@cdxgen/cdxgen 13.4.0 → 13.6.0

package/lib/audit/index.js

@@ -47,6 +47,7 @@ import {
   resolveGitUrlFromPurl,
   resolvePurlSourceDirectory,
   sanitizeRemoteUrlForLogs,
+  validateAndRejectGitSource,
 } from "../inventory/source.js";
 import { executeOsQuery } from "../managers/binary.js";
 import { getBomWithOras } from "../managers/oci.js";
@@ -1307,6 +1308,17 @@ export function buildTargetContextFindings(target) {
  * @returns {void}
  */
 function cloneRepositoryToDir(repoUrl, cloneDir, gitRef) {
+  // The repository URL comes from registry metadata, so it gets the same
+  // protocol and host checks as a URL sent to the server.
+  const validationError = validateAndRejectGitSource(repoUrl);
+  if (validationError) {
+    const error = new Error(
+      `${validationError.error}: ${validationError.details}`,
+    );
+    error.errorType = "clone";
+    error.retryable = false;
+    throw error;
+  }
   const gitArgs = [
     "-c",
     "alias.clone=",
@@ -1316,6 +1328,8 @@ function cloneRepositoryToDir(repoUrl, cloneDir, gitRef) {
     "safe.bareRepository=explicit",
     "-c",
     "core.hooksPath=/dev/null",
+    "-c",
+    "core.symlinks=false",
     "clone",
     "--template=",
     "--depth",

package/lib/cli/bomAssembly.js

@@ -25,6 +25,7 @@ import {
   CDXGEN_VERSION,
   frameworksList,
 } from "../core/state.js";
+import { getExecutedTools } from "../core/toolRegistry.js";
 import {
   isPkgTypeOnlyImport,
   setNpmCleanedVersionProperty,
@@ -45,6 +46,7 @@ import {
   setCycloneDxFormat,
   toCycloneDxSpecVersionString,
 } from "../inventory/bomUtils.js";
+import { mergeDuplicateCryptoComponents } from "../inventory/certificates.js";
 import { mergeServices, trimComponents } from "../inventory/depsUtils.js";
 import {
   attachIdentityTools,
@@ -59,7 +61,7 @@ import {
 } from "../inventory/purl.js";
 import { repairPurl } from "../inventory/sbomDocument.js";
 import { getLicenses } from "../inventory/spdx.js";
-import { getBinaryBom } from "../managers/binary.js";
+import { getBinaryBom, getPluginToolComponents } from "../managers/binary.js";
 import { isValidIriReference } from "../parsers/iri.js";
 
