@cyclonedx/cdxgen 11.4.4 → 11.6.0

package/lib/evinser/{evinser.test.js → evinser.poku.js}

@@ -1,6 +1,6 @@
 import { readFileSync } from "node:fs";
 
-import { expect, test } from "@jest/globals";
+import { assert, it } from "poku";
 
 import {
   constructServiceName,
@@ -9,7 +9,7 @@ import {
   parseSemanticSlices,
 } from "./evinser.js";
 
-test("Service detection test", () => {
+it("Service detection test", () => {
   const usageSlice = JSON.parse(
     readFileSync("./test/data/usages.json", { encoding: "utf-8" }),
   );
@@ -17,83 +17,97 @@ test("Service detection test", () => {
   const servicesMap = {};
   for (const slice of objectSlices) {
     detectServicesFromUsages("java", slice, servicesMap);
-    expect(servicesMap).toBeDefined();
+    assert.ok(servicesMap);
     const serviceName = constructServiceName("java", slice);
-    expect(serviceName).toBeDefined();
+    assert.ok(serviceName);
   }
 });
 
-test("extract endpoints test", () => {
-  expect(
+it("extract endpoints test", () => {
+  assert.deepStrictEqual(
     extractEndpoints("java", '@GetMapping(value = { "/", "/home" })'),
-  ).toEqual(["/", "/home"]);
-  expect(
+    ["/", "/home"],
+  );
+  assert.deepStrictEqual(
     extractEndpoints(
       "java",
       '@PostMapping(value = "/issue", consumes = MediaType.APPLICATION_XML_VALUE)',
     ),
-  ).toEqual(["/issue"]);
-  expect(extractEndpoints("java", '@GetMapping("/token")')).toEqual(["/token"]);
-  expect(
+    ["/issue"],
+  );
+  assert.deepStrictEqual(extractEndpoints("java", '@GetMapping("/token")'), [
+    "/token",
+  ]);
+  assert.deepStrictEqual(
     extractEndpoints(
       "javascript",
       'router.use("/api/v2/users",userRoutes.routes(),userRoutes.allowedMethods())',
     ),
-  ).toEqual(["/api/v2/users"]);
-  expect(
+    ["/api/v2/users"],
+  );
+  assert.deepStrictEqual(
     extractEndpoints(
       "javascript",
       "app.use('/encryptionkeys', serveIndexMiddleware, serveIndex('encryptionkeys', { icons: true, view: 'details' }))",
     ),
-  ).toEqual(["/encryptionkeys"]);
-  expect(
+    ["/encryptionkeys"],
+  );
+  assert.deepStrictEqual(
     extractEndpoints(
       "javascript",
       "app.use(express.static(path.resolve('frontend/dist/frontend')))",
     ),
-  ).toEqual(["frontend/dist/frontend"]);
-  expect(
+    ["frontend/dist/frontend"],
+  );
+  assert.deepStrictEqual(
     extractEndpoints(
       "javascript",
       "app.use('/ftp(?!/quarantine)/:file', fileServer())",
     ),
-  ).toEqual(["/ftp(?!/quarantine)/:file"]);
-  expect(
+    ["/ftp(?!/quarantine)/:file"],
+  );
+  assert.deepStrictEqual(
     extractEndpoints(
       "javascript",
       "app.use('/rest/basket/:id', security.isAuthorized())",
     ),
-  ).toEqual(["/rest/basket/:id"]);
-  expect(
+    ["/rest/basket/:id"],
+  );
+  assert.deepStrictEqual(
     extractEndpoints(
       "javascript",
       "app.get(['/.well-known/security.txt', '/security.txt'], verify.accessControlChallenges())",
     ),
-  ).toEqual(["/.well-known/security.txt", "/security.txt"]);
-  expect(
+    ["/.well-known/security.txt", "/security.txt"],
+  );
+  assert.deepStrictEqual(
     extractEndpoints(
       "javascript",
       'router.post("/convert",async(ctx:Context):Promise<void>=>{constparameters=ctx.request.body;constbatchClient=newBatchClient({region:"us-west-1"});constcommand=newSubmitJobCommand({jobName:parameters?.jobName,jobQueue:"FOO-ARN",jobDefinition:"BAR-ARN",parameters,});try{constobjectsOutput=awaitbatchClient.send(command);ctx.response.body=objectsOutput;}catch(err){//Poorexceptionhandlingctx.response.body=err;}})',
     ),
-  ).toEqual(["/convert"]);
-  expect(
+    ["/convert"],
+  );
+  assert.deepStrictEqual(
     extractEndpoints(
       "java",
       '@RequestMapping(path = "/{name}", method = RequestMethod.GET)',
     ),
-  ).toEqual(["/{name}"]);
-  expect(
+    ["/{name}"],
+  );
+  assert.deepStrictEqual(
     extractEndpoints("java", "@RequestMapping(method = RequestMethod.POST)"),
-  ).toEqual([]);
-  expect(
+    [],
+  );
+  assert.deepStrictEqual(
     extractEndpoints(
       "java",
       '@RequestMapping(value = "/{accountName}", method = RequestMethod.GET)',
     ),
-  ).toEqual(["/{accountName}"]);
+    ["/{accountName}"],
+  );
 });
 
