@cdxgen/cdxgen 13.4.0 → 13.6.0

package/lib/inventory/envcontext.js

@@ -1,6 +1,6 @@
-import { readFileSync } from "node:fs";
+import { readFileSync, realpathSync, statSync } from "node:fs";
 import { arch, homedir } from "node:os";
-import { basename, delimiter, dirname, join } from "node:path";
+import { basename, delimiter, dirname, isAbsolute, join } from "node:path";
 import process from "node:process";
 
 import { compareLoose } from "semver";
@@ -19,9 +19,12 @@ import {
   recordLedgerEvent,
 } from "../core/buildLedger.js";
 import {
+  BUNDLE_CMD,
   CARGO_CMD,
+  COMPOSER_CMD,
   DOTNET_CMD,
   GCC_CMD,
+  GEM_CMD,
   GO_CMD,
   getJavaCommand,
   getPythonCommand,
@@ -29,6 +32,7 @@ import {
   isDeno,
   isNode,
   NPM_CMD,
+  PHP_CMD,
   RUBY_CMD,
   RUSTC_CMD,
   SWIFT_CMD,
@@ -41,8 +45,20 @@ import {
 } from "../core/fs.js";
 import { diagnosticStream } from "../core/logger.js";
 import { dirNameStr, isMac, isWin } from "../core/paths.js";
+import { isProjectToolingAllowed } from "../core/projectTooling.js";
+import { brotliDecoderProperties, readBrotliDecoder } from "./brotliDecoder.js";
 import { isValidSdkmanVersion } from "./jvmToolEnv.js";
+import { createNodeRuntimeComponent } from "./nodeBuildInfo.js";
+import {
+  createPhpRuntimeComponent,
+  packageStoreOf,
+  parsePhpReportedVersion,
+} from "./phpBuildInfo.js";
 import { applyPurl, tryBuildPurl } from "./purl.js";
+import {
+  createRubyRuntimeComponent,
+  parseRubyDescription,
+} from "./rubyBuildInfo.js";
 import {
   classifySpawnRestriction,
   describeSpawnRestriction,
@@ -62,6 +78,9 @@ export const GIT_COMMAND = readEnvironmentVariable("GIT_CMD") || "git";
  *  - `core.fsmonitor=false`     — a repo-set fsmonitor value is a command git runs.
  *  - `core.hooksPath=/dev/null` — prevents any hook script from executing.
  *  - `safe.bareRepository=explicit` — avoids operating on an embedded bare repo.
+ *  - `gpg.program`, `gpg.ssh.program`, `gpg.x509.program` — `%G?` in a log
+ *    format verifies signatures by running these, so pin them to the tools
+ *    on PATH instead of a program named by the repo.
  * `-c` overrides take precedence over the repo-local config. Diff-producing
  * commands (`git show`/`git diff`) additionally pass `--no-ext-diff`/
  * `--no-textconv` to block `.gitattributes`-driven external diff and textconv
@@ -74,6 +93,12 @@ const GIT_HARDENING_CONFIG_ARGS = Object.freeze([
   "core.hooksPath=/dev/null",
   "-c",
   "safe.bareRepository=explicit",
+  "-c",
+  "gpg.program=gpg",
+  "-c",
+  "gpg.ssh.program=ssh-keygen",
+  "-c",
+  "gpg.x509.program=gpgsm",
 ]);
 
 /**
@@ -84,7 +109,15 @@ const GIT_HARDENING_CONFIG_ARGS = Object.freeze([
  * @returns {Object} environment for spawning git
  */
 function hardenedGitEnv() {
-  const env = { ...process.env, GIT_TERMINAL_PROMPT: "0" };
+  // These commands only read the local repository. A partial clone would
+  // otherwise fetch missing objects through the repo's own remote and
+  // core.sshCommand settings, so turn lazy fetching and every transport off.
