@cyclonedx/cdxgen 12.1.5 → 12.2.1

package/lib/server/server.js

@@ -36,7 +36,11 @@ const ALLOWED_PARAMS = [
   "projectGroup",
   "projectTag",
   "projectVersion",
+  "autoCreate",
+  "isLatest",
   "parentUUID",
+  "parentProjectName",
+  "parentProjectVersion",
   "serverUrl",
   "apiKey",
   "specVersion",
@@ -270,7 +274,10 @@ function gitClone(repoUrl, branch = null) {
     "core.fsmonitor=false",
     "-c",
     "safe.bareRepository=explicit",
+    "-c",
+    "core.hooksPath=/dev/null",
     "clone",
+    "--template=",
     repoUrl,
     "--depth",
     "1",
@@ -297,13 +304,14 @@ function gitClone(repoUrl, branch = null) {
     GIT_CONFIG_VALUE_0: "false",
     GIT_CONFIG_KEY_1: "safe.bareRepository",
     GIT_CONFIG_VALUE_1: "explicit",
+    GIT_TERMINAL_PROMPT: "0",
   };
   const env = isSecureMode
     ? {
         ...process.env,
         ...envConfigs,
         GIT_CONFIG_NOSYSTEM: "1",
-        GIT_CONFIG_NOGLOBAL: "1",
+        GIT_CONFIG_GLOBAL: "/dev/null",
         GIT_ALLOW_PROTOCOL: gitAllowProtocol,
       }
     : {
@@ -372,6 +380,17 @@ export function parseValue(raw) {
   throw new TypeError(`Invalid value type: ${t}.`);
 }
 
+/**
+ * Parses allowed query/body parameters into a typed options object.
+ * Query parameters take priority over body parameters. Handles the
+ * `type` → `projectType` rename, lifecycle-based `installDeps` defaulting,
+ * and profile option expansion.
+ *
+ * @param {Object} q Parsed query string key/value map
+ * @param {Object} [body={}] Parsed request body key/value map
+ * @param {Object} [options={}] Seed options object to merge results into
+ * @returns {Object} Populated options object
+ */
 export function parseQueryString(q, body = {}, options = {}) {
   // Priority is query params followed by body
   for (const param of ALLOWED_PARAMS) {
@@ -391,6 +410,14 @@ export function parseQueryString(q, body = {}, options = {}) {
   return options;
 }
 
+/**
+ * Extracts query parameters from an incoming HTTP request object.
+ * Handles repeated keys by collecting their values into an array.
+ * Returns an empty object if the URL cannot be parsed.
+ *
+ * @param {Object} req Node.js/connect HTTP request object
+ * @returns {Object} Key/value map of query parameters from the request URL
+ */
 export function getQueryParams(req) {
   try {
     if (!req?.url) {
@@ -402,7 +429,7 @@ export function getQueryParams(req) {
     const baseUrl = `${protocol}://${host}`;
 
     const fullUrl = new URL(req.url, baseUrl);
-    const params = {};
+    const params = Object.create(null);
 
     // Convert multiple values to an array
     for (const [key, value] of fullUrl.searchParams) {
@@ -449,21 +476,25 @@ const configureServer = (cdxgenServer) => {
 const ALL_INTERFACES = new Set(["0.0.0.0", "::", "::/128", "::/0"]);
 
 const start = (options) => {
+  if (isSecureMode && !process.permission) {
+    console.error(
+      "SECURE MODE: Node.js permission model not enabled. Use --permission flag.",
+    );
+    process.exit(1);
+  }
   console.log(`cdxgen server version ${CDXGEN_VERSION}`);
-
-  console.log(
-    "Listening on",
-    options.serverHost,
-    options.serverPort,
-    "without authentication!",
-  );
   if (ALL_INTERFACES.has(options.serverHost)) {
     console.log("Exposing cdxgen server on all IP address is a security risk!");
     if (isSecureMode) {
       process.exit(1);
     }
   }
-  if (+options.serverPort < 1024) {
+  const serverPort = Number(options.serverPort);
+  if (!Number.isInteger(serverPort) || serverPort <= 0 || serverPort > 65535) {
+    console.log("Invalid server port specified.");
+    process.exit(1);
+  }
+  if (serverPort < 1024) {
     console.log(
       "Running cdxgen server with a privileged port is a security risk!",
     );
@@ -503,9 +534,15 @@ const start = (options) => {
       process.exit(1);
     }
   }
+  console.log(
+    "Listening on",
+    options.serverHost,
+    serverPort,
+    "without authentication!",
+  );
   const cdxgenServer = http
     .createServer(app)
-    .listen(options.serverPort, options.serverHost);
+    .listen(serverPort, options.serverHost);
   configureServer(cdxgenServer);
 
   app.use("/health", (_req, res) => {
@@ -525,7 +562,7 @@ const start = (options) => {
     }
     const q = getQueryParams(req);
     let cleanup = false;
-    let reqOptions = {};
+    let reqOptions = Object.create(null);
     try {
       reqOptions = parseQueryString(
         q,
@@ -647,4 +684,4 @@ const start = (options) => {
   });
 };
 
-export { configureServer, start };
+export { configureServer, gitClone, start };