-test("parseSemanticSlices", () => {
+it("parseSemanticSlices", () => {
   const semanticsSlice = JSON.parse(
     readFileSync("./test/data/swiftsem/semantics.slices.json", {
       encoding: "utf-8",
@@ -104,6 +118,10 @@ test("parseSemanticSlices", () => {
       encoding: "utf-8",
     }),
   );
-  const retMap = parseSemanticSlices(bomJson.components, semanticsSlice);
-  expect(retMap).toBeDefined();
+  const retMap = parseSemanticSlices(
+    "swift",
+    bomJson.components,
+    semanticsSlice,
+  );
+  assert.ok(retMap);
 });

package/lib/evinser/{swiftsem.test.js → swiftsem.poku.js}

@@ -1,6 +1,6 @@
 import { readFileSync } from "node:fs";
 
-import { expect, test } from "@jest/globals";
+import { assert, it } from "poku";
 
 import {
   extractCompilerParamsFromBuild,
@@ -11,19 +11,20 @@ import {
   parseStructure,
 } from "./swiftsem.js";
 
-test("extractCompilerParamsFromBuild test", () => {
+it("extractCompilerParamsFromBuild test", () => {
   const paramsObj = extractCompilerParamsFromBuild(
     readFileSync("./test/data/swiftsem/swift-build-output1.txt", {
       encoding: "utf-8",
     }),
   );
-  expect(paramsObj.params).toBeDefined();
-  expect(paramsObj.compilerArgs).toEqual(
+  assert.ok(paramsObj.params);
+  assert.deepStrictEqual(
+    paramsObj.compilerArgs,
     "-sdk /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX15.0.sdk -F /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/Library/Frameworks -F -Xcc -I /Volumes/Work/sandbox/HAKit/.build/x86_64-apple-macosx/debug/Modules -I /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/usr/lib -L /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/usr/lib",
   );
 });
 
-test("parseDumpPackage", () => {
+it("parseDumpPackage", () => {
   const metadata = parseDumpPackage(
     JSON.parse(
       readFileSync("./test/data/swiftsem/swift-dump-package.json", {
@@ -31,8 +32,8 @@ test("parseDumpPackage", () => {
       }),
     ),
   );
-  expect(metadata.rootModule).toEqual("HAKit");
-  expect(metadata.dependencies).toEqual([
+  assert.deepStrictEqual(metadata.rootModule, "HAKit");
+  assert.deepStrictEqual(metadata.dependencies, [
     {
       dependsOn: ["Starscream"],
       ref: "HAKit",
@@ -52,11 +53,11 @@ test("parseDumpPackage", () => {
   ]);
 });
 
-test("collectBuildSymbols", () => {
+it("collectBuildSymbols", () => {
   const metadata = parseOutputFileMap(
     "./test/data/swiftsem/output-file-map.json",
   );
-  expect(metadata).toEqual({
+  assert.deepStrictEqual(metadata, {
     moduleName: "swiftsem",
     moduleSymbols: [
       "Compression",
@@ -84,7 +85,7 @@ test("collectBuildSymbols", () => {
   });
 });
 
