@cyclonedx/cdxgen 10.1.2 → 10.1.3

package/README.md

@@ -296,6 +296,13 @@ curl "http://127.0.0.1:9090/sbom?path=/Volumes/Work/sandbox/vulnerable-aws-koa-a
 curl "http://127.0.0.1:9090/sbom?url=https://github.com/HooliCorp/vulnerable-aws-koa-app.git&multiProject=true&type=js"
 ```
 
+If you need to pass credentials to authenticate.
+
+```shell
+curl "http://127.0.0.1:9090/sbom?url=https://<access_token>@github.com/some/repo.git&multiProject=true&type=js"
+curl "http://127.0.0.1:9090/sbom?url=https://<username>:<password>@bitbucket.org/some/repo.git&multiProject=true&type=js"
+```
+
 You can POST the arguments.
 
 ```bash

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cyclonedx/cdxgen",
-  "version": "10.1.2",
+  "version": "10.1.3",
   "description": "Creates CycloneDX Software Bill of Materials (SBOM) from source or container image",
   "homepage": "http://github.com/cyclonedx/cdxgen",
   "author": "Prabhu Subramanian <prabhu@appthreat.com>",
@@ -84,7 +84,7 @@
     "yargs": "^17.7.2"
   },
   "optionalDependencies": {
-    "@appthreat/atom": "2.0.7",
+    "@appthreat/atom": "2.0.8",
     "@appthreat/cdx-proto": "^0.0.4",
     "@cyclonedx/cdxgen-plugins-bin": "^1.5.8",
     "@cyclonedx/cdxgen-plugins-bin-arm64": "^1.5.8",

package/utils.js

@@ -4495,36 +4495,56 @@ export const getCratesMetadata = async function (pkgList) {
  * @param {Array} pkgList Package list
  */
 export const getDartMetadata = async function (pkgList) {
+  const RESPONSE_TYPE = "json";
+  const HEADER_ACCEPT = "application/vnd.pub.v2+json";
   const PUB_DEV_URL = process.env.PUB_DEV_URL || "https://pub.dev";
   const PUB_PACKAGES_URL = PUB_DEV_URL + "/api/packages/";
+  const PUB_LICENSE_REGEX = /^license:/i;
   const cdepList = [];
+
   for (const p of pkgList) {
     try {
       if (DEBUG_MODE) {
         console.log(`Querying ${PUB_DEV_URL} for ${p.name}`);
       }
       const res = await cdxgenAgent.get(PUB_PACKAGES_URL + p.name, {
-        responseType: "json",
+        responseType: RESPONSE_TYPE,
         headers: {
-          Accept: "application/vnd.pub.v2+json"
+          Accept: HEADER_ACCEPT
         }
       });
       if (res && res.body) {
-        const versions = res.body.versions;
-        for (const v of versions) {
-          if (p.version === v.version) {
-            const pubspec = v.pubspec;
-            p.description = pubspec.description;
-            if (pubspec.repository) {
-              p.repository = { url: pubspec.repository };
+        const version = res.body.versions.find((v) => p.version === v.version);
+        if (version) {
+          const pubspec = version.pubspec;
+          p.description = pubspec.description;
+          if (pubspec.repository) {
+            p.repository = { url: pubspec.repository };
+          }
+          if (pubspec.homepage) {
+            p.homepage = { url: pubspec.homepage };
+          }
+          const res2 = await cdxgenAgent.get(
+            PUB_PACKAGES_URL + p.name + "/score",
+            {
+              responseType: RESPONSE_TYPE,
+              headers: {
+                Accept: HEADER_ACCEPT
+              }
             }
-            if (pubspec.homepage) {
-              p.homepage = { url: pubspec.homepage };
+          );
+          if (res2 && res2.body) {
+            const tags = res2.body.tags;
+            const license = tags.find((tag) => PUB_LICENSE_REGEX.test(tag));
+            if (license) {
+              p.license = spdxLicenses.find(
+                (spdxLicense) =>
+                  spdxLicense.toLowerCase() ===
+                  license.replace(PUB_LICENSE_REGEX, "").toLowerCase()
+              );
             }
-            p.license = `${PUB_DEV_URL}/packages/${p.name}/license`;
-            cdepList.push(p);
-            break;
           }
+          cdepList.push(p);
         }
       }
     } catch (err) {

package/utils.test.js

@@ -1020,17 +1020,17 @@ test("get dart metadata", async () => {
     {
       group: "",
       name: "async",
-      version: "2.8.2"
+      version: "2.11.0"
     }
   ]);
   expect(dep_list.length).toEqual(1);
   expect(dep_list[0]).toEqual({
     group: "",
     name: "async",
-    version: "2.8.2",
+    version: "2.11.0",
     description:
       "Utility functions and classes related to the 'dart:async' library.",
-    license: "https://pub.dev/packages/async/license",
+    license: "BSD-3-Clause",
     repository: {
       url: "https://github.com/dart-lang/async"
     }