@cyclonedx/cdxgen 10.3.4 → 10.4.0

package/binary.js

@@ -1,18 +1,24 @@
-import { arch as _arch, platform as _platform, homedir, tmpdir } from "node:os";
-import process from "node:process";
 import { Buffer } from "node:buffer";
+import { spawnSync } from "node:child_process";
 import {
   existsSync,
+  lstatSync,
   mkdirSync,
   mkdtempSync,
   readFileSync,
   rmSync,
-  lstatSync
 } from "node:fs";
+import { arch as _arch, platform as _platform, homedir, tmpdir } from "node:os";
 import { basename, dirname, join, resolve } from "node:path";
-import { spawnSync } from "node:child_process";
+import process from "node:process";
 import { PackageURL } from "packageurl-js";
-import { DEBUG_MODE, TIMEOUT_MS, findLicenseId } from "./utils.js";
+import {
+  DEBUG_MODE,
+  TIMEOUT_MS,
+  adjustLicenseInformation,
+  findLicenseId,
+  isSpdxLicenseExpression,
+} from "./utils.js";
 
 import { URL, fileURLToPath } from "node:url";
 
@@ -78,8 +84,8 @@ if (
       "node_modules",
       "@cyclonedx",
       "cdxgen-plugins-bin" + pluginsBinSuffix,
-      "plugins"
-    )
+      "plugins",
+    ),
   ) &&
   existsSync(
     join(
@@ -88,8 +94,8 @@ if (
       "@cyclonedx",
       "cdxgen-plugins-bin" + pluginsBinSuffix,
       "plugins",
-      "goversion"
-    )
+      "goversion",
+    ),
   )
 ) {
   CDXGEN_PLUGINS_DIR = join(
@@ -97,7 +103,7 @@ if (
     "node_modules",
     "@cyclonedx",
     "cdxgen-plugins-bin" + pluginsBinSuffix,
-    "plugins"
+    "plugins",
   );
 }
 
@@ -108,8 +114,8 @@ if (!CDXGEN_PLUGINS_DIR) {
       isWin ? "npm.cmd" : "npm",
       ["root", "--quiet", "-g"],
       {
-        encoding: "utf-8"
-      }
+        encoding: "utf-8",
+      },
     );
     if (result) {
       const stdout = result.stdout;
@@ -123,7 +129,7 @@ if (!CDXGEN_PLUGINS_DIR) {
       globalNodePath,
       "@cyclonedx",
       "cdxgen-plugins-bin" + pluginsBinSuffix,
-      "plugins"
+      "plugins",
     );
     if (existsSync(globalPlugins)) {
       CDXGEN_PLUGINS_DIR = globalPlugins;
@@ -137,7 +143,7 @@ if (!CDXGEN_PLUGINS_DIR) {
 if (!CDXGEN_PLUGINS_DIR) {
   if (DEBUG_MODE) {
     console.warn(
-      "cdxgen plugins was not found. Please install with npm install -g @cyclonedx/cdxgen-plugins-bin"
+      "cdxgen plugins was not found. Please install with npm install -g @cyclonedx/cdxgen-plugins-bin",
     );
   }
   CDXGEN_PLUGINS_DIR = "";
@@ -147,7 +153,7 @@ if (existsSync(join(CDXGEN_PLUGINS_DIR, "goversion"))) {
   GOVERSION_BIN = join(
     CDXGEN_PLUGINS_DIR,
     "goversion",
-    "goversion-" + platform + "-" + arch + extn
+    "goversion-" + platform + "-" + arch + extn,
   );
 }
 let TRIVY_BIN = null;
@@ -155,7 +161,7 @@ if (existsSync(join(CDXGEN_PLUGINS_DIR, "trivy"))) {
   TRIVY_BIN = join(
     CDXGEN_PLUGINS_DIR,
     "trivy",
-    "trivy-cdxgen-" + platform + "-" + arch + extn
+    "trivy-cdxgen-" + platform + "-" + arch + extn,
   );
 } else if (process.env.TRIVY_CMD) {
   TRIVY_BIN = process.env.TRIVY_CMD;
@@ -165,7 +171,7 @@ if (existsSync(join(CDXGEN_PLUGINS_DIR, "cargo-auditable"))) {
   CARGO_AUDITABLE_BIN = join(
     CDXGEN_PLUGINS_DIR,
     "cargo-auditable",
-    "cargo-auditable-cdxgen-" + platform + "-" + arch + extn
+    "cargo-auditable-cdxgen-" + platform + "-" + arch + extn,
   );
 } else if (process.env.CARGO_AUDITABLE_CMD) {
   CARGO_AUDITABLE_BIN = process.env.CARGO_AUDITABLE_CMD;
@@ -175,7 +181,7 @@ if (existsSync(join(CDXGEN_PLUGINS_DIR, "osquery"))) {
   OSQUERY_BIN = join(
     CDXGEN_PLUGINS_DIR,
     "osquery",
-    "osqueryi-" + platform + "-" + arch + extn
+    "osqueryi-" + platform + "-" + arch + extn,
   );
   // osqueryi-darwin-amd64.app/Contents/MacOS/osqueryd
   if (platform === "darwin") {
@@ -193,7 +199,7 @@ if (existsSync(join(CDXGEN_PLUGINS_DIR, "dosai"))) {
   DOSAI_BIN = join(
     CDXGEN_PLUGINS_DIR,
     "dosai",
-    "dosai-" + platformToUse + "-" + arch + extn
+    "dosai-" + platformToUse + "-" + arch + extn,
   );
 } else if (process.env.DOSAI_CMD) {
   DOSAI_BIN = process.env.DOSAI_CMD;
@@ -265,13 +271,13 @@ const OS_DISTRO_ALIAS = {
   "debian-2": "hamm",
   "debian-1.3": "bo",
   "debian-1.2": "rex",
-  "debian-1.1": "buzz"
+  "debian-1.1": "buzz",
 };
 
