@cdxgen/cdxgen 13.4.0 → 13.6.0

package/lib/parsers/largeJson.js

@@ -54,9 +54,20 @@ function applySpec(value, spec) {
     return value;
   }
   if (Array.isArray(value)) {
+    let elements = value;
+    if (spec.map) {
+      const mapped = [];
+      for (const element of elements) {
+        const transformed = spec.map(element);
+        if (transformed !== undefined) {
+          mapped.push(transformed);
+        }
+      }
+      elements = mapped;
+    }
     return spec.filter
-      ? value.filter((element) => spec.filter(element))
-      : value;
+      ? elements.filter((element) => spec.filter(element))
+      : elements;
   }
   if (!spec.members) {
     return value;
@@ -256,8 +267,9 @@ class ByteCursor {
 
 // The members of the object at the cursor, as { key, start, end } byte ranges
 // of their values, in file order. A repeated key keeps its first position and
-// its last range, which is what JSON.parse does.
-function scanObjectMembers(cursor) {
+// its last range, which is what JSON.parse does. With `stopAt`, the scan ends
+// at the first member of that name, leaving the rest of the object unread.
+function scanObjectMembers(cursor, stopAt = undefined) {
   if (cursor.nextToken() !== OPEN_BRACE) {
     cursor.fail("Expected an object");
   }
@@ -280,6 +292,9 @@ function scanObjectMembers(cursor) {
     const start = cursor.offset;
     cursor.skipValue();
     members.set(key, { start, end: cursor.offset });
+    if (key === stopAt) {
+      return members;
+    }
     const delimiter = cursor.nextToken();
     if (delimiter === CLOSE_BRACE) {
       return members;
@@ -290,9 +305,10 @@ function scanObjectMembers(cursor) {
   }
 }
 
-// Decode the array at the cursor in runs of whole elements, keeping those that
-// `filter` accepts.
-function readArrayElements(cursor, filter, batchBytes) {
+// Decode the array at the cursor in runs of whole elements, mapping each one
+// through `spec.map` (an undefined result drops it) and keeping those that
+// `spec.filter` accepts.
+function readArrayElements(cursor, spec, batchBytes) {
   if (cursor.nextToken() !== OPEN_BRACKET) {
     cursor.fail("Expected an array");
   }
@@ -306,8 +322,12 @@ function readArrayElements(cursor, filter, batchBytes) {
     for (const element of JSON.parse(
       `[${cursor.endCapture(cursor.pos - 1)}]`,
     )) {
-      if (!filter || filter(element)) {
-        elements.push(element);
+      const mapped = spec?.map ? spec.map(element) : element;
+      if (mapped === undefined) {
+        continue;
+      }
+      if (!spec?.filter || spec.filter(mapped)) {
+        elements.push(mapped);
       }
     }
   };
@@ -363,7 +383,7 @@ function decodeRange(fd, start, end, spec, options) {
       );
     }
   } else if (first === OPEN_BRACKET) {
-    value = readArrayElements(cursor, spec?.filter, options.batchBytes);
+    value = readArrayElements(cursor, spec, options.batchBytes);
   } else {
     // A string or number this large has no smaller parts; JSON.parse reports
     // it the way it would for the whole file.
@@ -412,14 +432,43 @@ export function indexJsonObject(filePath, options = {}) {
   });
 }
 
+/**
+ * Decode one member of the top-level object in a JSON file, reading the file
+ * only up to the end of that member. A member near the start of a large file
+ * costs a few bounded reads, however large the rest of the file is; the rest
+ * is not checked for well-formedness.
+ *
+ * @param {string} filePath JSON file whose top-level value is an object
+ * @param {string} name Member to decode
+ * @param {Object} [options] Batch and chunk size overrides, for tests
+ * @returns {*} The decoded value, or undefined when the object has no such member
+ * @throws {SyntaxError} When the object is malformed before the member ends
+ */
+export function readJsonMember(filePath, name, options = {}) {
+  const resolved = resolveOptions(options);
+  return withFile(filePath, (fd) => {
+    const cursor = new ByteCursor(
+      fd,
+      0,
+      statSync(filePath).size,
+      resolved.chunkBytes,
+    );
+    const range = scanObjectMembers(cursor, name).get(name);
+    return range
+      ? decodeRange(fd, range.start, range.end, undefined, resolved)
+      : undefined;
+  });
+}
+
 /**
  * Decode the JSON value stored in a byte range of a file, without ever holding
  * more than a bounded run of it in one string.
  *
  * `spec` narrows what is kept. `{ members: { name: spec } }` keeps only the
- * named members of an object, each narrowed by its own spec. `{ filter }`
- * keeps the elements of an array that `filter(element)` accepts. Anything else
- * keeps the whole value.
+ * named members of an object, each narrowed by its own spec. `{ map }`
+ * transforms each element of an array, an undefined result dropping it, and
+ * `{ filter }` keeps the mapped elements that `filter(element)` accepts.
+ * Anything else keeps the whole value.
  *
  * @param {string} filePath JSON file
  * @param {{start: number, end: number}} range Byte range of the value, such as one returned by indexJsonObject

