@cdxgen/cdxgen 13.5.0 → 13.6.0

package/lib/inventory/formulationParsers.js

@@ -4,7 +4,9 @@ import { basename } from "node:path";
 import process from "node:process";
 
 import { readEnvironmentVariable } from "../core/activity.js";
+import { PROJECT_TYPE_ALIASES } from "../core/env.js";
 import { getAllFiles } from "../core/fs.js";
+import { thoughtLog } from "../core/logger.js";
 import { collectOSCryptoLibs } from "./cbomutils.js";
 import { azurePipelinesParser } from "./ciParsers/azurePipelines.js";
 import { circleCiParser } from "./ciParsers/circleCi.js";
@@ -187,6 +189,16 @@ const ENV_BLOCKLIST = [
   "webhook",
 ];
 
+// The project types a scan asked for, as given on the command line.
+function requestedProjectTypes(options) {
+  return [].concat(options?.projectType || []).flatMap((type) =>
+    `${type}`
+      .split(",")
+      .map((part) => part.trim().toLowerCase())
+      .filter(Boolean),
+  );
+}
+
 /**
  * Build the formulation section for a CycloneDX BOM.
  *
@@ -285,15 +297,31 @@ export function addFormulationSection(filePath, options, context = {}) {
     }
   }
 
+  // The toolchains and OS crypto libraries are probed on the machine cdxgen
+  // runs on. A container image or root filesystem was built elsewhere, so the
+  // scanning host's tools say nothing about it.
+  // Only an explicit container type counts: hasAnyProjectType treats
+  // `universal` as every type, and a universal source scan runs on the host.
+  const describesScanningHost = !requestedProjectTypes(options).some((type) =>
+    PROJECT_TYPE_ALIASES.oci.includes(type),
+  );
+  if (!describesScanningHost) {
+    thoughtLog(
+      "Skipping the toolchain and OS crypto library probes for formulation, since they would describe the scanning host and not the image.",
+    );
+  }
+
   // Build environment details (Java, .NET, Python, Node, GCC, Rust, Go, Ruby,
-  // PHP, Composer)
-  const infoComponents = collectEnvInfo(projectPath, options);
+  // RubyGems, Bundler, PHP, Composer)
+  const infoComponents = describesScanningHost
+    ? collectEnvInfo(projectPath, options)
+    : [];
   if (infoComponents?.length) {
     components = components.concat(infoComponents);
   }
 
   // OS crypto libraries (cbom mode)
-  if (options.includeCrypto) {
+  if (options.includeCrypto && describesScanningHost) {
     const cryptoLibs = collectOSCryptoLibs(options, context?.executeOsQuery);
     if (cryptoLibs?.length) {
       components = components.concat(cryptoLibs);

package/lib/inventory/gtfobins.js

@@ -17,6 +17,15 @@ const MATCH_FIELDS = [
   "executable",
   "description",
 ];
+// Rows of these categories name an account, not a program: a user called
+// `node` or `git` is no use of the binary of that name, and the GECOS comment
+// in the description is free text about the account.
+const ACCOUNT_CATEGORIES = new Set([
+  "authorized_keys_snapshot",
+  "logged_in_users_snapshot",
+  "users_snapshot",
+]);
+const ACCOUNT_SKIPPED_FIELDS = new Set(["name", "description"]);
 const UNIX_PATH_PATTERN = /(?:^|[\s'"`=;|&(])((?:\.{0,2}\/|\/)[^\s'"`|;&()]+)/g;
 const STANDALONE_COMMAND_PATTERN =
   /(?:^|[\s;|&(])([a-z_][a-z0-9+._-]{1,})(?=$|[\s'"`|;&()])/gi;
@@ -250,7 +259,11 @@ export function createGtfoBinsProperties(name, linkedName) {
  */
 export function createGtfoBinsPropertiesFromRow(queryCategory, row) {
   const matches = new Map();
+  const isAccount = ACCOUNT_CATEGORIES.has(queryCategory);
   for (const field of MATCH_FIELDS) {
+    if (isAccount && ACCOUNT_SKIPPED_FIELDS.has(field)) {
+      continue;
+    }
     const fieldValue = row?.[field];
     if (!fieldValue) {
       continue;