@cdxgen/cdxgen 13.6.0 → 13.7.0

package/lib/core/projectConfig.js

@@ -1,5 +1,8 @@
+import { realpathSync } from "node:fs";
 import path from "node:path";
 
+import { HOST_SCOPE_PROJECT_TYPES } from "./env.js";
+import { boundUntrustedGlobPatterns } from "./globPatterns.js";
 import {
   isReservedMetadataPropertyName,
   METADATA_PROPERTY_CONFIG_KEYS,
@@ -17,10 +20,162 @@ export const PROJECT_CONFIG_FILENAMES = [
   ".cdxgen.yaml",
 ];
 
+/**
+ * Options a config file may set, by their kebab-case name. A config file may
+ * also use the camelCase spelling of each, or one of the aliases in
+ * PROJECT_CONFIG_OPTION_ALIASES. Every other key is ignored: options that
+ * only library callers pass (such as `dosaiCommand` or `traceCmd`), yargs'
+ * own `extends`, and anything cdxgen does not know.
+ *
+ * Every option bin/cdxgen.js declares is either here or in
+ * OPERATOR_ONLY_OPTIONS, which projectConfig.poku.js checks.
+ */
+export const PROJECT_CONFIG_OPTIONS = new Set([
+  "activity-report",
+  "api-key",
+  "author",
+  "auto-compositions",
+  "auto-create",
+  "bom-audit",
+  "bom-audit-categories",
+  "bom-audit-fail-severity",
+  "bom-audit-include-trusted",
+  "bom-audit-max-targets",
+  "bom-audit-min-severity",
+  "bom-audit-only-trusted",
+  "bom-audit-rules-dir",
+  "bom-audit-scope",
+  "cache",
+  "cache-ttl",
+  "callsites-slices-file",
+  "caxa-app-dir",
+  "cmake-cache",
+  "color",
+  "compile-commands",
+  "component-type",
+  "data-flow-slices-file",
+  "deep",
+  "deps-slices-file",
+  "dry-run",
+  "env-audit",
+  "evidence",
+  "evinse-output",
+  "exclude",
+  "exclude-type",
+  "experimental-mcp-pinning",
+  "export-proto",
+  "fail-on-error",
+  "filter",
+  "format",
+  "generate-key-and-sign",
+  "git-branch",
+  "include-crypto",
+  "include-formulation",
+  "include-regex",
+  "include-release-notes",
+  "include-runtime",
+  "install-deps",
+  "introspect",
+  "introspect-annotate",
+  "introspect-fail-below",
+  "introspect-json",
+  "introspect-report",
+  "is-latest",
+  "json-pretty",
+  "license-policy",
+  "license-ref",
+  "lifecycle",
+  "log-format",
+  "metadata-property",
+  "min-confidence",
+  "no-babel",
+  "no-banner",
+  "no-ignore",
+  "only",
+  "openapi-spec-file",
+  "output",
+  "package-extensions",
+  "parent-project-id",
+  "parent-project-name",
+  "parent-project-version",
+  "print",
+  "profile",
+  "progress",
+  "project-group",
+  "project-id",
+  "project-name",
+  "project-tag",
+  "project-version",
+  "proto-bin-file",
+  "quiet",
+  "reachables-slices-file",
+  "recurse",
+  "release-notes-current-tag",
+  "release-notes-previous-tag",
+  "required-only",
+  "resolve-class",
+  "rust",
+  "scalasem",
+  "scalasem-include-tests",
+  "semantics-slices-file",
+  "server-url",
+  "spec-version",
+  "standard",
+  "tea-artifact-url",
+  "tea-author-email",
+  "tea-author-name",
+  "tea-collection-name",
+  "tea-fetch",
+  "tea-leaf-identifier",
+  "tea-publish",
+  "tea-reason",
+  "tea-token",
+  "technique",
+  "tlp-classification",
+  "tui",
+  "type",
+  "usages-slices-file",
+  "validate",
+  "verbose",
+]);
+
+/**
+ * Options only the operator may set, on the command line or through a
+ * CDXGEN_* environment variable. They choose an executable, start a listener,
+ * turn off certificate checks on the operator's own upload, opt into
+ * experimental tool installation, or end the run without a BOM. A config file
+ * that sets one is told so and ignored.
+ */
+export const OPERATOR_ONLY_OPTIONS = new Set([
+  "feature-flags",
+  "help",
+  "scalasem-command",
+  "server",
+  "server-host",
+  "server-port",
+  "skip-dt-tls-check",
+]);
+
+/**
+ * Alternate option names a config file may use, with the option each one
+ * stands for. yargs applies its aliases to config keys too, so each is
+ * checked as the option it names.
+ */
+export const PROJECT_CONFIG_OPTION_ALIASES = new Map([
+  ["c", "resolve-class"],
+  ["exclude-regex", "exclude"],
+  ["h", "help"],
+  ["o", "output"],
+  ["p", "print"],
+  ["q", "quiet"],
+  ["r", "recurse"],
+  ["t", "type"],
+]);
+
 /**
  * Options whose values name a file or directory cdxgen writes to or reads
  * from. A config file may set these, but only to a location inside its own
- * directory.
+ * directory, after symbolic links are resolved.
  */
 const PATH_OPTIONS = new Set([
   "output",
@@ -28,14 +183,26 @@ const PATH_OPTIONS = new Set([
   "proto-bin-file",
   "deps-slices-file",
   "usages-slices-file",
+  "callsites-slices-file",
   "data-flow-slices-file",
   "reachables-slices-file",
   "semantics-slices-file",
   "openapi-spec-file",
   "license-policy",
   "bom-audit-rules-dir",
+  "introspect-report",
+  "introspect-json",
+  "cmake-cache",
+  "compile-commands",
+  "caxa-app-dir",
 ]);
 