package/lib/parsers/vscodeExtensionId.js

@@ -0,0 +1,183 @@
+// The one place that reads the identity of an installed VS Code-family
+// extension from the name of its folder.
+//
+// An editor installs an extension into `<publisher>.<name>-<version>`, and a
+// platform-specific build into `<publisher>.<name>-<version>-<platform>`, for
+// example `anthropic.claude-code-2.1.313-darwin-arm64`. The extension scan and
+// the osquery `vscode_extensions` rows both name the extension from this, so an
+// extension found by `cdxgen -t vscode-extension` and by `obom` is the same
+// component with the same purl.
+
+/**
+ * Target platforms a VS Code-family marketplace publishes an extension for.
+ * `universal` and `web` builds are the same artefact on every platform and are
+ * not part of the extension's identity.
+ */
+export const VSCODE_TARGET_PLATFORMS = new Set([
+  "win32-x64",
+  "win32-arm64",
+  "win32-ia32",
+  "linux-x64",
+  "linux-arm64",
+  "linux-armhf",
+  "alpine-x64",
+  "alpine-arm64",
+  "darwin-x64",
+  "darwin-arm64",
+]);
+
+// Folder suffixes for builds that run on every platform.
+const NEUTRAL_PLATFORMS = ["universal", "web"];
+
+/**
+ * Normalize a target platform value from a manifest, an `extensions.json`
+ * record, or a folder name. Values that do not name a specific platform, such
+ * as `universal`, `web`, `undefined`, or an empty string, return an empty
+ * string.
+ *
+ * @param {string} value Raw target platform
+ * @returns {string} A value from VSCODE_TARGET_PLATFORMS, or an empty string
+ */
+export function normalizeVscodeTargetPlatform(value) {
+  const platform = `${value || ""}`.trim().toLowerCase();
+  return VSCODE_TARGET_PLATFORMS.has(platform) ? platform : "";
+}
+
+/**
+ * Split an installed extension folder name into its publisher, name, version
+ * and target platform.
+ *
+ * @param {string} dirName Folder name, such as `ms-python.python-2025.4.0` or
+ *   `anthropic.claude-code-2.1.313-darwin-arm64`
+ * @returns {{publisher: string, name: string, version: string, platform: string}|undefined}
+ *   The parts, or undefined when the name does not follow the pattern
+ */
+export function parseVscodeExtensionDirName(dirName) {
+  let value = `${dirName || ""}`.trim();
+  while (value.endsWith("/") || value.endsWith("\\")) {
+    value = value.slice(0, -1);
+  }
+  const dotIdx = value.indexOf(".");
+  if (dotIdx < 1) {
+    return undefined;
+  }
+  const publisher = value.substring(0, dotIdx);
+  let rest = value.substring(dotIdx + 1);
+  let platform = "";
+  for (const candidate of [...VSCODE_TARGET_PLATFORMS, ...NEUTRAL_PLATFORMS]) {
+    if (rest.toLowerCase().endsWith(`-${candidate}`)) {
+      platform = normalizeVscodeTargetPlatform(candidate);
+      rest = rest.substring(0, rest.length - candidate.length - 1);
+      break;
+    }
+  }
+  // Marketplaces require semver versions, so the version starts at the first
+  // hyphen whose remainder is a whole semver: `python-3.11-tools-1.0.0` is the
+  // name `python-3.11-tools` at 1.0.0, and `1.0.0-beta-2` stays one version.
+  // A folder whose version is not semver falls back to the first hyphen
+  // followed by digits and a dot.
+  let versionStart = -1;
+  let fallbackStart = -1;
+  for (let i = 1; i < rest.length - 2; i++) {
+    if (rest[i] !== "-" || !isDigit(rest[i + 1])) {
+      continue;
+    }
