@cdxgen/cdxgen 13.5.0 → 13.7.0

package/lib/inventory/deps.js

@@ -13,9 +13,11 @@ import {
   getTmpDir,
   multiChecksumFile,
   safeExistsSync,
+  safeMkdirSync,
   safeMkdtempSync,
   safeRmSync,
   safeSpawnSync,
+  safeWriteSync,
 } from "../core/fs.js";
 import { isWin } from "../core/paths.js";
 import { xml2js } from "../parsers/xml.js";
@@ -25,11 +27,19 @@ import {
   mavenLocalRepositories,
   splitArtifactFileName,
 } from "./jvmLocalRepos.js";
+import {
+  mavenMirrorSettingsArgs,
+  mavenWrapperMirrorEnv,
+} from "./mavenCentralMirror.js";
 import { pypiBomRef } from "./purl.js";
 import { findLicenseId, spdxLicenses } from "./spdx.js";
 
 const jarNSMapping_cache = new Map();
 
+// The largest classes.jar on Google's Maven repository is a few tens of MiB,
+// so this bound only stops an archive that claims an implausible size.
+const MAX_AAR_INNER_JAR_BYTES = 256 * 1024 * 1024;
+
 /**
  * Whether a jar holds sources or javadoc rather than classes.
  *
@@ -136,11 +146,13 @@ export async function collectMvnDependencies(
     const addArgs = parseMavenArgs(readEnvironmentVariable("MVN_ARGS"));
     copyArgs = copyArgs.concat(addArgs);
   }
+  copyArgs = copyArgs.concat(mavenMirrorSettingsArgs());
   if (basePath && basePath !== MAVEN_CACHE_DIR) {
     console.log(`Executing '${mavenCmd} in ${basePath}`);
     const result = safeSpawnSync(mavenCmd, copyArgs, {
       cwd: basePath,
       shell: isWin,
+      env: { ...process.env, ...mavenWrapperMirrorEnv() },
     });
     const rateLimited = noteBuildToolRateLimit(
       "maven",
@@ -187,9 +199,10 @@ export async function collectMvnDependencies(
 }
 
 /**
- * Method to collect class names from all jars in a directory
+ * Method to collect class names from all jars and Android libraries in a
+ * directory
  *
- * @param {string} jarPath Path containing jars
+ * @param {string} jarPath Path containing jars, or a single jar or aar file
  * @param {object} pomPathMap Map containing jar to pom names. Required to successfully parse gradle cache.
  *
  * @return object containing jar name and class list
@@ -207,20 +220,21 @@ export async function collectJarNS(jarPath, pomPathMap = {}) {
     )}`;
   }
   // Parse jar files to get class names
-  const jarFiles = jarPath.endsWith(".jar")
+  const jarFiles = /\.(jar|aar)$/i.test(jarPath)
     ? [jarPath]
-    : getAllFiles(jarPath, "**/*.jar");
+    : getAllFiles(jarPath, "**/*.{jar,aar}");
   if (jarFiles?.length) {
     for (const jf of jarFiles) {
       const jarName = basename(jf);
+      const isAar = jarName.toLowerCase().endsWith(".aar");
       // Sources and javadoc jars hold no runtime classes. Reading them would
       // attach their hashes to the main artifact's purl.
       if (isDocumentationJar(jarName)) {
         continue;
       }
-      let pomname =
-        pomPathMap[jarName.replace(".jar", ".pom")] ||
-        jf.replace(".jar", ".pom");
+      // Only the extension is replaced, never a match earlier in the path.
+      const toPom = (file) => `${file.slice(0, -".jar".length)}.pom`;
+      let pomname = pomPathMap[toPom(jarName)] || toPom(jf);
       let pomData;
       let purl;
       let manifestLicenses;
@@ -229,7 +243,12 @@ export async function collectJarNS(jarPath, pomPathMap = {}) {
         let searchDir = dirname(jf);
         // in case of gradle, there would be hash directory that is different for jar vs pom
         // so we need to start search from a level up
-        if (searchDir.includes(join(".gradle", "caches"))) {
+        if (
+          searchDir.includes(join(".gradle", "caches")) ||
+          // A copied cache, or one reached through GRADLE_CACHE_DIR, keeps
+          // the files-2.1 directory without the .gradle parent.
+          searchDir.split(/[\\/]/).includes("files-2.1")
+        ) {
           searchDir = join(searchDir, "..");
         }
         const pomSearch = getAllFiles(searchDir, "**/*.pom");
@@ -256,7 +275,9 @@ export async function collectJarNS(jarPath, pomPathMap = {}) {
         }
       } else {
         const coordinates = inferMavenCoordinatesFromPath(jf);
-        if (coordinates?.extension === "jar") {
+        // An aar gets the same type=jar purl the Gradle dependency tree gives
+        // it, so the two entries merge into one component.
+        if (coordinates && ["jar", "aar"].includes(coordinates.extension)) {
           purl = jarPurl(
             coordinates.group,
             coordinates.name,
@@ -268,8 +289,9 @@ export async function collectJarNS(jarPath, pomPathMap = {}) {
         // descriptor, so its metadata and manifest licence are read here,
         // before any remote lookup. Only a jar whose path names its
         // coordinates is read: they choose its descriptor, and an entry
-        // without a purl never becomes a component.
-        if (purl) {
+        // without a purl never becomes a component. An aar keeps no
+        // descriptor of its own; its POM sits beside it in the cache.
+        if (purl && !isAar) {
           const embedded = await readEmbeddedJarMetadata(jf, coordinates);
           if (embedded?.pomXml) {
             try {
@@ -294,7 +316,9 @@ export async function collectJarNS(jarPath, pomPathMap = {}) {
           console.log(`Parsing ${jf}`);
         }
         const [nsList, hashValues] = await Promise.all([
-          getJarClasses(jf),
+          // An aar is hashed as published, over the aar file itself; its
+          // classes come from the jars it holds.
+          isAar ? getAarClasses(jf) : getJarClasses(jf),
           multiChecksumFile(["md5", "sha1", "sha256", "sha512"], jf).catch(
             () => undefined,
           ),
@@ -330,12 +354,41 @@ export async function collectJarNS(jarPath, pomPathMap = {}) {
     }
   } else {
     console.log(
-      `${jarPath} did not contain any jars. Try building the project to improve the BOM precision.`,
+      `${jarPath} did not contain any jars or aar files. Try building the project to improve the BOM precision.`,
     );
   }
   return jarNSMapping;
 }
 
