@cdxgen/cdxgen 13.5.0 → 13.7.0

package/lib/core/fs.js

@@ -43,6 +43,7 @@ import {
 } from "./activity.js";
 import { thoughtLog, traceLog } from "./logger.js";
 import { isWin } from "./paths.js";
+import { recordExecutedTool } from "./toolRegistry.js";
 
 function getArchiveSourceByteSize(sourcePath) {
   if (!sourcePath || !safeExistsSync(sourcePath)) {
@@ -139,10 +140,126 @@ export function safeIsExecutableSync(filePath) {
   }
 }
 
+// writeFileSync flags that create or replace a file, which the no-follow
+// write below reproduces with open(2) flags.
+const NO_FOLLOW_WRITE_FLAGS = new Set([
+  "a",
+  "a+",
+  "as",
+  "as+",
+  "ax",
+  "ax+",
+  "w",
+  "w+",
+  "wx",
+  "wx+",
+]);
+
+/**
+ * Determine whether a path names a device or a process file, such as
+ * /dev/stdout, /dev/null or the /dev/fd entry of a shell process
+ * substitution. These are symbolic links an operator names on purpose, so
+ * they are written through as given.
+ *
+ * @param {string} filePath File path to check.
+ * @returns {boolean} True for paths under /dev or /proc on POSIX systems.
+ */
+function isDeviceOrProcessPath(filePath) {
+  if (isWin) {
+    return false;
+  }
+  const absolutePath = resolve(filePath);
+  return absolutePath.startsWith("/dev/") || absolutePath.startsWith("/proc/");
+}
+
+/**
+ * Convert a writeFileSync flag string into open(2) flags.
+ *
+ * @param {string} flag Flag such as "w", "a" or "wx".
+ * @returns {number} Numeric open flags.
+ */
+function writeOpenFlags(flag) {
+  let flags =
+    fsConstants.O_CREAT |
+    (flag.includes("+") ? fsConstants.O_RDWR : fsConstants.O_WRONLY) |
+    (flag.startsWith("a") ? fsConstants.O_APPEND : fsConstants.O_TRUNC);
+  if (flag.includes("x")) {
+    flags |= fsConstants.O_EXCL;
+  }
+  return flags;
+}
+
+/**
+ * Write a file without following a symbolic link in the last component of
+ * its path. A link found there is removed and a regular file is created in
+ * its place, so a link committed to a scanned repository under a name cdxgen
+ * writes, such as bom.json, cannot send the write to the file it points at.
+ * The open uses O_NOFOLLOW where the platform has it, so a link that appears
+ * after the check makes the write fail rather than follow it. Links in the
+ * parent directories are followed as usual.
+ *
+ * @param {string} filePath File path to write.
+ * @param {string|Buffer|Uint8Array} data Data to write.
+ * @param {Object|string} [options] writeFileSync options or encoding.
+ * @returns {boolean} True when a symbolic link was replaced.
+ */
+function writeFileWithoutFollowingLink(filePath, data, options) {
+  const flag =
+    (typeof options === "object" && options?.flag
+      ? String(options.flag)
+      : undefined) || "w";
+  if (
+    typeof filePath !== "string" ||
+    !NO_FOLLOW_WRITE_FLAGS.has(flag) ||
+    isDeviceOrProcessPath(filePath)
+  ) {
+    writeFileSync(filePath, data, options);
+    return false;
+  }
+  let replacedLink = false;
+  let pathStats;
+  try {
+    pathStats = lstatSync(filePath);
+  } catch {
+    pathStats = undefined;
+  }
+  if (pathStats?.isSymbolicLink()) {
+    // rmSync removes the link itself, including a directory link on Windows.
+    rmSync(filePath, { force: true });
+    replacedLink = true;
+  }
+  const openFlags =
+    writeOpenFlags(flag) |
+    (fsConstants.O_NOFOLLOW || 0) |
+    (replacedLink ? fsConstants.O_EXCL : 0);
+  const mode =
+    typeof options === "object" && options?.mode !== undefined
+      ? options.mode
+      : 0o666;
+  const fd = openSync(filePath, openFlags, mode);
+  try {
+    writeFileSync(fd, data, {
+      encoding: typeof options === "string" ? options : options?.encoding,
+    });
+  } finally {
+    closeSync(fd);
+  }
+  if (replacedLink) {
+    console.warn(
+      `'${filePath}' was a symbolic link. cdxgen replaced the link with a regular file instead of writing to the file it pointed at.`,
+    );
+  }
+  return replacedLink;
+}
+
 /**
  * Permission- and dry-run-aware wrapper around writeFileSync. Records the
  * activity and returns undefined when blocked.
  *
+ * The last component of the path is never followed when it is a symbolic
+ * link: the link is replaced with a regular file. Paths under /dev and /proc,
+ * such as /dev/stdout, are written through as given.
+ *
  * @param {string} filePath File path to write.
  * @param {string|Buffer} data Data to write.
  * @param {Object} [options] writeFileSync options (encoding, mode, flag).
@@ -152,8 +269,15 @@ export function safeWriteSync(filePath, data, options) {
   if (isWriteBlocked(filePath)) {
     return undefined;
   }
-  writeFileSync(filePath, data, options);
-  recordFilesystemActivity("write", filePath, "completed");
+  const replacedLink = writeFileWithoutFollowingLink(filePath, data, options);
+  recordFilesystemActivity(
+    "write",
+    filePath,
+    "completed",
+    replacedLink
+      ? "Replaced a symbolic link with a regular file instead of following it."
+      : undefined,
+  );
 }
 
