@cdxgen/cdxgen 13.5.0 → 13.7.0

package/lib/inventory/rubyHostProbe.js

@@ -0,0 +1,218 @@
+// Bounded, read-only probe for the Ruby no package manager owns on a live host,
+// for `-t os` / obom. osquery's package tables list what dpkg, rpm and the like
+// installed, so a Ruby built by ruby-build, rbenv, rvm, asdf, mise, chruby or
+// frum, unpacked from a toolcache tarball, or installed under /usr/local or
+// /opt is invisible to them, and with it the version an advisory in the
+// interpreter core is read against.
+//
+// Candidates come from fixed directories and from each version manager's tree
+// under the home directories, one wildcard level at a time, never from a walk
+// of the file system. The ownership rules, caps and degradations are the
+// shared host-runtime probe's. Only rbconfig.rb and the interpreter's own
+// files are read; nothing is executed.
+
+import { join } from "node:path";
+
+import {
+  isDryRun,
+  readEnvironmentVariable,
+  recordActivity,
+} from "../core/activity.js";
+import { recordDegradation } from "../core/buildLedger.js";
+import {
+  isDirectory,
+  listDirectory,
+  probeHostRuntime,
+} from "./hostRuntimeProbe.js";
+import {
+  attachRubyBuild,
+  createRubyRuntimeInventory,
+  isRubyBinaryName,
+  MAX_RUBY_PROBES,
+  readRubyBuildVersion,
+} from "./rubyBuildInfo.js";
+
+// The most directories one wildcard pattern may expand to.
+const MAX_EXPANDED_DIRECTORIES = 256;
+
+// Relative to the root.
+const POSIX_DIRECTORIES = {
+  linux: [
+    "usr/local/bin",
+    "opt/*/bin",
+    "opt/rubies/*/bin",
+    "opt/hostedtoolcache/Ruby/*/*/bin",
+    "usr/local/rbenv/versions/*/bin",
+    "usr/local/rvm/rubies/*/bin",
+  ],
+  darwin: [
+    "usr/local/bin",
+    "opt/*/bin",
+    "opt/rubies/*/bin",
+    "Users/runner/hostedtoolcache/Ruby/*/*/bin",
+  ],
+};
+
+// Relative to a home directory.
+export const RUBY_VERSION_MANAGER_DIRECTORIES = [
+  ".rbenv/versions/*/bin",
+  ".rvm/rubies/*/bin",
+  ".asdf/installs/ruby/*/bin",
+  ".local/share/mise/installs/ruby/*/bin",
+  ".rubies/*/bin",
+  ".frum/versions/*/bin",
+  ".local/share/rv/rubies/*/bin",
+];
+
+export const HOME_PARENTS = {
+  linux: ["home"],
+  darwin: ["Users"],
+};
+
+/**
+ * Expand a relative directory pattern whose `*` segments match one directory
+ * name each.
+ *
+ * @param {string} base absolute directory the pattern hangs off
+ * @param {string} pattern `/`-separated relative pattern
+ * @returns {string[]} existing directories, at most MAX_EXPANDED_DIRECTORIES
+ */
+export function expandDirectories(base, pattern) {
+  let current = [base];
+  for (const segment of pattern.split("/")) {
+    const next = [];
+    for (const directory of current) {
+      if (segment !== "*") {
+        next.push(join(directory, segment));
+        continue;
+      }
+      for (const name of listDirectory(directory)) {
+        const child = join(directory, name);
+        if (isDirectory(child)) {
+          next.push(child);
+        }
+        if (next.length >= MAX_EXPANDED_DIRECTORIES) {
+          break;
+        }
+      }
+    }
+    current = next.slice(0, MAX_EXPANDED_DIRECTORIES);
+  }
+  return current.filter(isDirectory);
+}
+
+/**
+ * The home directories of a host: /root and /home/* on Linux, /Users/* on
+ * macOS.
+ *
+ * @param {{rootPath: string, platform: string}} context probe context
+ * @returns {string[]}
+ */
+export function homeDirectories(context) {
+  const { rootPath, platform } = context;
+  const homes = [];
+  if (platform === "linux") {