+    if (isSemver(rest.substring(i + 1))) {
+      versionStart = i;
+      break;
+    }
+    let j = i + 1;
+    while (j < rest.length && isDigit(rest[j])) {
+      j++;
+    }
+    if (fallbackStart < 0 && rest[j] === ".") {
+      fallbackStart = i;
+    }
+  }
+  if (versionStart < 0) {
+    versionStart = fallbackStart;
+  }
+  if (versionStart < 1) {
+    return undefined;
+  }
+  const name = rest.substring(0, versionStart);
+  const version = rest.substring(versionStart + 1);
+  if (!name || !version) {
+    return undefined;
+  }
+  return { publisher, name, version, platform };
+}
+
+function isDigit(character) {
+  return character >= "0" && character <= "9";
+}
+
+function isIdentifierList(text, numericNoLeadingZero) {
+  if (!text) {
+    return false;
+  }
+  return text.split(".").every((part) => {
+    if (!part.length) {
+      return false;
+    }
+    for (const character of part) {
+      const ok =
+        isDigit(character) ||
+        character === "-" ||
+        (character >= "a" && character <= "z") ||
+        (character >= "A" && character <= "Z");
+      if (!ok) {
+        return false;
+      }
+    }
+    if (numericNoLeadingZero && [...part].every(isDigit)) {
+      return part === "0" || part[0] !== "0";
+    }
+    return true;
+  });
+}
+
+/**
+ * Check a string is a semantic version: three numeric parts, then an optional
+ * `-prerelease` and `+build`.
+ *
+ * @param {string} text Candidate version
+ * @returns {boolean} true for a semver
+ */
+export function isSemver(text) {
+  const plus = text.indexOf("+");
+  const core = plus >= 0 ? text.substring(0, plus) : text;
+  if (plus >= 0 && !isIdentifierList(text.substring(plus + 1), false)) {
+    return false;
+  }
+  const dash = core.indexOf("-");
+  const numbers = dash >= 0 ? core.substring(0, dash) : core;
+  if (dash >= 0 && !isIdentifierList(core.substring(dash + 1), true)) {
+    return false;
+  }
+  const parts = numbers.split(".");
+  return (
+    parts.length === 3 &&
+    parts.every(
+      (part) =>
+        part.length > 0 &&
+        [...part].every(isDigit) &&
+        (part === "0" || part[0] !== "0"),
+    )
+  );
+}
+
+/**
+ * Read the target platform from the path of an installed extension folder.
+ *
+ * @param {string} extensionPath Path to the extension folder, with either
+ *   separator
+ * @returns {string} The target platform, or an empty string
+ */
+export function vscodeExtensionPlatformFromPath(extensionPath) {
+  const segments = `${extensionPath || ""}`
+    .split(/[/\\]/u)
+    .filter((segment) => segment.length);
+  const dirName = segments[segments.length - 1];
+  return parseVscodeExtensionDirName(dirName)?.platform || "";
+}

package/lib/server/server.js

@@ -14,7 +14,9 @@ import {
   isSecureMode,
   readEnvironmentVariable,
 } from "../core/activity.js";
+import { PROJECT_TYPE_ALIASES } from "../core/env.js";
 import { isWin } from "../core/paths.js";
+import { isSecureModeActive } from "../core/projectTooling.js";
 import { resetRunState } from "../core/runState.js";
 import { CDXGEN_VERSION } from "../core/state.js";
 import { installConsoleShim, ui } from "../core/ui.js";
@@ -27,6 +29,7 @@ import {
   getGitAllowProtocol,
   gitClone,
   isAllowedPath,
+  isAllowedRealPath,
   isAllowedWinPath,
   maybePurlSource,
   maybeRemotePath,
@@ -82,6 +85,11 @@ const ALLOWED_PARAMS = [
   "tlpClassification",
 ];
 
