDryRun, recordActivity } from "../core/activity.js";
+import { safeExistsSync, safeReadFileSync } from "../core/fs.js";
+import { thoughtLog } from "../core/logger.js";
+
+/** The database, or the packages it lists, past these is unreadable rather than read in part. */
+export const MAX_APK_DATABASE_BYTES = 64 * 1024 * 1024;
+export const MAX_APK_PACKAGES = 100000;
+
+/** Where apk keeps the installed database, relative to the root, in the order they are tried. */
+export const APK_INSTALLED_DB_PATHS = [
+  "lib/apk/db/installed",
+  "usr/lib/apk/db/installed",
+  "var/lib/apk/db/installed",
+];
+
+// No field of a package record is longer than this once read.
+const MAX_FIELD_LENGTH = 4096;
+
+const FIELD_NAMES = {
+  P: "name",
+  V: "version",
+  A: "arch",
+  o: "origin",
+  m: "maintainer",
+  L: "license",
+  U: "url",
+  T: "description",
+};
+
+function readBounded(file, maxBytes) {
+  try {
+    const stats = statSync(file);
+    if (!stats.isFile() || stats.size > maxBytes) {
+      return undefined;
+    }
+  } catch {
+    return undefined;
+  }
+  const text = safeReadFileSync(file, "utf-8");
+  // A file that grew between the stat and the read is over the cap too.
+  return typeof text === "string" && text.length <= maxBytes ? text : undefined;
+}
+
+function newRecord() {
+  return { fields: {}, fileCount: 0, files: [], touched: false };
+}
+
+/**
+ * Parse the text of an installed database.
+ *
+ * @param {string} text Database text
+ * @param {Set<string>|undefined} wantedFiles Absolute paths whose owner is wanted
+ * @param {number} maxPackages Most packages to accept
+ * @returns {{packages: Object[], malformed: number, overflow: boolean}}
+ */
+function parseDatabase(text, wantedFiles, maxPackages) {
+  const packages = [];
+  let malformed = 0;
+  let overflow = false;
+  let record = newRecord();
+  let directory = "";
+  const finishRecord = () => {
+    const { fields, fileCount, files, touched } = record;
+    record = newRecord();
+    directory = "";
+    if (!touched) {
+      return;
+    }
+    // A package with no name or no version cannot be named by a purl.
+    if (!fields.name || !fields.version) {
+      malformed++;
+      return;
+    }
+    packages.push({ ...fields, fileCount, files });
+    if (packages.length > maxPackages) {
+      overflow = true;
+    }
+  };
+  let position = 0;
+  while (position <= text.length && !overflow) {
+    let end = text.indexOf("\n", position);
+    if (end === -1) {
+      end = text.length;
+    }
+    let line = text.slice(position, end);
+    position = end + 1;
+    if (line.endsWith("\r")) {
+      line = line.slice(0, -1);
+    }
+    if (line === "") {
+      finishRecord();
+      continue;
+    }
+    if (line.length < 2 || line[1] !== ":") {
+      continue;
+    }
+    const letter = line[0];
+    const value = line.slice(2);
+    if (Object.hasOwn(FIELD_NAMES, letter)) {
+      record.touched = true;
+      if (value) {
+        record.fields[FIELD_NAMES[letter]] =
+          value.length > MAX_FIELD_LENGTH
+            ? value.slice(0, MAX_FIELD_LENGTH)
+            : value;
+      }
+    } else if (letter === "F") {
+      record.touched = true;
+      directory = value;
+    } else if (letter === "R") {
+      record.touched = true;
+      record.fileCount++;
+      if (wantedFiles) {
+        const file = `/${directory ? `${directory}/` : ""}${value}`;
+        if (wantedFiles.has(file)) {
+          record.files.push(file);
+        }
+      }
+    }
+  }
+  if (!overflow) {
+    finishRecord();
+  }
+  return { packages, malformed, overflow };
+}
+
+/**