-test("parseModuleInfo", () => {
+it("parseModuleInfo", () => {
   let metadata = parseModuleInfo(
     JSON.parse(
       readFileSync("./test/data/swiftsem/swift-module-info2.json", {
@@ -92,11 +93,11 @@ test("parseModuleInfo", () => {
       }),
     ),
   );
-  expect(metadata).toBeDefined();
-  expect(metadata.classes.length).toEqual(13);
-  expect(metadata.protocols.length).toEqual(25);
-  expect(metadata.enums.length).toEqual(16);
-  expect(metadata.importedModules).toEqual([
+  assert.ok(metadata);
+  assert.deepStrictEqual(metadata.classes.length, 13);
+  assert.deepStrictEqual(metadata.protocols.length, 25);
+  assert.deepStrictEqual(metadata.enums.length, 16);
+  assert.deepStrictEqual(metadata.importedModules, [
     "CommonCrypto",
     "Foundation",
     "Network",
@@ -113,11 +114,11 @@ test("parseModuleInfo", () => {
       }),
     ),
   );
-  expect(metadata).toBeDefined();
-  expect(metadata.classes.length).toEqual(8);
-  expect(metadata.protocols.length).toEqual(14);
-  expect(metadata.enums.length).toEqual(15);
-  expect(metadata.importedModules).toEqual([
+  assert.ok(metadata);
+  assert.deepStrictEqual(metadata.classes.length, 8);
+  assert.deepStrictEqual(metadata.protocols.length, 14);
+  assert.deepStrictEqual(metadata.enums.length, 15);
+  assert.deepStrictEqual(metadata.importedModules, [
     "Dispatch",
     "Foundation",
     "Network",
@@ -129,7 +130,7 @@ test("parseModuleInfo", () => {
   ]);
 });
 
-test("parseStructure", () => {
+it("parseStructure", () => {
   let metadata = parseStructure(
     JSON.parse(
       readFileSync("./test/data/swiftsem/swift-structure-starscream2.json", {
@@ -137,8 +138,8 @@ test("parseStructure", () => {
       }),
     ),
   );
-  expect(metadata).toBeDefined();
-  expect(metadata.referredTypes).toEqual([
+  assert.ok(metadata);
+  assert.deepStrictEqual(metadata.referredTypes, [
     "DispatchQueue",
     "Equatable",
     "HAData",
@@ -158,8 +159,8 @@ test("parseStructure", () => {
       }),
     ),
   );
-  expect(metadata).toBeDefined();
-  expect(metadata.referredTypes).toEqual([
+  assert.ok(metadata);
+  assert.deepStrictEqual(metadata.referredTypes, [
     "@escaping () -> Void",
     "@escaping (HACancellable, T) -> Void",
     "@escaping (Result<T, HAError>) -> Void",
@@ -202,8 +203,8 @@ test("parseStructure", () => {
       }),
     ),
   );
-  expect(metadata).toBeDefined();
-  expect(metadata.referredTypes).toEqual([
+  assert.ok(metadata);
+  assert.deepStrictEqual(metadata.referredTypes, [
     "AVSpeechSynthesizer",
     "AVSpeechSynthesizerDelegate",
     "AVSpeechUtterance",
@@ -216,8 +217,8 @@ test("parseStructure", () => {
       }),
     ),
   );
-  expect(metadata).toBeDefined();
-  expect(metadata.referredTypes).toEqual([
+  assert.ok(metadata);
+  assert.deepStrictEqual(metadata.referredTypes, [
     "(URL, URL) throws -> Void",
     "@escaping (GRDBWriteTransaction) throws -> Result<Void, Error>",
     "CaseIterable",
@@ -246,7 +247,7 @@ test("parseStructure", () => {
   ]);
 });
 
-test("parseIndex", () => {
+it("parseIndex", () => {
   let metadata = parseIndex(
     JSON.parse(
       readFileSync("./test/data/swiftsem/swift-index-starscream.json", {
@@ -254,10 +255,10 @@ test("parseIndex", () => {
       }),
     ),
   );
-  expect(metadata).toBeDefined();
-  expect(metadata.obfuscatedSymbols).toBeDefined();
-  expect(metadata.symbolLocations).toBeDefined();
-  expect(metadata.swiftModules).toEqual([
+  assert.ok(metadata);
+  assert.ok(metadata.obfuscatedSymbols);
+  assert.ok(metadata.symbolLocations);
+  assert.deepStrictEqual(metadata.swiftModules, [
     "Combine",
     "CoreFoundation",
     "Darwin",
@@ -278,7 +279,7 @@ test("parseIndex", () => {
     "sys_time",
     "unistd",
   ]);
-  expect(metadata.clangModules).toEqual([
+  assert.deepStrictEqual(metadata.clangModules, [
     "CoreFoundation",
     "Darwin",
     "Dispatch",
@@ -306,10 +307,10 @@ test("parseIndex", () => {
       }),
     ),
   );
-  expect(metadata).toBeDefined();
-  expect(metadata.obfuscatedSymbols).toBeDefined();
-  expect(metadata.symbolLocations).toBeDefined();
-  expect(metadata.swiftModules).toEqual([
+  assert.ok(metadata);
+  assert.ok(metadata.obfuscatedSymbols);
+  assert.ok(metadata.symbolLocations);
+  assert.deepStrictEqual(metadata.swiftModules, [
     "Combine",
     "CoreFoundation",
     "Darwin",
@@ -330,7 +331,7 @@ test("parseIndex", () => {
     "sys_time",
     "unistd",
   ]);
-  expect(metadata.clangModules).toEqual([
+  assert.deepStrictEqual(metadata.clangModules, [
     "CoreFoundation",
     "Darwin",
     "Dispatch",
@@ -359,15 +360,15 @@ test("parseIndex", () => {
       }),
     ),
   );
-  expect(metadata).toBeDefined();
-  expect(metadata.obfuscatedSymbols).toBeDefined();
-  expect(metadata.symbolLocations).toBeDefined();
-  expect(metadata.swiftModules).toEqual([
+  assert.ok(metadata);
+  assert.ok(metadata.obfuscatedSymbols);
+  assert.ok(metadata.symbolLocations);
+  assert.deepStrictEqual(metadata.swiftModules, [
     "Swift",
     "_Concurrency",
     "_StringProcessing",
   ]);
-  expect(metadata.clangModules).toEqual([
+  assert.deepStrictEqual(metadata.clangModules, [
     "AVFAudio",
     "SwiftShims",
     "_SwiftConcurrencyShims",