+/**
+ * Options whose values are glob patterns matched against every file a scan
+ * walks, in the order they draw on the shared expansion budget.
+ */
+const PATTERN_OPTIONS = ["exclude", "include-regex"];
+
 /**
  * Options that change where cdxgen sends data or how much of the host it
  * touches. These stay usable, but never silently.
@@ -64,9 +231,53 @@ function optionSpellings(option) {
   return camel === option ? [option] : [option, camel];
 }
 
+/**
+ * Find the option a config key names.
+ *
+ * @param {string} key config file key
+ * @returns {string|undefined} kebab-case option name, or undefined when the
+ *   key is not the kebab-case spelling, the camelCase spelling or an alias of
+ *   an option cdxgen declares
+ */
+function configKeyOption(key) {
+  if (PROJECT_CONFIG_OPTION_ALIASES.has(key)) {
+    return PROJECT_CONFIG_OPTION_ALIASES.get(key);
+  }
+  const kebab = key.replace(/[A-Z]/g, (letter) => `-${letter.toLowerCase()}`);
+  if (!PROJECT_CONFIG_OPTIONS.has(kebab) && !OPERATOR_ONLY_OPTIONS.has(kebab)) {
+    return undefined;
+  }
+  return optionSpellings(kebab).includes(key) ? kebab : undefined;
+}
+
+/**
+ * Resolve a path through the symbolic links of its longest existing prefix.
+ * The part that does not exist yet is appended unchanged.
+ *
+ * @param {string} absolutePath absolute path to resolve
+ * @returns {string} the path with every existing component resolved
+ */
+function resolveExistingPrefix(absolutePath) {
+  const missing = [];
+  let current = absolutePath;
+  for (;;) {
+    try {
+      return path.join(realpathSync(current), ...missing.reverse());
+    } catch {
+      const parent = path.dirname(current);
+      if (parent === current) {
+        return absolutePath;
+      }
+      missing.push(path.basename(current));
+      current = parent;
+    }
+  }
+}
+
 /**
  * Determine whether a config-supplied path stays inside the config's own
- * directory.
+ * directory once symbolic links are resolved, so a link committed to the
+ * scanned tree cannot carry a path option outside it.
  *
  * @param {string} configDir directory the config file was read from
  * @param {unknown} value config-supplied path value
@@ -76,40 +287,95 @@ function isContainedPath(configDir, value) {
   if (typeof value !== "string" || !value.length) {
     return false;
   }
-  const relativePath = path.relative(
-    path.resolve(configDir),
-    path.resolve(configDir, value),
-  );
+  const root = resolveExistingPrefix(path.resolve(configDir));
+  const target = resolveExistingPrefix(path.resolve(configDir, value));
+  const relativePath = path.relative(root, target);
   return (
     relativePath === "" ||
-    (!relativePath.startsWith("..") && !path.isAbsolute(relativePath))
+    (relativePath !== ".." &&
+      !relativePath.startsWith(`..${path.sep}`) &&
+      !path.isAbsolute(relativePath))
   );
 }
 