 export function getGoBuildInfo(src) {
   if (GOVERSION_BIN) {
     let result = spawnSync(GOVERSION_BIN, [src], {
-      encoding: "utf-8"
+      encoding: "utf-8",
     });
     if (result.status !== 0 || result.error || !result.stdout) {
       if (result.stdout || result.stderr) {
@@ -281,7 +287,7 @@ export function getGoBuildInfo(src) {
         console.log("Falling back to go version command");
       }
       result = spawnSync("go", ["version", "-v", "-m", src], {
-        encoding: "utf-8"
+        encoding: "utf-8",
       });
       if (result.status !== 0 || result.error) {
         if (result.stdout || result.stderr) {
@@ -303,7 +309,7 @@ export function getGoBuildInfo(src) {
 export function getCargoAuditableInfo(src) {
   if (CARGO_AUDITABLE_BIN) {
     const result = spawnSync(CARGO_AUDITABLE_BIN, [src], {
-      encoding: "utf-8"
+      encoding: "utf-8",
     });
     if (result.status !== 0 || result.error) {
       if (result.stdout || result.stderr) {
@@ -354,7 +360,7 @@ export function getOSPackages(src) {
       "--cache-dir",
       trivyCacheDir,
       "--output",
-      bomJsonFile
+      bomJsonFile,
     ];
     if (!DEBUG_MODE) {
       args.push("-q");
@@ -364,7 +370,7 @@ export function getOSPackages(src) {
       console.log("Executing", TRIVY_BIN, args.join(" "));
     }
     const result = spawnSync(TRIVY_BIN, args, {
-      encoding: "utf-8"
+      encoding: "utf-8",
     });
     if (result.status !== 0 || result.error) {
       if (result.stdout || result.stderr) {
@@ -376,8 +382,8 @@ export function getOSPackages(src) {
       try {
         tmpBom = JSON.parse(
           readFileSync(bomJsonFile, {
-            encoding: "utf-8"
-          })
+            encoding: "utf-8",
+          }),
         );
       } catch (e) {
         // ignore errors
@@ -515,7 +521,7 @@ export function getOSPackages(src) {
                     name,
                     purlObj.version,
                     purlObj.qualifiers,
-                    purlObj.subpath
+                    purlObj.subpath,
                   ).toString();
                   comp["bom-ref"] = decodeURIComponent(comp.purl);
                 }
@@ -543,7 +549,7 @@ export function getOSPackages(src) {
                     if (dtmpA && dtmpA.length > 1) {
                       distro_codename = dtmpA[0].replace(
                         "redhat",
-                        "enterprise_linux"
+                        "enterprise_linux",
                       );
                     }
                   }
@@ -557,7 +563,7 @@ export function getOSPackages(src) {
                     name,
                     purlObj.version,
                     purlObj.qualifiers,
-                    purlObj.subpath
+                    purlObj.subpath,
                   ).toString();
                   comp["bom-ref"] = decodeURIComponent(comp.purl);
                 }
@@ -572,33 +578,28 @@ export function getOSPackages(src) {
               comp.licenses.length
             ) {
               const newLicenses = [];
-              for (const alic of comp.licenses) {
-                if (alic.license.name) {
-                  // Licenses array can either be made of expressions or id/name but not both
-                  if (
-                    comp.licenses.length == 1 &&
-                    (alic.license.name.toUpperCase().includes(" AND ") ||
-                      alic.license.name.toUpperCase().includes(" OR "))
-                  ) {
-                    newLicenses.push({ expression: alic.license.name });
+              for (const aLic of comp.licenses) {
+                if (aLic.license.name) {
+                  if (isSpdxLicenseExpression(aLic.license.name)) {
+                    newLicenses.push({ expression: aLic.license.name });
                   } else {
-                    const possibleId = findLicenseId(alic.license.name);
-                    if (possibleId !== alic.license.name) {
+                    const possibleId = findLicenseId(aLic.license.name);
+                    if (possibleId !== aLic.license.name) {
                       newLicenses.push({ license: { id: possibleId } });
                     } else {
                       newLicenses.push({
-                        license: { name: alic.license.name }
+                        license: { name: aLic.license.name },
                       });
                     }
                   }
                 } else if (
-                  Object.keys(alic).length &&
-                  Object.keys(alic.license).length
+                  Object.keys(aLic).length &&
+                  Object.keys(aLic.license).length
                 ) {
-                  newLicenses.push(alic);
+                  newLicenses.push(aLic);
                 }
               }
-              comp.licenses = newLicenses;
+              comp.licenses = adjustLicenseInformation(newLicenses);
             }
             // Fix hashes
             if (
@@ -629,7 +630,7 @@ export function getOSPackages(src) {
             const compDeps = retrieveDependencies(
               tmpDependencies,
               origBomRef,
-              comp
+              comp,
             );
             if (compDeps) {
               dependenciesList.push(compDeps);
@@ -646,7 +647,7 @@ export function getOSPackages(src) {
                   srcName,
                   srcVersion,
                   purlObj.qualifiers,
-                  purlObj.subpath
+                  purlObj.subpath,
                 ).toString();
               }
               newComp["bom-ref"] = decodeURIComponent(newComp.purl);
@@ -660,7 +661,7 @@ export function getOSPackages(src) {
   return {
     osPackages: pkgList,
     dependenciesList,
-    allTypes: Array.from(allTypes)
+    allTypes: Array.from(allTypes),
   };
 }
 