+ * Read the packages of the apk installed database.
+ *
+ * @param {Object} [options] Read options
+ * @param {string} [options.rootPath="/"] Directory the database paths hang off;
+ *   tests point it at a built tree
+ * @param {string} [options.databaseFile] Read this file instead of looking
+ *   under `rootPath`
+ * @param {Set<string>} [options.wantedFiles] Absolute paths whose owner is
+ *   wanted. A package comes back with the ones it owns in `files`; the other
+ *   files of a package are only counted, so a large database stays small.
+ * @param {number} [options.maxBytes] Largest database to read, 64 MiB by default
+ * @param {number} [options.maxPackages] Most packages to accept, 100000 by default
+ * @param {string} [options.platform] `linux` by default for the process; an apk
+ *   database exists on Linux only
+ * @returns {{state: string, path?: string, packages: Object[], malformed: number}}
+ *   `state` is `ok`, `absent` (no database, or not Linux), `unreadable` (a
+ *   database that could not be read in full) or `skipped` (a dry run).
+ *   `malformed` counts the records left out for having no name or version.
+ *   Each package has `name`, `version` and `fileCount`, `files`, and, when the
+ *   record has them, `arch`, `origin`, `maintainer`, `license`, `url` and
+ *   `description`.
+ */
+export function readApkInstalledDb(options = {}) {
+  const result = (state, extra = {}) => ({
+    state,
+    packages: [],
+    malformed: 0,
+    ...extra,
+  });
+  const platform = options.platform || process.platform;
+  if (platform !== "linux") {
+    return result("absent");
+  }
+  const rootPath = options.rootPath || "/";
+  if (isDryRun) {
+    recordActivity({
+      capability: "apk-installed-db",
+      kind: "read",
+      reason:
+        "Dry run mode blocks reading the apk installed database, which lives outside the project.",
+      status: "blocked",
+      target: options.databaseFile || rootPath,
+    });
+    return result("skipped");
+  }
+  const candidates = options.databaseFile
+    ? [options.databaseFile]
+    : APK_INSTALLED_DB_PATHS.map((location) => join(rootPath, location));
+  const file = candidates.find((candidate) => safeExistsSync(candidate));
+  if (!file) {
+    return result("absent");
+  }
+  const unreadable = (reason) => {
+    thoughtLog(`The apk installed database ${file} was not read: ${reason}.`);
+    recordActivity({
+      capability: "apk-installed-db",
+      kind: "read",
+      reason: `The apk installed database ${file} could not be read: ${reason}.`,
+      status: "failed",
+      target: file,
+    });
+    return result("unreadable", { path: file });
+  };
+  const maxBytes = options.maxBytes ?? MAX_APK_DATABASE_BYTES;
+  const text = readBounded(file, maxBytes);
+  if (text === undefined) {
+    return unreadable(`it is not a file of at most ${maxBytes} bytes`);
+  }
+  const maxPackages = options.maxPackages ?? MAX_APK_PACKAGES;
+  const { packages, malformed, overflow } = parseDatabase(
+    text,
+    options.wantedFiles,
+    maxPackages,
+  );
+  if (overflow) {
+    return unreadable(`it lists more than ${maxPackages} packages`);
+  }
+  if (malformed) {
+    thoughtLog(
+      `${malformed} record(s) of the apk installed database ${file} have no name or no version and were left out.`,
+    );
+  }
+  recordActivity({
+    capability: "apk-installed-db",
+    kind: "read",
+    reason: `Read ${packages.length} package(s) from the apk installed database ${file}.`,
+    status: "completed",
+    target: file,
+  });
+  return result("ok", { path: file, packages, malformed });
+}