+  const env = {
+    ...process.env,
+    GIT_TERMINAL_PROMPT: "0",
+    GIT_NO_LAZY_FETCH: "1",
+    GIT_ALLOW_PROTOCOL: "cdxgen-no-network",
+  };
   if (isSecureMode) {
     env.GIT_CONFIG_NOSYSTEM = "1";
     env.GIT_CONFIG_GLOBAL = "/dev/null";
@@ -113,6 +146,11 @@ export const SDKMAN_JAVA_TOOL_ALIASES = {
   java24: readEnvironmentVariable("JAVA24_TOOL") || "24.0.2-tem",
   java25: readEnvironmentVariable("JAVA25_TOOL") || "25.0.4-tem",
   java26: readEnvironmentVariable("JAVA26_TOOL") || "26.0.2-tem",
+  // The broker serves no Java 27 build yet (every vendor id 404s), so java27
+  // has an alias only when JAVA27_TOOL names one that is downloadable.
+  ...(readEnvironmentVariable("JAVA27_TOOL")
+    ? { java27: readEnvironmentVariable("JAVA27_TOOL") }
+    : {}),
 };
 
 /**
@@ -337,8 +375,10 @@ function recordToolProbeResolved(tool, ecosystem, found) {
  * @param {string} tool Tool name
  * @param {string} ecosystem Ecosystem the tool belongs to
  * @param {string} command Probe command that failed
+ * @param {string} [detail] What to say when the command is not restricted,
+ *   instead of the default that no command answered
  */
-function recordToolProbeFailure(tool, ecosystem, command) {
+function recordToolProbeFailure(tool, ecosystem, command, detail) {
   if (!isLedgerEnabled()) {
     return;
   }
@@ -362,7 +402,7 @@ function recordToolProbeFailure(tool, ecosystem, command) {
       ecosystem,
       tool,
       source: "PATH",
-      detail: `No ${tool} command answered the version probe.`,
+      detail: detail || `No ${tool} command answered the version probe.`,
     });
   }
 }
@@ -460,6 +500,16 @@ export function collectNodeInfo(dir) {
     version: runtimeInfo.version,
     components: runtimeInfo.components,
   };
+  if (runtimeInfo.runtime === "Node.js" && runtimeInfo.version) {
+    // The same identity a scanned image's Node.js gets, without a bom-ref, as
+    // for the other toolchains.
+    const runtime = formulationToolchain(
+      createNodeRuntimeComponent(runtimeInfo.version),
+    );
+    nodeInfo.purl = runtime.purl;
+    nodeInfo.cpe = runtime.cpe;
+    annotateNodeBrotli(nodeInfo.components);
+  }
   const moduleDesc = getCommandOutput(NPM_CMD, dir, ["--version"]);
   if (moduleDesc) {
     nodeInfo.description = `npm: ${moduleDesc}`;
@@ -470,6 +520,36 @@ export function collectNodeInfo(dir) {
   return nodeInfo;
 }
 
+/**
+ * Record whether the Brotli decoder the running Node.js uses carries the
+ * CVE-2026-111497 fix. process.versions.brotli cannot say: Node.js backports
+ * the fix without changing it. The decoder is read where it lives, in the node
+ * binary or in the shared libbrotlidec a `--shared-brotli` build loads.
+ *
+ * @param {Object[]|undefined} components bundled components of the runtime
+ */
+function annotateNodeBrotli(components) {
+  const brotli = (components || []).find(
+    (component) => component.name === "brotli",
+  );
+  if (!brotli) {
+    return;
+  }
+  let decoderFile = globalThis.process?.execPath;
+  if (nodeComponentLinkage("brotli") === "shared") {
+    decoderFile = (
+      globalThis.process?.report?.getReport?.()?.sharedObjects || []
+    ).find((path) => basename(path).startsWith("libbrotlidec"));
+  }
+  const decoder = decoderFile ? readBrotliDecoder(decoderFile) : undefined;
+  if (decoder) {
+    brotli.properties = [
+      ...(brotli.properties || []),
+      ...brotliDecoderProperties(decoder),
+    ];
+  }
+}
+
 /**
  * Collect gcc version
  *
@@ -559,23 +639,333 @@ export function collectSwiftInfo(dir) {
 }
 
 /**
- * Collect Ruby version
+ * The real path of the executable a command name runs, looked up on PATH as
+ * the shell would, or undefined when it cannot be found.