 /**
@@ -292,10 +294,85 @@ function anchorDetectedParent(
   return anchored;
 }
 
+/**
+ * Builds the tool components for the external helpers and build tools this
+ * run executed, from the run-scoped registry (issue #598). Bundled plugin
+ * helpers are enriched with the manifest component of the plugin package that
+ * ships them, so the plugin package's version and identity travel with the
+ * helper. Empty when the run spawned nothing external, which keeps such BOMs
+ * byte-identical to the previous behaviour.
+ *
+ * @returns {object[]} Sorted CycloneDX tool components
+ */
+export const buildExternalToolComponents = () => {
+  const recordedTools = getExecutedTools();
+  if (!recordedTools.length) {
+    return [];
+  }
+  const recordedNames = recordedTools.map((tool) => tool.name);
+  const pluginComponents = getPluginToolComponents(recordedNames);
+  const pluginByName = new Map(
+    pluginComponents.map((component) => [component.name, component]),
+  );
+  const components = [];
+  for (const tool of recordedTools) {
+    const pluginComponent = pluginByName.get(tool.name);
+    if (pluginComponent?.["bom-ref"]) {
+      components.push(pluginComponent);
+      continue;
+    }
+    const component = {
+      type: "application",
+      name: tool.name,
+    };
+    if (tool.version) {
+      component.version = tool.version;
+    }
+    components.push(component);
+  }
+  return components;
+};
+
+/**
+ * Drops the executed tools that are already present: a tool whose bom-ref or
+ * name matches an explicitly passed context tool, or whose bom-ref an earlier
+ * executed tool already carries (several bundled helpers can share one plugin
+ * package component). The context tools themselves are never touched.
+ *
+ * @param {object[]} contextTools Tool components passed in by the caller
+ * @param {object[]} executedTools Tool components from the run's registry
+ * @returns {object[]} The executed tools to append
+ */
+const newExecutedTools = (contextTools, executedTools) => {
+  const seenRefs = new Set();
+  const seenNames = new Set();
+  for (const component of contextTools) {
+    if (component?.["bom-ref"]) {
+      seenRefs.add(component["bom-ref"]);
+    }
+    if (component?.name) {
+      seenNames.add(component.name);
+    }
+  }
+  const unique = [];
+  for (const component of executedTools) {
+    const ref = component["bom-ref"];
+    if ((ref && seenRefs.has(ref)) || seenNames.has(component.name)) {
+      continue;
+    }
+    if (ref) {
+      seenRefs.add(ref);
+    }
+    unique.push(component);
+  }
+  return unique;
+};
+
 /**
  * Assembles the `metadata.tools` block, including the cdxgen tool entry and,
  * for spec versions prior to 1.5, the legacy tools array. For spec version
- * 1.6+ the author field is converted to the authors array.
+ * 1.6+ the author field is converted to the authors array. The tools this run
+ * executed follow the context tools, sorted by name, and cdxgen comes last.
  *
  * @param {object} options CLI options
  * @param {object} [context={}] Additional context carrying existing components
@@ -303,6 +380,7 @@ function anchorDetectedParent(
  *   tools array (1.4) or a components array with tool components (1.5+)
  */
 export const addToolsSection = (options, context = {}) => {
+  const externalTools = buildExternalToolComponents();
   if (options.specVersion === 1.4) {
     return [
       {
@@ -310,6 +388,11 @@ export const addToolsSection = (options, context = {}) => {
         name: "cdxgen",
         version: CDXGEN_VERSION,
       },
+      ...newExecutedTools([], externalTools).map((tool) =>
+        tool.version
+          ? { name: tool.name, version: tool.version }
+          : { name: tool.name },
+      ),
     ];
   }
   let components = [];
@@ -330,6 +413,7 @@ export const addToolsSection = (options, context = {}) => {
   } else if (tools && Object.keys(tools).length && tools.components) {
     components = components.concat(tools.components);
   }
+  components = components.concat(newExecutedTools(components, externalTools));
   const cdxToolComponent = {
     group: CDXGEN_TOOL_GROUP,
     name: CDXGEN_TOOL_NAME,
@@ -457,6 +541,11 @@ export const addLifecyclesSection = (options) => {
 /**
  * Function to create metadata block
  *
+ * @param {Object} [parentComponent] Component the BOM describes