package/lib/inventory/atomUtils.js

@@ -30,6 +30,7 @@ import {
 import { TRACE_MODE } from "../core/logger.js";
 import { dirNameStr, isWin } from "../core/paths.js";
 import { formatDuration, reapProcessTree } from "../core/processTree.js";
+import { isProjectToolingAllowed } from "../core/projectTooling.js";
 import { readJsonFile } from "../parsers/largeJson.js";
 import { cmakeBuildDirCandidates } from "./cmakeBuildDirs.js";
 
@@ -182,6 +183,7 @@ export function findCompileCommands(src, options = {}) {
 }
 
 const atomFrontendArgKeysCache = new Map();
+const atomOptionsCache = new Map();
 
 /**
  * Split an atom command that may carry a leading argument (`node
@@ -270,6 +272,43 @@ export function atomFrontendArgKeys(language) {
   return keys;
 }
 
+/**
+ * The options the installed atom accepts, as `atom --help` lists them. Asked
+ * once per atom command. An atom that fails to start accepts none.
+ *
+ * @returns {Set<string>} Supported options, such as `--bom-file`
+ */
+export function atomOptions() {
+  const command = getAtomCommand();
+  if (atomOptionsCache.has(command)) {
+    return atomOptionsCache.get(command);
+  }
+  const [bin, leadingArg] = splitAtomCommand(command);
+  const args = ["--help"];
+  if (leadingArg !== undefined) {
+    args.unshift(leadingArg);
+  }
+  const env = { ...process.env };
+  if (readEnvironmentVariable("ATOM_JAVA_HOME")) {
+    env.JAVA_HOME = readEnvironmentVariable("ATOM_JAVA_HOME");
+  }
+  const options = new Set();
+  const result = safeSpawnSync(bin, args, {
+    shell: isWin,
+    env,
+    timeout: 120000,
+  });
+  if (result?.status === 0 && result.stdout) {
+    for (const match of `${result.stdout}`.matchAll(
+      /(?:^|\s)(--[a-z][a-z0-9-]*)/g,
+    )) {
+      options.add(match[1]);
+    }
+  }
+  atomOptionsCache.set(command, options);
+  return options;
+}
+
 /**
  * The `--frontend-args` atom takes for a C/C++ language: the project's
  * compilation database, when there is one and the installed atom reads it
@@ -314,6 +353,77 @@ export function atomCompileCommandsArgs(src, language, options = {}) {
   return ["--frontend-args", `compile-commands=${database}`];
 }
 
+/**
+ * The `--bom-file` a reachables slice takes package purls from: the BOM evinse
+ * annotates. atom would otherwise only find a BOM saved as `bom.json` inside
+ * the scanned directory, so a BOM written anywhere else gave every reachable
+ * flow no purl. An atom without `--bom-file` is given the arguments it has
+ * always been given, and still reads a `bom.json` in the scanned directory.
+ *
+ * @param {string} sliceType atom slice command
+ * @param {Object} options CLI options, for `input`
+ * @returns {string[]} Arguments to add to the atom command
+ */
+export function atomBomFileArgs(sliceType, options = {}) {
+  if (
+    sliceType !== "reachables" ||
+    !options?.input ||
+    !safeExistsSync(options.input)
+  ) {
+    return [];
+  }
+  const bomFile = resolve(options.input);
+  // The argument reaches a Windows shell command line through `shell: isWin`
+  // in executeAtom, so a path a shell would interpret is never passed on.
+  if (UNSAFE_SHELL_CHARS_RE.test(bomFile)) {
+    console.warn(
+      `The BOM path ${bomFile} contains characters a shell would interpret. Reachable flows will carry purls only if a bom.json is in the scanned directory.`,
+    );
+    return [];
+  }
+  if (!atomOptions().has("--bom-file")) {
+    if (DEBUG_MODE) {
+      console.log(
+        "The installed atom does not take --bom-file. Reachable flows will carry purls only if a bom.json is in the scanned directory.",
+      );
+    }
+    return [];
+  }
+  return ["--bom-file", bomFile];
+}
+
+/**
+ * The arguments that stop atom's Java frontend from running the scanned
+ * project's build. In its default delombok mode, atom runs
+ * `mvn dependency:build-classpath` inside a Maven project, which loads the
+ * project's `.mvn` configuration and build extensions, so delombok and
+ * dependency fetching are turned off whenever the project's own tooling may
+ * not run.
+ *
+ * @param {string} language atom `-l` value
+ * @param {Object} options CLI options
+ * @returns {string[]|undefined} Arguments to add to the atom command, or
+ *   undefined when the installed atom cannot be told to leave the build alone
+ */
+export function atomBuildToolArgs(language, options = {}) {
+  if (
+    `${language}`.toLowerCase() !== "java" ||
+    isProjectToolingAllowed(options)
+  ) {
+    return [];
+  }
+  const keys = atomFrontendArgKeys(language);
+  if (!keys.has("delombok-mode")) {
+    return undefined;
+  }
+  return [
+    "--frontend-args",
+    keys.has("fetch-dependencies")
+      ? "delombok-mode=no-delombok,fetch-dependencies=false"
+      : "delombok-mode=no-delombok",
+  ];
+}
+
 // Absolute ceiling on atom's heap. Past this point a larger heap buys a
 // collector that runs less often rather than an analysis that succeeds where it
 // otherwise would not, while the reservation itself is what pushes a build