+// Options that install packages or run the scanned project's own build tools
+// (for example `cargo check`, which runs build.rs), and so execute code from
+// the scanned repository.
+const CODE_EXECUTION_PARAMS = ["installDeps", "deep"];
+
 const app = connect();
 
 export { isAllowedHttpHost };
@@ -156,6 +164,7 @@ export function parseValue(raw) {
  * @returns {Object} Populated options object
  */
 export function parseQueryString(q, body = {}, options = {}) {
+  const operatorOptions = { ...options };
   // Priority is query params followed by body
   for (const param of ALLOWED_PARAMS) {
     const raw = q[param] ?? body[param];
@@ -163,7 +172,7 @@ export function parseQueryString(q, body = {}, options = {}) {
       options[param] = parseValue(raw);
     }
   }
-  options.projectType = options.type?.split(",");
+  options.projectType = toProjectTypeList(options.type);
   delete options.type;
   if (options.lifecycle === "pre-build") {
     options.installDeps = false;
@@ -171,9 +180,170 @@ export function parseQueryString(q, body = {}, options = {}) {
   if (options.profile) {
     applyProfileOptions(options);
   }
+  // failOnError ends the process, so one failing request would stop the server
+  // for every client.
+  options.failOnError = false;
+  restrictRequestOptions(options, operatorOptions);
   return options;
 }
 