+ * @param {Object} [options] CLI options
+ * @param {Object} [context] Generator context. `context.metadataProperties`
+ *   holds facts of a manifest that has no component to carry them, such as the
+ *   platform data of a composer.lock whose composer.json names no project.
  */
 export function addMetadata(parentComponent = {}, options = {}, context = {}) {
   // DO NOT fork this project to just change the vendor or author's name
@@ -518,7 +607,13 @@ export function addMetadata(parentComponent = {}, options = {}, context = {}) {
           // We cannot use purl or bom-ref here since they would not match
           // purl - could have application on one side and a different type
           // bom-ref could have qualifiers on one side
-          if (fullName !== parentFullName) {
+          // A purl subpath marks a separate project that declares the
+          // parent's coordinates, such as a second Maven project or a Gradle
+          // subproject with the same group, name and version.
+          const separateProject =
+            comp.purl?.includes("#") &&
+            comp.purl.split("#")[1] !== parentComponent.purl?.split("#")[1];
+          if (fullName !== parentFullName || separateProject) {
             if (!comp["bom-ref"]) {
               comp["bom-ref"] = `pkg:${comp.type}/${decodeURIComponent(
                 fullName,
@@ -752,7 +847,7 @@ export function addMetadata(parentComponent = {}, options = {}, context = {}) {
             });
             let appLanguage;
             // TODO: Move these lists to a config file.
-            for (const lang in [
+            for (const lang of [
               "java",
               "node",
               "dotnet",
@@ -828,6 +923,9 @@ export function addMetadata(parentComponent = {}, options = {}, context = {}) {
     // AI provenance/oversight detection (`-t ai-provenance`) is injected into the
     // BOM document root (bomJson.properties) after post-processing, not into
     // metadata.properties. See ensureAiProvenanceProperties/ensureAiOversightProperties.
+    if (context?.metadataProperties?.length) {
+      mproperties.push(...context.metadataProperties);
+    }
     if (mproperties.length) {
       metadata.properties = mproperties;
     }
@@ -1602,6 +1700,10 @@ export const buildBomNSData = (options, pkgInfo, ptype, context) => {
     if (context?.formulationList?.length) {
       bomNSData.formulationList = context.formulationList;
     }
+    // createMultiXBom rebuilds the metadata block, so these are handed on.
+    if (context?.metadataProperties?.length) {
+      bomNSData.metadataProperties = context.metadataProperties;
+    }
     // Carry language-specific provenance citations (e.g. PEP 770 embedded
     // SBOMs) so postProcess can attach them in the single root-level citations
     // section it builds.
@@ -1933,16 +2035,28 @@ export function emitAiInventorySummary(aiInventory, discoveryPath) {
  * @param {Array} components Components
  * @param {Object} parentComponent Parent component
  * @param {Array} dependencies Dependencies
+ * @param {Array} [metadataProperties] Properties for the metadata block, from
+ *   generators whose manifest has no component to carry them
  *
  * @returns {Object} Object including BOM Json
  */
-export function dedupeBom(options, components, parentComponent, dependencies) {
+export function dedupeBom(
+  options,
+  components,
+  parentComponent,
+  dependencies,
+  metadataProperties = [],
+) {
   if (!components) {
     return {};
   }
   if (!dependencies) {
     dependencies = [];
   }
+  // Certificate components from different producers (trustinspector rootfs,
+  // the source-directory scan, observed chains) share a bom-ref; merge their
+  // occurrences and properties before the generic trim.
+  components = mergeDuplicateCryptoComponents(components);
   components = trimComponents(components);
   // Let's apply some common tweaks
   // Convert evidence.identity section to an object for 1.5
@@ -1971,7 +2085,7 @@ export function dedupeBom(options, components, parentComponent, dependencies) {
         ),
         serialNumber: serialNum,
         version: 1,
-        metadata: addMetadata(parentComponent, options, {}),
+        metadata: addMetadata(parentComponent, options, { metadataProperties }),
         components,
         services: options.services || [],
         dependencies,

