@cdxgen/cdxgen 13.5.0 → 13.6.0

package/lib/cli/managedBom.js

@@ -6,6 +6,7 @@ import {
   extname,
   isAbsolute,
   join,
+  relative,
   resolve,
 } from "node:path";
 import process from "node:process";
@@ -101,11 +102,14 @@ import {
   addRubyGemsDistributionUrls,
   addRubyRuntimeComponent,
   collectGemModuleNames,
+  collectProjectRubyDeclarations,
   describeProjectGem,
   enrichGemsFromLocalCache,
   parseBundleConfig,
   parseGemfileLockData,
   parseGemspecData,
+  resolveProjectRuby,
+  toGemPurl,
 } from "../ecosystems/rubyutils.js";
 import { getTerraformRegistryMetadata } from "../ecosystems/terraformRegistry.js";
 import {
@@ -152,7 +156,11 @@ import {
 import { addEvidenceForDotnet } from "../inventory/evidenceUtils.js";
 import { resolvePluginBinary } from "../inventory/plugins.js";
 import { nugetPurl, pypiBomRef } from "../inventory/purl.js";
-import { classifyProbeResult } from "../inventory/toolRequirements.js";
+import { isInsideInstalledGem } from "../inventory/rubyBuildInfo.js";
+import {
+  classifyProbeResult,
+  parseGemfileLockBundlerVersion,
+} from "../inventory/toolRequirements.js";
 import { getPluginToolComponents } from "../managers/binary.js";
 import { getTreeWithPlugin } from "../managers/piptree.js";
 import {
@@ -1429,7 +1437,14 @@ export async function createRubyBom(path, options) {
   if (typeof options.includeNodeModulesDir === "undefined" || options.deep) {
     options.includeNodeModulesDir = true;
   }
-  const excludeList = (options.exclude || []).concat(["**/vendor/cache/**"]);
+  // RubyGems caches the specs it fetched from a source under ~/.cache/gem/specs
+  // and ~/.gem/specs, Marshal-dumped into files named <gem>-<version>.gemspec.
+  // Those describe what a source offered, not what is installed.
+  const excludeList = (options.exclude || []).concat([
+    "**/vendor/cache/**",
+    "**/.cache/gem/specs/**",
+    "**/.gem/specs/**",
+  ]);
   const gemLockExcludeList = (options.exclude || []).concat([
     "**/vendor/bundle/ruby/**/Gemfile.lock",
     "**/test/data/**/Gemfile*.lock",
@@ -1455,6 +1470,12 @@ export async function createRubyBom(path, options) {
       exclude: gemLockExcludeList,
     },
   );
+  // An installed gem's own directory can hold its development Gemfile.lock,
+  // nested gemspecs and manifests (rbs ships steep/Gemfile.lock, typeprof a
+  // VS Code extension). They describe how the gem is developed, not what is
+  // installed, and would add gems that are not there.
+  const isGemInternalFile = (f) =>
+    isInsideInstalledGem(f, safeExistsSync, path);
   let gemspecFiles = getAllFiles(
     path,
     `${options.multiProject ? "**/" : ""}*.gemspec`,
@@ -1462,7 +1483,7 @@ export async function createRubyBom(path, options) {
       ...options,
       exclude: excludeList,
     },
-  );
+  ).filter((f) => !isGemInternalFile(f));
   let gemHome =
     readEnvironmentVariable("CDXGEN_GEM_HOME") ||
     readEnvironmentVariable("GEM_HOME");
@@ -1543,7 +1564,9 @@ export async function createRubyBom(path, options) {
       ...options,
       exclude: gemLockExcludeList,
     },
-  );
+  ).filter((f) => !isGemInternalFile(f));
+  // The lockfiles each Bundler release resolved
+  const bundlerVersions = new Map();
   if (gemLockFiles.length) {
     for (const f of gemLockFiles) {
       if (DEBUG_MODE) {
@@ -1551,6 +1574,15 @@ export async function createRubyBom(path, options) {
       }
       const gemLockData = readFileSync(f, { encoding: "utf-8" });
       const retMap = await parseGemfileLockData(gemLockData, f, { gemHome });
+      // Bundler is not listed among the specs, but runs every bundle: the
+      // lockfile names the release that resolved it under BUNDLED WITH.