+ *
+ * @param {string} command command name or path
+ * @returns {string|undefined}
+ */
+function resolveExecutable(command) {
+  const name = `${command || ""}`.trim().split(" ")[0];
+  if (!name) {
+    return undefined;
+  }
+  const extensions = isWin
+    ? ["", ...`${process.env.PATHEXT || ".EXE;.CMD;.BAT"}`.split(";")]
+    : [""];
+  const directories = isAbsolute(name)
+    ? [dirname(name)]
+    : `${process.env.PATH || ""}`.split(delimiter).filter(Boolean);
+  const base = isAbsolute(name) ? basename(name) : name;
+  for (const directory of directories) {
+    for (const extension of extensions) {
+      const candidate = join(directory, `${base}${extension}`);
+      try {
+        if (statSync(candidate).isFile()) {
+          return realpathSync(candidate);
+        }
+      } catch {
+        // not here
+      }
+    }
+  }
+  return undefined;
+}
+
+/**
+ * Whether a Ruby executable is one the operating system or a package manager
+ * that patches it owns. Distros backport fixes under the old upstream version,
+ * so its version must not be matched against upstream advisories by CPE.
+ *
+ * @param {string|undefined} realPath real path of the executable
+ * @returns {boolean}
+ */
+export function isPackagedRubyPath(realPath) {
+  if (!realPath || isWin) {
+    return false;
+  }
+  // Homebrew builds the upstream release, so it keeps the CPE, as it does in
+  // an OBOM; Nix and Guix patch theirs.
+  const store = packageStoreOf(realPath);
+  if (store) {
+    return store !== "homebrew";
+  }
+  return ["/usr/bin/", "/bin/", "/usr/lib/", "/usr/libexec/", "/System/"].some(
+    (prefix) => realPath.startsWith(prefix),
+  );
+}
+
+// The shims of rbenv, asdf and mise run whichever Ruby is selected, which can
+// be the distro's (`rbenv global system`).
+function isVersionManagerShim(realPath) {
+  return `${realPath}`.split(/[\\/]/).includes("shims");
+}
+
+// Whether the Ruby `ruby --version` described may carry its release's CPE.
+// A shim is followed to the interpreter it runs; one that cannot be followed
+// keeps no CPE, since it may be the distro's.
+function rubyKeepsCpe(dir) {
+  let executable = resolveExecutable(RUBY_CMD);
+  if (executable && isVersionManagerShim(executable)) {
+    const target = isWin
+      ? ""
+      : firstOutputLine(
+          getCommandOutput(RUBY_CMD, dir, ["-e", "print RbConfig.ruby"]),
+        );
+    if (!isAbsolute(target)) {
+      return false;
+    }
+    try {
+      executable = realpathSync(target);
+    } catch {
+      executable = target;
+    }
+  }
+  return !isPackagedRubyPath(executable);
+}
+
+/**
+ * Collect the Ruby on the PATH.
+ *
+ * `ruby --version` prints the interpreter's description, such as
+ * `ruby 3.3.6 (2024-11-05 revision 75015d4c1f) [x86_64-linux]`, which is kept
+ * as the component description. The identity is `pkg:generic/ruby@3.3.6`
+ * (or jruby, truffleruby), with the CPE of the release unless a package
+ * manager owns the executable: a distro backports fixes under the old upstream
+ * version.