package/lib/helpers/cbomutils.poku.js

@@ -0,0 +1,8 @@
+import { assert, it } from "poku";
+
+import { collectOSCryptoLibs } from "./cbomutils.js";
+
+it("cbom utils tests", () => {
+  const cryptoLibs = collectOSCryptoLibs();
+  assert.ok(cryptoLibs);
+});

package/lib/helpers/{display.test.js → display.poku.js}

@@ -1,10 +1,10 @@
 import { readFileSync } from "node:fs";
 
-import { test } from "@jest/globals";
+import { it } from "poku";
 
 import { printDependencyTree } from "./display.js";
 
-test("print tree test", () => {
+it("print tree test", () => {
   const bomJson = JSON.parse(
     readFileSync("./test/data/vuln-spring-1.5.bom.json", { encoding: "utf-8" }),
   );

package/lib/helpers/dotnetutils.js

@@ -0,0 +1,132 @@
+/**
+ * Extracts version number from a HintPath in .NET project files
+ * @param {string|null|undefined} hintPath - The HintPath string to extract version from
+ * @returns {string|null} The extracted version number or null if not found
+ * @example
+ * extractVersionFromHintPath('..\\packages\\BouncyCastle.Cryptography.2.6.2\\lib\\net461\\BouncyCastle.Cryptography.dll')
+ * // returns '2.6.2'
+ *
+ * extractVersionFromHintPath('C:\\Users\\user\\.nuget\\packages\\microsoft.entityframeworkcore\\7.0.10\\lib\\net6.0\\Microsoft.EntityFrameworkCore.dll')
+ * // returns '7.0.10'
+ *
+ * extractVersionFromHintPath('../packages/MyLib.1.0.0+build.123/lib/net48/MyLib.dll')
+ * // returns '1.0.0+build.123'
+ */
+export function extractVersionFromHintPath(hintPath) {
+  if (!hintPath || typeof hintPath !== "string") {
+    return null;
+  }
+
+  const normalizedPath = hintPath.replace(/\\/g, "/");
+
+  const directPackagePattern =
+    /(?:packages|nuget|\.nuget\/packages|paquets)\/([^\/]+?)\.(\d+(?:\.\d+){1,3}(?:-[a-zA-Z0-9.-]*)?(?:\+[a-zA-Z0-9.-]+)?)(?:\/|$)/i;
+  const directMatch = normalizedPath.match(directPackagePattern);
+  if (directMatch) {
+    return directMatch[2];
+  }
+
+  const structuredPattern =
+    /(?:^|\/)(?:packages|nuget|\.nuget\/packages|paquets)\/.+?\/(\d+(?:\.\d+){1,3}(?:-[a-zA-Z0-9.-]*)?(?:\+[a-zA-Z0-9.-]+)?)(?:\/|$)/i;
+  const structuredMatch = normalizedPath.match(structuredPattern);
+  if (structuredMatch) {
+    return structuredMatch[1];
+  }
+
+  const fallbackPatterns = [
+    /lib\/(\d+(?:\.\d+){1,3}(?:-[a-zA-Z0-9.-]*)?(?:\+[a-zA-Z0-9.-]+)?)\/[^\/]+\.dll$/,
+    /(?:^|\/)(\d+(?:\.\d+){1,3}(?:-[a-zA-Z0-9.-]*)?(?:\+[a-zA-Z0-9.-]+)?)(?:\/[^\/]*\.dll$)/,
+  ];
+
+  for (const pattern of fallbackPatterns) {
+    const fallbackMatch = normalizedPath.match(pattern);
+    if (fallbackMatch?.[1]) {
+      const version = fallbackMatch[1];
+      if (isValidVersion(version)) {
+        return version;
+      }
+    }
+  }
+
+  return null;
+}
+
+/**
+ * Validates if a string is a valid semantic version
+ * Supports versions with pre-release identifiers and build metadata
+ * @param {string|null|undefined} version - The version string to validate