+/**
+ * The jar namespace map entries of components a jar scan produced, in the
+ * shape {@link collectJarNS} writes (`{ namespaces: string[] }`), from their
+ * `internal:Namespaces` properties. The scan reads each jar from a temporary
+ * copy, so no `jarFile` is recorded. Purls `existing` already maps keep the
+ * entry they have, which names the jar it was read from.
+ *
+ * @param {Object[]} components Components with `internal:Namespaces` properties
+ * @param {Object} [existing] Jar namespace map already collected
+ * @returns {Object} New entries keyed by purl
+ */
+export function namespaceMappingOfComponents(components, existing = {}) {
+  const mapping = {};
+  for (const component of components || []) {
+    if (!component?.purl || existing[component.purl]) {
+      continue;
+    }
+    const namespaces = (component.properties || [])
+      .filter((property) => property.name === "internal:Namespaces")
+      .flatMap((property) => String(property.value || "").split("\n"))
+      .map((namespace) => namespace.trim())
+      .filter(Boolean);
+    if (namespaces.length) {
+      mapping[component.purl] = { namespaces: [...new Set(namespaces)] };
+    }
+  }
+  return mapping;
+}
+
 /**
  * Convert a JAR namespace mapping (produced by {@link collectJarNS}) into an array
  * of CycloneDX package component objects.
@@ -1101,6 +1154,81 @@ export async function getJarClasses(jarFile) {
   return retList;
 }
 
+/**
+ * Method to get the classes of an Android library. An `.aar` keeps its code
+ * in `classes.jar` at its root and any number of further jars under `libs/`,
+ * each of which is read in turn.
+ *
+ * Each inner jar is unpacked to a temporary file, so in dry run mode, which
+ * blocks those writes, an aar yields no classes. An inner jar that declares
+ * more than `maxInnerJarBytes` uncompressed is skipped without being
+ * decompressed, because the whole entry is held in memory while it is copied.
+ *
+ * @param {string} aarFile Aar file to read
+ * @param {Object} [opts] Options
+ * @param {number} [opts.maxInnerJarBytes] Uncompressed size bound for each
+ *   inner jar. Defaults to 256 MiB.
+ *
+ * @returns {Promise<string[]>} Sorted class names of every jar inside
+ */
+export async function getAarClasses(
+  aarFile,
+  { maxInnerJarBytes = MAX_AAR_INNER_JAR_BYTES } = {},
+) {
+  const classes = new Set();
+  let zip;
+  let tempDir;
+  try {
+    zip = new StreamZip.async({ file: aarFile });
+    const innerJars = Object.values(await zip.entries())
+      .filter(
+        (entry) =>
+          !entry.isDirectory &&
+          (entry.name === "classes.jar" ||
+            (entry.name.startsWith("libs/") && entry.name.endsWith(".jar"))),
+      )
+      .sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
+    for (const entry of innerJars) {
+      if (entry.size > maxInnerJarBytes) {
+        if (DEBUG_MODE) {
+          console.log(
+            `Skipping ${entry.name} in ${aarFile}: ${entry.size} bytes exceeds the ${maxInnerJarBytes} byte limit.`,
+          );
+        }
+        continue;
+      }
+      tempDir ||= safeMkdtempSync(join(getTmpDir(), "aar-classes-"));
+      // Entry names use forward slashes on every platform. node-stream-zip
+      // rejects names with "..", a backslash or an absolute prefix, so the
+      // file stays inside tempDir.
+      const innerJar = join(tempDir, ...entry.name.split("/"));
+      safeMkdirSync(dirname(innerJar), { recursive: true });
+      safeWriteSync(innerJar, await zip.entryData(entry.name));
+      // The write is skipped in dry run mode or without write permission.
+      if (!safeExistsSync(innerJar)) {
+        continue;
+      }
+      for (const cls of await getJarClasses(innerJar)) {
+        classes.add(cls);
+      }
+    }
+  } catch (err) {
+    if (DEBUG_MODE) {
+      console.log(`Unable to read the jars inside ${aarFile}: ${err.message}`);
+    }
+  } finally {
+    if (tempDir) {
+      safeRmSync(tempDir, { recursive: true, force: true });
+    }
+    try {
+      await zip?.close();
+    } catch (_err) {
+      // An archive that failed to open reports its close as well.
+    }
+  }
+  return [...classes].sort();
+}
+
 /**
  * Recursively flatten a Python package's transitive dependencies into the
  * dependencies map and flat package list.