@@ -714,7 +715,7 @@ export function executeOsQuery(query) {
     const result = spawnSync(OSQUERY_BIN, args, {
       encoding: "utf-8",
       maxBuffer: 50 * 1024 * 1024,
-      timeout: 60 * 1000
+      timeout: 60 * 1000,
     });
     if (result.status !== 0 || result.error) {
       if (DEBUG_MODE && result.stderr) {
@@ -733,7 +734,7 @@ export function executeOsQuery(query) {
             if (DEBUG_MODE) {
               console.log("Unable to parse the output from query", query);
               console.log(
-                "This could be due to the amount of data returned or the query being invalid for the given platform."
+                "This could be due to the amount of data returned or the query being invalid for the given platform.",
               );
             }
           }
@@ -763,7 +764,7 @@ export function getDotnetSlices(src, slicesFile) {
   const result = spawnSync(DOSAI_BIN, args, {
     encoding: "utf-8",
     timeout: TIMEOUT_MS,
-    cwd: src
+    cwd: src,
   });
   if (result.status !== 0 || result.error) {
     if (DEBUG_MODE && result.error) {
@@ -802,14 +803,14 @@ export function getBinaryBom(src, binaryBomFile, deepMode) {
   const result = spawnSync(BLINT_BIN, args, {
     encoding: "utf-8",
     timeout: TIMEOUT_MS,
-    cwd
+    cwd,
   });
   if (result.status !== 0 || result.error) {
     if (result.stderr) {
       console.error(result.stdout, result.stderr);
     } else {
       console.log(
-        "Install blint using 'pip install blint' or use the cdxgen container image."
+        "Install blint using 'pip install blint' or use the cdxgen container image.",
       );
     }
     return false;