  *
  * @param {string} dir Working directory
  * @returns Object containing Ruby details
  */
 export function collectRubyInfo(dir) {
   const versionDesc = getCommandOutput(RUBY_CMD, dir, ["--version"]);
-  if (versionDesc) {
-    const info = {
-      type: "platform",
-      name: "ruby",
-      version: versionDesc.trim(),
-    };
-    recordToolProbeResolved("ruby", "ruby", info.version);
+  const banner = firstOutputLine(versionDesc);
+  const parsed = parseRubyDescription(banner);
+  if (parsed) {
+    const info = formulationToolchain(
+      createRubyRuntimeComponent(parsed.version, {
+        engine: parsed.engine,
+        withCpe: rubyKeepsCpe(dir),
+      }),
+    );
+    info.description = banner;
+    const properties = [];
+    if (parsed.patchlevel !== undefined) {
+      properties.push({
+        name: "cdx:ruby:patchlevel",
+        value: parsed.patchlevel,
+      });
+    }
+    if (parsed.rubyVersion) {
+      properties.push({
+        name: "cdx:ruby:languageVersion",
+        value: parsed.rubyVersion,
+      });
+    }
+    if (parsed.platform) {
+      properties.push({ name: "cdx:ruby:platform", value: parsed.platform });
+    }
+    if (properties.length) {
+      info.properties = properties;
+    }
+    recordToolProbeResolved("ruby", "ruby", banner);
     return info;
   }
-  recordToolProbeFailure("ruby", "ruby", RUBY_CMD);
+  recordToolProbeFailure(
+    "ruby",
+    "ruby",
+    RUBY_CMD,
+    versionDesc
+      ? "The ruby version probe did not print a Ruby version banner."
+      : undefined,
+  );
+  return undefined;
+}
+
+/**
+ * Whether the Ruby collectRubyInfo found is the MRI release a project needs.
+ *
+ * @param {Object|undefined} info result of collectRubyInfo
+ * @param {string} version wanted MRI version
+ * @returns {boolean}
+ */
+export function isRubyVersionActive(info, version) {
+  return Boolean(info && info.name === "ruby" && info.version === version);
+}
+
+/**
+ * Collect the RubyGems version. `gem --version` prints the bare version.
+ *
+ * @param {string} dir Working directory
+ * @returns {Object|undefined} the RubyGems component
+ */
+export function collectRubyGemsInfo(dir) {
+  const token = firstOutputLine(getCommandOutput(GEM_CMD, dir, ["--version"]));
+  if (/^\d+\.\d+\.\d+$/.test(token)) {
+    recordToolProbeResolved("gem", "ruby", token);
+    return formulationToolchain(
+      applyPurl(
+        {
+          type: "platform",
+          name: "rubygems",
+          version: token,
+          cpe: `cpe:2.3:a:rubygems:rubygems:${token}:*:*:*:*:*:*:*`,
+        },
+        tryBuildPurl({ type: "generic", name: "rubygems", version: token }),
+      ),
+    );
+  }
+  recordToolProbeFailure("gem", "ruby", GEM_CMD);
+  return undefined;
+}
+
+/**
+ * Collect the Bundler version. `bundle --version` prints `Bundler version
+ * 2.5.22`, or the bare version from Bundler 2.6 on.
+ *
+ * @param {string} dir Working directory
+ * @returns {Object|undefined} the Bundler component
+ */
+export function collectBundlerInfo(dir) {
+  const line = firstOutputLine(
+    getCommandOutput(BUNDLE_CMD, dir, ["--version"]),
+  );
+  const token = line.startsWith("Bundler version ")
+    ? line.slice("Bundler version ".length).trim()
+    : line;
+  if (/^\d+\.\d+\.\d+$/.test(token)) {
+    recordToolProbeResolved("bundler", "ruby", token);
+    return formulationToolchain(
+      applyPurl(
+        {
+          type: "platform",
+          name: "bundler",
+          version: token,
+          cpe: `cpe:2.3:a:bundler:bundler:${token}:*:*:*:*:*:*:*`,
+        },
+        tryBuildPurl({ type: "gem", name: "bundler", version: token }),
+      ),
+    );
+  }
+  recordToolProbeFailure("bundler", "ruby", BUNDLE_CMD);
+  return undefined;
+}
+
+/**
+ * The first line of a command's output, without its line end.
+ *
+ * @param {string|undefined} output Output of getCommandOutput
+ * @returns {string} First line, or an empty string
+ */
+function firstOutputLine(output) {
+  return `${output || ""}`.split(/\r?\n/, 1)[0].trim();
+}
+
+/**
+ * A toolchain component for the formulation section. Formulation shares the
+ * document's bom-ref namespace with the inventory, which can hold the very same
+ * `pkg:generic/php@<version>` runtime (an image scanned with
+ * --include-formulation), so like the other toolchains it carries no bom-ref.