+/**
+ * Split a config-supplied project type value into the individual types.
+ *
+ * @param {unknown} value `type` value from a config file
+ * @returns {string[]} trimmed, non-empty project types
+ */
+function projectTypeList(value) {
+  return (Array.isArray(value) ? value : [value])
+    .flatMap((entry) => `${entry ?? ""}`.split(","))
+    .map((entry) => entry.trim())
+    .filter(Boolean);
+}
+
 /**
  * Apply the trust boundary between cdxgen and the directory it is scanning.
  *
  * A config file lives in the tree under analysis, so it is attacker-controlled
- * whenever that tree is. Path options are therefore confined to the config's
- * own directory - a scanned project may choose where in itself the BOM lands,
- * but not write outside it - and options that redirect data off the host or
- * widen what cdxgen executes are announced on the console. A project may
- * describe itself with custom metadata properties, but not in the namespaces
- * cdxgen reserves for the facts it establishes, so a scanned tree cannot pass
- * its own claims off as cdxgen's.
+ * whenever that tree is. It may therefore only set the options listed in
+ * PROJECT_CONFIG_OPTIONS: options that choose an executable, start a listener
+ * or weaken the operator's own checks, and every key cdxgen does not declare
+ * as an option, are dropped. Path options are confined to the config's own
+ * directory - a scanned project may choose where in itself the BOM lands, but
+ * not write outside it - and project types that inventory the host rather
+ * than the scan path are dropped. Exclude and include patterns are kept
+ * within the bounds of boundUntrustedGlobPatterns, so a project cannot make
+ * every file match against thousands of brace-expanded patterns. Options that
+ * redirect data off the host or widen what cdxgen does are announced on the
+ * console. A project may describe itself with custom metadata properties, but
+ * not in the namespaces cdxgen reserves for the facts it establishes, so a
+ * scanned tree cannot pass its own claims off as cdxgen's.
  *
  * @param {Object} config parsed config file contents
  * @param {string} configDir directory the config file was read from
- * @returns {{config: Object, rejected: string[], announced: string[], reservedProperties: string[]}} sanitized config and what it did
+ * @returns {{config: Object, rejected: string[], announced: string[], reservedProperties: string[], ignored: string[], operatorOnly: string[], hostScopeTypes: string[], refusedPatterns: {key: string, pattern: string, reason: string}[]}} sanitized config and what it did
  */
 export function sanitizeProjectConfig(config, configDir) {
-  if (!config || typeof config !== "object") {
-    return { announced: [], config: {}, rejected: [], reservedProperties: [] };
+  const result = {
+    announced: [],
+    config: {},
+    hostScopeTypes: [],
+    ignored: [],
+    operatorOnly: [],
+    refusedPatterns: [],
+    rejected: [],
+    reservedProperties: [],
+  };
+  if (!config || typeof config !== "object" || Array.isArray(config)) {
+    return result;
+  }
+  const sanitized = result.config;
+  const aliasEntries = [];
+  for (const [key, value] of Object.entries(config)) {
+    if (METADATA_PROPERTY_CONFIG_KEYS.includes(key)) {
+      sanitized[key] = value;
+      continue;
+    }
+    const option = configKeyOption(key);
+    if (!option) {
+      result.ignored.push(key);
+      continue;
+    }
+    if (OPERATOR_ONLY_OPTIONS.has(option)) {
+      result.operatorOnly.push(key);
+      continue;
+    }
+    if (PROJECT_CONFIG_OPTION_ALIASES.has(key)) {
+      aliasEntries.push([option, value]);
+      continue;
+    }
+    sanitized[key] = value;
+  }
+  // An alias is stored under the option it names, so the checks below see
+  // it. A spelled-out option in the same file takes precedence.
+  for (const [option, value] of aliasEntries) {
+    if (optionSpellings(option).every((key) => sanitized[key] === undefined)) {
+      sanitized[option] = value;
+    }
   }
-  const sanitized = { ...config };
-  const rejected = [];
-  const announced = [];
-  const reservedProperties = [];
   for (const key of METADATA_PROPERTY_CONFIG_KEYS) {
     if (sanitized[key] === undefined) {
       continue;
@@ -117,7 +383,7 @@ export function sanitizeProjectConfig(config, configDir) {
     const properties = [];
     for (const aprop of parseMetadataProperties(sanitized[key])) {
       if (isReservedMetadataPropertyName(aprop.name)) {
-        reservedProperties.push(aprop.name);
+        result.reservedProperties.push(aprop.name);
       } else {
         properties.push(aprop);
       }
@@ -134,17 +400,58 @@ export function sanitizeProjectConfig(config, configDir) {
         continue;
       }
       if (!isContainedPath(configDir, sanitized[key])) {
-        rejected.push(`${key}=${sanitized[key]}`);
+        result.rejected.push(`${key}=${sanitized[key]}`);
         delete sanitized[key];
       }
     }
   }
+  if (sanitized.type !== undefined) {
+    const types = projectTypeList(sanitized.type);
+    const projectTypes = types.filter(
+      (type) => !HOST_SCOPE_PROJECT_TYPES.has(type.toLowerCase()),
+    );
+    result.hostScopeTypes = types.filter(
+      (type) => !projectTypes.includes(type),
+    );
+    if (result.hostScopeTypes.length) {
+      if (projectTypes.length) {
+        sanitized.type = projectTypes;
+      } else {
+        delete sanitized.type;
+      }
+    }
+  }
+  // Exclude patterns, then include patterns, share one expansion budget.
+  let patternsUsed = 0;
+  for (const option of PATTERN_OPTIONS) {
+    for (const key of optionSpellings(option)) {
+      if (sanitized[key] === undefined) {
+        continue;
+      }
+      const { accepted, expansions, refused } = boundUntrustedGlobPatterns(
+        sanitized[key],
+        { used: patternsUsed },
+      );
+      patternsUsed += expansions;
+      for (const entry of refused) {
+        result.refusedPatterns.push({ key, ...entry });
+      }
+      if (!refused.length) {
+        continue;
+      }
+      if (!accepted.length) {
+        delete sanitized[key];
+      } else {
+        sanitized[key] = Array.isArray(sanitized[key]) ? accepted : accepted[0];
+      }
+    }
+  }
   for (const option of ANNOUNCED_OPTIONS) {
     for (const key of optionSpellings(option)) {
       if (sanitized[key] !== undefined) {
-        announced.push(key);
+        result.announced.push(key);
       }
     }
   }
-  return { announced, config: sanitized, rejected, reservedProperties };
+  return result;
 }