+      const bundlerVersion = parseGemfileLockBundlerVersion(gemLockData);
+      if (bundlerVersion) {
+        bundlerVersions.set(bundlerVersion, [
+          ...(bundlerVersions.get(bundlerVersion) || []),
+          f,
+        ]);
+      }
       if (retMap.pkgList?.length) {
         pkgList = pkgList.concat(retMap.pkgList);
         pkgList = trimComponents(pkgList);
@@ -1633,6 +1665,42 @@ export async function createRubyBom(path, options) {
       options,
     ));
   }
+  for (const [bundlerVersion, lockFiles] of [...bundlerVersions.entries()].sort(
+    (a, b) => a[0].localeCompare(b[0]),
+  )) {
+    const purl = toGemPurl("bundler", bundlerVersion);
+    const ref = decodeURIComponent(purl);
+    if (pkgList.some((p) => p["bom-ref"] === ref)) {
+      continue;
+    }
+    pkgList.push({
+      name: "bundler",
+      version: bundlerVersion,
+      purl,
+      "bom-ref": ref,
+      scope: "required",
+      properties: [
+        { name: "cdx:gem:bundledWith", value: "true" },
+        { name: "internal:SrcFile", value: lockFiles.join(", ") },
+      ],
+      evidence: {
+        identity: [
+          {
+            field: "purl",
+            confidence: 0.8,
+            methods: [
+              {
+                technique: "manifest-analysis",
+                confidence: 0.8,
+                value: lockFiles.join(", "),
+              },
+            ],
+          },
+        ],
+      },
+    });
+    rootList.push(ref);
+  }
   if (rootList.length) {
     dependencies = mergeDependencies(
       dependencies,
@@ -1737,18 +1805,76 @@ export async function createRubyBom(path, options) {
   pkgList = await enrichGemsFromLocalCache(pkgList, { gemHome });
   // The download URL of a gem from the public registry needs no network call
   pkgList = addRubyGemsDistributionUrls(pkgList);
-  // Gems declare the Ruby they run on; surface it as the runtime they depend
-  // on. The component says the runtime is external, which only CycloneDX 1.7
-  // can express, and a container image ships its own Ruby.
-  if (
-    options.specVersion >= 1.7 &&
-    !hasAnyProjectType(["oci"], options, false)
-  ) {
-    ({ pkgList, dependencies } = addRubyRuntimeComponent(
-      pkgList,
-      parentComponent,
-      dependencies,
-    ));
+  // The project and its gems declare the Ruby they run on; surface it as the
+  // runtime they depend on. A pinned Ruby (Gemfile.lock, .ruby-version,
+  // .tool-versions, mise, the Gemfile) is a version with a CPE, which every
+  // spec version can carry. A bare range needs CycloneDX 1.7's versionRange
+  // and isExternal. A container image ships its own Ruby, which the image
+  // scan reads from the interpreter's files.
