@cdxgen/cdxgen 13.6.0 → 13.7.0

package/lib/parsers/kiroPermissions.js

@@ -0,0 +1,166 @@
+/**
+ * Summarize Kiro CLI V3 permission documents into policy-safe posture facts.
+ *
+ * Kiro V3 describes what an agent may do with `capability`/`effect` rules that
+ * live in an agent definition's `permissions` object, in the user-scope
+ * `~/.kiro/settings/permissions.yaml`, and in the per-workspace
+ * `~/.kiro/workspace-roots/<hash>/permissions.yaml`. The rules carry `match`
+ * pattern lists, free-text reasons, and paths, none of which belong in a BOM.
+ * This module reduces a document to counts, allowlisted effect counts,
+ * validated capability names, and booleans, and never returns the patterns or
+ * any other free text.
+ */
+
+// Effects documented at kiro.dev/docs/permissions. An unknown effect is
+// counted by `ruleCount` alone and by no per-effect counter.
+const KIRO_EFFECTS = new Set(["allow", "deny", "ask", "evaluate"]);
+
+// Policy presets that may be listed under the top-level `policies` key.
+// kiro.dev documents `approve-for-me`; other preset names are dropped rather
+// than copied, because the full set is not documented.
+const KIRO_POLICY_PRESET_ALLOWLIST = new Set(["approve-for-me"]);
+
+// A capability is a short lowercase token such as `fs_read`, `shell`, or the
+// meta-capability `all`. Anything outside this shape is dropped instead of
+// being copied into the BOM.
+const KIRO_CAPABILITY_PATTERN = /^[a-z][a-z0-9_-]{0,63}$/u;
+
+const isPlainEntry = (value) =>
+  value !== null && typeof value === "object" && !Array.isArray(value);
+
+const sortedUnique = (values) => [...new Set(values)].sort();
+
+/**
+ * Decide whether a rule's `match` list holds at least one non-empty pattern.
+ *
+ * @param {unknown} match The rule's match value
+ * @returns {boolean} True when a non-empty string pattern is present
+ */
+const hasNonEmptyMatch = (match) =>
+  Array.isArray(match) &&
+  match.some((entry) => typeof entry === "string" && entry.trim() !== "");
+
+/**
+ * Summarize a Kiro V3 permission document.
+ *
+ * Accepts the parsed `permissions` object of an agent definition or a parsed
+ * `permissions.yaml` document. A bare rules array is accepted as well. The
+ * result carries only counts, booleans, and validated token lists; `match`
+ * patterns, `exclude` lists, reasons, and paths are never returned.
+ *
+ * @param {Object|Array|undefined} rulesOrDoc Parsed permissions object, YAML
+ *   document, or rules array
+ * @returns {{
+ *   ruleCount: number,
+ *   allowRuleCount: number,
+ *   denyRuleCount: number,
+ *   askRuleCount: number,
+ *   evaluateRuleCount: number,
+ *   capabilities: string[],
+ *   allowsAllCapabilities: boolean,
+ *   unrestrictedAllowCapabilities: string[],
+ *   workspaceTrusted: boolean|undefined,
+ *   policyPresets: string[],
+ *   unknownPolicyPresetCount: number,
+ * }} Permission posture summary
+ */
+export function summarizeKiroPermissions(rulesOrDoc) {
+  const doc = Array.isArray(rulesOrDoc) ? { rules: rulesOrDoc } : rulesOrDoc;
+  const rules = Array.isArray(doc?.rules) ? doc.rules : [];
+  let ruleCount = 0;
+  const effectCounts = { allow: 0, deny: 0, ask: 0, evaluate: 0 };
+  const capabilities = [];
+  const unrestrictedAllowCapabilities = [];
+  let allowsAllCapabilities = false;
+  for (const rule of rules) {
+    if (!isPlainEntry(rule)) {
+      continue;
+    }