package/lib/core/toolRegistry.js

@@ -48,6 +48,16 @@ const WRAPPER_BASENAMES = new Set([
   "zsh",
 ]);
 
+/**
+ * Commands cdxgen runs to learn about the machine it runs on rather than the
+ * project, such as `ldd --version` choosing between the glibc and musl
+ * plugin binaries. They did not help generate the BOM, so they are not tools
+ * of it.
+ *
+ * @type {Set<string>}
+ */
+const HOST_PROBE_BASENAMES = new Set(["ldd"]);
+
 /**
  * Strip a trailing Windows executable suffix from a binary name.
  *
@@ -97,7 +107,11 @@ export function recordExecutedTool(name, version) {
     return;
   }
   const toolName = toolNameOf(name);
-  if (!toolName || WRAPPER_BASENAMES.has(toolName)) {
+  if (
+    !toolName ||
+    WRAPPER_BASENAMES.has(toolName) ||
+    HOST_PROBE_BASENAMES.has(toolName)
+  ) {
     return;
   }
   const key = toolName.toLowerCase();

package/lib/ecosystems/denoutils.js

@@ -721,7 +721,7 @@ export async function parseDenoLock(lockFile, options = {}) {
     // Deterministic canonical jsr page for the original specifier, e.g.
     // `https://jsr.io/@std/assert@1.0.19`. The npm-mirror tarball URL is only
     // available after a registry lookup, so this gives every jsr component a
-    // stable reference even without --fetch-license.
+    // stable reference even when FETCH_LICENSE is not set.
     const jsrHomepage = `https://jsr.io/${group ? `${group}/` : ""}${name}@${version}`;
     const pkgObj = {
       group: JSR_NPM_SCOPE,
@@ -1056,7 +1056,7 @@ export async function parseDenoLock(lockFile, options = {}) {
 
   // Offline enrichment first: mine license/description/repository from a
   // project's node_modules and the global deno npm cache. This needs no
-  // network and runs even without --fetch-license.
+  // network and runs even when FETCH_LICENSE is not set.
   mineInstalledMetadata(
     pkgList,
     options.projectRoot || dirname(lockFile),

package/lib/ecosystems/golem.js

@@ -20,6 +20,7 @@ import {
   hasInlineCredential,
   sanitizeBomUrl,
 } from "../core/propertySanitizer.js";
+import { occurrenceLocationKey } from "../inventory/occurrenceKey.js";
 import { resolvePluginBinary } from "../inventory/plugins.js";
 import { canonicalPurlFromLooseString } from "../inventory/purl.js";
 
@@ -93,20 +94,14 @@ function rangeLocation(range) {
   if (!start?.filename) {
     return undefined;
   }
-  if (start.line && start.line > 0) {
-    return `${start.filename}#${start.line}`;
-  }
-  return start.filename;
+  return occurrenceLocationKey(start.filename, start.line);
 }
 
 function positionLocation(position) {
   if (!position?.filename) {
     return undefined;
   }
-  if (position.line && position.line > 0) {
-    return `${position.filename}#${position.line}`;
-  }
-  return position.filename;
+  return occurrenceLocationKey(position.filename, position.line);
 }
 
 function purlWithoutVersion(purl) {