+  if (!hasAnyProjectType(["oci"], options, false)) {
+    // Each project of a multi-project scan pins its own Ruby
+    const rootDir = resolve(path);
+    const projectDirs = [rootDir];
+    if (options.multiProject) {
+      for (const f of [...gemLockFiles, ...gemFiles]) {
+        const dir = dirname(resolve(f));
+        if (!projectDirs.includes(dir)) {
+          projectDirs.push(dir);
+        }
+      }
+    }
+    const rubies = [];
+    for (const dir of projectDirs) {
+      const ruby = resolveProjectRuby(collectProjectRubyDeclarations(dir));
+      if (!ruby) {
+        continue;
+      }
+      if (dir !== rootDir && ruby.source) {
+        ruby.source = relative(rootDir, join(dir, ruby.source)).replaceAll(
+          "\\",
+          "/",
+        );
+      }
+      if (ruby.conflicts?.length) {
+        console.log(
+          `NOTE: The project in ${dir} declares more than one Ruby. The BOM records ${ruby.engine} ${ruby.version} from ${ruby.source}; also declared: ${ruby.conflicts.join(", ")}.`,
+        );
+      }
+      rubies.push(ruby);
+    }
+    // One runtime per distinct pinned Ruby; the scanned directory's first
+    const pinned = [];
+    for (const ruby of rubies) {
+      if (
+        ruby.version &&
+        !pinned.some(
+          (other) =>
+            other.engine === ruby.engine && other.version === ruby.version,
+        )
+      ) {
+        pinned.push(ruby);
+      }
+    }
+    const [primary, ...others] = pinned.length ? pinned : rubies.slice(0, 1);
+    if (options.specVersion >= 1.7 || primary?.version) {
+      ({ pkgList, dependencies } = addRubyRuntimeComponent(
+        pkgList,
+        parentComponent,
+        dependencies,
+        primary,
+      ));
+    }
+    // The gems were linked to the first; the others hang off the project
+    for (const ruby of others) {
+      let extra;
+      ({ pkgList: extra, dependencies } = addRubyRuntimeComponent(
+        [],
+        parentComponent,
+        dependencies,
+        ruby,
+      ));
+      pkgList = pkgList.concat(extra);
+    }
   }
   return buildBomNSData(options, pkgList, "gem", {
     src: path,

package/lib/cli/nativeBom.js

@@ -45,7 +45,12 @@ import {
   emptyCppBuildContext,
   resolveCppBuildContext,
 } from "../ecosystems/cppBuildContext.js";
-import { getCppModules, hasCppSources } from "../ecosystems/cppEvidence.js";
+import {
+  getCppModules,
+  hasCppSources,
+  installedVcpkgPorts,
+  parseVcpkgManifest,
+} from "../ecosystems/cppEvidence.js";
 import {
   getCratesMetadata,
   getSwiftPackageMetadata,
@@ -132,6 +137,10 @@ import { resolveZigGraph } from "../ecosystems/zigResolver.js";
 import { cmakeBuildDirCandidates } from "../inventory/cmakeBuildDirs.js";
 import { mergeDependencies, trimComponents } from "../inventory/depsUtils.js";
 import { convertOSQueryResults } from "../inventory/evidenceUtils.js";
+import {
+  clojureMirrorArgs,
+  leiningenMirrorArgs,
+} from "../inventory/mavenCentralMirror.js";
 import { applyPurl, nixBomRef, tryBuildPurl } from "../inventory/purl.js";
 import {
   classifyProbeResult,
@@ -1806,10 +1815,33 @@ export function createCppBom(path, options) {
   // The need for java >= 21 with atom is causing confusions since there could be C projects
   // inside of other project types. So we currently limit this analyis only when -t argument
   // is used.
-  if (
-    !hasAnyProjectType(["docker", "oci", "container", "os"], options, false) &&
-    (!options.createMultiXBom || options.deep)
-  ) {
+  if (!isImageScan && options.createMultiXBom && !options.deep) {
+    // The atom analysis below is skipped in this mode, but a vcpkg manifest is
+    // read without running anything, and its declared ports are as much a
+    // part of the project as CMake's find_package names.
+    const manifest = parseVcpkgManifest(path, {
+      installedPorts: installedVcpkgPorts(path, options),
+      isListed: (name) =>
+        pkgList.some(
+          (p) => !p.group && p.name?.toLowerCase() === `${name}`.toLowerCase(),
+        ),
+    });
+    if (manifest.pkgList.length) {
+      pkgList = pkgList.concat(manifest.pkgList);
+      if (!parentComponent && manifest.parentComponent) {
+        parentComponent = manifest.parentComponent;
+      }
+      if (parentComponent?.["bom-ref"]) {
+        dependencies = mergeDependencies(dependencies, [
+          {
+            ref: parentComponent["bom-ref"],
+            dependsOn: manifest.pkgList.map((p) => p["bom-ref"]),
+          },
+        ]);
+      }
+    }
+  }
+  if (!isImageScan && (!options.createMultiXBom || options.deep)) {
     let osPkgsList = [];
     // Case 1: Development libraries installed in this OS environment might be used for build
     // We collect OS packages with the word dev in the name using osquery here
@@ -1967,6 +1999,10 @@ export function createClojureBom(path, options) {
     if (readEnvironmentVariable("LEIN_ARGS")) {
       LEIN_ARGS = readEnvironmentVariable("LEIN_ARGS").split(" ");
     }
+    const leinProjectContent = safeExistsSync(leinFiles[0])
+      ? readFileSync(leinFiles[0], { encoding: "utf-8" })
+      : undefined;
+    LEIN_ARGS = leiningenMirrorArgs(LEIN_ARGS, leinProjectContent);
     // `lein deps :tree-data` evaluates project.clj, which is a Clojure
     // program, so it belongs to the dependency-tooling surface disabled by
     // --no-install-deps and the pre-build lifecycle.