+ * @returns {boolean} True if the version is valid, false otherwise
+ * @example
+ * isValidVersion('1.0.0') // true
+ * isValidVersion('1.0.0-alpha') // true
+ * isValidVersion('1.0.0+build.123') // true
+ * isValidVersion('1.0.0-alpha+build.123') // true
+ * isValidVersion('1.0.0-') // false
+ * isValidVersion('invalid') // false
+ */
+export function isValidVersion(version) {
+  if (!version || typeof version !== "string") return false;
+
+  const versionRegex =
+    /^\d+(\.\d+){1,3}(-[a-zA-Z0-9]+(?:[.-][a-zA-Z0-9]+)*)?(\+[a-zA-Z0-9.-]+)?$/;
+  return versionRegex.test(version);
+}
+
+/**
+ * Extracts both package name and version from a HintPath in .NET project files
+ * @param {string|null|undefined} hintPath - The HintPath string to extract package info from
+ * @returns {{name: string|null, version: string|null}} Object containing package name and version
+ * @example
+ * extractPackageInfoFromHintPath('..\\packages\\BouncyCastle.Cryptography.2.6.2\\lib\\net461\\BouncyCastle.Cryptography.dll')
+ * // returns { name: 'BouncyCastle.Cryptography', version: '2.6.2' }
+ *
+ * extractPackageInfoFromHintPath('C:\\Users\\user\\.nuget\\packages\\microsoft.entityframeworkcore\\7.0.10\\lib\\net6.0\\Microsoft.EntityFrameworkCore.dll')
+ * // returns { name: 'microsoft.entityframeworkcore', version: '7.0.10' }
+ */
+export function extractPackageInfoFromHintPath(hintPath) {
+  if (!hintPath || typeof hintPath !== "string") {
+    return { name: null, version: null };
+  }
+
+  const normalizedPath = hintPath.replace(/\\/g, "/");
+
+  const directPattern =
+    /(?:packages|nuget|\.nuget\/packages|paquets)\/([^\/]+?)\.(\d+(?:\.\d+){1,3}(?:-[a-zA-Z0-9.-]*)?(?:\+[a-zA-Z0-9.-]+)?)(?:\/|$)/i;
+  const directMatch = normalizedPath.match(directPattern);
+  if (directMatch) {
+    return {
+      name: directMatch[1],
+      version: directMatch[2],
+    };
+  }
+
+  const structuredPattern =
+    /(?:^|\/)(?:packages|nuget|\.nuget\/packages|paquets)\/(.+?)\/(\d+(?:\.\d+){1,3}(?:-[a-zA-Z0-9.-]*)?(?:\+[a-zA-Z0-9.-]+)?)(?:\/|$)/i;
+  const structuredMatch = normalizedPath.match(structuredPattern);
+  if (structuredMatch) {
+    const fullPath = structuredMatch[1];
+    const pathParts = fullPath.split("/").filter((part) => part);
+    const name = pathParts.length > 0 ? pathParts[pathParts.length - 1] : null;
+    return {
+      name: name,
+      version: structuredMatch[2],
+    };
+  }
+
+  const libPattern =
+    /lib\/(\d+(?:\.\d+){1,3}(?:-[a-zA-Z0-9.-]*)?(?:\+[a-zA-Z0-9.-]+)?)\/[^\/]+\.dll$/;
+  const libMatch = normalizedPath.match(libPattern);
+  if (libMatch?.[1]) {
+    const dllMatch = normalizedPath.match(/\/([^\/]+)\.dll$/);
+    return {
+      name: dllMatch ? dllMatch[1] : null,
+      version: libMatch[1],
+    };
+  }
+
+  const version = extractVersionFromHintPath(hintPath);
+  return {
+    name: null,
+    version: version,
+  };
+}