@cdxgen/cdxgen 13.5.0 → 13.6.0

package/lib/evinser/evinser.js

@@ -1,4 +1,5 @@
 import fs from "node:fs";
+import { builtinModules } from "node:module";
 import path, { basename, join, resolve } from "node:path";
 import process from "node:process";
 
@@ -54,6 +55,7 @@ import {
   isScalasemLanguage,
 } from "../ecosystems/scalasem.js";
 import {
+  atomBomFileArgs,
   atomBuildToolArgs,
   atomCompileCommandsArgs,
   buildAtomCommandEnv,
@@ -91,6 +93,7 @@ import {
   readDosaiMethodsReport,
 } from "../inventory/dosai.js";
 import { parseOccurrenceEvidenceLocation } from "../inventory/evidenceUtils.js";
+import { splitPurlLoose } from "../inventory/purl.js";
 import { executeOsQuery } from "../managers/binary.js";
 import { MAX_JSON_TEXT_BYTES, readJsonFile } from "../parsers/largeJson.js";
 import { postProcess } from "../stages/postgen/postgen.js";
@@ -98,7 +101,8 @@ import { createOrLoad } from "./db.js";
 import { findPurlLocations } from "./scalasem.js";
 import { createSemanticsSlices } from "./swiftsem.js";
 
-const typePurlsCache = {};
+// keyed by type names, which can be "constructor", "toString", ...: no prototype
+const typePurlsCache = Object.create(null);
 
 function appendUniqueProperty(properties, name, value) {
   if (value === undefined || value === null || value === "") {
@@ -261,6 +265,7 @@ export function buildEvinseOptions(options, args, input) {
     force: false,
     withReachables: options.deep,
     usagesSlicesFile: options.usagesSlicesFile,
+    callsitesSlicesFile: options.callsitesSlicesFile,
     dataFlowSlicesFile: options.dataFlowSlicesFile,
     reachablesSlicesFile: options.reachablesSlicesFile,
     semanticsSlicesFile: options.semanticsSlicesFile,
@@ -734,6 +739,7 @@ export async function createSlice(
     args.push("--slice-depth");
     args.push(readEnvironmentVariable("ATOM_SLICE_DEPTH"));
   }
+  args.push(...atomBomFileArgs(sliceType, options));
   args.push(...atomCompileCommandsArgs(filePath, language, options));
   args.push(...buildToolArgs);
   args.push(resolve(filePath));
@@ -1573,6 +1579,7 @@ export async function analyzeProject(dbObjMap, options) {
     cryptoGeneratePurls = retMap.cryptoGeneratePurls;
   }
   // Reuse existing usages slices
+  let usagesAtomFile;
   if (options.usagesSlicesFile && usableSlicesFile(options.usagesSlicesFile)) {
     usageSlice = filterAtomSliceData(
       readSlicesFile(options.usagesSlicesFile, "usages"),
@@ -1582,6 +1589,7 @@ export async function analyzeProject(dbObjMap, options) {
   } else {
     // Generate our own slices
     retMap = await createSlice(language, dirPath, "usages", options);
+    usagesAtomFile = retMap?.atomFile || "";
     if (retMap?.slicesFile && safeExistsSync(retMap.slicesFile)) {
       usageSlice = filterAtomSliceData(
         readSlicesFile(retMap.slicesFile, "usages"),
@@ -1661,6 +1669,35 @@ export async function analyzeProject(dbObjMap, options) {
     servicesMap = retMap.servicesMap;
     userDefinedTypesMap = retMap.userDefinedTypesMap;
   }
+  // Parse the callsites slice (JS/TS): one record per external use site, each
+  // record's own (file, line) is an occurrence of the module's package. The
+  // usages slice above still provides services and endpoints.
+  if (JS_LANGUAGES.includes(language)) {
+    let callsitesSlice;
+    if (
+      options.callsitesSlicesFile &&
+      usableSlicesFile(options.callsitesSlicesFile)
+    ) {
+      callsitesSlice = readSlicesFile(options.callsitesSlicesFile, "callsites");
+    } else if (
+      usagesAtomFile !== undefined &&
+      !safeExistsSync(usagesAtomFile)
+    ) {
+      // The usages run above built no atom (stopped at the timeout, or atom
+      // failed); a callsites run would rebuild the same atom and fail the same way.