+    homes.push(join(rootPath, "root"));
+  }
+  for (const parent of HOME_PARENTS[platform] || []) {
+    for (const name of listDirectory(join(rootPath, parent))) {
+      const home = join(rootPath, parent, name);
+      if (isDirectory(home)) {
+        homes.push(home);
+      }
+    }
+  }
+  return homes.slice(0, MAX_EXPANDED_DIRECTORIES);
+}
+
+/**
+ * The directories a Windows Ruby lives in: the RubyInstaller's C:\Ruby34-x64,
+ * Chocolatey's C:\tools\ruby34, and the hosted toolcache.
+ *
+ * @param {Object} context probe context
+ * @returns {string[]} install roots, each with a `bin` directory
+ */
+export function windowsRubyRoots(context) {
+  const { rootPath } = context;
+  const roots = [];
+  for (const parent of [rootPath, join(rootPath, "tools")]) {
+    for (const name of listDirectory(parent)) {
+      const directory = join(parent, name);
+      if (name.toLowerCase().startsWith("ruby") && isDirectory(directory)) {
+        roots.push(directory);
+      }
+    }
+  }
+  roots.push(
+    ...expandDirectories(rootPath, "hostedtoolcache/windows/Ruby/*/*"),
+  );
+  return roots.slice(0, MAX_EXPANDED_DIRECTORIES);
+}
+
+function candidateDirectories(context) {
+  const { rootPath, platform } = context;
+  const directories = [];
+  if (platform === "win32") {
+    for (const root of windowsRubyRoots(context)) {
+      directories.push({ directory: join(root, "bin") });
+    }
+    return directories;
+  }
+  for (const pattern of POSIX_DIRECTORIES[platform] || []) {
+    for (const directory of expandDirectories(rootPath, pattern)) {
+      directories.push({ directory });
+    }
+  }
+  for (const home of homeDirectories(context)) {
+    for (const pattern of RUBY_VERSION_MANAGER_DIRECTORIES) {
+      for (const directory of expandDirectories(home, pattern)) {
+        directories.push({ directory });
+      }
+    }
+  }
+  return directories;
+}
+
+/**
+ * Look for Ruby no package manager owns on the host. Components come back
+ * only for the files nothing owns: a `file` component for each `ruby` binary
+ * with the cdx:ruby properties, and one `platform` component per Ruby version
+ * with its CPE.
+ *
+ * @param {Object} [options] probe options, as probeHostPhp takes them
+ * @returns {{components: Object[], dependencies: Object[]}}
+ */
+export function probeHostRuby(options = {}) {
+  return probeHostRuntime(options, {
+    label: "Ruby",
+    ecosystem: "ruby",
+    capability: "ruby-host-probe",
+    remediationId: "ruby.host-probe.package-db-unreadable",
+    maxProbes: MAX_RUBY_PROBES,
+    chocolateyPackages: ["ruby"],
+    // Chocolatey's ruby package runs the RubyInstaller into C:\tools.
+    chocolateyDirectories: (context) => [join(context.rootPath, "tools")],
+    directories: candidateDirectories,
+    classify: (name, platform) => {
+      if (platform === "win32") {
+        return name.toLowerCase() === "ruby.exe" ? "ruby" : undefined;
+      }
+      return isRubyBinaryName(name) ? "ruby" : undefined;
+    },
+    readBuild: (context, candidate) =>
+      readRubyBuildVersion(candidate.real, context.realRoot),
+    createInventory: createRubyRuntimeInventory,
+    attach: (inventory, component, build) =>
+      attachRubyBuild(inventory, component, build),
+    finish: (inventory) => ({
+      components: inventory.runtimeComponents,
+      dependencies: inventory.dependencies,
+    }),
+    hooks: {
+      isDryRun,
+      readEnvironmentVariable,
+      recordActivity,
+      recordDegradation,
+    },
+  });
+}

