@cdxgen/cdxgen 13.5.0 → 13.7.0

package/lib/cli/managedBom.js

@@ -6,6 +6,7 @@ import {
   extname,
   isAbsolute,
   join,
+  relative,
   resolve,
 } from "node:path";
 import process from "node:process";
@@ -101,11 +102,14 @@ import {
   addRubyGemsDistributionUrls,
   addRubyRuntimeComponent,
   collectGemModuleNames,
+  collectProjectRubyDeclarations,
   describeProjectGem,
   enrichGemsFromLocalCache,
   parseBundleConfig,
   parseGemfileLockData,
   parseGemspecData,
+  resolveProjectRuby,
+  toGemPurl,
 } from "../ecosystems/rubyutils.js";
 import { getTerraformRegistryMetadata } from "../ecosystems/terraformRegistry.js";
 import {
@@ -143,6 +147,7 @@ import {
   dosaiFailureReported,
   dosaiMethodsSectionsArgument,
   dosaiReportFileOmittedSections,
+  dosaiSlicesFileIsFresh,
   dosaiToolComponents,
   isDosaiDotnetLanguage,
   normalizeDosaiServiceMap,
@@ -152,7 +157,11 @@ import {
 import { addEvidenceForDotnet } from "../inventory/evidenceUtils.js";
 import { resolvePluginBinary } from "../inventory/plugins.js";
 import { nugetPurl, pypiBomRef } from "../inventory/purl.js";
-import { classifyProbeResult } from "../inventory/toolRequirements.js";
+import { isInsideInstalledGem } from "../inventory/rubyBuildInfo.js";
+import {
+  classifyProbeResult,
+  parseGemfileLockBundlerVersion,
+} from "../inventory/toolRequirements.js";
 import { getPluginToolComponents } from "../managers/binary.js";
 import { getTreeWithPlugin } from "../managers/piptree.js";
 import {
@@ -1429,7 +1438,14 @@ export async function createRubyBom(path, options) {
   if (typeof options.includeNodeModulesDir === "undefined" || options.deep) {
     options.includeNodeModulesDir = true;
   }
-  const excludeList = (options.exclude || []).concat(["**/vendor/cache/**"]);
+  // RubyGems caches the specs it fetched from a source under ~/.cache/gem/specs
+  // and ~/.gem/specs, Marshal-dumped into files named <gem>-<version>.gemspec.
+  // Those describe what a source offered, not what is installed.
+  const excludeList = (options.exclude || []).concat([
+    "**/vendor/cache/**",
+    "**/.cache/gem/specs/**",
+    "**/.gem/specs/**",
+  ]);
   const gemLockExcludeList = (options.exclude || []).concat([
     "**/vendor/bundle/ruby/**/Gemfile.lock",
     "**/test/data/**/Gemfile*.lock",
@@ -1455,6 +1471,12 @@ export async function createRubyBom(path, options) {
       exclude: gemLockExcludeList,
     },
   );
+  // An installed gem's own directory can hold its development Gemfile.lock,
+  // nested gemspecs and manifests (rbs ships steep/Gemfile.lock, typeprof a
+  // VS Code extension). They describe how the gem is developed, not what is
+  // installed, and would add gems that are not there.
+  const isGemInternalFile = (f) =>
+    isInsideInstalledGem(f, safeExistsSync, path);
   let gemspecFiles = getAllFiles(
     path,
     `${options.multiProject ? "**/" : ""}*.gemspec`,
@@ -1462,7 +1484,7 @@ export async function createRubyBom(path, options) {
       ...options,
       exclude: excludeList,
     },
-  );
+  ).filter((f) => !isGemInternalFile(f));
   let gemHome =
     readEnvironmentVariable("CDXGEN_GEM_HOME") ||
     readEnvironmentVariable("GEM_HOME");
@@ -1543,7 +1565,9 @@ export async function createRubyBom(path, options) {
       ...options,
       exclude: gemLockExcludeList,
     },
-  );
+  ).filter((f) => !isGemInternalFile(f));
+  // The lockfiles each Bundler release resolved
+  const bundlerVersions = new Map();
   if (gemLockFiles.length) {
     for (const f of gemLockFiles) {
       if (DEBUG_MODE) {
@@ -1551,6 +1575,15 @@ export async function createRubyBom(path, options) {
       }
       const gemLockData = readFileSync(f, { encoding: "utf-8" });
       const retMap = await parseGemfileLockData(gemLockData, f, { gemHome });
+      // Bundler is not listed among the specs, but runs every bundle: the
+      // lockfile names the release that resolved it under BUNDLED WITH.