+      console.log(
+        "Skipping the callsites slice since atom could not build the atom for the usages slice.",
+      );
+    } else {
+      retMap = await createSlice(language, dirPath, "callsites", options);
+      if (retMap?.slicesFile && safeExistsSync(retMap.slicesFile)) {
+        callsitesSlice = readSlicesFile(retMap.slicesFile, "callsites");
+      }
+    }
+    if (callsitesSlice?.callsites?.length) {
+      attributeJsCallsites(callsitesSlice, purlImportsMap, purlLocationMap);
+    }
+  }
   // A component whose calls the slices do not show (code inside the project,
   // such as a vendored library) is still used where its header is included
   for (const [purl, includeLocations] of cIncludeLocations) {
@@ -1968,8 +2005,15 @@ export async function parseSliceUsages(
 ) {
   const fileName = slice.fileName;
   const typesToLookup = new Set();
-  const lKeyOverrides = {};
-  const usages = slice.usages || [];
+  // keyed by type names, which can be "constructor", "toString", ...: no prototype
+  const lKeyOverrides = Object.create(null);
+  // A user defined type has no usages; its fields' types are evidence at the fields' lines.
+  const usages =
+    slice.usages ||
+    (slice.fields || [])
+      .filter((f) => f?.typeFullName)
+      .map((f) => ({ targetObj: f }));
+  const isJs = JS_LANGUAGES.includes(language);
   // What should be the line number to use. slice.lineNumber would be quite coarse and could lead to reports such as
   // #1670. Line numbers under targetObj and definedBy is a safe bet for dynamic languages, but occassionally leads to
   // confusion when inter-procedural tracking works better than expected.
@@ -1992,13 +2036,27 @@ export async function parseSliceUsages(
       sliceLineNumber ||
       ausage?.targetObj?.lineNumber ||
       ausage?.definedBy?.lineNumber;
+    // JavaScript entries name the imported module they resolve to; attribute those by package
+    // and keep the symbol-based matching below for entries without one.
+    if (isJs) {
+      attributeJsModules(ausage, fileName, purlImportsMap, purlLocationMap);
+    }
+    const viaSymbols = (o) => !(isJs && o?.module);
     // First capture the types in the targetObj and definedBy
     for (const atype of [
-      [ausage?.targetObj?.isExternal, ausage?.targetObj?.typeFullName],
-      [ausage?.targetObj?.isExternal, ausage?.targetObj?.resolvedMethod],
-      [ausage?.definedBy?.name?.includes("::"), ausage?.definedBy?.name],
-      [ausage?.definedBy?.isExternal, ausage?.definedBy?.typeFullName],
-      [ausage?.definedBy?.isExternal, ausage?.definedBy?.resolvedMethod],
+      ...(viaSymbols(ausage?.targetObj)
+        ? [
+            [ausage?.targetObj?.isExternal, ausage?.targetObj?.typeFullName],
+            [ausage?.targetObj?.isExternal, ausage?.targetObj?.resolvedMethod],
+          ]
+        : []),
+      ...(viaSymbols(ausage?.definedBy)
+        ? [
+            [ausage?.definedBy?.name?.includes("::"), ausage?.definedBy?.name],
+            [ausage?.definedBy?.isExternal, ausage?.definedBy?.typeFullName],
+            [ausage?.definedBy?.isExternal, ausage?.definedBy?.resolvedMethod],
+          ]
+        : []),
       ...(ausage?.fields || []).map((f) => [f?.isExternal, f?.typeFullName]),
     ]) {
       if (
@@ -2039,7 +2097,8 @@ export async function parseSliceUsages(
     for (const acall of []
       .concat(ausage?.invokedCalls || [])
       .concat(ausage?.argToCalls || [])
-      .concat(ausage?.procedures || [])) {
+      .concat(ausage?.procedures || [])
+      .filter(viaSymbols)) {
       if (
         acall.resolvedMethod?.startsWith("@") ||
         acall?.callName?.includes("::")
@@ -2139,9 +2198,7 @@ export async function parseSliceUsages(
               if (!purlLocationMap[apurl]) {
                 purlLocationMap[apurl] = new Set();
               }