 /**
@@ -172,7 +296,7 @@ export function safeWriteChunksSync(filePath, chunks) {
     return undefined;
   }
   const tempPath = `${filePath}.${process.pid}.${randomUUID()}.tmp`;
-  const fd = openSync(tempPath, "w");
+  const fd = openSync(tempPath, "wx");
   try {
     for (const chunk of chunks) {
       const bytes = typeof chunk === "string" ? Buffer.from(chunk) : chunk;
@@ -991,6 +1115,8 @@ export function safeSpawnSync(command, args, options) {
   }
   traceLog("spawn", { command, args, ...options });
   commandsExecuted.add(command);
+  // The tool as invoked, before a shell invocation folds the arguments in.
+  const executedCommand = command;
   // Fix for DEP0190 warning
   if (options?.shell === true) {
     const joined = joinShellCommand(command, args, rawShellArgs);
@@ -1000,6 +1126,15 @@ export function safeSpawnSync(command, args, options) {
     }
   }
   const result = spawnSync(command, args, options);
+  // The run-scoped tool registry feeds metadata.tools (issue #598); every
+  // external execution funnels through this wrapper. A spawn that failed to
+  // start, such as a missing binary, ran nothing and is not recorded; through
+  // a shell, a missing command shows as exit code 127, or 9009 on cmd.exe.
+  const shellCommandNotFound =
+    options?.shell === true && [127, 9009].includes(result.status);
+  if (!result.error && !shellCommandNotFound) {
+    recordExecutedTool(executedCommand);
+  }
   recordActivity({
     kind: activityDescriptor.kind,
     ...activityDescriptor.metadata,