package/lib/inventory/auditCategories.js

@@ -1,4 +1,4 @@
-import { shouldRunPredictiveBomAudit } from "../core/env.js";
+import { getCommandName, shouldRunPredictiveBomAudit } from "../core/env.js";
 
 /** Frozen list of hardware-bill-of-materials (HBOM) audit categories. */
 export const HBOM_AUDIT_CATEGORIES = Object.freeze([
@@ -186,11 +186,11 @@ export function validateBomAuditCategories(categories, rules) {
  * @returns {string | undefined} Default category string, if any
  */
 export function getDefaultBomAuditCategories(options, commandPath) {
-  const normalizedCommandPath = `${commandPath || ""}`.toLowerCase();
+  const commandName = getCommandName(commandPath);
   const defaultHbomCategories = options?.includeRuntime
     ? `${DEFAULT_HBOM_AUDIT_CATEGORIES},host-topology`
     : DEFAULT_HBOM_AUDIT_CATEGORIES;
-  if (normalizedCommandPath.includes("hbom")) {
+  if (commandName.startsWith("hbom")) {
     return defaultHbomCategories;
   }
   const projectTypes = Array.isArray(options?.projectType)

package/lib/inventory/brotliDecoder.js

@@ -0,0 +1,142 @@
+// BOM components for the Brotli decoders compiled into native files. The
+// detection itself, and why its markers can be trusted, is in
+// lib/core/brotliProbe.js.
+
+import {
+  MAX_BROTLI_PROBE_BYTES,
+  MAX_BROTLI_PROBES,
+  readBrotliDecoder,
+} from "../core/brotliProbe.js";
+import { applyPurl, tryBuildPurl } from "./purl.js";
+
+export { MAX_BROTLI_PROBE_BYTES, MAX_BROTLI_PROBES, readBrotliDecoder };
+
+/**
+ * The properties a file component carries once it has been probed: the fix
+ * state of each decoder found in it, or why it could not be read.
+ *
+ * @param {Object} decoder result of readBrotliDecoder
+ * @returns {{name: string, value: string}[]} properties to append
+ */
+export function brotliDecoderProperties(decoder) {
+  const properties = [];
+  if (decoder?.skipped) {
+    properties.push({ name: "cdx:brotli:probe", value: decoder.skipped });
+  }
+  if (decoder?.c) {
+    properties.push(
+      { name: "cdx:brotli:c:blockSwitchFix", value: decoder.c.blockSwitchFix },
+      { name: "cdx:brotli:c:evidence", value: decoder.c.evidence },
+    );
+  }
+  if (decoder?.go) {
+    properties.push({
+      name: "cdx:brotli:go:blockSwitchFix",
+      value: decoder.go.blockSwitchFix,
+    });
+  }
+  return properties;
+}
+
+/**
+ * The library component every embedded decoder links to. It has no version:
+ * no build records one, and only the per-file cdx:brotli:*:blockSwitchFix
+ * properties say whether a copy is vulnerable. The `vcs_url` qualifier names
+ * the project and keeps the identity apart from an unpackaged `brotli`
+ * executable, which is `pkg:generic/brotli`. The purl has no namespace: a
+ * `pkg:github` purl is typed as an application and `pkg:generic/google` as a
+ * framework when the BOM is assembled, and this is neither.
+ *
+ * @returns {Object} component with `purl` and `bom-ref`
+ */
+export function createBrotliComponent() {
+  return applyPurl(
+    {
+      type: "library",
+      name: "brotli",
+      description:
+        "Brotli decoder compiled into native files; see the cdx:brotli properties on each file",
+      properties: [],
+    },
+    tryBuildPurl({
+      type: "generic",
+      name: "brotli",
+      qualifiers: { vcs_url: "git+https://github.com/google/brotli" },