+      const bundlerVersion = parseGemfileLockBundlerVersion(gemLockData);
+      if (bundlerVersion) {
+        bundlerVersions.set(bundlerVersion, [
+          ...(bundlerVersions.get(bundlerVersion) || []),
+          f,
+        ]);
+      }
       if (retMap.pkgList?.length) {
         pkgList = pkgList.concat(retMap.pkgList);
         pkgList = trimComponents(pkgList);
@@ -1633,6 +1666,42 @@ export async function createRubyBom(path, options) {
       options,
     ));
   }
+  for (const [bundlerVersion, lockFiles] of [...bundlerVersions.entries()].sort(
+    (a, b) => a[0].localeCompare(b[0]),
+  )) {
+    const purl = toGemPurl("bundler", bundlerVersion);
+    const ref = decodeURIComponent(purl);
+    if (pkgList.some((p) => p["bom-ref"] === ref)) {
+      continue;
+    }
+    pkgList.push({
+      name: "bundler",
+      version: bundlerVersion,
+      purl,
+      "bom-ref": ref,
+      scope: "required",
+      properties: [
+        { name: "cdx:gem:bundledWith", value: "true" },
+        { name: "internal:SrcFile", value: lockFiles.join(", ") },
+      ],
+      evidence: {
+        identity: [
+          {
+            field: "purl",
+            confidence: 0.8,
+            methods: [
+              {
+                technique: "manifest-analysis",
+                confidence: 0.8,
+                value: lockFiles.join(", "),
+              },
+            ],
+          },
+        ],
+      },
+    });
+    rootList.push(ref);
+  }
   if (rootList.length) {
     dependencies = mergeDependencies(
       dependencies,
@@ -1737,18 +1806,76 @@ export async function createRubyBom(path, options) {
   pkgList = await enrichGemsFromLocalCache(pkgList, { gemHome });
   // The download URL of a gem from the public registry needs no network call
   pkgList = addRubyGemsDistributionUrls(pkgList);
-  // Gems declare the Ruby they run on; surface it as the runtime they depend
-  // on. The component says the runtime is external, which only CycloneDX 1.7
-  // can express, and a container image ships its own Ruby.
-  if (
-    options.specVersion >= 1.7 &&
-    !hasAnyProjectType(["oci"], options, false)
-  ) {
-    ({ pkgList, dependencies } = addRubyRuntimeComponent(
-      pkgList,
-      parentComponent,
-      dependencies,
-    ));
+  // The project and its gems declare the Ruby they run on; surface it as the
+  // runtime they depend on. A pinned Ruby (Gemfile.lock, .ruby-version,
+  // .tool-versions, mise, the Gemfile) is a version with a CPE, which every
+  // spec version can carry. A bare range needs CycloneDX 1.7's versionRange
+  // and isExternal. A container image ships its own Ruby, which the image
+  // scan reads from the interpreter's files.
