@cyclonedx/cdxgen 12.1.5 → 12.2.0

package/lib/server/server.poku.js

@@ -11,53 +11,71 @@ import {
   validateAndRejectGitSource,
 } from "./server.js";
 
+function nullProtoObj(obj) {
+  if (obj === null || typeof obj !== "object") {
+    return obj;
+  }
+  if (Array.isArray(obj)) {
+    return obj.map(nullProtoObj);
+  }
+  if (Object.prototype.toString.call(obj) === "[object Object]") {
+    const result = Object.create(null);
+    for (const [key, value] of Object.entries(obj)) {
+      result[key] = nullProtoObj(value);
+    }
+    return result;
+  }
+  return obj;
+}
+
+function checkEqual(actual, expected, message) {
+  assert.deepStrictEqual(nullProtoObj(actual), nullProtoObj(expected), message);
+}
+
 it("parseValue tests", () => {
-  assert.deepStrictEqual(parseValue("foo"), "foo");
-  assert.deepStrictEqual(parseValue("foo\n"), "foo");
-  assert.deepStrictEqual(parseValue("foo\r\n"), "foo");
-  assert.deepStrictEqual(parseValue(1), 1);
-  assert.deepStrictEqual(parseValue("true"), true);
-  assert.deepStrictEqual(parseValue("false"), false);
-  assert.deepStrictEqual(parseValue(["foo", "bar", 42]), ["foo", "bar", 42]);
+  checkEqual(parseValue("foo"), "foo");
+  checkEqual(parseValue("foo\n"), "foo");
+  checkEqual(parseValue("foo\r\n"), "foo");
+  checkEqual(parseValue(1), 1);
+  checkEqual(parseValue("true"), true);
+  checkEqual(parseValue("false"), false);
+  checkEqual(parseValue(["foo", "bar", 42]), ["foo", "bar", 42]);
   assert.throws(() => parseValue({ foo: "bar" }), TypeError);
   assert.throws(() => parseValue([42, "foo", { foo: "bar" }]), TypeError);
   assert.throws(() => parseValue([42, "foo", new Error()]), TypeError);
   assert.throws(() => parseValue(["foo", "bar", new String(42)]), TypeError);
-  assert.deepStrictEqual(parseValue(true), true);
-  assert.deepStrictEqual(parseValue(false), false);
-  assert.deepStrictEqual(parseValue(null), null);
-  assert.deepStrictEqual(parseValue(undefined), undefined);
-  assert.deepStrictEqual(parseValue([null, undefined, null]), [
+  checkEqual(parseValue(true), true);
+  checkEqual(parseValue(false), false);
+  checkEqual(parseValue(null), null);
+  checkEqual(parseValue(undefined), undefined);
+  checkEqual(parseValue([null, undefined, null]), [null, undefined, null]);
+  checkEqual(parseValue(""), "");
+  checkEqual(parseValue("   \n"), "   ");
+  checkEqual(parseValue("42"), "42");
+  checkEqual(parseValue("0"), "0");
+  checkEqual(parseValue("-1"), "-1");
+  checkEqual(parseValue("True"), "True");
+  checkEqual(parseValue("False"), "False");
+  checkEqual(parseValue(" TRUE "), " TRUE ");
+  checkEqual(parseValue(["true", "false", 0, "0", null, undefined]), [
+    true,
+    false,
+    0,
+    "0",
     null,
     undefined,
-    null,
   ]);
-  assert.deepStrictEqual(parseValue(""), "");
-  assert.deepStrictEqual(parseValue("   \n"), "   ");
-  assert.deepStrictEqual(parseValue("42"), "42");
-  assert.deepStrictEqual(parseValue("0"), "0");
-  assert.deepStrictEqual(parseValue("-1"), "-1");
-  assert.deepStrictEqual(parseValue("True"), "True");
-  assert.deepStrictEqual(parseValue("False"), "False");
-  assert.deepStrictEqual(parseValue(" TRUE "), " TRUE ");
-  assert.deepStrictEqual(
-    parseValue(["true", "false", 0, "0", null, undefined]),
-    [true, false, 0, "0", null, undefined],
-  );
   assert.throws(() => parseValue([["nested"]]), TypeError);
   assert.throws(() => parseValue(Symbol("test")), TypeError);
   assert.throws(() => parseValue(BigInt(42)), TypeError);
   // biome-ignore-start lint/suspicious/noEmptyBlockStatements: test
   assert.throws(() => parseValue(() => {}), TypeError);
   // biome-ignore-end lint/suspicious/noEmptyBlockStatements: test
-  assert.deepStrictEqual(parseValue(Number.NaN), Number.NaN);
-  assert.deepStrictEqual(
-    parseValue(Number.POSITIVE_INFINITY),
-    Number.POSITIVE_INFINITY,
-  );
+  checkEqual(parseValue(Number.NaN), Number.NaN);
+  checkEqual(parseValue(Number.POSITIVE_INFINITY), Number.POSITIVE_INFINITY);
   const obj = { toString: () => "foo" };
   assert.throws(() => parseValue(obj), TypeError);
-  assert.deepStrictEqual(parseValue("hello\r\n"), "hello");
+  checkEqual(parseValue("hello\r\n"), "hello");
 });
 