@@ -2058,6 +2094,7 @@ export function createClojureBom(path, options) {
     if (readEnvironmentVariable("CLJ_ARGS")) {
       CLJ_ARGS = readEnvironmentVariable("CLJ_ARGS").split(" ");
     }
+    CLJ_ARGS = clojureMirrorArgs(CLJ_ARGS);
     for (const f of ednFiles) {
       const basePath = dirname(f);
       console.log("Executing", CLJ_CMD, "in", basePath);

package/lib/core/boundedFile.js

@@ -0,0 +1,344 @@
+// Bounded, read-only access to files inside an extracted image or a live host.
+//
+// Every file a scan opens may be hostile: only regular files that stay inside
+// the extracted root are opened, a symlink is never followed, a FIFO is never
+// opened, and reads are capped. A missing or odd file yields no result rather
+// than throwing.
+
+import { createHash } from "node:crypto";
+import {
+  closeSync,
+  constants,
+  fstatSync,
+  lstatSync,
+  openSync,
+  readSync,
+  realpathSync,
+} from "node:fs";
+import { resolve, sep } from "node:path";
+import process from "node:process";
+
+const READ_CHUNK_BYTES = 1024 * 1024;
+
+// O_NOFOLLOW refuses a symlink swapped in after lstat, and O_NONBLOCK keeps a
+// FIFO swapped in the same way from blocking the open. Neither exists on
+// Windows, where neither race applies.
+const OPEN_FLAGS =
+  constants.O_RDONLY |
+  (constants.O_NOFOLLOW || 0) |
+  (constants.O_NONBLOCK || 0);
+
+/**
+ * The largest file scanFileMarkers reads. Larger files are skipped whole
+ * rather than read in part, so a marker past the cap is never mistaken for an
+ * absent one; the result says the file was skipped.
+ *
+ * @type {number}
+ */
+export const MAX_MARKER_SCAN_BYTES = 2 * 1024 * 1024 * 1024;
+
+/**
+ * Open a path only when it is a regular file that does not resolve outside
+ * rootDir. lstat runs first so a FIFO is rejected without opening it (an open
+ * on a FIFO blocks until a writer appears) and a symlink is never followed.
+ *
+ * @param {string} absPath absolute path
+ * @param {string|undefined} rootDir extracted root the path must stay under
+ * @returns {{fd: number, size: number}|undefined} an open descriptor the
+ *   caller closes, or undefined
+ */
+export function openRegularFile(absPath, rootDir) {
+  let fd;
+  try {
+    if (typeof absPath !== "string" || !absPath) {
+      return undefined;
+    }
+    const lst = lstatSync(absPath);
+    if (!lst.isFile()) {
+      return undefined;
+    }
+    if (rootDir) {
+      const root = realpathSync(resolve(rootDir));
+      const real = realpathSync(absPath);
+      const rootPrefix = root.endsWith(sep) ? root : root + sep;
+      if (real !== root && !real.startsWith(rootPrefix)) {
+        return undefined;
+      }
+    }
+    fd = openSync(absPath, OPEN_FLAGS);
+    const stats = fstatSync(fd);
+    if (!stats.isFile()) {
+      closeSync(fd);
+      return undefined;
+    }
+    return { fd, size: stats.size };
+  } catch {
+    if (fd !== undefined) {
+      try {
+        closeSync(fd);
+      } catch {
+        // already closed
+      }
+    }
+    return undefined;
+  }
+}
+
+/**
+ * Read a small text file in full, only when it is a regular file no larger
+ * than maxBytes. A FIFO, a directory, a symlink or an oversized file reads as
+ * undefined.