package/cbomutils.js

@@ -1,12 +1,12 @@
 import { readFileSync } from "node:fs";
-import { convertOSQueryResults, dirNameStr } from "./utils.js";
-import { executeOsQuery } from "./binary.js";
 import { join } from "node:path";
+import { executeOsQuery } from "./binary.js";
+import { convertOSQueryResults, dirNameStr } from "./utils.js";
 const cbomosDbQueries = JSON.parse(
-  readFileSync(join(dirNameStr, "data", "cbomosdb-queries.json"), "utf-8")
+  readFileSync(join(dirNameStr, "data", "cbomosdb-queries.json"), "utf-8"),
 );
 const cbomCryptoOids = JSON.parse(
-  readFileSync(join(dirNameStr, "data", "crypto-oid.json"), "utf-8")
+  readFileSync(join(dirNameStr, "data", "crypto-oid.json"), "utf-8"),
 );
 
 /**
@@ -24,7 +24,7 @@ export function collectOSCryptoLibs(options) {
       queryCategory,
       queryObj,
       results,
-      false
+      false,
     );
     if (dlist && dlist.length) {
       osPkgsList = osPkgsList.concat(dlist);
@@ -59,7 +59,7 @@ export function findCryptoAlgos(code) {
       cryptoAlgos.push({
         ...cbomCryptoOids[algoName],
         name: algoName,
-        ref: `crypto/algorithm/${algoName}@${cbomCryptoOids[algoName].oid}`
+        ref: `crypto/algorithm/${algoName}@${cbomCryptoOids[algoName].oid}`,
       });
     }
   }

package/db.js

@@ -9,7 +9,7 @@ class DataFlows extends Model {}
 export const createOrLoad = async (dbName, dbPath, logging = false) => {
   const sequelize = new Sequelize({
     define: {
-      freezeTableName: true
+      freezeTableName: true,
     },
     dialect: "sqlite",
     dialectOptions: {
@@ -17,7 +17,7 @@ export const createOrLoad = async (dbName, dbPath, logging = false) => {
         SQLite.OPEN_READWRITE |
         SQLite.OPEN_CREATE |
         SQLite.OPEN_NOMUTEX |
-        SQLite.OPEN_SHAREDCACHE
+        SQLite.OPEN_SHAREDCACHE,
     },
     storage: dbPath.includes("memory") ? dbPath : path.join(dbPath, dbName),
     logging,
@@ -25,56 +25,56 @@ export const createOrLoad = async (dbName, dbPath, logging = false) => {
       max: 5,
       min: 0,
       acquire: 30000,
-      idle: 10000
-    }
+      idle: 10000,
+    },
   });
   Namespaces.init(
     {
       purl: {
         type: DataTypes.STRING,
         allowNull: false,
-        primaryKey: true
+        primaryKey: true,
       },
       data: {
         type: DataTypes.JSON,
-        allowNull: false
-      }
+        allowNull: false,
+      },
     },
-    { sequelize, modelName: "Namespaces" }
+    { sequelize, modelName: "Namespaces" },
   );
   Usages.init(
     {
       purl: {
         type: DataTypes.STRING,
         allowNull: false,
-        primaryKey: true
+        primaryKey: true,
       },
       data: {
         type: DataTypes.JSON,
-        allowNull: false
-      }
+        allowNull: false,
+      },
     },
-    { sequelize, modelName: "Usages" }
+    { sequelize, modelName: "Usages" },
   );
   DataFlows.init(
     {
       purl: {
         type: DataTypes.STRING,
         allowNull: false,
-        primaryKey: true
+        primaryKey: true,
       },
       data: {
         type: DataTypes.JSON,
-        allowNull: false
-      }
+        allowNull: false,
+      },
     },
-    { sequelize, modelName: "DataFlows" }
+    { sequelize, modelName: "DataFlows" },
   );
   await sequelize.sync();
   return {
     sequelize,
     Namespaces,
     Usages,
-    DataFlows
+    DataFlows,
   };
 };

