@cdxgen/cdxgen 13.5.0 → 13.7.0

package/lib/inventory/cbomutils.js

@@ -601,19 +601,68 @@ export async function collectDosaiCryptoComponents(src, options = {}) {
 /**
  * Find crypto algorithm in the given code snippet
  *
+ * cleanStr fuses the snippet's identifiers into one lowercase string
+ * (`prepare_for_save(iv` becomes `prepareforsaveiv`), so a plain substring
+ * test reads short algorithm names inside unrelated identifiers (`rsa` in
+ * `for_save`). A name therefore matches only where a cleanStr word begins:
+ * the snippet's start, right after any character cleanStr strips or keeps as
+ * a separator, or at a lowercase-to-uppercase change in the original text
+ * (`SHA256withRSA`, `HmacSHA256`, `PBKDF2WithHmacSHA256`,
+ * `generateRsaKeyPair`). Boundaries are computed from the original string
+ * before it is lowercased, so case changes survive the cleanStr fusion.
+ * Letter/digit changes do not start a word: they added no match on any
+ * reviewed form or corpus snippet, while splitting every digit-bearing
+ * identifier (`md5`, `base64`) into false word starts. Fused forms the names
+ * themselves are written in still match: `algorithms.AES(key)` and
+ * `AESGCM(key)` yield `aes`, `AES-256-GCM` yields `aes256-GCM`,
+ * `createHash("sha256")` yields `sha-256`. All-uppercase fused forms
+ * (`HMACSHA256`) still hide every name but the run's first.
+ *
  * @param {string} code Code snippet
  * @returns {Array} Arary of crypto algorithm objects with oid and description
  */
 export function findCryptoAlgos(code) {
-  const cleanCode = cleanStr(code);
+  if (typeof code !== "string" || !code) {
+    return [];
+  }
+  const cleanChars = [];
+  // canStart[i] is true when cleanChars[i] begins a maximal [0-9a-z] word,
+  // either in the original text or at a lower-to-uppercase change in it
+  const canStart = [];
+  let inWord = false;
+  for (let i = 0; i < code.length; i++) {
+    const ch = code[i];
+    const lower = ch.toLowerCase();
+    const isWordChar =
+      lower.length === 1 &&
+      ((lower >= "0" && lower <= "9") || (lower >= "a" && lower <= "z"));
+    if (isWordChar) {
+      cleanChars.push(lower);
+      const prev = i > 0 ? code[i - 1] : "";
+      const caseStart = /[a-z]/.test(prev) && /[A-Z]/.test(ch);
+      canStart.push(!inWord || caseStart);
+      inWord = true;
+    } else {
+      inWord = false;
+    }
+  }
+  const cleanCode = cleanChars.join("");
   const cryptoAlgos = [];
   for (const algoName of Object.keys(cbomCryptoOids)) {
-    if (cleanCode.includes(cleanStr(algoName))) {
-      cryptoAlgos.push({
-        ...cbomCryptoOids[algoName],
-        name: algoName,
-        ref: `crypto/algorithm/${algoName}@${cbomCryptoOids[algoName].oid}`,
-      });
+    const needle = cleanStr(algoName);
+    if (!needle) {
+      continue;
+    }
+    let pos = cleanCode.indexOf(needle);
+    for (; pos !== -1; pos = cleanCode.indexOf(needle, pos + 1)) {
+      if (canStart[pos]) {
+        cryptoAlgos.push({
+          ...cbomCryptoOids[algoName],
+          name: algoName,
+          ref: `crypto/algorithm/${algoName}@${cbomCryptoOids[algoName].oid}`,
+        });
+        break;
+      }
     }
   }
   return cryptoAlgos;