+ *
+ * @param {string} absPath absolute path
+ * @param {number} maxBytes largest size read
+ * @param {string|undefined} [rootDir] root the path must stay under
+ * @returns {string|undefined} the text, or undefined
+ */
+export function readRegularTextFile(absPath, maxBytes, rootDir) {
+  const opened = openRegularFile(absPath, rootDir);
+  if (!opened) {
+    return undefined;
+  }
+  try {
+    if (opened.size > maxBytes) {
+      return undefined;
+    }
+    const buffer = Buffer.alloc(opened.size);
+    let total = 0;
+    while (total < opened.size) {
+      const read = readSync(
+        opened.fd,
+        buffer,
+        total,
+        opened.size - total,
+        total,
+      );
+      if (read <= 0) {
+        break;
+      }
+      total += read;
+    }
+    return buffer.toString("utf8", 0, total);
+  } catch {
+    return undefined;
+  } finally {
+    try {
+      closeSync(opened.fd);
+    } catch {
+      // already closed
+    }
+  }
+}
+
+/**
+ * Find byte markers in a file with bounded chunked reads.
+ *
+ * Each hit records up to `beforeBytes` bytes before the marker and up to
+ * `contextBytes` bytes after it, so a caller can read a version that follows a
+ * marker or check what a string is part of. Consecutive reads overlap by the
+ * longest marker plus the context length, so a marker split across two reads
+ * is seen whole once. Only bytes that were read are searched.
+ *
+ * @param {string} absPath absolute path of the file
+ * @param {string|undefined} rootDir extracted root the file must stay under
+ * @param {Buffer[]} markers byte markers to look for
+ * @param {Object} [options] options
+ * @param {number} [options.maxBytes] files larger than this are not read
+ * @param {number} [options.contextBytes=64] bytes kept after each hit
+ * @param {number} [options.beforeBytes=1] bytes kept before each hit
+ * @param {number} [options.maxHits=16] hits kept per marker
+ * @returns {{hits: {before: Buffer, after: Buffer, offset: number}[][], size: number, skipped?: string}|undefined}
+ *   hits per marker, in marker order, and the file size; `skipped` is
+ *   `too-large` when the file is over the cap and was not read. Undefined when
+ *   the file cannot be opened.
+ */
+export function scanFileMarkers(
+  absPath,
+  rootDir,
+  markers,
+  {
+    maxBytes = MAX_MARKER_SCAN_BYTES,
+    contextBytes = 64,
+    beforeBytes = 1,
+    maxHits = 16,
+  } = {},
+) {
+  if (!Array.isArray(markers) || !markers.length) {
+    return undefined;
+  }
+  const opened = openRegularFile(absPath, rootDir);
+  if (!opened) {
+    return undefined;
+  }
+  const hits = markers.map(() => []);
+  try {
+    const { fd, size } = opened;
+    if (size > maxBytes) {
+      return { hits, size, skipped: "too-large" };
+    }
+    if (size <= 0) {
+      return { hits, size };
+    }
+    const longest = Math.max(...markers.map((marker) => marker.length));
+    const overlap = longest + contextBytes;
+    const bufferSize = Math.min(size, READ_CHUNK_BYTES) + overlap;
+    const buffer = Buffer.allocUnsafe(bufferSize);
+    // The bytes just before the current window, for a hit near its start.
+    let previousTail = Buffer.alloc(0);
+    for (let position = 0; position < size; position += READ_CHUNK_BYTES) {
+      const want = Math.min(bufferSize, size - position);
+      const read = readSync(fd, buffer, 0, want, position);
+      if (read <= 0) {
+        break;
+      }
+      // What a previous, longer read left in the buffer past `read` is never
+      // searched.
+      const window = buffer.subarray(0, read);
+      // Only hits starting inside this window are new; the overlap lets the
+      // next window see a marker and its context that cross the edge. The
+      // last window has no next one, so everything it read is searched.