-              if (lKeyOverrides[atype]) {
-                purlLocationMap[apurl].add(...lKeyOverrides[atype]);
-              }
+              addAllLocations(purlLocationMap[apurl], lKeyOverrides[atype]);
             }
           }
         } else {
@@ -2149,9 +2206,7 @@ export async function parseSliceUsages(
             if (!purlLocationMap[apurl]) {
               purlLocationMap[apurl] = new Set();
             }
-            if (lKeyOverrides[atype]) {
-              purlLocationMap[apurl].add(...lKeyOverrides[atype]);
-            }
+            addAllLocations(purlLocationMap[apurl], lKeyOverrides[atype]);
           }
         }
       }
@@ -2173,9 +2228,7 @@ export async function parseSliceUsages(
           if (!purlLocationMap[ns.purl]) {
             purlLocationMap[ns.purl] = new Set();
           }
-          if (lKeyOverrides[atype]) {
-            purlLocationMap[ns.purl].add(...lKeyOverrides[atype]);
-          }
+          addAllLocations(purlLocationMap[ns.purl], lKeyOverrides[atype]);
         }
         typePurlsCache[atype] = nsHits;
       } else {
@@ -2583,6 +2636,17 @@ export function detectServicesFromOpenAPI(
  * @param {Array} slice Usages array for each objectSlice
  * @param {Object} servicesMap Existing service map
  */
+/**
+ * The text routes and endpoints are read from: JavaScript slices keep a call's source text in
+ * `code` and the resolved callee name in `resolvedMethod`; other languages have only the latter.
+ *
+ * @param {Object|undefined} entry slice entry
+ * @returns {string|undefined} text
+ */
+function sourceTextOf(entry) {
+  return entry?.code || entry?.resolvedMethod;
+}
+
 export function detectServicesFromUsages(language, slice, servicesMap = {}) {
   const usages = slice.usages;
   if (!usages) {
@@ -2595,30 +2659,30 @@ export function detectServicesFromUsages(language, slice, servicesMap = {}) {
     let authenticated;
     if (language === "ruby" && definedBy?.name?.includes("/")) {
       endpoints = extractEndpoints(language, definedBy.name);
-    } else if (targetObj?.resolvedMethod) {
+    } else if (sourceTextOf(targetObj)) {
       if (language !== "php") {
-        endpoints = extractEndpoints(language, targetObj?.resolvedMethod);
+        endpoints = extractEndpoints(language, sourceTextOf(targetObj));
       }
-      if (targetObj?.resolvedMethod.toLowerCase().includes("auth")) {
+      if (sourceTextOf(targetObj).toLowerCase().includes("auth")) {
         authenticated = true;
       }
-    } else if (definedBy?.resolvedMethod) {
+    } else if (sourceTextOf(definedBy)) {
       if (language !== "php") {
-        endpoints = extractEndpoints(language, definedBy?.resolvedMethod);
+        endpoints = extractEndpoints(language, sourceTextOf(definedBy));
       }
-      if (definedBy?.resolvedMethod.toLowerCase().includes("auth")) {
+      if (sourceTextOf(definedBy).toLowerCase().includes("auth")) {
         authenticated = true;
       }
     }
     if (usage.invokedCalls) {
       for (const acall of usage.invokedCalls) {
-        if (acall.resolvedMethod) {
+        if (sourceTextOf(acall)) {
           if (language !== "php") {
             const tmpEndpoints = extractEndpoints(
               language,
-              acall.resolvedMethod,
+              sourceTextOf(acall),
             );
-            if (acall.resolvedMethod.toLowerCase().includes("auth")) {
+            if (sourceTextOf(acall).toLowerCase().includes("auth")) {
               authenticated = true;
             }
             if (tmpEndpoints?.length) {
@@ -2824,6 +2888,72 @@ export function extractEndpoints(language, code) {
   return endpoints;
 }
 
+/**
+ * Key naming the package a purl refers to, independent of its version,
+ * qualifiers and subpath. Namespace and name are the decoded purl segments,
+ * so an encoded scope (`%40angular/common`) keys like a plain one.