package/display.js

@@ -7,7 +7,7 @@ const SYMBOLS_ANSI = {
   EMPTY: "",
   INDENT: "  ",
   LAST_BRANCH: "└── ",
-  VERTICAL: "│ "
+  VERTICAL: "│ ",
 };
 
 const MAX_TREE_DEPTH = 6;
@@ -25,15 +25,15 @@ export const printTable = (bomJson) => {
   }
   const config = {
     columnDefault: {
-      width: 30
+      width: 30,
     },
     columnCount: 4,
     columns: [
       { width: 25 },
       { width: 35 },
       { width: 25, alignment: "right" },
-      { width: 15 }
-    ]
+      { width: 15 },
+    ],
   };
   const stream = createStream(config);
   stream.write(["Group", "Name", "Version", "Scope"]);
@@ -42,7 +42,7 @@ export const printTable = (bomJson) => {
       comp.group || "",
       comp.name,
       `\x1b[1;35m${comp.version || ""}\x1b[0m`,
-      comp.scope || ""
+      comp.scope || "",
     ]);
   }
   console.log();
@@ -51,7 +51,7 @@ export const printTable = (bomJson) => {
     bomJson.components.length,
     "components and",
     bomJson.dependencies.length,
-    "dependencies"
+    "dependencies",
   );
 };
 const formatProps = (props) => {
@@ -64,10 +64,10 @@ const formatProps = (props) => {
 export const printOSTable = (bomJson) => {
   const config = {
     columnDefault: {
-      width: 50
+      width: 50,
     },
     columnCount: 3,
-    columns: [{ width: 20 }, { width: 40 }, { width: 50 }]
+    columns: [{ width: 20 }, { width: 40 }, { width: 50 }],
   };
   const stream = createStream(config);
   stream.write(["Type", "Title", "Properties"]);
@@ -75,7 +75,7 @@ export const printOSTable = (bomJson) => {
     stream.write([
       comp.type,
       `\x1b[1;35m${comp.name.replace(/\+/g, " ").replace(/--/g, "::")}\x1b[0m`,
-      formatProps(comp.properties || [])
+      formatProps(comp.properties || []),
     ]);
   }
   console.log();
@@ -90,14 +90,14 @@ export const printServices = (bomJson) => {
       aservice.name || "",
       aservice.endpoints ? aservice.endpoints.join("\n") : "",
       aservice.authenticated ? "\x1b[1;35mYes\x1b[0m" : "",
-      aservice.xTrustBoundary ? "\x1b[1;35mYes\x1b[0m" : ""
+      aservice.xTrustBoundary ? "\x1b[1;35mYes\x1b[0m" : "",
     ]);
   }
   const config = {
     header: {
       alignment: "center",
-      content: "List of Services\nGenerated with \u2665 by cdxgen"
-    }
+      content: "List of Services\nGenerated with \u2665 by cdxgen",
+    },
   };
   if (data.length > 1) {
     console.log(table(data, config));
@@ -133,14 +133,14 @@ export const printOccurrences = (bomJson) => {
       comp.evidence.occurrences
         .map((l) => l.location)
         .sort(locationComparator)
-        .join("\n")
+        .join("\n"),
     ]);
   }
   const config = {
     header: {
       alignment: "center",
-      content: "Component Evidence\nGenerated with \u2665 by cdxgen"
-    }
+      content: "Component Evidence\nGenerated with \u2665 by cdxgen",
+    },
   };
   if (data.length > 1) {
     console.log(table(data, config));
@@ -162,9 +162,9 @@ export const printCallStack = (bomJson) => {
     const frames = Array.from(
       new Set(
         comp.evidence.callstack.frames.map(
-          (c) => `${c.fullFilename}${c.line ? "#" + c.line : ""}`
-        )
-      )
+          (c) => `${c.fullFilename}${c.line ? "#" + c.line : ""}`,
+        ),
+      ),
     ).sort(locationComparator);
     const frameDisplay = [frames[0]];
     if (frames.length > 1) {