+/**
+ * Normalise a `type` value from the request or the start-up options, which may
+ * be a comma separated string or an array, into a list of project types.
+ *
+ * @param {string|string[]|undefined} type Project type value
+ * @returns {string[]|undefined} Project types, or undefined when none are given
+ */
+function toProjectTypeList(type) {
+  if (type === undefined || type === null || type === "") {
+    return undefined;
+  }
+  const types = (Array.isArray(type) ? type : [type])
+    .flatMap((t) => String(t).split(","))
+    .map((t) => t.trim())
+    .filter(Boolean);
+  return types.length ? types : undefined;
+}
+
+/**
+ * Stop a request from turning on options that execute code from the scanned
+ * repository when the operator has not. In secure mode, or when the server was
+ * started with --no-install-deps, a request may turn these options off but
+ * never on.
+ *
+ * @param {Object} options Options parsed from the request
+ * @param {Object} operatorOptions Options the server was started with
+ * @returns {void}
+ */
+function restrictRequestOptions(options, operatorOptions) {
+  if (!isSecureModeActive() && operatorOptions.installDeps !== false) {
+    return;
+  }
+  for (const param of CODE_EXECUTION_PARAMS) {
+    // Only an explicit false from the request changes the operator's choice.
+    // Values such as "" or 0 would otherwise pass gates that test `!== false`.
+    options[param] =
+      operatorOptions[param] === true && options[param] !== false;
+  }
+}
+
+// Project types that inventory the host the server runs on, such as installed
+// packages, users, shell history, IDE and browser extensions, or the Maven,
+// Gradle, sbt, Cargo and Helm caches in the server user's home directory.
+// They ignore the scan path, so the path allowlist does not limit them.
+const HOST_SCOPE_PROJECT_TYPES = new Set(
+  [
+    "os",
+    "hbom",
+    "cargo-cache",
+    "helm-index",
+    "gradle-index",
+    "sbt-index",
+    "maven-index",
+    "vscode-extension",
+    "chrome-extension",
+    "agentic",
+  ]
+    .flatMap((key) => PROJECT_TYPE_ALIASES[key] || [key])
+    .concat(["maven-repo"]),
+);
+
+/**
+ * Check request options that the server must refuse outright.
+ *
+ * @param {Object} reqOptions Options parsed from the request
+ * @param {Object} operatorOptions Options the server was started with
+ * @returns {Object|null} Error object with status, error and details, or null
+ */
+export function validateRequestOptions(reqOptions, operatorOptions = {}) {
+  const operatorTypes = new Set(
+    toProjectTypeList(operatorOptions.type ?? operatorOptions.projectType) ||
+      [],
+  );
+  const hostScopeType = (reqOptions.projectType || []).find(
+    (t) => HOST_SCOPE_PROJECT_TYPES.has(t) && !operatorTypes.has(t),
+  );
+  if (hostScopeType) {
+    return {
+      status: 403,
+      error: "Project Type Not Allowed",
+      details: `The '${hostScopeType}' project type scans the server host. Start the server with this type to allow it.`,
+    };
+  }
+  const excludes = Array.isArray(reqOptions.exclude)
+    ? reqOptions.exclude
+    : [reqOptions.exclude];
+  // Brace patterns expand before matching, so one short pattern such as
+  // {1..100000} can keep the server busy for minutes.
+  if (
+    reqOptions.exclude !== operatorOptions.exclude &&
+    excludes.some(
+      (e) => typeof e === "string" && (e.includes("{") || e.length > 512),
+    )
+  ) {
+    return {
+      status: 400,
+      error: "Invalid Exclude Pattern",
+      details:
+        "Exclude patterns sent to the server cannot use braces or exceed 512 characters.",
+    };
+  }
+  if (
+    reqOptions.serverUrl &&
+    reqOptions.serverUrl !== operatorOptions.serverUrl
+  ) {
+    const requestedOrigin = urlOrigin(reqOptions.serverUrl);
+    if (!requestedOrigin) {
+      return {
+        status: 400,
+        error: "Invalid Server URL",
+        details: "The Dependency-Track server URL is invalid.",
+      };
+    }
+    if (requestedOrigin !== urlOrigin(operatorOptions.serverUrl)) {
+      // The operator's API key only ever goes to the operator's server.
+      if (
+        operatorOptions.apiKey &&
+        reqOptions.apiKey === operatorOptions.apiKey
+      ) {
+        return {
+          status: 400,
+          error: "API Key Required",
+          details:
+            "A request that names its own Dependency-Track server must send its own API key.",
+        };
+      }
+      // CDXGEN_SERVER_ALLOWED_HOSTS only covers git hosts, so in secure mode a
+      // server the operator did not configure must be on CDXGEN_ALLOWED_HOSTS.
+      if (isSecureMode && !readEnvironmentVariable("CDXGEN_ALLOWED_HOSTS")) {
+        return {
+          status: 403,
+          error: "Host Not Allowed",
+          details:
+            "Set CDXGEN_ALLOWED_HOSTS to let requests choose a Dependency-Track server.",
+        };
+      }
+    }
+  }
+  if (isSecureMode && reqOptions.includeFormulation && reqOptions.serverUrl) {
+    return {
+      status: 400,
+      error: "Formulation Not Allowed",
+      details:
+        "Formulation data may contain secrets and is not submitted to Dependency-Track in secure mode.",
+    };
+  }
+  return null;
+}
+
+function urlOrigin(value) {
+  try {
+    return new URL(value).origin;
+  } catch (_err) {
+    return undefined;
+  }
+}
+
 /**
  * Extracts query parameters from an incoming HTTP request object.
  * Handles repeated keys by collecting their values into an array.
@@ -391,6 +561,18 @@ const start = (options) => {
         }),
       );
     }
+    const optionsError = validateRequestOptions(reqOptions, options);
+    if (optionsError) {
+      res.writeHead(optionsError.status, {
+        "Content-Type": "application/json",
+      });
+      return res.end(
+        JSON.stringify({
+          error: optionsError.error,
+          details: optionsError.details,
+        }),
+      );
+    }
     // Enforce the v13 CycloneDX spec floor on the HTTP entry point too, so the
     // server cannot be used to request a generation target the CLI rejects.
     if (reqOptions.specVersion !== undefined) {
@@ -477,7 +659,18 @@ const start = (options) => {
             );
           }
         }
-        cloneDir = gitClone(sourcePath, gitRef);
+        try {
+          cloneDir = gitClone(sourcePath, gitRef);
+        } catch (_err) {
+          console.log("Unable to clone repository. See the server log.");
+          res.writeHead(500, { "Content-Type": "application/json" });
+          return res.end(
+            JSON.stringify({
+              error: "Unable to clone repository",
+              details: "Cloning the repository failed. See the server log.",
+            }),
+          );
+        }
         srcDir = cloneDir;
         if (purlResolution?.type === "npm") {
           const cloneRootDir = cloneDir;
@@ -502,8 +695,11 @@ const start = (options) => {
         cleanup = true;
       } else {
         srcDir = sourcePath;
+        // Check where a symlinked path really points as well, so a link inside
+        // an allowed directory cannot open a scan of a directory outside it.
         if (
           !isAllowedPath(path.resolve(srcDir)) ||
+          !isAllowedRealPath(srcDir) ||
           (isWin && !isAllowedWinPath(srcDir))
         ) {
           res.writeHead(403, { "Content-Type": "application/json" });