+ *
+ * @param {string} purl Purl string
+ * @returns {string|undefined} `type/namespace/name`, or undefined for a non-purl
+ */
+export function versionlessPurlKey(purl) {
+  const parts = splitPurlLoose(purl);
+  if (!parts) {
+    return undefined;
+  }
+  return `${parts.type}/${parts.namespace || ""}/${parts.name}`;
+}
+
+/**
+ * Index the data-flow frames recorded under versionless flow purls by
+ * {@link versionlessPurlKey}. A flow purl without a version attaches to every
+ * BOM component of the same package name, whatever its version (maintainer
+ * decision, 2026-10-27); chen leaves the version off exactly when it cannot
+ * pick one between apps that pin the package differently.
+ *
+ * @param {Object} dataFlowFrames Frames keyed by flow purl
+ * @returns {Object} Frames keyed by versionless purl key
+ */
+export function indexVersionlessPurls(dataFlowFrames) {
+  const index = {};
+  for (const [purl, frames] of Object.entries(dataFlowFrames || {})) {
+    if (splitPurlLoose(purl)?.version === null) {
+      const key = versionlessPurlKey(purl);
+      if (!key) {
+        continue;
+      }
+      index[key] ??= [];
+      index[key].push(...frames);
+    }
+  }
+  return index;
+}
+
+/**
+ * Index the crypto generate pools recorded under versionless flow purls by
+ * {@link versionlessPurlKey}, the crypto counterpart of
+ * {@link indexVersionlessPurls}.
+ *
+ * @param {Object} cryptoGeneratePurls Algorithm bom-refs keyed by flow purl
+ * @returns {Object} Algorithm bom-ref sets keyed by versionless purl key
+ */
+export function indexVersionlessCrypto(cryptoGeneratePurls) {
+  const index = {};
+  for (const [purl, algos] of Object.entries(cryptoGeneratePurls || {})) {
+    if (splitPurlLoose(purl)?.version === null) {
+      const key = versionlessPurlKey(purl);
+      if (!key) {
+        continue;
+      }
+      index[key] ??= new Set();
+      for (const ref of algos || []) {
+        index[key].add(ref);
+      }
+    }
+  }
+  return index;
+}
+
 /**
  * Method to create the SBOM with evidence file called evinse file.
  *
@@ -2875,6 +3005,15 @@ export async function createEvinseFile(sliceArtefacts, options) {
   let servicesPresent = false;
   const propertyEvidencePresent =
     metadataProperties.length || Object.keys(componentPropertiesMap).length;
+  // Versionless flow purls attach to every same-name component (see
+  // indexVersionlessPurls), so look both ways: exact purl first, then the
+  // versionless index.
+  const versionlessFrames = indexVersionlessPurls(dataFlowFrames);
+  const versionlessCrypto = indexVersionlessCrypto(cryptoGeneratePurls);
+  const depCryptoPurls =
+    Object.keys(versionlessCrypto).length && cryptoGeneratePurls
+      ? { ...cryptoGeneratePurls }
+      : cryptoGeneratePurls;
   for (const comp of [bomJson.metadata?.component, ...components]) {
     if (!comp?.purl) {
       continue;
@@ -2895,7 +3034,12 @@ export async function createEvinseFile(sliceArtefacts, options) {
         .map((l) => parseOccurrenceEvidenceLocation(l));
       occEvidencePresent = true;
     }
-    const dfFrames = dataFlowFrames[comp.purl];
+    const compKey = versionlessPurlKey(comp.purl);
+    let dfFrames = dataFlowFrames[comp.purl];
+    const extraFrames = compKey ? versionlessFrames[compKey] : undefined;
+    if (extraFrames?.length) {
+      dfFrames = [...(dfFrames || []), ...extraFrames];
+    }
     if (dfFrames?.length) {
       if (!comp.evidence) {
         comp.evidence = {};
@@ -2909,10 +3053,20 @@ export async function createEvinseFile(sliceArtefacts, options) {
       }
     }
     // Add crypto tags if this purl offers any generation algorithm
-    if (
-      cryptoGeneratePurls?.[comp.purl] &&
-      Array.from(cryptoGeneratePurls[comp.purl]).length
-    ) {
+    let compCryptoPurls = cryptoGeneratePurls?.[comp.purl];
+    const extraCrypto = compKey ? versionlessCrypto[compKey] : undefined;
+    if (extraCrypto?.size) {
+      compCryptoPurls = new Set([...(compCryptoPurls || []), ...extraCrypto]);
+      // The provides section below looks pool entries up by bom-ref, so the
+      // merged set has to be reachable that way too.