package/lib/core/globPatterns.js

@@ -0,0 +1,218 @@
+/**
+ * Longest exclude or include pattern cdxgen accepts from an untrusted source,
+ * such as a server request or a config file in the scanned directory.
+ */
+export const UNTRUSTED_GLOB_PATTERN_MAX_LENGTH = 512;
+
+/**
+ * Most patterns a list of untrusted exclude or include patterns may stand
+ * for once brace expressions are expanded. Every expanded pattern is matched
+ * against every file the scan walks, so the total, not the length of the
+ * list as written, is what decides the cost.
+ */
+export const UNTRUSTED_GLOB_EXPANSION_BUDGET = 128;
+
+function isIntegerText(text) {
+  const digits = text.startsWith("-") ? text.slice(1) : text;
+  return (
+    digits.length > 0 && [...digits].every((char) => char >= "0" && char <= "9")
+  );
+}
+
+function isLetter(text) {
+  return (
+    text.length === 1 &&
+    ((text >= "a" && text <= "z") || (text >= "A" && text <= "Z"))
+  );
+}
+
+/**
+ * Count the members of a brace range such as `1..10`, `a..z` or `0..100..5`.
+ *
+ * @param {string} body text between the braces
+ * @param {number} limit value returned for ranges at or beyond the limit
+ * @returns {number|undefined} member count, or undefined when the body is
+ *   not a range
+ */
+function braceRangeSize(body, limit) {
+  const parts = body.split("..");
+  if (parts.length !== 2 && parts.length !== 3) {
+    return undefined;
+  }
+  const [start, end, step = "1"] = parts;
+  if (!isIntegerText(step)) {
+    return undefined;
+  }
+  const increment = Math.abs(Number(step)) || 1;
+  let distance;
+  if (isIntegerText(start) && isIntegerText(end)) {
+    distance = Math.abs(Number(end) - Number(start));
+  } else if (isLetter(start) && isLetter(end)) {
+    distance = Math.abs(end.charCodeAt(0) - start.charCodeAt(0));
+  } else {
+    return undefined;
+  }
+  const size = Math.floor(distance / increment) + 1;
+  return Number.isFinite(size) && size < limit ? size : limit;
+}
+
+function newBraceGroup(start) {
+  return {
+    current: 1,
+    hasAnyComma: false,
+    hasComma: false,
+    hasDots: false,
+    hasGroup: false,
+    start,
+    sum: 0,
+  };
+}
+
+/**
+ * Count, from above, how many patterns a glob's brace expressions expand to,
+ * following the brace-expansion package that minimatch uses:
+ *
+ * - alternatives in `{a,b}` add up, and groups side by side or inside one
+ *   another multiply;
+ * - a range such as `{1..9}`, `{a..z}` or `{0..100..5}` counts its members;
+ * - a group with no comma of its own but a list inside it, such as
+ *   `{{a,b}c}`, is expanded and each result is braced and expanded again,
+ *   so it counts as its contents, unless its text holds `..` and a result
+ *   could become a range of any size.
+ *
+ * brace-expansion reads braces that form neither a list nor a range in ways
+ * that depend on the rest of the pattern, so a group that is neither, a
+ * closing brace with no group open, a group left open, and the `..` case
+ * above all count as more than `cap`. Patterns that list alternatives or
+ * ranges, such as `{test,tests}` or `*.{js,ts}`, get the exact count, or one
+ * slightly above it where a letter range such as `{Z..c}` spans the `\` that
+ * brace-expansion leaves out. `\` escapes the next character. The count stops growing at
+ * `cap + 1` and each character is read once, so a pattern that would expand
+ * to millions costs no more to count than its length.
+ *
+ * @param {string} pattern glob pattern
+ * @param {number} [cap] largest count of interest
+ * @returns {number} upper bound on the number of expanded patterns, at most
+ *   `cap + 1`
+ */
+export function globBraceExpansionCount(
+  pattern,
+  cap = Number.MAX_SAFE_INTEGER - 1,
+) {
+  const limit = cap + 1;
+  const clamp = (value) => Math.min(value, limit);