package/lib/stages/postgen/annotator.js

@@ -463,6 +463,15 @@ export function textualMetadata(bomJson) {
   const swidCount = bomJson?.components?.filter((c) =>
     c?.purl?.startsWith("pkg:swid"),
   ).length;
+  // Homebrew packages are pkg:brew, not pkg:swid, so they are not counted as
+  // applications; formulae and casks are told apart by a property.
+  const brewComponents =
+    bomJson?.components?.filter((c) => c?.purl?.startsWith("pkg:brew/")) || [];
+  const brewCaskCount = brewComponents.filter((c) =>
+    c.properties?.some(
+      (p) => p.name === "cdx:homebrew:type" && p.value === "cask",
+    ),
+  ).length;
   const { unpackagedExecutableCount, unpackagedSharedLibraryCount } =
     getContainerFileInventoryStats(bomJson?.components);
   const githubStats = getGitHubWorkflowStats(bomJson?.components);
@@ -711,7 +720,14 @@ export function textualMetadata(bomJson) {
       text = `${text} The system appears to be set up for remote development, with ${vsixCount} Visual Studio Code extensions installed.`;
     }
     if (swidCount > 0) {
-      text = `${text} In addition, there are ${swidCount} applications installed on the system.`;
+      text = `${text} In addition, there ${swidCount === 1 ? "is 1 application" : `are ${swidCount} applications`} installed on the system.`;
+    }
+    if (brewComponents.length > 0) {
+      const brewCount = brewComponents.length;
+      const casks = brewCaskCount
+        ? `, of which ${brewCaskCount} ${brewCaskCount === 1 ? "is a cask" : "are casks"}`
+        : "";
+      text = `${text} The system also has ${brewCount} Homebrew package${brewCount === 1 ? "" : "s"} installed${casks}.`;
     }
   }
   if (bomType === "HBOM" && hbomSummary) {

package/lib/stages/postgen/introspection/reflect.js

@@ -36,6 +36,7 @@ import {
   isVersionedJvmToolProjectType,
   PROJECT_TYPE_ALIASES,
 } from "../../../core/env.js";
+import { safeExistsSync } from "../../../core/fs.js";
 import { dirNameStr } from "../../../core/paths.js";
 import { CDXGEN_VERSION } from "../../../core/state.js";
 import { evaluateRules, loadRules } from "../ruleEngine.js";
@@ -389,7 +390,9 @@ function resolveLedgerEvents(context) {
     };
   }
   const sidecarPath = readEnvironmentVariable("CDXGEN_INTROSPECT_LEDGER");
-  if (sidecarPath) {
+  // A sidecar the run could not create (the permission model denies writes
+  // outside the granted paths) holds nothing; the buffer still has the events.
+  if (sidecarPath && safeExistsSync(sidecarPath)) {
     return { events: loadLedgerFile(sidecarPath), source: "sidecar" };
   }
   const events = getLedgerEvents();

package/lib/stages/postgen/postgen.js

@@ -1,5 +1,5 @@
 import { readFileSync } from "node:fs";
-import { basename, join, relative, sep } from "node:path";
+import { join, relative } from "node:path";
 import process from "node:process";
 
 import { Purl } from "@cdxgen/cdx-purl";
@@ -943,10 +943,10 @@ function applyCustomMetadataProperties(bomJson, options) {
 export function applyStandards(bomJson, options) {
   if (options.standard && Array.isArray(options.standard)) {
     for (let astandard of options.standard) {
-      // See issue: #1953
-      if (astandard.includes(sep)) {
-        astandard = basename(astandard);
-      }
+      // See issue: #1953. Server requests can send either separator, and on
+      // Windows both "/" and "\" separate path segments, so keep only the
+      // last segment of either kind.
+      astandard = String(astandard).split(/[\\/]/).pop();
       const templateFile = join(
         dirNameStr,
         "data",