+      if (depCryptoPurls) {
+        depCryptoPurls[comp.purl] = compCryptoPurls;
+        if (comp["bom-ref"]) {
+          depCryptoPurls[comp["bom-ref"]] = compCryptoPurls;
+        }
+      }
+    }
+    if (compCryptoPurls && Array.from(compCryptoPurls).length) {
       comp.tags = ["crypto", "crypto-generate"];
     }
   } // for
@@ -2944,14 +3098,14 @@ export async function createEvinseFile(sliceArtefacts, options) {
   }
   // Fix the dependencies section with provides information
   if (
-    cryptoGeneratePurls &&
-    Object.keys(cryptoGeneratePurls).length &&
+    depCryptoPurls &&
+    Object.keys(depCryptoPurls).length &&
     bomJson.dependencies
   ) {
     const newDependencies = [];
     for (const depObj of bomJson.dependencies) {
-      if (depObj.ref && cryptoGeneratePurls[depObj.ref]) {
-        const providedAlgos = Array.from(cryptoGeneratePurls[depObj.ref]);
+      if (depObj.ref && depCryptoPurls[depObj.ref]) {
+        const providedAlgos = Array.from(depCryptoPurls[depObj.ref]);
         if (providedAlgos.length) {
           depObj.provides = providedAlgos;
         }
@@ -3196,15 +3350,15 @@ export function collectReachableFrames(_language, reachablesSlice) {
       if (tagStr.includes("crypto")) {
         isCryptoFlow = true;
       }
+      // Join with a space: findCryptoAlgos treats every non-alphanumeric as a
+      // word separator, and a space is the one separator cleanStr keeps.
       if (isCryptoFlow && fnode.code) {
-        codeSnippets = `${codeSnippets}\\n${fnode.code}`;
+        codeSnippets = `${codeSnippets} ${fnode.code}`;
       }
-      if (
-        tagStr.includes("crypto-generate") ||
-        fnode.code.includes("encrypt") ||
-        fnode.code.includes("decrypt") ||
-        fnode.code.includes("sign")
-      ) {
+      // Pool membership is tag-driven: a node contributes its pkg: tags only
+      // when the tagger marked it crypto-generate. Code substring tests read
+      // assign/design/signup into encrypt/decrypt/sign and are gone.
+      if (tagStr.includes("crypto-generate")) {
         cpurls = tagStr.split(", ").filter((t) => t.startsWith("pkg:"));
         for (const cpurl of cpurls) {
           if (!cryptoGeneratePurls[cpurl]) {
@@ -3407,6 +3561,155 @@ export function getClassTypeFromSignature(language, typeFullName) {
   return simplifyType(typeFullName);
 }
 
+const JS_LANGUAGES = ["javascript", "js", "ts", "typescript"];
+
+/**
+ * Add every location of a set to a purl's locations (Set.add takes a single value).
+ *
+ * @param {Set<string>} target purl location set
+ * @param {Set<string>|undefined} locations locations to add
+ */
+function addAllLocations(target, locations) {
+  for (const l of locations || []) {
+    target.add(l);
+  }
+}
+
+/**
+ * npm package name of a JavaScript module specifier: `@scope/pkg/sub` -> `@scope/pkg`,
+ * `lodash/fp` -> `lodash`. Node.js builtins (`node:fs`, `fs`) are not packages.