@@ -172,21 +172,21 @@ export const printCallStack = (bomJson) => {
         frameDisplay.push(`${SYMBOLS_ANSI.BRANCH} ${frames[i]}`);
       }
       frameDisplay.push(
-        `${SYMBOLS_ANSI.LAST_BRANCH} ${frames[frames.length - 1]}`
+        `${SYMBOLS_ANSI.LAST_BRANCH} ${frames[frames.length - 1]}`,
       );
     }
     data.push([
       comp.group || "",
       comp.name,
       comp.version || "",
-      frameDisplay.join("\n")
+      frameDisplay.join("\n"),
     ]);
   }
   const config = {
     header: {
       alignment: "center",
-      content: "Component Call Stack Evidence\nGenerated with \u2665 by cdxgen"
-    }
+      content: "Component Call Stack Evidence\nGenerated with \u2665 by cdxgen",
+    },
   };
   if (data.length > 1) {
     console.log(table(data, config));
@@ -212,8 +212,8 @@ export const printDependencyTree = (bomJson) => {
     const config = {
       header: {
         alignment: "center",
-        content: "Dependency Tree\nGenerated with \u2665 by cdxgen"
-      }
+        content: "Dependency Tree\nGenerated with \u2665 by cdxgen",
+      },
     };
     console.log(table([[treeGraphics.join("\n")]], config));
   } else {
@@ -261,7 +261,7 @@ const recursePrint = (depMap, subtree, level, shownList, treeGraphics) => {
       level > 0
     ) {
       treeGraphics.push(
-        `${levelPrefix(level, i == listToUse.length - 1)}${refStr}`
+        `${levelPrefix(level, i == listToUse.length - 1)}${refStr}`,
       );
       shownList.push(refStr.toLowerCase());
       if (l && depMap[refStr]) {
@@ -271,7 +271,7 @@ const recursePrint = (depMap, subtree, level, shownList, treeGraphics) => {
             depMap[refStr],
             level + 1,
             shownList,
-            treeGraphics
+            treeGraphics,
           );
         }
       }
@@ -286,7 +286,7 @@ export const printReachables = (sliceArtefacts) => {
   }
   const purlCounts = {};
   const reachablesSlices = JSON.parse(
-    readFileSync(reachablesSlicesFile, "utf-8")
+    readFileSync(reachablesSlicesFile, "utf-8"),
   );
   for (const areachable of reachablesSlices.reachables || []) {
     const purls = areachable.purls || [];
@@ -295,7 +295,7 @@ export const printReachables = (sliceArtefacts) => {
     }
   }
   const sortedPurls = Object.fromEntries(
-    Object.entries(purlCounts).sort(([, a], [, b]) => b - a)
+    Object.entries(purlCounts).sort(([, a], [, b]) => b - a),
   );
   const data = [["Package URL", "Reachable Flows"]];
   for (const apurl of Object.keys(sortedPurls)) {
@@ -304,8 +304,8 @@ export const printReachables = (sliceArtefacts) => {
   const config = {
     header: {
       alignment: "center",
-      content: "Reachable Components\nGenerated with \u2665 by cdxgen"
-    }
+      content: "Reachable Components\nGenerated with \u2665 by cdxgen",
+    },
   };
   if (data.length > 1) {
     console.log(table(data, config));

package/display.test.js

@@ -1,10 +1,10 @@
-import { test } from "@jest/globals";
 import { readFileSync } from "node:fs";
+import { test } from "@jest/globals";
 import { printDependencyTree } from "./display.js";
 
 test("print tree test", () => {
   const bomJson = JSON.parse(
-    readFileSync("./test/data/vuln-spring-1.5.bom.json", { encoding: "utf-8" })
+    readFileSync("./test/data/vuln-spring-1.5.bom.json", { encoding: "utf-8" }),
   );
   printDependencyTree(bomJson);
 });