@cdxgen/cdxgen 13.6.0 → 13.7.0

package/lib/inventory/dotnetRuntime.js

@@ -11,7 +11,7 @@
 // https://learn.microsoft.com/dotnet/core/dependency-loading/default-probing#how-are-the-properties-populated
 
 import { closeSync, readSync } from "node:fs";
-import { join } from "node:path";
+import { isAbsolute, join } from "node:path";
 
 import { globSync } from "glob";
 
@@ -38,6 +38,12 @@ const DOTNET_ROOTS = [
 ];
 const RUNTIME_PACK_RE =
   /^(Microsoft\.[A-Za-z]+(?:\.[A-Za-z]+)*\.App\.Runtime\.[A-Za-z0-9.-]+)\/(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)$/;
+// The version shape a runtime pack names, anchored for the versions a line of
+// `dotnet --list-runtimes` reports.
+const RUNTIME_VERSION_RE = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/;
+// The pre-release label a CPE can name: `rc` or `preview` with its number,
+// written with or without a dot between the label and the number.
+const PRERELEASE_LABEL_RE = /^(rc|preview)\.?(\d+)(?:[.-]|$)/;
 
 function readJsonBounded(absPath, rootDir) {
   const opened = openRegularFile(absPath, rootDir);
@@ -93,27 +99,79 @@ export function runtimePackFromDepsJson(depsJson, framework) {
 }
 
 /**
- * The CPE NVD uses for a shared framework version: `.net` from 5.0 on,
- * `.net_core` before it, and `asp.net_core` for ASP.NET Core.
+ * The .NET majors whose previews NVD names `preview.<N>`. NVD names the
+ * previews of every other .NET major, of ASP.NET Core and of .NET Core
+ * `preview<N>`.
+ */
+const DOTTED_PREVIEW_MAJORS = new Set([7, 8, 10]);
+
+/**
+ * Read the pre-release tag of a runtime version.
+ *
+ * @param {string} version runtime version
+ * @returns {{label: string, number: string}|null|undefined} the `rc` or
+ *   `preview` tag and its number; undefined for a release; null for a
+ *   pre-release of any other kind
+ */
+function dotnetPrerelease(version) {
+  const dashAt = version.indexOf("-");
+  if (dashAt < 0) {
+    return undefined;
+  }
+  const tag = PRERELEASE_LABEL_RE.exec(version.slice(dashAt + 1));
+  return tag ? { label: tag[1], number: tag[2] } : null;
+}
+
+/**
+ * The CPE NVD uses for a shared framework version, with the version and update
+ * fields spelled the way the NVD CPE dictionary spells them.
+ *
+ * The product is `.net` from 5.0 on, `.net_core` before it, and `asp.net_core`
+ * for ASP.NET Core. NVD names a .NET Core x.y.0 release and its pre-releases
+ * with two version parts (`.net_core:3.1`, `.net_core:3.0:preview9`), and the
+ * .NET 5.0 pre-releases the same way (`.net:5.0:rc1`); every other version
+ * keeps three. A release candidate is `rc<N>`, and a preview is
+ * `preview.<N>` for .NET 7, 8 and 10 and `preview<N>` otherwise. A release
+ * keeps the `*` update, which is the only one NVD lists for some releases. A
+ * pre-release of any other kind names no version NVD has, so it gets no CPE.
  *
  * @param {string} framework framework directory name
  * @param {string} version runtime version
  * @returns {string|undefined} CPE 2.3 string
  */
 export function dotnetCpe(framework, version) {
-  const base = /^(\d+)\.\d+\.\d+/.exec(version || "");
+  const base = /^(\d+)\.(\d+)\.(\d+)/.exec(version || "");
   if (!base) {
     return undefined;
   }
-  const plain = base[0];
+  const major = Number(base[1]);
+  let product;
   if (framework === "Microsoft.AspNetCore.App") {
-    return `cpe:2.3:a:microsoft:asp.net_core:${plain}:*:*:*:*:*:*:*`;
+    product = "asp.net_core";
+  } else if (framework === "Microsoft.NETCore.App") {
+    product = major >= 5 ? ".net" : ".net_core";
+  } else {
+    return undefined;
   }
-  if (framework === "Microsoft.NETCore.App") {
-    const product = Number(base[1]) >= 5 ? ".net" : ".net_core";
-    return `cpe:2.3:a:microsoft:${product}:${plain}:*:*:*:*:*:*:*`;
+  const prerelease = dotnetPrerelease(version);
+  if (prerelease === null) {
+    return undefined;
   }
-  return undefined;
+  let update = "*";
+  if (prerelease?.label === "rc") {
+    update = `rc${prerelease.number}`;
+  } else if (prerelease) {
+    update =
+      product === ".net" && DOTTED_PREVIEW_MAJORS.has(major)
+        ? `preview.${prerelease.number}`
+        : `preview${prerelease.number}`;
+  }
+  const twoPart =
+    base[3] === "0" &&
+    (product === ".net_core" ||
+      (product === ".net" && major === 5 && prerelease !== undefined));
+  const cpeVersion = twoPart ? `${base[1]}.${base[2]}` : base[0];
+  return `cpe:2.3:a:microsoft:${product}:${cpeVersion}:${update}:*:*:*:*:*:*`;
 }
 