+    ruleCount += 1;
+    if (typeof rule.effect === "string" && KIRO_EFFECTS.has(rule.effect)) {
+      effectCounts[rule.effect] += 1;
+    }
+    if (typeof rule.capability === "string") {
+      const capability = rule.capability;
+      if (KIRO_CAPABILITY_PATTERN.test(capability)) {
+        capabilities.push(capability);
+        if (rule.effect === "allow" && !hasNonEmptyMatch(rule.match)) {
+          unrestrictedAllowCapabilities.push(capability);
+          if (capability === "all") {
+            allowsAllCapabilities = true;
+          }
+        }
+      }
+    }
+  }
+  const listedPresets = Array.isArray(doc?.policies)
+    ? doc.policies.filter((entry) => typeof entry === "string")
+    : [];
+  // Preset names outside the allowlist are counted, never copied, so a
+  // reviewer still learns that an unrecognised preset is active.
+  const policyPresets = listedPresets.filter((entry) =>
+    KIRO_POLICY_PRESET_ALLOWLIST.has(entry),
+  );
+  const unknownPolicyPresetCount = new Set(
+    listedPresets.filter((entry) => !KIRO_POLICY_PRESET_ALLOWLIST.has(entry)),
+  ).size;
+  return {
+    allowRuleCount: effectCounts.allow,
+    allowsAllCapabilities,
+    askRuleCount: effectCounts.ask,
+    capabilities: sortedUnique(capabilities),
+    denyRuleCount: effectCounts.deny,
+    evaluateRuleCount: effectCounts.evaluate,
+    policyPresets: sortedUnique(policyPresets),
+    ruleCount,
+    unknownPolicyPresetCount,
+    unrestrictedAllowCapabilities: sortedUnique(unrestrictedAllowCapabilities),
+    ...(typeof doc?.workspaceTrusted === "boolean"
+      ? { workspaceTrusted: doc.workspaceTrusted }
+      : {}),
+  };
+}
+
+/**
+ * Flatten a permission summary into property suffix/value pairs.
+ *
+ * Both scans that consume Kiro permission documents emit the same suffixes;
+ * the host scan prefixes them with `cdx:agentic:` and the project scan with
+ * `cdx:agent:`. Values are numbers, booleans, or comma-separated validated
+ * tokens, so no free text reaches a BOM through this mapping.
+ *
+ * @param {ReturnType<summarizeKiroPermissions>} summary Permission posture summary
+ * @returns {Record<string, number|boolean|string>} Property suffix mapped to its value
+ */
+export function kiroPermissionSummaryEntries(summary) {
+  const entries = {
+    permissionAllowRuleCount: summary.allowRuleCount,
+    permissionAllowsAll: Boolean(summary.allowsAllCapabilities),
+    permissionAskRuleCount: summary.askRuleCount,
+    permissionDenyRuleCount: summary.denyRuleCount,
+    permissionEvaluateRuleCount: summary.evaluateRuleCount,
+    permissionRuleCount: summary.ruleCount,
+  };
+  // An empty list carries no information, so the property is omitted instead
+  // of being emitted with an empty value.
+  for (const [suffix, list] of [
+    ["permissionCapabilities", summary.capabilities],
+    [
+      "permissionUnrestrictedAllowCapabilities",
+      summary.unrestrictedAllowCapabilities,
+    ],
+    ["permissionPolicyPresets", summary.policyPresets],
+  ]) {
+    if (list?.length) {
+      entries[suffix] = list.join(",");
+    }
+  }
+  if (summary.unknownPolicyPresetCount) {
+    entries.permissionUnknownPolicyPresetCount =
+      summary.unknownPolicyPresetCount;
+  }
+  if (typeof summary.workspaceTrusted === "boolean") {
+    entries.permissionWorkspaceTrusted = summary.workspaceTrusted;
+  }
+  return entries;
+}