+  if (!hasAnyProjectType(["oci"], options, false)) {
+    // Each project of a multi-project scan pins its own Ruby
+    const rootDir = resolve(path);
+    const projectDirs = [rootDir];
+    if (options.multiProject) {
+      for (const f of [...gemLockFiles, ...gemFiles]) {
+        const dir = dirname(resolve(f));
+        if (!projectDirs.includes(dir)) {
+          projectDirs.push(dir);
+        }
+      }
+    }
+    const rubies = [];
+    for (const dir of projectDirs) {
+      const ruby = resolveProjectRuby(collectProjectRubyDeclarations(dir));
+      if (!ruby) {
+        continue;
+      }
+      if (dir !== rootDir && ruby.source) {
+        ruby.source = relative(rootDir, join(dir, ruby.source)).replaceAll(
+          "\\",
+          "/",
+        );
+      }
+      if (ruby.conflicts?.length) {
+        console.log(
+          `NOTE: The project in ${dir} declares more than one Ruby. The BOM records ${ruby.engine} ${ruby.version} from ${ruby.source}; also declared: ${ruby.conflicts.join(", ")}.`,
+        );
+      }
+      rubies.push(ruby);
+    }
+    // One runtime per distinct pinned Ruby; the scanned directory's first
+    const pinned = [];
+    for (const ruby of rubies) {
+      if (
+        ruby.version &&
+        !pinned.some(
+          (other) =>
+            other.engine === ruby.engine && other.version === ruby.version,
+        )
+      ) {
+        pinned.push(ruby);
+      }
+    }
+    const [primary, ...others] = pinned.length ? pinned : rubies.slice(0, 1);
+    if (options.specVersion >= 1.7 || primary?.version) {
+      ({ pkgList, dependencies } = addRubyRuntimeComponent(
+        pkgList,
+        parentComponent,
+        dependencies,
+        primary,
+      ));
+    }
+    // The gems were linked to the first; the others hang off the project
+    for (const ruby of others) {
+      let extra;
+      ({ pkgList: extra, dependencies } = addRubyRuntimeComponent(
+        [],
+        parentComponent,
+        dependencies,
+        ruby,
+      ));
+      pkgList = pkgList.concat(extra);
+    }
   }
   return buildBomNSData(options, pkgList, "gem", {
     src: path,
@@ -2379,9 +2506,13 @@ export async function createCsharpBom(path, options) {
         // Anything else needs only the sections cdxgen reads, so dosai
         // leaves the rest out (Metadata.OmittedSections names it).
         const willRunEvinse = runsEvidenceAnalysis(options);
-        // Reuse an existing slice as-is, with one exception: a trimmed file
+        // Reuse an existing slice as-is, with two exceptions. A trimmed file
         // (an earlier --deep run left it behind) is regenerated full before
-        // an evidence run uses it, so dosai still runs once per scan.
+        // an evidence run uses it, so dosai still runs once per scan. A slice
+        // older than the sources it describes is regenerated for every run:
+        // it holds the occurrences of the sources as they were when it was
+        // written, so reusing one keeps occurrences of call sites that no
+        // longer exist (issue 4675).
         let reuseExisting = safeExistsSync(slicesFile);
         if (reuseExisting && willRunEvinse) {
           const omitted = dosaiReportFileOmittedSections(slicesFile);
@@ -2394,6 +2525,17 @@ export async function createCsharpBom(path, options) {
             reuseExisting = false;
           }
         }
+        if (
+          reuseExisting &&
+          !dosaiSlicesFileIsFresh(slicesFile, path, options)
+        ) {
+          if (DEBUG_MODE) {
+            console.log(
+              `The existing dosai methods slice "${slicesFile}" is older than the sources it describes; regenerating it.`,
+            );
+          }
+          reuseExisting = false;
+        }
         // Create the slices file if it doesn't exist
         if (!reuseExisting) {
           thoughtLog(
@@ -2425,7 +2567,7 @@ export async function createCsharpBom(path, options) {
           }
         } else if (DEBUG_MODE) {
           console.log(
-            `Reusing the existing dosai methods slice "${slicesFile}" without checking whether it honours the current --exclude patterns. Delete the file to force a fresh run.`,
+            `Reusing the existing dosai methods slice "${slicesFile}", which is newer than the sources it describes. The slice is still not checked against the current --exclude patterns; delete the file to force a fresh run.`,
           );
         }
         pkgList = addEvidenceForDotnet(pkgList, slicesFile, {

package/lib/cli/nativeBom.js

@@ -45,7 +45,12 @@ import {
   emptyCppBuildContext,
   resolveCppBuildContext,
 } from "../ecosystems/cppBuildContext.js";
-import { getCppModules, hasCppSources } from "../ecosystems/cppEvidence.js";
+import {
+  getCppModules,
+  hasCppSources,
+  installedVcpkgPorts,
+  parseVcpkgManifest,
+} from "../ecosystems/cppEvidence.js";
 import {
   getCratesMetadata,
   getSwiftPackageMetadata,
@@ -132,6 +137,10 @@ import { resolveZigGraph } from "../ecosystems/zigResolver.js";
 import { cmakeBuildDirCandidates } from "../inventory/cmakeBuildDirs.js";
 import { mergeDependencies, trimComponents } from "../inventory/depsUtils.js";
 import { convertOSQueryResults } from "../inventory/evidenceUtils.js";
+import {
+  clojureMirrorArgs,
+  leiningenMirrorArgs,
+} from "../inventory/mavenCentralMirror.js";
 import { applyPurl, nixBomRef, tryBuildPurl } from "../inventory/purl.js";
 import {
   classifyProbeResult,
@@ -1420,6 +1429,16 @@ export async function createDartBom(path, options) {
         pkgList = pkgList.concat(retMap.pkgList);
       }
       if (retMap?.rootList?.length) {
+        // A pubspec.lock read without its pubspec.yaml still names the
+        // project's direct dependencies; the project is then named after the
+        // directory that holds the lock file.