+    }),
+  );
+}
+
+/**
+ * Start collecting the decoder copies of one scan.
+ *
+ * @returns {{component: Object|undefined, dependencies: Object[], copies: number, unpatched: number, unknown: number}}
+ */
+export function createBrotliInventory() {
+  return {
+    component: undefined,
+    dependencies: [],
+    copies: 0,
+    unpatched: 0,
+    unknown: 0,
+  };
+}
+
+/**
+ * Tag a probed file component and, when it holds a decoder, link it to the
+ * shared brotli component, creating that component on first use. Mutates the
+ * file component in place.
+ *
+ * @param {Object} inventory accumulator from createBrotliInventory
+ * @param {Object} fileComponent file component with a `properties` array
+ * @param {Object} decoder result of readBrotliDecoder
+ */
+export function attachBrotliDecoder(inventory, fileComponent, decoder) {
+  const properties = brotliDecoderProperties(decoder);
+  if (!properties.length) {
+    return;
+  }
+  fileComponent.properties.push(...properties);
+  if (!decoder.c && !decoder.go) {
+    return;
+  }
+  if (!inventory.component) {
+    inventory.component = createBrotliComponent();
+  }
+  const states = [decoder.c?.blockSwitchFix, decoder.go?.blockSwitchFix];
+  inventory.copies += 1;
+  if (states.includes("false")) {
+    inventory.unpatched += 1;
+  } else if (states.includes("unknown")) {
+    inventory.unknown += 1;
+  }
+  if (fileComponent["bom-ref"] && inventory.component["bom-ref"]) {
+    inventory.dependencies.push({
+      ref: fileComponent["bom-ref"],
+      dependsOn: [inventory.component["bom-ref"]],
+    });
+  }
+}
+
+/**
+ * Finish an inventory: record the copy counts on the brotli component.
+ *
+ * @param {Object} inventory accumulator from createBrotliInventory
+ * @returns {{components: Object[], dependencies: Object[]}} what to add to the BOM
+ */
+export function finishBrotliInventory(inventory) {
+  if (!inventory?.component) {
+    return { components: [], dependencies: [] };
+  }
+  inventory.component.properties = [
+    { name: "cdx:brotli:embeddedCopies", value: String(inventory.copies) },
+    { name: "cdx:brotli:unpatchedCopies", value: String(inventory.unpatched) },
+    { name: "cdx:brotli:unknownCopies", value: String(inventory.unknown) },
+  ];
+  return {
+    components: [inventory.component],
+    dependencies: [
+      { ref: inventory.component["bom-ref"], dependsOn: [] },
+      ...inventory.dependencies,
+    ],
+  };
+}

package/lib/inventory/buildToolRateLimit.js

@@ -129,7 +129,7 @@ export function noteBuildToolRateLimit(tool, output, context = {}) {
     ? `, so cdxgen runs no further ${tool} resolution in this scan and`
     : ", so";
   console.warn(
-    `The repository ${tool} downloads from is rate limiting this machine (HTTP 429)${stopped} its dependency tree is incomplete. ${MIRROR_SETTINGS[tool] || MIRROR_SETTINGS[TOOL_MATCHER[tool]]} cdxgen's own lookups can be moved with MAVEN_CENTRAL_URL.`,
+    `The repository ${tool} downloads from is rate limiting this machine (HTTP 429)${stopped} its dependency tree is incomplete. ${MIRROR_SETTINGS[tool] || MIRROR_SETTINGS[TOOL_MATCHER[tool]]} Set MAVEN_CENTRAL_MIRROR=true to point every build tool at Google's Maven Central mirror, or MAVEN_CENTRAL_URL for cdxgen's own lookups.`,
   );
   recordDegradation("build.rate-limited", {
     ecosystem: "java",