package/lib/server/server.js

@@ -14,7 +14,12 @@ import {
   isSecureMode,
   readEnvironmentVariable,
 } from "../core/activity.js";
-import { PROJECT_TYPE_ALIASES } from "../core/env.js";
+import { HOST_SCOPE_PROJECT_TYPES } from "../core/env.js";
+import {
+  boundUntrustedGlobPatterns,
+  UNTRUSTED_GLOB_EXPANSION_BUDGET,
+  UNTRUSTED_GLOB_PATTERN_MAX_LENGTH,
+} from "../core/globPatterns.js";
 import { isWin } from "../core/paths.js";
 import { isSecureModeActive } from "../core/projectTooling.js";
 import { resetRunState } from "../core/runState.js";
@@ -22,7 +27,11 @@ import { CDXGEN_VERSION } from "../core/state.js";
 import { installConsoleShim, ui } from "../core/ui.js";
 import { fetchPomXmlAsJson } from "../ecosystems/ecosystems.js";
 import { normalizeOutputFormats } from "../helpers/exportUtils.js";
-import { isCycloneDxBom } from "../inventory/bomUtils.js";
+import {
+  isCycloneDx20SpecVersion,
+  isCycloneDxBom,
+} from "../inventory/bomUtils.js";
+import { DEPENDENCY_TRACK_CDX20_ERROR } from "../inventory/cyclonedx20.js";
 import {
   cleanupSourceDir,
   findGitRefForPurlVersion,
@@ -227,27 +236,6 @@ function restrictRequestOptions(options, operatorOptions) {
   }
 }
 
-// Project types that inventory the host the server runs on, such as installed
-// packages, users, shell history, IDE and browser extensions, or the Maven,
-// Gradle, sbt, Cargo and Helm caches in the server user's home directory.
-// They ignore the scan path, so the path allowlist does not limit them.
-const HOST_SCOPE_PROJECT_TYPES = new Set(
-  [
-    "os",
-    "hbom",
-    "cargo-cache",
-    "helm-index",
-    "gradle-index",
-    "sbt-index",
-    "maven-index",
-    "vscode-extension",
-    "chrome-extension",
-    "agentic",
-  ]
-    .flatMap((key) => PROJECT_TYPE_ALIASES[key] || [key])
-    .concat(["maven-repo"]),
-);
-
 /**
  * Check request options that the server must refuse outright.
  *
@@ -270,22 +258,18 @@ export function validateRequestOptions(reqOptions, operatorOptions = {}) {
       details: `The '${hostScopeType}' project type scans the server host. Start the server with this type to allow it.`,
     };
   }
-  const excludes = Array.isArray(reqOptions.exclude)
-    ? reqOptions.exclude
-    : [reqOptions.exclude];
-  // Brace patterns expand before matching, so one short pattern such as
-  // {1..100000} can keep the server busy for minutes.
+  // Every exclude pattern is matched against every file the scan walks, and
+  // brace patterns expand before matching, so one short pattern such as
+  // {1..100000}, or a long enough list, can keep the server busy for minutes.
   if (
     reqOptions.exclude !== operatorOptions.exclude &&
-    excludes.some(
-      (e) => typeof e === "string" && (e.includes("{") || e.length > 512),
-    )
+    boundUntrustedGlobPatterns(reqOptions.exclude, { allowBraces: false })
+      .refused.length
   ) {
     return {
       status: 400,
       error: "Invalid Exclude Pattern",
-      details:
-        "Exclude patterns sent to the server cannot use braces or exceed 512 characters.",
+      details: `Exclude patterns sent to the server cannot use braces, exceed ${UNTRUSTED_GLOB_PATTERN_MAX_LENGTH} characters, or number more than ${UNTRUSTED_GLOB_EXPANSION_BUDGET}.`,
     };
   }
   if (
@@ -333,6 +317,19 @@ export function validateRequestOptions(reqOptions, operatorOptions = {}) {
         "Formulation data may contain secrets and is not submitted to Dependency-Track in secure mode.",
     };
   }
+  // Dependency-Track ingests CycloneDX 1.x only, so a request that would
+  // upload (server URL plus API key) cannot ask for the 2.0 draft.
+  if (
+    reqOptions.serverUrl &&
+    reqOptions.apiKey &&
+    isCycloneDx20SpecVersion(reqOptions.specVersion)
+  ) {
+    return {
+      status: 400,
+      error: "Unsupported Spec Version For Dependency-Track",
+      details: DEPENDENCY_TRACK_CDX20_ERROR,
+    };
+  }
   return null;
 }
 