package/lib/inventory/rustFormulationParser.js

@@ -3,6 +3,7 @@ import { basename, dirname, join } from "node:path";
 
 import { safeExistsSync } from "../core/fs.js";
 import { parseToml } from "../core/toml.js";
+import { formulationSourcePath } from "./ecosystemFormulationParsers.js";
 
 // Keep this list conservative and high-signal: it is meant to surface common
 // Rust native build helpers for audit triage, not to exhaustively model every
@@ -53,17 +54,18 @@ function appendProperty(properties, name, value) {
   });
 }
 
-function createFormulationComponent(name, filePath, toolName) {
+function createFormulationComponent(name, filePath, toolName, rootDir) {
+  const sourcePath = formulationSourcePath(filePath, rootDir);
   return {
     type: "application",
     name,
     version: "config",
-    "bom-ref": `urn:cdxgen:formulation:${toolName}:${filePath}`,
-    properties: [{ name: "internal:SrcFile", value: filePath }],
+    "bom-ref": `urn:cdxgen:formulation:${toolName}:${sourcePath}`,
+    properties: [{ name: "internal:SrcFile", value: sourcePath }],
   };
 }
 
-function parseCargoManifest(filePath) {
+function parseCargoManifest(filePath, rootDir) {
   let cargoData;
   try {
     cargoData = parseToml(readFileSync(filePath, { encoding: "utf-8" }));
@@ -75,7 +77,12 @@ function parseCargoManifest(filePath) {
   }
   const packageName =
     cargoData?.package?.name || basename(dirname(filePath)) || "cargo-project";
-  const component = createFormulationComponent(packageName, filePath, "cargo");
+  const component = createFormulationComponent(
+    packageName,
+    filePath,
+    "cargo",
+    rootDir,
+  );
   const properties = component.properties;
   const buildDependencies = cargoData?.["build-dependencies"];
   const devDependencies = cargoData?.["dev-dependencies"];
@@ -248,7 +255,7 @@ function parseCargoManifest(filePath) {
   return component;
 }
 
-function parsePyProject(filePath) {
+function parsePyProject(filePath, rootDir) {
   let pyprojectData;
   try {
     pyprojectData = parseToml(readFileSync(filePath, { encoding: "utf-8" }));
@@ -269,6 +276,7 @@ function parsePyProject(filePath) {
       "maturin-project",
     filePath,
     "maturin",
+    rootDir,
   );
   const properties = component.properties;
   appendProperty(properties, "cdx:rust:buildTool", "maturin");
@@ -311,23 +319,26 @@ function parsePyProject(filePath) {
  * formulation components carrying build-tool, build-script capability, native
  * build dependency, and maturin metadata properties.
  *
- * @type {{id: string, patterns: string[], parse(files: string[]): {components: Object[]}}}
+ * Components record the manifest path relative to context.rootDir, the
+ * scanned project root.
+ *
+ * @type {{id: string, patterns: string[], parse(files: string[], options?: Object, context?: {rootDir?: string}): {components: Object[]}}}
  */
 export const rustFormulationParser = {
   id: "rust-build",
   patterns: ["**/Cargo.toml", "**/pyproject.toml"],
-  parse(files) {
+  parse(files, _options, context = {}) {
     const components = [];
     for (const filePath of files || []) {
       if (filePath.endsWith("Cargo.toml")) {
-        const cargoComponent = parseCargoManifest(filePath);
+        const cargoComponent = parseCargoManifest(filePath, context.rootDir);
         if (cargoComponent) {
           components.push(cargoComponent);
         }
         continue;
       }
       if (filePath.endsWith("pyproject.toml")) {
-        const pyprojectComponent = parsePyProject(filePath);
+        const pyprojectComponent = parsePyProject(filePath, context.rootDir);
         if (pyprojectComponent) {
           components.push(pyprojectComponent);
         }

package/lib/inventory/scalaCoords.js

@@ -7,7 +7,7 @@ import { Purl } from "@cdxgen/cdx-purl";
 // platform suffix (`jwt-core`, `upickle_sjs1`), so the same library is named
 // differently depending on the build tool that reported it.
 const SCALA_BINARY_SUFFIX_REGEX = /_(2\.\d+|3)$/;
-const SCALA_PLATFORM_SUFFIX_REGEX = /_(sjs1|sjs0\.6|native0\.\d+)$/;
+const SCALA_PLATFORM_SUFFIX_REGEX = /_(sjs\d+(?:\.\d+)?|native\d+(?:\.\d+)?)$/;
 
 /**
  * Parse a Scala-published Maven artifact name into its coordinate parts.
@@ -123,10 +123,11 @@ export function scalaCoordinateOfPurl(purlString) {
 }
 
 // An artifact name that already ends in a full Scala version, as scala-cli
-// `:::` and sbt `CrossVersion.full` artifacts do (`_3.3.7`, `_2.13.16`). A
+// `:::` and sbt `CrossVersion.full` artifacts do (`_3.3.7`, `_2.13.16`,
+// `_3.4.0-RC1-bin-20231010-abc1234-NIGHTLY`). A
 // binary suffix such as `_3` left on a name is part of the name: the
 // component producers strip exactly one, into the compiler version.
-const SCALA_FULL_VERSION_SUFFIX_REGEX = /_\d+\.\d+\.\d+(?:-[A-Za-z0-9.]+)?$/;
+const SCALA_FULL_VERSION_SUFFIX_REGEX = /_\d+\.\d+\.\d+(?:-[A-Za-z0-9.-]+)?$/;
 
 /**
  * The artifactId the library is published under, for cache and repository