+        if (!parentComponent) {
+          parentComponent = createDefaultParentComponent(
+            dirname(f),
+            "generic",
+            options,
+          );
+        }
         const thisParentDependsOn = [
           {
             ref: parentComponent["bom-ref"],
@@ -1806,10 +1825,33 @@ export function createCppBom(path, options) {
   // The need for java >= 21 with atom is causing confusions since there could be C projects
   // inside of other project types. So we currently limit this analyis only when -t argument
   // is used.
-  if (
-    !hasAnyProjectType(["docker", "oci", "container", "os"], options, false) &&
-    (!options.createMultiXBom || options.deep)
-  ) {
+  if (!isImageScan && options.createMultiXBom && !options.deep) {
+    // The atom analysis below is skipped in this mode, but a vcpkg manifest is
+    // read without running anything, and its declared ports are as much a
+    // part of the project as CMake's find_package names.
+    const manifest = parseVcpkgManifest(path, {
+      installedPorts: installedVcpkgPorts(path, options),
+      isListed: (name) =>
+        pkgList.some(
+          (p) => !p.group && p.name?.toLowerCase() === `${name}`.toLowerCase(),
+        ),
+    });
+    if (manifest.pkgList.length) {
+      pkgList = pkgList.concat(manifest.pkgList);
+      if (!parentComponent && manifest.parentComponent) {
+        parentComponent = manifest.parentComponent;
+      }
+      if (parentComponent?.["bom-ref"]) {
+        dependencies = mergeDependencies(dependencies, [
+          {
+            ref: parentComponent["bom-ref"],
+            dependsOn: manifest.pkgList.map((p) => p["bom-ref"]),
+          },
+        ]);
+      }
+    }
+  }
+  if (!isImageScan && (!options.createMultiXBom || options.deep)) {
     let osPkgsList = [];
     // Case 1: Development libraries installed in this OS environment might be used for build
     // We collect OS packages with the word dev in the name using osquery here
@@ -1967,6 +2009,10 @@ export function createClojureBom(path, options) {
     if (readEnvironmentVariable("LEIN_ARGS")) {
       LEIN_ARGS = readEnvironmentVariable("LEIN_ARGS").split(" ");
     }
+    const leinProjectContent = safeExistsSync(leinFiles[0])
+      ? readFileSync(leinFiles[0], { encoding: "utf-8" })
+      : undefined;
+    LEIN_ARGS = leiningenMirrorArgs(LEIN_ARGS, leinProjectContent);
     // `lein deps :tree-data` evaluates project.clj, which is a Clojure
     // program, so it belongs to the dependency-tooling surface disabled by
     // --no-install-deps and the pre-build lifecycle.
@@ -2058,6 +2104,7 @@ export function createClojureBom(path, options) {
     if (readEnvironmentVariable("CLJ_ARGS")) {
       CLJ_ARGS = readEnvironmentVariable("CLJ_ARGS").split(" ");
     }
+    CLJ_ARGS = clojureMirrorArgs(CLJ_ARGS);
     for (const f of ednFiles) {
       const basePath = dirname(f);
       console.log("Executing", CLJ_CMD, "in", basePath);