@@ -749,7 +746,12 @@ const start = (options) => {
         requestedFormats.includes("spdx") &&
         isCycloneDxBom(bomNSData?.bomJson)
       ) {
-        responseBomJson = convertCycloneDxToSpdx(bomNSData.bomJson, reqOptions);
+        // The SPDX converter reads the 1.x shape; at 2.0 that is the
+        // internal model rather than the rendered document.
+        responseBomJson = convertCycloneDxToSpdx(
+          bomNSData.internalBomJson ?? bomNSData.bomJson,
+          reqOptions,
+        );
       }
       if (reqOptions.serverUrl && reqOptions.apiKey) {
         let serverHostname;

package/lib/stages/postgen/postgen.js

@@ -31,6 +31,7 @@ import {
 } from "../../inventory/aiInventory.js";
 import {
   DEFAULT_CDX_SPEC_VERSION,
+  isCycloneDx20SpecVersion,
   normalizeCycloneDxComponentTypeFilter,
   normalizeCycloneDxSpecVersion,
 } from "../../inventory/bomUtils.js";
@@ -40,8 +41,13 @@ import {
   createCitation,
   findCdxgenToolBomRef,
 } from "../../inventory/citations.js";
+import {
+  CDX20_INTERNAL_SECTIONS_KEY,
+  renderCycloneDx20,
+} from "../../inventory/cyclonedx20.js";
 import { mergeDependencies, mergeServices } from "../../inventory/depsUtils.js";
 import { addFormulationSection } from "../../inventory/formulationParsers.js";
+import { hardwareRenderContext } from "../../inventory/hbomLoader.js";
 import { getContainerFileInventoryStats } from "../../inventory/inventoryStats.js";
 import { enhanceBom } from "../../inventory/licenseEnhancer.js";
 import { applyMcpPinningState } from "../../inventory/mcpPinning.js";
@@ -546,6 +552,13 @@ async function applyIntrospection(bomNSData, options, filePath) {
 /**
  * Filter and enhance BOM post generation.
  *
+ * At CycloneDX 2.0 the returned `bomNSData` carries two documents:
+ * `bomJson` is the rendered 2.0 document (what library users, the server and
+ * the writer see), and `internalBomJson` is the 1.x-shaped model the audit,
+ * evinse, display and SPDX-export readers use. `internalBomJson` is never
+ * serialized; `refreshRenderedBom` re-renders `bomJson` from it after any
+ * later mutation. At 1.x `internalBomJson` is unset.
+ *
  * @param {Object} bomNSData BOM with namespaces object
  * @param {Object} options CLI options
  * @param {string} [filePath] Source path used for formulation and metadata context
@@ -615,10 +628,37 @@ export async function postProcess(bomNSData, options, filePath) {
   ]);
   cleanupEnv(options);
   cleanupTmpDir();
-  sortBomCollections(bomNSData.bomJson);
+  // A model read from another 2.0 document keeps that document's originals,
+  // keyed by the exact 1.x form of each object, so an unchanged object
+  // renders back as it was. Sorting would change those forms, so such a
+  // model keeps its order; cdxgen's own BOMs are sorted for determinism.
+  if (!bomNSData.bomJson?.[CDX20_INTERNAL_SECTIONS_KEY]?.shadows) {
+    sortBomCollections(bomNSData.bomJson);
+  }
   // Reflection reads the finished BOM, so it runs after sorting; it returns
   // its verdict alongside the BOM instead of mutating it.
   await applyIntrospection(bomNSData, options, filePath);
+  // CycloneDX 2.0: everything above produced the 1.x-shaped model. Keep it on
+  // `internalBomJson` for the readers that run after postProcess (audit,
+  // evinse, display, SPDX export) and render the 2.0 document once, here.
+  // `refreshRenderedBom` re-renders after any later mutation of the model,
+  // with the same render context (the optional cdx-hbom hardware mapper,
+  // loaded only when the model has hardware components).
+  // At 1.x both stay untouched, so those outputs are byte-identical. The
+  // document's own specVersion decides when the caller passed none, which is
+  // how an evinse run over a 2.0 input stays at 2.0.
+  if (
+    isCycloneDx20SpecVersion(
+      options.specVersion ?? bomNSData.bomJson?.specVersion,
+    )
+  ) {
+    bomNSData.renderContext = await hardwareRenderContext(bomNSData.bomJson);
+    bomNSData.internalBomJson = bomNSData.bomJson;
+    bomNSData.bomJson = renderCycloneDx20(
+      bomNSData.bomJson,
+      bomNSData.renderContext,
+    );
+  }
   return bomNSData;
 }
 