+      const isLast = position + read >= size;
+      const searchLimit = isLast ? read : Math.min(READ_CHUNK_BYTES, read);
+      for (let index = 0; index < markers.length; index++) {
+        const marker = markers[index];
+        const found = hits[index];
+        let offset = window.indexOf(marker);
+        while (
+          offset !== -1 &&
+          offset < searchLimit &&
+          found.length < maxHits
+        ) {
+          const afterStart = offset + marker.length;
+          const before =
+            offset >= beforeBytes
+              ? window.subarray(offset - beforeBytes, offset)
+              : Buffer.concat([
+                  previousTail,
+                  window.subarray(0, offset),
+                ]).subarray(-beforeBytes);
+          found.push({
+            offset: position + offset,
+            before: Buffer.from(before),
+            after: Buffer.from(
+              window.subarray(
+                Math.min(afterStart, read),
+                Math.min(read, afterStart + contextBytes),
+              ),
+            ),
+          });
+          offset = window.indexOf(marker, offset + 1);
+        }
+      }
+      if (read < bufferSize) {
+        break;
+      }
+      previousTail = Buffer.from(
+        window.subarray(
+          Math.max(0, READ_CHUNK_BYTES - beforeBytes),
+          READ_CHUNK_BYTES,
+        ),
+      );
+    }
+    return { hits, size };
+  } catch {
+    return undefined;
+  } finally {
+    try {
+      closeSync(opened.fd);
+    } catch {
+      // already closed
+    }
+  }
+}
+
+/**
+ * Compute the digest of a regular file with bounded chunked reads, under the
+ * same rules as readRegularTextFile: a FIFO, a directory, a symlink, a file
+ * that resolves outside rootDir or one larger than maxBytes yields undefined.
+ *
+ * @param {string} absPath absolute path
+ * @param {number} maxBytes largest size hashed
+ * @param {string|undefined} [rootDir] root the path must stay under
+ * @param {string} [algorithm="sha256"] node:crypto hash algorithm
+ * @returns {string|undefined} the hex digest, or undefined
+ */
+export function hashRegularFile(
+  absPath,
+  maxBytes,
+  rootDir,
+  algorithm = "sha256",
+) {
+  const opened = openRegularFile(absPath, rootDir);
+  if (!opened) {
+    return undefined;
+  }
+  try {
+    if (opened.size > maxBytes) {
+      return undefined;
+    }
+    const hash = createHash(algorithm);
+    const buffer = Buffer.alloc(Math.min(READ_CHUNK_BYTES, opened.size || 1));
+    let total = 0;
+    while (total < opened.size) {
+      const read = readSync(
+        opened.fd,
+        buffer,
+        0,
+        Math.min(buffer.length, opened.size - total),
+        total,
+      );
+      if (read <= 0) {
+        break;
+      }
+      hash.update(buffer.subarray(0, read));
+      total += read;
+    }
+    return hash.digest("hex");
+  } catch {
+    return undefined;
+  } finally {
+    try {
+      closeSync(opened.fd);
+    } catch {
+      // already closed
+    }
+  }
+}
+
+/**
+ * True when the process runs as root, where a symlink planted in a user's
+ * home could point a scan at files only root can read.
+ *
+ * @returns {boolean} true for uid 0
+ */
+export function isRunningAsRoot() {
+  return typeof process.getuid === "function" && process.getuid() === 0;
+}
+
+/**
+ * Read a small text file a user keeps in their home, such as an editor's or an
+ * agent's configuration. Dotfile managers often make these symlinks, so a
+ * symlink to a regular file is followed, except when the process runs as root.
+ * The target must still be a regular file no larger than maxBytes.
+ *
+ * @param {string} absPath absolute path
+ * @param {number} maxBytes largest size read
+ * @returns {string|undefined} the text, or undefined
+ */
+export function readUserFileText(absPath, maxBytes) {
+  if (typeof absPath !== "string" || !absPath) {
+    return undefined;
+  }
+  let target = absPath;
+  try {
+    if (lstatSync(absPath).isSymbolicLink()) {
+      if (isRunningAsRoot()) {
+        return undefined;
+      }
+      target = realpathSync(absPath);
+    }
+  } catch {
+    return undefined;
+  }
+  return readRegularTextFile(target, maxBytes);
+}