package/lib/cli/cliOptions.js

@@ -19,6 +19,7 @@ import {
   METADATA_PROPERTY_CONFIG_KEYS,
   parseMetadataProperties,
 } from "../core/metadataProperties.js";
+import { toCamel } from "../core/paths.js";
 import {
   DEFAULT_CDX_SPEC_VERSION,
   normalizeCycloneDxComponentTypeFilter,
@@ -124,6 +125,106 @@ export function isUserProvided(value, yaDefault) {
   return value !== undefined && value !== yaDefault;
 }
 
+/**
+ * The value the operator gave an option on the command line or through its
+ * CDXGEN_* environment variable. yargs also fills options in from defaults
+ * and from a config file, which cannot be told apart in its output.
+ *
+ * @param {string} option kebab-case option name
+ * @param {object} [context]
+ * @param {string[]} [context.argv] Raw command-line arguments
+ * @param {object} [context.env] Environment variables
+ * @param {boolean} [context.boolean] Read the option as a boolean flag
+ * @returns {string|boolean|undefined} The operator's value, or undefined
+ */
+export function operatorOptionChoice(
+  option,
+  { argv = process.argv.slice(2), env = process.env, boolean = false } = {},
+) {
+  const spellings = [...new Set([option, toCamel(option)])];
+  const toBoolean = (value) =>
+    ["true", "1"].includes(`${value}`.trim().toLowerCase());
+  let choice;
+  for (let i = 0; i < argv.length; i++) {
+    const arg = `${argv[i]}`;
+    if (arg === "--") {
+      break;
+    }
+    for (const name of spellings) {
+      if (boolean && arg === `--no-${name}`) {
+        choice = false;
+      } else if (arg === `--${name}`) {
+        const next = argv[i + 1] === undefined ? "" : `${argv[i + 1]}`;
+        if (!boolean) {
+          choice = next;
+          i++;
+        } else if (["true", "false"].includes(next.toLowerCase())) {
+          choice = toBoolean(next);
+          i++;
+        } else {
+          choice = true;
+        }
+      } else if (arg.startsWith(`--${name}=`)) {
+        const value = arg.slice(name.length + 3);
+        choice = boolean ? toBoolean(value) : value;
+      }
+    }
+  }
+  if (choice !== undefined) {
+    return choice;
+  }
+  const envValue =
+    env[`CDXGEN_${option.toUpperCase().replaceAll("-", "_")}`] ?? "";
+  if (`${envValue}`.trim() === "") {
+    return undefined;
+  }
+  return boolean ? toBoolean(envValue) : `${envValue}`;
+}
+
+/**
+ * Make the operator's choice about running the scanned project's own code
+ * final. A config file is read from the working directory, which is usually
+ * the scanned project, so it carries that project's trust. Neither the config
+ * file nor a profile or lifecycle may turn installs on when the operator
+ * disabled them, and secure mode keeps installs off unless the operator
+ * passes --install-deps. Introspection keeps the project's build tools
+ * running with installs off, which is likewise the operator's decision, so
+ * introspection asked for only by the config file does not do that.
+ *
+ * **Mutates `options` in place.**
+ *
+ * @param {object} options The options object, after applyAdvancedOptions
+ * @param {object} [context]
+ * @param {object} [context.projectConfig] Sanitized config file contents
+ * @param {boolean} [context.isSecureMode] Whether cdxgen runs in secure mode
+ * @param {string[]} [context.argv] Raw command-line arguments
+ * @param {object} [context.env] Environment variables
+ * @returns {void}
+ */
+export function applyOperatorToolingChoice(options, context = {}) {
+  const { projectConfig, argv, env } = context;
+  const secureMode = context.isSecureMode ?? isSecureMode;
+  const installChoice = operatorOptionChoice("install-deps", {
+    argv,
+    env,
+    boolean: true,
+  });
+  if (installChoice === false || (secureMode && installChoice !== true)) {
+    options.installDeps = false;
+  }
+  const configAsksIntrospect =
+    ["true", "1"].includes(`${projectConfig?.introspect}`.toLowerCase()) ||
+    projectConfig?.profile === "introspect";
+  if (
+    options.introspect === true &&
+    configAsksIntrospect &&
+    operatorOptionChoice("introspect", { argv, env, boolean: true }) !== true &&
+    operatorOptionChoice("profile", { argv, env }) !== "introspect"
+  ) {
+    options.introspectFromConfigFile = true;
+  }
+}
+
 /**
  * Combine the custom metadata properties of every source (discussion 4391):
  * the `--metadata-property` flag, the CDXGEN_METADATA_PROPERTY and
@@ -588,7 +689,9 @@ export function applyAdvancedOptions(options, context = {}) {
       options.deep = true;
       options.evidence = false;
       options.includeCrypto = false;
-      options.installDeps = !secureMode;
+      // A profile may skip installs but never turn them back on once they
+      // were disabled, which would run the scanned project's code.
+      options.installDeps = !secureMode && options.installDeps !== false;
       break;
     case "deep-learning":
     case "ml-deep":
@@ -596,7 +699,7 @@ export function applyAdvancedOptions(options, context = {}) {
       options.deep = true;
       options.evidence = true;
       options.includeCrypto = true;
-      options.installDeps = !secureMode;
+      options.installDeps = !secureMode && options.installDeps !== false;
       options.bomAudit = true;
       break;
     default:
@@ -619,7 +722,11 @@ export function applyAdvancedOptions(options, context = {}) {
             "PREVIEW: post-build lifecycle SBOM generation is supported only for limited project types.",
         });
       }
-      options.installDeps = true;
+      // The project is already built, so installs are on only where they
+      // would have been anyway: a disabled install stays disabled.
+      if (options.installDeps !== false) {
+        options.installDeps = true;
+      }
       break;
     default:
       break;