package/lib/stages/postgen/specVersionCompat.js

@@ -27,6 +27,8 @@ import {
   setCycloneDxFormat,
   toCycloneDxSpecVersionString,
 } from "../../inventory/bomUtils.js";
+import { CDX20_INTERNAL_SECTIONS_KEY } from "../../inventory/cyclonedx20.js";
+import { markInternalModel } from "../../inventory/cyclonedx20ReadContext.js";
 
 const COMPONENT_1_6_ONLY_FIELDS = new Set([
   "authors",
@@ -115,9 +117,17 @@ function normalizeMetadataForSpecVersion(subject, specVersion) {
 }
 
 function normalizeBomForSpecVersion(subject, specVersion) {
+  if (!subject) {
+    return;
+  }
   if (specVersion < 1.7) {
     deleteFields(subject, BOM_1_7_ONLY_FIELDS);
   }
+  if (specVersion < 2) {
+    // 2.0-only sections ride through the internal model under this key
+    // (see lib/inventory/cyclonedx20.js); a 1.x document never serializes it.
+    delete subject[CDX20_INTERNAL_SECTIONS_KEY];
+  }
 }
 
 function normalizeDependencyForSpecVersion(subject, specVersion) {
@@ -713,6 +723,9 @@ export function applySpecVersionCompatibility(bomJson, options) {
     downgradeSubjectForSpecVersion(bomJson, specVersion);
   } else if (isCycloneDx20SpecVersion(specVersion)) {
     upgradeSubjectForSpecVersion(bomJson, specVersion);
+    // The result is the 1.x-shaped model labelled 2.0, not a 2.0 document;
+    // the mark tells loadBomForAnalysis not to read it as one.
+    markInternalModel(bomJson);
   }
   return setCycloneDxFormat(bomJson, normalizedSpecVersion);
 }
@@ -763,3 +776,66 @@ export function diffRemovedFieldPaths(sourceBomJson, normalizedBomJson) {
     .filter((path) => !retainedPaths.has(path))
     .sort();
 }
+
+/**
+ * Count the leaf values of a JSON document as `path=value` strings, using
+ * the dotted, index-free paths of collectFieldPaths. Array order is ignored,
+ * so two documents that differ only in member order give the same counts,
+ * but a repeated entry counts once per occurrence. Empty arrays and objects
+ * count as leaves.
+ *
+ * @param {*} subject JSON value
+ * @param {string} [prefix] Path so far
+ * @param {Map<string, number>} [leaves] Accumulator
+ * @returns {Map<string, number>} Occurrences of each `path=value` string
+ */
+export function collectLeafValues(subject, prefix = "", leaves = new Map()) {
+  const add = (leaf) => {
+    leaves.set(leaf, (leaves.get(leaf) || 0) + 1);
+  };
+  if (Array.isArray(subject)) {
+    if (!subject.length) {
+      add(`${prefix}=[]`);
+    }
+    for (const entry of subject) {
+      collectLeafValues(entry, prefix, leaves);
+    }
+    return leaves;
+  }
+  if (isObjectRecord(subject)) {
+    const entries = Object.entries(subject);
+    if (!entries.length) {
+      add(`${prefix}={}`);
+    }
+    for (const [key, value] of entries) {
+      collectLeafValues(value, prefix ? `${prefix}.${key}` : key, leaves);
+    }
+    return leaves;
+  }
+  if (subject !== undefined) {
+    add(`${prefix}=${JSON.stringify(subject)}`);
+  }
+  return leaves;
+}
+
+/**
+ * Report the leaf values of `sourceBomJson` that `convertedBomJson` lacks,
+ * ignoring member order (see collectLeafValues). A value the source holds
+ * more often than the output is reported once for every missing occurrence,
+ * so dropping one of two identical entries counts.
+ *
+ * @param {Object} sourceBomJson BOM before conversion
+ * @param {Object} convertedBomJson BOM after conversion
+ * @returns {string[]} Sorted `path=value` strings missing from the output,
+ *   repeated per missing occurrence
+ */
+export function diffMissingLeafValues(sourceBomJson, convertedBomJson) {
+  const retained = collectLeafValues(convertedBomJson);
+  const missing = [];
+  for (const [leaf, count] of collectLeafValues(sourceBomJson)) {
+    for (let i = retained.get(leaf) || 0; i < count; i++) {
+      missing.push(leaf);
+    }
+  }
+  return missing.sort();
+}