+ *
+ * @param {Object} component component built with applyPurl
+ * @returns {Object} the component without its bom-ref
+ */
+function formulationToolchain(component) {
+  delete component["bom-ref"];
+  return component;
+}
+
+/**
+ * Collect the PHP version of the PHP found on the PATH.
+ *
+ * `-n` stops PHP loading any php.ini, so a PHPRC or an auto_prepend_file cannot
+ * run code, and `-v` is used rather than `-r 'echo PHP_VERSION;'` because the
+ * shell on Windows does not quote arguments. The first line is
+ * `PHP 8.5.11 (cli) (built: Sep 22 2026 13:32:06) (NTS)`.
+ *
+ * The identity is `pkg:generic/php`: a probe of the PATH cannot tell which
+ * package manager, if any, installed this PHP. A banner with a distro revision,
+ * such as Ubuntu 22.04's `PHP 8.1.2-1ubuntu2.14`, is recorded as reported but
+ * without a CPE: the distro backports fixes under the old upstream number.
+ *
+ * @param {string} dir Working directory
+ * @returns Object containing the PHP details
+ */
+export function collectPhpInfo(dir) {
+  const output = getCommandOutput(PHP_CMD, dir, ["-n", "-v"]);
+  const banner = firstOutputLine(output);
+  const reported = banner.startsWith("PHP ")
+    ? parsePhpReportedVersion(banner.slice("PHP ".length))
+    : undefined;
+  if (reported) {
+    recordToolProbeResolved("php", "php", reported.version);
+    return formulationToolchain(
+      createPhpRuntimeComponent(reported.version, {
+        withCpe: !reported.distroRevision,
+      }),
+    );
+  }
+  recordToolProbeFailure(
+    "php",
+    "php",
+    PHP_CMD,
+    output
+      ? "The php version probe did not print a PHP version banner."
+      : undefined,
+  );
+  return undefined;
+}
+
+/**
+ * Collect the Composer version.
+ *
+ * `--no-plugins` and `--no-scripts` keep the plugins and scripts of the
+ * project in the working directory from running, which `composer --version`
+ * would otherwise let a plugin do. It needs no network. The banner is
+ * `Composer version 2.10.3 2026-08-27 13:34:23`, but an older Composer on a
+ * newer PHP prints deprecation notices above it, so the first line that starts
+ * with it is read; the line after it names the PHP Composer runs on, with its
+ * path, and is never read. The banner must start its line: an indented echo of
+ * the project's composer.json in an error block does not count. Only a stable
+ * release is recorded: a pre-release or a snapshot has no version a CPE can
+ * name.
+ *
+ * @param {string} dir Working directory
+ * @returns Object containing the Composer details
+ */
+export function collectComposerInfo(dir) {
+  const output = getCommandOutput(COMPOSER_CMD, dir, [
+    "--version",
+    "--no-plugins",
+    "--no-scripts",
+    "--no-interaction",
+  ]);
+  const token =
+    /^Composer version (\S+)/m.exec(
+      `${output || ""}`.slice(0, 64 * 1024),
+    )?.[1] || "";
+  if (/^\d+\.\d+\.\d+$/.test(token)) {
+    recordToolProbeResolved("composer", "php", token);
+    return formulationToolchain(
+      applyPurl(
+        {
+          type: "platform",
+          name: "composer",
+          version: token,
+          cpe: `cpe:2.3:a:getcomposer:composer:${token}:*:*:*:*:*:*:*`,
+        },
+        tryBuildPurl({ type: "generic", name: "composer", version: token }),
+      ),
+    );
+  }
+  recordToolProbeFailure(
+    "composer",
+    "php",
+    COMPOSER_CMD,
+    output
+      ? "The composer version probe did not print a stable Composer version."
+      : undefined,
+  );
   return undefined;
 }
 
@@ -594,12 +984,23 @@ export function runSwiftCommand(dir, args) {
  * Collect toolchain information components for the current environment.
  *
  * Probes the working directory for java, dotnet, python, node, gcc, rust, go,
- * and ruby toolchains and returns one component per detected tool.
+ * ruby, php and composer toolchains and returns one component per detected
+ * tool.