 describe("parseQueryString tests", () => {
@@ -70,22 +88,22 @@ describe("parseQueryString tests", () => {
     };
     const options = {};
     const result = parseQueryString(q, body, options);
-    assert.deepStrictEqual(result.foo, undefined);
-    assert.deepStrictEqual(result.excludeType, ["2"]);
-    assert.deepStrictEqual(result.technique, ["manifest-analysis"]);
+    checkEqual(result.foo, undefined);
+    checkEqual(result.excludeType, ["2"]);
+    checkEqual(result.technique, ["manifest-analysis"]);
   });
 
   it("splits type into projectType and removes type", () => {
     const options = { type: "a,b,c" };
     const result = parseQueryString({}, {}, options);
-    assert.deepStrictEqual(result.projectType, ["a", "b", "c"]);
-    assert.deepStrictEqual(result.type, undefined);
+    checkEqual(result.projectType, ["a", "b", "c"]);
+    checkEqual(result.type, undefined);
   });
 
   it("sets installDeps to false for pre-build lifecycle", () => {
     const options = { lifecycle: "pre-build" };
     const result = parseQueryString({}, {}, options);
-    assert.deepStrictEqual(result.installDeps, false);
+    checkEqual(result.installDeps, false);
   });
 });
 
@@ -102,23 +120,23 @@ describe("isAllowedHost()", () => {
 
   it("returns true if CDXGEN_SERVER_ALLOWED_HOSTS is not set", () => {
     delete process.env.CDXGEN_SERVER_ALLOWED_HOSTS;
-    assert.deepStrictEqual(isAllowedHost("anything"), true);
+    checkEqual(isAllowedHost("anything"), true);
   });
 
   it("returns true for a hostname that is in the list", () => {
     process.env.CDXGEN_SERVER_ALLOWED_HOSTS = "foo.com,bar.com";
-    assert.deepStrictEqual(isAllowedHost("foo.com"), true);
-    assert.deepStrictEqual(isAllowedHost("bar.com"), true);
+    checkEqual(isAllowedHost("foo.com"), true);
+    checkEqual(isAllowedHost("bar.com"), true);
   });
 
   it("returns false for a hostname not in the list", () => {
     process.env.CDXGEN_SERVER_ALLOWED_HOSTS = "foo.com,bar.com";
-    assert.deepStrictEqual(isAllowedHost("baz.com"), false);
+    checkEqual(isAllowedHost("baz.com"), false);
   });
 
   it("treats an empty-string env var as unset (returns true)", () => {
     process.env.CDXGEN_SERVER_ALLOWED_HOSTS = "";
-    assert.deepStrictEqual(isAllowedHost("whatever"), true);
+    checkEqual(isAllowedHost("whatever"), true);
   });
 });
 
@@ -203,15 +221,15 @@ describe("isAllowedPath()", () => {
 describe("isAllowedWinPath windows tests()", () => {
   it("returns false for windows device name paths", () => {
     if (isWin) {
-      assert.deepStrictEqual(isAllowedWinPath("CON:../foo"), false);
-      assert.deepStrictEqual(isAllowedWinPath("X:\\foo\\..\\bar"), true);
-      assert.deepStrictEqual(isAllowedWinPath("C:\\Users"), true);
-      assert.deepStrictEqual(isAllowedWinPath("C:\\🚀"), true);
-      assert.deepStrictEqual(isAllowedWinPath("C:"), true);
-      assert.deepStrictEqual(isAllowedWinPath("c:"), true);
-      assert.deepStrictEqual(isAllowedWinPath("CON:"), false);
-      assert.deepStrictEqual(isAllowedWinPath("COM¹:"), false);
-      assert.deepStrictEqual(isAllowedWinPath("COM¹:../foo"), false);
+      checkEqual(isAllowedWinPath("CON:../foo"), false);
+      checkEqual(isAllowedWinPath("X:\\foo\\..\\bar"), true);
+      checkEqual(isAllowedWinPath("C:\\Users"), true);
+      checkEqual(isAllowedWinPath("C:\\🚀"), true);
+      checkEqual(isAllowedWinPath("C:"), true);
+      checkEqual(isAllowedWinPath("c:"), true);
+      checkEqual(isAllowedWinPath("CON:"), false);
+      checkEqual(isAllowedWinPath("COM¹:"), false);
+      checkEqual(isAllowedWinPath("COM¹:../foo"), false);
       for (const d of [
         "PRN:.\\..\\bar",
         "LpT5:/another/path",
@@ -244,7 +262,7 @@ describe("isAllowedWinPath windows tests()", () => {
         "🚀:\\",
         "⚡:\\",
       ]) {
-        assert.deepStrictEqual(isAllowedWinPath(d), false);
+        checkEqual(isAllowedWinPath(d), false);
       }
     }
   });
@@ -264,7 +282,7 @@ describe("getQueryParams", () => {
     );
     const result = getQueryParams(req);
 