+  const groups = [newBraceGroup(0)];
+  const text = String(pattern);
+  for (let index = 0; index < text.length; index += 1) {
+    const character = text[index];
+    if (character === "\\") {
+      index += 1;
+      continue;
+    }
+    const group = groups.at(-1);
+    if (character === "{") {
+      group.hasGroup = true;
+      groups.push(newBraceGroup(index + 1));
+    } else if (character === "." && text[index + 1] === ".") {
+      group.hasDots = true;
+    } else if (character === "," && groups.length > 1) {
+      group.sum = clamp(group.sum + group.current);
+      group.current = 1;
+      group.hasComma = true;
+      group.hasAnyComma = true;
+    } else if (character === "}") {
+      if (groups.length === 1) {
+        return limit;
+      }
+      let count;
+      if (group.hasComma) {
+        count = clamp(group.sum + group.current);
+      } else if (group.hasAnyComma) {
+        count = group.hasDots ? limit : group.current;
+      } else if (!group.hasGroup) {
+        count = braceRangeSize(text.slice(group.start, index), limit);
+      }
+      if (count === undefined) {
+        return limit;
+      }
+      groups.pop();
+      const parent = groups.at(-1);
+      parent.current = clamp(parent.current * count);
+      parent.hasAnyComma ||= group.hasAnyComma;
+      parent.hasDots ||= group.hasDots;
+    }
+  }
+  return groups.length === 1 ? groups[0].current : limit;
+}
+
+/**
+ * Split exclude or include patterns from an untrusted source into the ones
+ * cdxgen uses and the ones it refuses. Patterns are taken in order while
+ * they fit the expansion budget, so a list cannot multiply the work of a
+ * scan by brace expansion or sheer number.
+ *
+ * @param {unknown} patterns a pattern, a list of patterns, or nothing
+ * @param {Object} [options] bound options
+ * @param {boolean} [options.allowBraces=true] refuse every pattern with a
+ *   brace when false
+ * @param {number} [options.budget] expanded patterns allowed in all
+ * @param {number} [options.used=0] expanded patterns earlier lists have
+ *   already taken from the budget
+ * @returns {{accepted: string[], refused: {pattern: string, reason: string}[], expansions: number}}
+ *   the patterns to use, the ones refused with the reason, and the expanded
+ *   patterns the accepted ones use
+ */
+export function boundUntrustedGlobPatterns(
+  patterns,
+  {
+    allowBraces = true,
+    budget = UNTRUSTED_GLOB_EXPANSION_BUDGET,
+    used = 0,
+  } = {},
+) {
+  const entries =
+    patterns === undefined || patterns === null
+      ? []
+      : Array.isArray(patterns)
+        ? patterns
+        : [patterns];
+  const accepted = [];
+  const refused = [];
+  let expansions = 0;
+  for (const entry of entries) {
+    if (typeof entry !== "string" && typeof entry !== "number") {
+      refused.push({ pattern: String(entry), reason: "is not a string" });
+      continue;
+    }
+    const pattern = String(entry);
+    if (pattern.length > UNTRUSTED_GLOB_PATTERN_MAX_LENGTH) {
+      refused.push({
+        pattern,
+        reason: `is longer than ${UNTRUSTED_GLOB_PATTERN_MAX_LENGTH} characters`,
+      });
+      continue;
+    }
+    if (!allowBraces && pattern.includes("{")) {
+      refused.push({ pattern, reason: "uses braces" });
+      continue;
+    }
+    const count = globBraceExpansionCount(pattern, budget);
+    if (count > budget) {
+      refused.push({
+        pattern,
+        reason: `expands to more than ${budget} patterns`,
+      });
+      continue;
+    }
+    if (used + expansions + count > budget) {
+      refused.push({
+        pattern,
+        reason: `would bring the patterns past ${budget} after brace expansion`,
+      });
+      continue;
+    }
+    expansions += count;
+    accepted.push(pattern);
+  }
+  return { accepted, expansions, refused };
+}