 /**
@@ -121,7 +179,9 @@ export function dotnetCpe(framework, version) {
  *
  * @param {string} framework framework directory name
  * @param {{pack: string, version: string, rid: string}} runtime runtime pack
- * @param {string} location root-relative path of the deps.json
+ * @param {string} [location] root-relative path of the deps.json. A runtime
+ *   found on the scanning host gets none, since host paths can name the user's
+ *   home directory.
  * @returns {Object|undefined} component, or undefined when no purl can be built
  */
 export function createDotnetRuntimeComponent(framework, runtime, location) {
@@ -133,10 +193,12 @@ export function createDotnetRuntimeComponent(framework, runtime, location) {
       { name: "cdx:dotnet:sharedFramework", value: framework },
       { name: "cdx:dotnet:runtimeIdentifier", value: runtime.rid },
     ],
-    evidence: {
-      occurrences: [{ location: `/${location.replace(/^\/+/, "")}` }],
-    },
   };
+  if (location) {
+    component.evidence = {
+      occurrences: [{ location: `/${location.replace(/^\/+/, "")}` }],
+    };
+  }
   const cpe = dotnetCpe(framework, runtime.version);
   if (cpe) {
     component.cpe = cpe;
@@ -152,6 +214,94 @@ export function createDotnetRuntimeComponent(framework, runtime, location) {
   return applyPurl(component, purl);
 }
 
+/**
+ * Parse the output of `dotnet --list-runtimes`, one `<framework> <version>
+ * [<directory>]` line per installed runtime. Warnings, update notices, blank
+ * lines, unknown frameworks and versions of a shape no runtime pack names are
+ * left out, and no more than MAX_FRAMEWORKS runtimes are kept.
+ *
+ * https://learn.microsoft.com/dotnet/core/install/how-to-detect-installed-versions
+ *
+ * @param {string} output output of `dotnet --list-runtimes`
+ * @returns {{framework: string, version: string, frameworkDir: string}[]} one
+ *   entry per installed runtime
+ */
+export function parseDotnetListRuntimes(output) {
+  const entries = [];
+  if (!output) {
+    return entries;
+  }
+  for (const rawLine of `${output}`.split(/\r?\n/)) {
+    if (entries.length >= MAX_FRAMEWORKS) {
+      break;
+    }
+    const line = rawLine.trim();
+    // The directory is the text between ` [` and the trailing `]`, and can
+    // contain spaces, as in `C:\Program Files\dotnet\shared\Microsoft.NETCore.App`.
+    const bracketAt = line.indexOf(" [");
+    if (bracketAt <= 0 || !line.endsWith("]")) {
+      continue;
+    }
+    const head = line.slice(0, bracketAt);
+    const spaceAt = head.indexOf(" ");
+    if (spaceAt <= 0) {
+      continue;
+    }
+    const framework = head.slice(0, spaceAt);
+    const version = head.slice(spaceAt + 1);
+    if (!FRAMEWORKS.has(framework) || !RUNTIME_VERSION_RE.test(version)) {
+      continue;
+    }
+    const frameworkDir = line.slice(bracketAt + 2, line.length - 1);
+    entries.push({ framework, version, frameworkDir });
+  }
+  return entries;
+}
+
+/**
+ * Create the platform component for one runtime the host install reports.
+ *
+ * The identity comes from the deps.json in the runtime's own directory, read
+ * with the directory as the root so the read cannot leave it and a symlink is
+ * not followed. Only an absolute directory is read, which is what the dotnet
+ * host prints. A runtime whose deps.json is missing, unreadable or names
+ * another version keeps its name, its version and its CPE, without a purl:
+ * without the runtime identifier of the pack there is no correct nuget purl.
+ *
+ * @param {{framework: string, version: string, frameworkDir: string}} entry
+ *   one entry of parseDotnetListRuntimes
+ * @returns {Object} platform component
+ */
+export function createHostDotnetRuntimeComponent(entry) {
+  const depsJson = isAbsolute(entry.frameworkDir)
+    ? readJsonBounded(
+        join(entry.frameworkDir, entry.version, `${entry.framework}.deps.json`),
+        entry.frameworkDir,
+      )
+    : undefined;
+  const runtime = runtimePackFromDepsJson(depsJson, entry.framework);
+  // The directory a runtime lives in is named after its version.
+  if (runtime && runtime.version === entry.version) {
+    const component = createDotnetRuntimeComponent(entry.framework, runtime);
+    if (component) {
+      return component;
+    }
+  }
+  const component = {
+    type: "platform",
+    name: entry.framework,
+    version: entry.version,
+    properties: [
+      { name: "cdx:dotnet:sharedFramework", value: entry.framework },
+    ],
+  };
+  const cpe = dotnetCpe(entry.framework, entry.version);
+  if (cpe) {
+    component.cpe = cpe;
+  }
+  return component;
+}
+
 /**
  * Find the .NET shared frameworks installed under a root that no package
  * manager owns, and return one platform component per runtime pack.