-    assert.deepStrictEqual(result, {
+    checkEqual(result, {
       url: "https://example.com",
       multiProject: "true",
       type: "js",
@@ -277,7 +295,7 @@ describe("getQueryParams", () => {
     );
     const result = getQueryParams(req);
 
-    assert.deepStrictEqual(result, {
+    checkEqual(result, {
       q: "hello world",
       filter: "category=tech",
     });
@@ -288,7 +306,7 @@ describe("getQueryParams", () => {
     const result = getQueryParams(req);
 
     // URLSearchParams.entries() returns the first value when there are duplicates
-    assert.deepStrictEqual(result, {
+    checkEqual(result, {
       tags: ["javascript", "react", "node"],
     });
   });
@@ -297,21 +315,21 @@ describe("getQueryParams", () => {
     const req = createMockRequest("/sbom");
     const result = getQueryParams(req);
 
-    assert.deepStrictEqual(result, {});
+    checkEqual(result, {});
   });
 
   it("should handle query string with only question mark", () => {
     const req = createMockRequest("/sbom?");
     const result = getQueryParams(req);
 
-    assert.deepStrictEqual(result, {});
+    checkEqual(result, {});
   });
 
   it("should handle parameters without values", () => {
     const req = createMockRequest("/api?flag1&flag2&param=value");
     const result = getQueryParams(req);
 
-    assert.deepStrictEqual(result, {
+    checkEqual(result, {
       flag1: "",
       flag2: "",
       param: "value",
@@ -325,7 +343,7 @@ describe("getQueryParams", () => {
     );
     const result = getQueryParams(req);
 
-    assert.deepStrictEqual(result, {
+    checkEqual(result, {
       param1: "value1",
     });
   });
@@ -338,7 +356,7 @@ describe("getQueryParams", () => {
     );
     const result = getQueryParams(req);
 
-    assert.deepStrictEqual(result, {
+    checkEqual(result, {
       token: "abc123",
     });
   });
@@ -349,7 +367,7 @@ describe("getQueryParams", () => {
     );
     const result = getQueryParams(req);
 
-    assert.deepStrictEqual(result, {
+    checkEqual(result, {
       name: "john",
       age: "25",
       active: "true",
@@ -362,7 +380,7 @@ describe("getQueryParams", () => {
     );
     const result = getQueryParams(req);
 
-    assert.deepStrictEqual(result, {
+    checkEqual(result, {
       q: "hello world!",
       category: "web development",
     });
@@ -372,14 +390,14 @@ describe("getQueryParams", () => {
     const req = createMockRequest(undefined);
     const result = getQueryParams(req);
 
-    assert.deepStrictEqual(result, {});
+    checkEqual(result, {});
   });
 
   it("should handle numeric values as strings", () => {
     const req = createMockRequest("/calculate?x=10&y=20&operation=add");
     const result = getQueryParams(req);
 
-    assert.deepStrictEqual(result, {
+    checkEqual(result, {
       x: "10",
       y: "20",
       operation: "add",
@@ -390,7 +408,7 @@ describe("getQueryParams", () => {
     const req = createMockRequest("/config?debug=true&verbose=false&enabled=1");
     const result = getQueryParams(req);
 
-    assert.deepStrictEqual(result, {
+    checkEqual(result, {
       debug: "true",
       verbose: "false",
       enabled: "1",
@@ -402,7 +420,7 @@ describe("getQueryParams", () => {
     const req = createMockRequest("not-a-valid-url");
     const result = getQueryParams(req);
 