package/lib/core/httpClient.js

@@ -5,6 +5,7 @@ import { brotliDecompressSync, gunzipSync, inflateSync } from "node:zlib";
 
 import { Agent, EnvHttpProxyAgent, request as undiciRequest } from "undici";
 
+import { readBrotliDecoder } from "./brotliProbe.js";
 import { registerRunReset } from "./runState.js";
 
 // Environment variables here are read with raw `process.env` rather than
@@ -208,6 +209,75 @@ export function resolveTimeout(timeout) {
   return undefined;
 }
 
+let runtimeBrotliVerdict;
+
+/**
+ * Set or clear the cached runtime Brotli verdict. Exported for unit tests only.
+ *
+ * @param {boolean|undefined} verdict verdict to use, or undefined to re-check
+ */
+export function _setRuntimeBrotliVerdict(verdict) {
+  runtimeBrotliVerdict = verdict;
+}
+
+/**
+ * Whether the Brotli decoder of the runtime cdxgen runs on carries the
+ * CVE-2026-111497 fix, read once from the decoder itself: the node binary, or
+ * the shared libbrotlidec a `--shared-brotli` build (Homebrew, distro
+ * packages) loads; under Bun, the bun binary, which carries its own copy.
+ * process.versions.brotli cannot answer this, since Node.js backports the fix
+ * without changing it. Deno decodes Brotli in Rust, which was never affected.
+ *
+ * On Node.js cdxgen never asks for `br`, so a Brotli response comes only from
+ * a server that sends it unasked. When the decoder cannot be shown to be
+ * patched, such a body is left undecoded rather than handed to a decoder an
+ * attacker can write past. Bun decodes in its transport, so there the client
+ * stops asking for `br` instead.
+ *
+ * @param {Object} [runtime] the runtime to judge, for tests
+ * @returns {boolean} true when Brotli bodies may be decoded
+ */
+export function runtimeBrotliDecoderIsPatched(runtime = undefined) {
+  if (!runtime && runtimeBrotliVerdict !== undefined) {
+    return runtimeBrotliVerdict;
+  }
+  const subject = runtime || {
+    isDeno: globalThis.Deno?.version?.deno !== undefined,
+    execPath: process.execPath,
+    sharedBrotli: [true, "true"].includes(
+      process.config?.variables?.node_shared_brotli,
+    ),
+    sharedObjects: () => process.report?.getReport?.()?.sharedObjects || [],
+  };
+  let verdict = false;
+  if (subject.isDeno) {
+    verdict = true;
+  } else {
+    const decoderFile = subject.sharedBrotli
+      ? subject
+          .sharedObjects()
+          .find((path) =>
+            `${path}`.split(/[\\/]/).pop().startsWith("libbrotlidec"),
+          )
+      : subject.execPath;
+    verdict = Boolean(
+      decoderFile &&
+        readBrotliDecoder(decoderFile)?.c?.blockSwitchFix === "true",
+    );
+  }
+  if (!runtime) {
+    runtimeBrotliVerdict = verdict;
+    if (!verdict) {
+      console.warn(
+        isBun
+          ? "The Brotli decoder in this Bun is not patched for CVE-2026-111497, or could not be checked, so cdxgen no longer asks servers for Brotli-encoded responses. Bun still decodes one a server sends unasked; upgrade Bun to a release with a patched Brotli."
+          : "The Brotli decoder of this runtime is not patched for CVE-2026-111497, or could not be checked, so Brotli-encoded responses are left undecoded. Upgrade Node.js to 22.23.4, 24.22.1 or 26.12.1 or later (and the shared brotli library on Homebrew or distro builds).",
+      );
+    }
+  }
+  return verdict;
+}
+
 /**
  * Decompress a response body buffer according to its `Content-Encoding`. undici
  * performs no automatic decompression, so we replicate the behaviour `got` gave
@@ -235,6 +305,9 @@ function decompressBody(rawBody, contentEncoding) {
       } else if (encoding === "deflate") {
         buffer = inflateSync(buffer);
       } else if (encoding === "br") {
+        if (!runtimeBrotliDecoderIsPatched()) {
+          return buffer;
+        }
         buffer = brotliDecompressSync(buffer);
       } else if (encoding === "identity") {
         // no-op
@@ -296,6 +369,30 @@ async function readBody(undiciResponse, responseType) {
   return { body, rawBody };
 }
 