  *
  * @param {string} dir Working directory to inspect
+ * @param {Object} [options] CLI options, which decide whether the project's
+ *   own toolchain files may choose the tools that run
  * @returns {Object[]} Array of toolchain component objects; empty when nothing is detected
  */
-export function collectEnvInfo(dir) {
+export function collectEnvInfo(dir, options = undefined) {
+  // Version managers pick the toolchain from files in the working directory.
+  // rust-toolchain.toml can name an absolute toolchain path and global.json
+  // can name SDK paths, so unless the project's tooling may run, the probes
+  // run outside the scanned project and report the toolchains installed on
+  // the host.
+  if (!isProjectToolingAllowed(options)) {
+    dir = getTmpDir();
+  }
   const infoComponents = [];
   let cmp = collectJavaInfo(dir);
   if (cmp) {
@@ -630,6 +1031,22 @@ export function collectEnvInfo(dir) {
     infoComponents.push(cmp);
   }
   cmp = collectRubyInfo(dir);
+  if (cmp) {
+    infoComponents.push(cmp);
+    cmp = collectRubyGemsInfo(dir);
+    if (cmp) {
+      infoComponents.push(cmp);
+    }
+    cmp = collectBundlerInfo(dir);
+    if (cmp) {
+      infoComponents.push(cmp);
+    }
+  }
+  cmp = collectPhpInfo(dir);
+  if (cmp) {
+    infoComponents.push(cmp);
+  }
+  cmp = collectComposerInfo(dir);
   if (cmp) {
     infoComponents.push(cmp);
   }
@@ -1055,7 +1472,7 @@ export function installRubyVersion(rubyVersion, filePath) {
     return { fullToolBinDir: undefined, status: false };
   }
   const existingRuby = collectRubyInfo(filePath);
-  if (existingRuby?.version?.startsWith(`ruby ${rubyVersion} `)) {
+  if (isRubyVersionActive(existingRuby, rubyVersion)) {
     return { fullToolBinDir: undefined, status: true };
   }
   const fullToolBinDir = rubyVersionDir(rubyVersion);
@@ -1821,6 +2238,36 @@ export function gitRevertsAndHotfixes(dir, maxCount = 20) {
   return entries;
 }
 
+// process.versions keys whose configure flag is named differently.
+const NODE_SHARED_FLAG_NAMES = {
+  ares: "cares",
+  libffi: "ffi",
+  llhttp: "http_parser",
+  uv: "libuv",
+};
+
+/**
+ * Whether the running Node.js links a bundled dependency as a shared library,
+ * from the `node_shared_<name>` configure variables it reports.
+ *
+ * @param {string} name key of process.versions
+ * @param {Object} [variables] configure variables, process.config.variables
+ *   by default
+ * @returns {string|undefined} `shared`, `bundled`, or undefined when the build
+ *   does not say
+ */
+export function nodeComponentLinkage(
+  name,
+  variables = globalThis.process?.config?.variables,
+) {
+  const flag = `node_shared_${NODE_SHARED_FLAG_NAMES[name] || name}`;
+  if (!variables || !(flag in variables)) {
+    return undefined;
+  }
+  const value = variables[flag];
+  return value === true || value === "true" ? "shared" : "bundled";
+}
+
 /**
  * Get information about the runtime.
  *
@@ -1853,12 +2300,22 @@ export function getRuntimeInformation() {
           name,
           version: version || null,
         });
+        // A distro or Homebrew build links some of these as shared libraries
+        // (`configure --shared-brotli`); the version is then the shared
+        // library's, and updating Node.js alone does not update it.
+        const linkage = nodeComponentLinkage(name);
         const apkg = {
           name,
           version,
-          description: `Bundled with Node.js ${runtimeInfo.version}`,
+          description:
+            linkage === "shared"
+              ? `Linked by Node.js ${runtimeInfo.version} as a shared library`
+              : `Bundled with Node.js ${runtimeInfo.version}`,
           type: "library",
           scope: "excluded",
+          ...(linkage
+            ? { properties: [{ name: "cdx:node:linkage", value: linkage }] }
+            : {}),
         };
         applyPurl(apkg, bundledPurl);
         if (nodeSourceUrl) {