-    assert.deepStrictEqual(result, {});
+    checkEqual(result, {});
   });
 
   it("should handle empty host gracefully", () => {
@@ -413,7 +431,7 @@ describe("getQueryParams", () => {
     };
     const result = getQueryParams(req);
 
-    assert.deepStrictEqual(result, {
+    checkEqual(result, {
       param: "value",
     });
   });
@@ -426,7 +444,7 @@ describe("getQueryParams", () => {
     };
     const result = getQueryParams(req);
 
-    assert.deepStrictEqual(result, {
+    checkEqual(result, {
       param: "value",
     });
   });
@@ -450,84 +468,60 @@ describe("validateGitSource() tests", () => {
   });
 
   it("should reject ext:: and fd:: outright", () => {
-    assert.deepStrictEqual(
+    checkEqual(
       validateAndRejectGitSource("ext::sh -c id").error,
       "Invalid Protocol",
     );
-    assert.deepStrictEqual(
-      validateAndRejectGitSource("fd::123").error,
-      "Invalid Protocol",
-    );
-    assert.deepStrictEqual(
+    checkEqual(validateAndRejectGitSource("fd::123").error, "Invalid Protocol");
+    checkEqual(
       validateAndRejectGitSource("EXT::sh -c id").error,
       "Invalid Protocol",
     );
   });
 
   it("should allow standard local paths to bypass validation", () => {
-    assert.deepStrictEqual(validateAndRejectGitSource("/tmp/local-path"), null);
-    assert.deepStrictEqual(
-      validateAndRejectGitSource("C:\\Users\\local"),
-      null,
-    );
+    checkEqual(validateAndRejectGitSource("/tmp/local-path"), null);
+    checkEqual(validateAndRejectGitSource("C:\\Users\\local"), null);
   });
 
   it("should handle ssh git@ format gracefully", () => {
-    assert.deepStrictEqual(
-      validateAndRejectGitSource("git@github.com:foo/bar.git"),
-      null,
-    );
+    checkEqual(validateAndRejectGitSource("git@github.com:foo/bar.git"), null);
   });
 
   it("should reject malformed git URLs", () => {
     // invalid URL format (can't parse via node's new URL object)
-    assert.deepStrictEqual(
+    checkEqual(
       validateAndRejectGitSource("http://[:::1]/bad-ipv6").error,
       "Invalid URL Format",
     );
   });
 
   it("should enforce GIT_ALLOW_PROTOCOL default schemes", () => {
-    assert.deepStrictEqual(
-      validateAndRejectGitSource("https://github.com/repo"),
-      null,
-    );
-    assert.deepStrictEqual(
-      validateAndRejectGitSource("http://github.com/repo"),
-      {
-        status: 400,
-        error: "Protocol Not Allowed",
-        details: "The protocol 'http:' is not permitted by GIT_ALLOW_PROTOCOL.",
-      },
-    );
-    assert.deepStrictEqual(
-      validateAndRejectGitSource("git://github.com/repo"),
-      null,
-    );
-    assert.deepStrictEqual(
-      validateAndRejectGitSource("ssh://github.com/repo"),
-      null,
-    );
-    assert.deepStrictEqual(
-      validateAndRejectGitSource("git+ssh://github.com/repo"),
-      null,
-    );
+    checkEqual(validateAndRejectGitSource("https://github.com/repo"), null);
+    checkEqual(validateAndRejectGitSource("http://github.com/repo"), {
+      status: 400,
+      error: "Protocol Not Allowed",
+      details: "The protocol 'http:' is not permitted by GIT_ALLOW_PROTOCOL.",
+    });
+    checkEqual(validateAndRejectGitSource("git://github.com/repo"), null);
+    checkEqual(validateAndRejectGitSource("ssh://github.com/repo"), null);
+    checkEqual(validateAndRejectGitSource("git+ssh://github.com/repo"), null);
 
     // ftp is not allowed by default
     const res = validateAndRejectGitSource("ftp://github.com/repo");
-    assert.deepStrictEqual(res.error, "Protocol Not Allowed");
-    assert.deepStrictEqual(
+    checkEqual(res.error, "Protocol Not Allowed");
+    checkEqual(
       res.details,
       "The protocol 'ftp:' is not permitted by GIT_ALLOW_PROTOCOL.",
     );
   });
 
   it("should reject protocol smuggling techniques", () => {
-    assert.deepStrictEqual(
+    checkEqual(
       validateAndRejectGitSource("git+ext://github.com/repo").error,
       "Protocol Not Allowed",
     );
-    assert.deepStrictEqual(
+    checkEqual(
       validateAndRejectGitSource("http+ext://github.com/repo").error,
       "Protocol Not Allowed",
     );
@@ -535,30 +529,24 @@ describe("validateGitSource() tests", () => {
 