+ *
+ * @param {string} module module specifier
+ * @returns {string|undefined} package name
+ */
+export function jsPackageOfModule(module) {
+  if (!module || module.startsWith("node:") || module.startsWith(".")) {
+    return undefined;
+  }
+  const parts = module.split("/");
+  const pkg = module.startsWith("@") ? parts.slice(0, 2).join("/") : parts[0];
+  if (isNodeBuiltin(pkg)) {
+    return undefined;
+  }
+  return pkg;
+}
+
+function isNodeBuiltin(name) {
+  return NODE_BUILTINS.has(name);
+}
+
+const NODE_BUILTINS = new Set(builtinModules);
+
+const jsPurlsByPackageCache = new WeakMap();
+
+function jsPurlsByPackage(purlImportsMap) {
+  let byPackage = jsPurlsByPackageCache.get(purlImportsMap);
+  if (!byPackage) {
+    byPackage = {};
+    for (const apurl of Object.keys(purlImportsMap || {})) {
+      try {
+        const purlObj = Purl.parse(apurl);
+        if (purlObj.type !== "npm") {
+          continue;
+        }
+        const name = purlObj.namespace
+          ? `${purlObj.namespace}/${purlObj.name}`
+          : purlObj.name;
+        (byPackage[name] = byPackage[name] || []).push(apurl);
+      } catch (_e) {
+        // not a valid purl
+      }
+    }
+    jsPurlsByPackageCache.set(purlImportsMap, byPackage);
+  }
+  return byPackage;
+}
+
+/**
+ * Attribute a JavaScript usage's module-qualified entries to the packages providing them.
+ *
+ * Each call entry with a `module` is a use of that module's package at the call's line. When
+ * the slice's object is an import binding (defined by a require/import naming the module),
+ * every call the object takes part in is a use of that package too.
+ *
+ * @param {Object} ausage usage entry of an object slice
+ * @param {string} fileName file of the slice
+ * @param {Object} purlImportsMap purl -> imported modules and symbols
+ * @param {Object} purlLocationMap purl -> Set of `file#line`
+ */
+export function attributeJsModules(
+  ausage,
+  fileName,
+  purlImportsMap,
+  purlLocationMap,
+) {
+  const byPackage = jsPurlsByPackage(purlImportsMap);
+  const record = (module, line) => {
+    const pkg = jsPackageOfModule(module);
+    if (!pkg || !line) {
+      return;
+    }
+    for (const apurl of byPackage[pkg] || []) {
+      if (!purlLocationMap[apurl]) {
+        purlLocationMap[apurl] = new Set();
+      }
+      purlLocationMap[apurl].add(`${fileName}#${line}`);
+    }
+  };
+  const calls = []
+    .concat(ausage?.invokedCalls || [])
+    .concat(ausage?.argToCalls || []);
+  for (const c of [ausage?.targetObj, ausage?.definedBy, ...calls]) {
+    if (c?.module) {
+      record(c.module, c.lineNumber);
+    }
+  }
+  // Only an import binding stands for its module: a value merely returned by a package's call
+  // (`const s = purl.toString()`) is not a use of that package wherever it goes.
+  const definedBy = ausage?.definedBy;
+  const isImportBinding =
+    definedBy?.name === "require" ||
+    definedBy?.name === "import" ||
+    /^(require|import)\(/.test(definedBy?.code || "");
+  const bindingModule = isImportBinding ? definedBy?.module : undefined;
+  if (bindingModule) {
+    for (const c of calls) {
+      record(bindingModule, c?.lineNumber);
+    }
+  }
+}
+
+/**
+ * Attribute a callsites slice's records to the packages providing their modules.
+ *
+ * Each record of `{"callsites": [...]}` (atom `callsites` command) is one external use site
+ * carrying its own file and line; the record is an occurrence of every purl whose package
+ * matches the record's module.
+ *
+ * @param {Object} callsitesSlice callsites slice with a `callsites` array
+ * @param {Object} purlImportsMap purl -> imported modules and symbols
+ * @param {Object} purlLocationMap purl -> Set of `file#line`
+ */
+export function attributeJsCallsites(
+  callsitesSlice,
+  purlImportsMap,
+  purlLocationMap,
+) {
+  const byPackage = jsPurlsByPackage(purlImportsMap);
+  for (const record of callsitesSlice?.callsites || []) {
+    const pkg = jsPackageOfModule(record?.module);
+    if (!pkg || !(record.line > 0)) {
+      continue;
+    }
+    for (const apurl of byPackage[pkg] || []) {
+      if (!purlLocationMap[apurl]) {
+        purlLocationMap[apurl] = new Set();
+      }
+      purlLocationMap[apurl].add(`${record.file}#${record.line}`);
+    }
+  }
+}
+
 function addToOverrides(lKeyOverrides, atype, fileName, ausageLineNumber) {
   if (!lKeyOverrides[atype]) {
     lKeyOverrides[atype] = new Set();