+/**
+ * The headers to put on the wire. Bun's bundled undici asks for br by default
+ * and decodes it with Bun's own decoder before this client sees the body, so
+ * the check in decompressBody never runs there. Where that decoder is not
+ * patched, ask only for the encodings this client decodes itself. A server
+ * that sends br unasked is still decoded by Bun; only upgrading Bun closes
+ * that. The cache key is built from the caller's headers, not these.
+ *
+ * @param {Object} headers Request headers.
+ * @returns {Object} Headers to send.
+ */
+function transportHeaders(headers) {
+  if (
+    !isBun ||
+    Object.keys(headers).some(
+      (key) => key.toLowerCase() === "accept-encoding",
+    ) ||
+    runtimeBrotliDecoderIsPatched()
+  ) {
+    return headers;
+  }
+  return { ...headers, "accept-encoding": "gzip, deflate" };
+}
+
 /**
  * Convert a body into the `[body, headers]` pair to hand to undici. When the
  * `json` option is present it is serialized and a JSON `content-type` is added
@@ -752,7 +849,7 @@ async function doRequest(mergedOptions) {
   const insecure = options.https?.rejectUnauthorized === false;
   const requestOptions = {
     method,
-    headers,
+    headers: transportHeaders(headers),
     body: method === "GET" || method === "HEAD" ? undefined : body,
     dispatcher: selectDispatcher(insecure),
     signal,

package/lib/core/lockPaths.js

@@ -0,0 +1,38 @@
+import { isAbsolute, relative, resolve, win32 } from "node:path";
+
+/**
+ * Containment check for a path taken from a lockfile (issue #3816). A crafted
+ * npm lockfile can name `file:`/`link:` specifiers or link targets built from
+ * `..` chains or absolute paths, so a parser that is about to list such an
+ * entry checks the resolved path against the project root first.
+ *
+ * The candidate is resolved against `projectRoot`, so both relative values
+ * and the absolute paths arborist already normalised are accepted. The root
+ * itself counts as inside: a lockfile may legitimately link the project to
+ * its own directory.
+ *
+ * @param {string} candidate Path to check, absolute or relative to projectRoot
+ * @param {string} projectRoot Project root the path must stay inside; a falsy
+ *   root means the current working directory, mirroring `node:path`
+ *
+ * @returns {Boolean} True when the path is inside projectRoot
+ */
+export function isPathInsideProject(candidate, projectRoot) {
+  if (typeof candidate !== "string" || !candidate) {
+    return false;
+  }
+  if (candidate.includes("\0")) {
+    return false;
+  }
+  const rootAbs = resolve(projectRoot || process.cwd());
+  const rel = relative(rootAbs, resolve(rootAbs, candidate));
+  if (!rel) {
+    return true;
+  }
+  // relative() returns an absolute path when the two sit on different
+  // Windows drives.
+  if (isAbsolute(rel) || win32.isAbsolute(rel)) {
+    return false;
+  }
+  return rel !== ".." && !rel.startsWith("../") && !rel.startsWith("..\\");
+}

package/lib/core/paths.js

@@ -14,7 +14,7 @@
  * `https://` URL, and `fileURLToPath` throws `ERR_INVALID_URL_SCHEME` on those.
  */
 
-import { platform } from "node:os";
+import { homedir, platform } from "node:os";
 import { dirname } from "node:path";
 import { fileURLToPath } from "node:url";
 
@@ -68,3 +68,26 @@ export function isValidDriveRoot(root) {
 export function toCamel(str) {
   return str.replace(/-([a-z])/g, (_, g) => g.toUpperCase());
 }
+
+/**
+ * Rewrite an absolute path under the user's home directory to a `~`-relative
+ * form so the emitted BOM does not carry the local username.
+ *
+ * @param {string} filePath Absolute path
+ * @param {string} [home] Home directory, defaulting to the current user's
+ * @returns {string} Home-relative path when applicable, else the input
+ */
+export function redactHomePath(filePath, home = homedir()) {
+  const value = String(filePath || "");
+  if (!home || !value.startsWith(home)) {
+    return value;
+  }
+  // Require a path boundary so a sibling home such as /Users/alice-backup is
+  // not rewritten as if it sat under /Users/alice.
+  const remainder = value.slice(home.length);
+  if (remainder && !/^[/\\]/u.test(remainder)) {
+    return value;
+  }
+  const rest = remainder.replace(/^[/\\]/u, "");
+  return rest ? `~/${rest.replaceAll("\\", "/")}` : "~";
+}