   it("should respect custom CDXGEN_SERVER_GIT_ALLOW_PROTOCOL configs", () => {
     process.env.CDXGEN_SERVER_GIT_ALLOW_PROTOCOL = "https:git";
-    assert.deepStrictEqual(
-      validateAndRejectGitSource("https://github.com/repo"),
-      null,
-    );
-    assert.deepStrictEqual(
-      validateAndRejectGitSource("git://github.com/repo"),
-      null,
-    );
+    checkEqual(validateAndRejectGitSource("https://github.com/repo"), null);
+    checkEqual(validateAndRejectGitSource("git://github.com/repo"), null);
 
     // http is no longer allowed
     const res = validateAndRejectGitSource("http://github.com/repo");
-    assert.deepStrictEqual(res.error, "Protocol Not Allowed");
-    assert.deepStrictEqual(
+    checkEqual(res.error, "Protocol Not Allowed");
+    checkEqual(
       res.details,
       "The protocol 'http:' is not permitted by GIT_ALLOW_PROTOCOL.",
     );
   });
 
   it("should reject remote helper syntax (::) inside valid schemes", () => {
-    assert.deepStrictEqual(
+    checkEqual(
       validateAndRejectGitSource("https://github.com/ext::sh -c id").error,
       "Invalid URL Syntax",
     );
-    assert.deepStrictEqual(
+    checkEqual(
       validateAndRejectGitSource("git://foo::bar/repo").error,
       "Invalid URL Format",
     );
@@ -566,44 +554,35 @@ describe("validateGitSource() tests", () => {
 
   it("should validate allowed hosts", () => {
     process.env.CDXGEN_SERVER_ALLOWED_HOSTS = "github.com,gitlab.com";
-    assert.deepStrictEqual(
-      validateAndRejectGitSource("https://github.com/repo"),
-      null,
-    );
+    checkEqual(validateAndRejectGitSource("https://github.com/repo"), null);
 
     const res = validateAndRejectGitSource("https://evil.com/repo");
-    assert.deepStrictEqual(res.error, "Host Not Allowed");
-    assert.deepStrictEqual(res.status, 403);
+    checkEqual(res.error, "Host Not Allowed");
+    checkEqual(res.status, 403);
   });
 });
 it("should correctly normalize and validate various git@ (SCP-like) formats", () => {
-  assert.deepStrictEqual(
+  checkEqual(
     validateAndRejectGitSource("git@gitlab.com:group/project.git"),
     null,
   );
-  assert.deepStrictEqual(
+  checkEqual(
     validateAndRejectGitSource("git@bitbucket.org:workspace/repo:name.git"),
     null,
   );
-  assert.deepStrictEqual(
-    validateAndRejectGitSource("git@github.com/user/repo.git"),
-    null,
-  );
-  assert.deepStrictEqual(
+  checkEqual(validateAndRejectGitSource("git@github.com/user/repo.git"), null);
+  checkEqual(
     validateAndRejectGitSource("ssh://git@github.com/user/repo.git"),
     null,
   );
   process.env.CDXGEN_SERVER_ALLOWED_HOSTS = "github.com,bitbucket.org";
-  assert.deepStrictEqual(
-    validateAndRejectGitSource("git@github.com:user/repo.git"),
-    null,
-  );
-  assert.deepStrictEqual(
+  checkEqual(validateAndRejectGitSource("git@github.com:user/repo.git"), null);
+  checkEqual(
     validateAndRejectGitSource("git@bitbucket.org:workspace/repo.git"),
     null,
   );
   const deniedRes = validateAndRejectGitSource("git@evil.com:foo/bar.git");
-  assert.deepStrictEqual(deniedRes.status, 403);
-  assert.deepStrictEqual(deniedRes.error, "Host Not Allowed");
+  checkEqual(deniedRes.status, 403);
+  checkEqual(deniedRes.error, "Host Not Allowed");
   delete process.env.CDXGEN_SERVER_ALLOWED_HOSTS;
 });

package/lib/stages/postgen/annotator.js

@@ -289,7 +289,7 @@ export function textualMetadata(bomJson) {
     (c) => c.type === "cryptographic-asset",
   ).length;
   const vsixCount = bomJson?.components?.filter((c) =>
-    c?.purl?.startsWith("pkg:vsix"),
+    c?.purl?.startsWith("pkg:vscode-extension"),
   ).length;
   const swidCount = bomJson?.components?.filter((c) =>
     c?.purl?.startsWith("pkg:swid"),