package/lib/inventory/cacheDir.js

@@ -28,13 +28,21 @@ import { isMac, isWin } from "../core/paths.js";
  * rather than reading `isWin`/`isMac` here, or the Windows and Linux branches
  * become untestable on a macOS developer machine.
  *
+ * Every environment-derived root must be absolute by the *target* platform's
+ * rules, never the host's (`path.isAbsolute` would accept `\cache` on a
+ * Windows host): a relative value is ignored, so it cannot point inside the
+ * working directory. XDG requires this of `XDG_CACHE_HOME`; the home and
+ * `LOCALAPPDATA` roots get the same treatment for the same reason.
+ *
  * @param {Object} inputs Resolution inputs.
  * @param {"linux"|"macos"|"windows"} inputs.platform Which convention to apply.
- * @param {string} [inputs.cdxgenCacheDir] `CDXGEN_CACHE_DIR`.
+ * @param {string} [inputs.cdxgenCacheDir] `CDXGEN_CACHE_DIR`, an explicit
+ *   override taken as given.
  * @param {string} [inputs.xdgCacheHome] `XDG_CACHE_HOME`. Ignored unless
- *   absolute, per the XDG spec, so it cannot point inside the working directory.
- * @param {string} [inputs.home] Home directory.
- * @param {string} [inputs.localAppData] `LOCALAPPDATA`.
+ *   `/`-rooted.
+ * @param {string} [inputs.home] Home directory. Ignored unless absolute.
+ * @param {string} [inputs.localAppData] `LOCALAPPDATA`. Ignored unless drive-
+ *   or UNC-rooted; the home profile is the fallback.
  * @returns {string|null} Absolute path, or null when nothing resolves.
  */
 export function resolveCacheDirFor({
@@ -48,20 +56,55 @@ export function resolveCacheDirFor({
     return path.resolve(cdxgenCacheDir);
   }
   if (platform === "windows") {
-    if (localAppData?.trim()) {
+    if (isWindowsAbsolute(localAppData)) {
       return path.join(localAppData, "cdxgen", "cache");
     }
-    return home?.trim()
+    return isWindowsAbsolute(home)
       ? path.join(home, "AppData", "Local", "cdxgen", "cache")
       : null;
   }
   if (platform === "macos") {
-    return home?.trim() ? path.join(home, "Library", "Caches", "cdxgen") : null;
+    return isPosixAbsolute(home)
+      ? path.join(home, "Library", "Caches", "cdxgen")
+      : null;
   }
-  if (xdgCacheHome?.trim() && path.isAbsolute(xdgCacheHome)) {
+  if (isPosixAbsolute(xdgCacheHome)) {
     return path.join(xdgCacheHome, "cdxgen");
   }
-  return home?.trim() ? path.join(home, ".cache", "cdxgen") : null;
+  return isPosixAbsolute(home) ? path.join(home, ".cache", "cdxgen") : null;
+}
+
+/**
+ * Absolute by POSIX rules: `/`-rooted.
+ *
+ * @param {string} [value] Candidate path
+ * @returns {boolean} Whether the path is absolute
+ */
+function isPosixAbsolute(value) {
+  return typeof value === "string" && value.startsWith("/");
+}
+
+/**
+ * Absolute by Windows rules: a drive letter followed by a separator (`C:\` or
+ * `C:/`), or a UNC path (`\\server\share`). `C:cache` (relative to the drive's
+ * current directory) and `\cache` (relative to the current drive) are not.
+ * Mirrors `is_windows_absolute` in cdxrs.
+ *
+ * @param {string} [value] Candidate path
+ * @returns {boolean} Whether the path is absolute
+ */
+function isWindowsAbsolute(value) {
+  if (typeof value !== "string" || value.length < 3) {
+    return false;
+  }
+  const isSeparator = (char) => char === "\\" || char === "/";
+  const driveRooted = /^[a-zA-Z]$/.test(value[0]) && value[1] === ":";
+  if (driveRooted) {
+    return isSeparator(value[2]);
+  }
+  return (
+    isSeparator(value[0]) && isSeparator(value[1]) && !isSeparator(value[2])
+  );
 }
 
 /**