package/lib/validator/bomValidator.js

@@ -55,11 +55,18 @@ const compileSchemaValidator = (specVersion) => {
     const ajv = new Ajv2020(AJV_OPTIONS);
     useLinearUniqueItems(ajv);
     addCycloneDxFormats(ajv);
+    // The 2.0 draft pins its own cryptography definitions; the 1.7 schema
+    // keeps reading data/cryptography-defs.schema.json below.
     addDraft2020BundledSchema(
       ajv,
-      readJsonSchema("cryptography-defs.schema.json"),
+      readJsonSchema("cyclonedx-2.0-cryptography-defs.schema.json"),
       "https://cyclonedx.org/schema/cryptography-defs.schema.json",
     );
+    addDraft2020BundledSchema(
+      ajv,
+      readJsonSchema("behavior-taxonomy.schema.json"),
+      "https://cyclonedx.org/schema/behavior-taxonomy.schema.json",
+    );
     addDraft2020BundledSchema(
       ajv,
       readJsonSchema("jsf-0.82.schema.json"),

package/lib/validator/complianceEngine.js

@@ -1,6 +1,6 @@
 /**
- * Orchestrates evaluation of internal compliance rule packs (SCVS + CRA) and
- * aggregates results into per-benchmark scorecards.
+ * Orchestrates evaluation of internal compliance rule packs (SCVS + CRA + CISA)
+ * and aggregates results into per-benchmark scorecards.
  *
  * This module is deliberately independent of the CycloneDX BOM audit engine
  * (lib/stages/postgen/auditBom.js). The two engines share similar *Finding*
@@ -9,6 +9,8 @@
 
 import {
   getAllComplianceRules,
+  getCisaAiRules,
+  getCisaRules,
   getCraRules,
   getScvsRules,
 } from "./complianceRules.js";
@@ -63,6 +65,25 @@ const BENCHMARKS = {
     filter: (rules) => rules.filter((r) => r.standard === "CRA"),
     levelPredicate: () => true,
   },
+  cisa: {
+    id: "cisa",
+    name: "CISA 2026 minimum elements for an SBOM",
+    standard: "CISA",
+    // The AI element rules share the CISA standard key but form their own
+    // benchmark, so both filters select by category.
+    filter: (rules) =>
+      rules.filter(
+        (r) => r.standard === "CISA" && r.category === "compliance-cisa",
+      ),
+    levelPredicate: () => true,
+  },
+  "cisa-ai": {
+    id: "cisa-ai",
+    name: "CISA and G7 minimum elements for an AI SBOM",
+    standard: "CISA",
+    filter: (rules) => rules.filter((r) => r.category === "compliance-cisa-ai"),
+    levelPredicate: () => true,
+  },
 };
 
 /**
@@ -238,4 +259,10 @@ export function buildBenchmarkReports(findings, requestedAliases) {
   return aliases.map((b) => scoreBenchmark(b, findings));
 }
 
-export { getAllComplianceRules, getCraRules, getScvsRules };
+export {
+  getAllComplianceRules,
+  getCisaAiRules,
+  getCisaRules,
+  getCraRules,
+  getScvsRules,
+};