@cyclonedx/cdxgen 12.2.0 → 12.2.1

package/lib/helpers/analyzer.js

@@ -145,8 +145,8 @@ const setFileRef = (
     exportedModules,
     isExternal: true,
     fileName: fileRelativeLoc,
-    lineNumber: sourceLoc?.line ? sourceLoc.line : undefined,
-    columnNumber: sourceLoc?.column ? sourceLoc.column : undefined,
+    lineNumber: sourceLoc?.line ?? undefined,
+    columnNumber: sourceLoc?.column ?? undefined,
   };
   // replace relative imports with full path
   let moduleFullPath = pathway;
@@ -186,7 +186,7 @@ const setFileRef = (
 const vueCleaningRegex = /<\/*script.*>|<style[\s\S]*style>|<\/*br>/gi;
 const vueTemplateRegex = /(<template.*>)([\s\S]*)(<\/template>)/gi;
 const vueCommentRegex = /<!--[\s\S]*?-->/gi;
-const vueBindRegex = /(:\[)([\s\S]*?)(\])/gi;
+const vueBindRegex = /(:\[)([\s\S]*?)(])/gi;
 const vuePropRegex = /\s([.:@])([a-zA-Z]*?=)/gi;
 
 const fileToParseableCode = (file) => {
@@ -216,12 +216,252 @@ const fileToParseableCode = (file) => {
   return code;
 };
 
+const isWasmPath = (modulePath) =>
+  typeof modulePath === "string" && /\.wasm([?#].*)?$/i.test(modulePath);
+
+const getStringValue = (astNode) => {
+  if (!astNode) {
+    return undefined;
+  }
+  if (astNode.type === "StringLiteral") {
+    return astNode.value;
+  }
+  if (
+    astNode.type === "TemplateLiteral" &&
+    astNode.expressions.length === 0 &&
+    astNode.quasis.length === 1
+  ) {
+    return astNode.quasis[0].value.cooked;
+  }
+  return undefined;
+};
+
+const unwrapAwait = (astNode) =>
+  astNode?.type === "AwaitExpression" ? astNode.argument : astNode;
+
+const isImportMetaUrl = (astNode) =>
+  astNode?.type === "MemberExpression" &&
+  astNode.object?.type === "MetaProperty" &&
+  astNode.object.meta?.name === "import" &&
+  astNode.object.property?.name === "meta" &&
+  astNode.property?.type === "Identifier" &&
+  astNode.property.name === "url";
+
+const getMemberExpressionPropertyName = (propertyNode) => {
+  if (!propertyNode) {
+    return undefined;
+  }
+  if (propertyNode.type === "Identifier") {
+    return propertyNode.name;
+  }
+  if (propertyNode.type === "StringLiteral") {
+    return propertyNode.value;
+  }
+  return undefined;
+};
+
+const resolveWasmLiteralFromNode = (astNode, wasmBufferByVarName) => {
+  const normalizedNode = unwrapAwait(astNode);
+  const directLiteral = getStringValue(normalizedNode);
+  if (isWasmPath(directLiteral)) {
+    return directLiteral;
+  }
+  if (normalizedNode?.type === "Identifier") {
+    return wasmBufferByVarName.get(normalizedNode.name);
+  }
+  if (normalizedNode?.type === "CallExpression") {
+    if (
+      normalizedNode.callee?.type === "Identifier" &&
+      normalizedNode.callee.name === "fetch" &&
+      normalizedNode.arguments?.length
+    ) {
+      return resolveWasmLiteralFromNode(
+        normalizedNode.arguments[0],
+        wasmBufferByVarName,
+      );
+    }
+  }
+  if (normalizedNode?.type === "NewExpression") {
+    if (
+      normalizedNode.callee?.type === "Identifier" &&
+      normalizedNode.callee.name === "URL" &&
+      normalizedNode.arguments?.length
+    ) {
+      const urlLiteral = getStringValue(normalizedNode.arguments[0]);
+      const baseArg = normalizedNode.arguments[1];
+      if (isWasmPath(urlLiteral) && (!baseArg || isImportMetaUrl(baseArg))) {
+        return urlLiteral;
+      }
+    }
+  }
+  return undefined;
+};
+
+const getWasmSourceFromInstantiateCall = (callNode, wasmBufferByVarName) => {
+  if (!callNode?.callee || callNode.callee.type !== "MemberExpression") {
+    return undefined;
+  }
+  const objectNode = callNode.callee.object;
+  const propertyNode = callNode.callee.property;
+  const calleeObjectName = getMemberExpressionPropertyName(objectNode);
+  const calleePropertyName = getMemberExpressionPropertyName(propertyNode);
+  if (calleeObjectName !== "WebAssembly") {
+    return undefined;
+  }
+  if (
+    calleePropertyName !== "instantiate" &&
+    calleePropertyName !== "instantiateStreaming" &&
+    calleePropertyName !== "compile" &&
+    calleePropertyName !== "compileStreaming"
+  ) {
+    return undefined;
+  }
+  if (!callNode.arguments?.length) {
+    return undefined;
+  }
+  return resolveWasmLiteralFromNode(callNode.arguments[0], wasmBufferByVarName);
+};
+
+const getWasmSourceFromCallExpression = (callNode, wasmBufferByVarName) => {
+  const wasmSourceFromInstantiate = getWasmSourceFromInstantiateCall(
+    callNode,
+    wasmBufferByVarName,
+  );
+  if (wasmSourceFromInstantiate) {
+    return wasmSourceFromInstantiate;
+  }
+  if (
+    callNode?.callee?.type === "Identifier" &&
+    ["fetch", "locateFile"].includes(callNode.callee.name) &&
+    callNode.arguments?.length
+  ) {
+    return resolveWasmLiteralFromNode(
+      callNode.arguments[0],
+      wasmBufferByVarName,
+    );
+  }
+  return undefined;
+};
+
+const getNamedImportsFromObjectPattern = (idNode) => {
+  const namedImports = [];
+  if (!idNode || idNode.type !== "ObjectPattern") {
+    return namedImports;
+  }
+  for (const prop of idNode.properties || []) {
+    if (prop.type !== "ObjectProperty") {
+      continue;
+    }
+    const keyName = getMemberExpressionPropertyName(prop.key);
+    if (keyName) {
+      namedImports.push(keyName);
+    }
+  }
+  return namedImports;
+};
+
+const setSyntheticImportRef = (
+  allImports,
+  allExports,
+  src,
+  file,
+  importPath,
+  modules,
+  sourceLoc,
+) => {
+  if (!importPath) {
+    return;
+  }
+  const safeModules = modules || [];
+  const syntheticSpecifiers = safeModules.map((moduleName) => ({
+    imported: { name: moduleName },
+  }));
+  setFileRef(
+    allImports,
+    allExports,
+    src,
+    file,
+    { value: importPath, loc: sourceLoc ? { start: sourceLoc } : undefined },
+    syntheticSpecifiers,
+  );
+};
+
+const setSyntheticExportRef = (
+  allImports,
+  allExports,
+  src,
+  file,
+  importPath,
+  modules,
+  sourceLoc,
+) => {
+  if (!importPath) {
+    return;
+  }
+  const safeModules = modules || [];
+  const syntheticSpecifiers = safeModules.map((moduleName) => ({
+    exported: { name: moduleName },
+  }));
+  setFileRef(
+    allImports,
+    allExports,
+    src,
+    file,
+    { value: importPath, loc: sourceLoc ? { start: sourceLoc } : undefined },
+    syntheticSpecifiers,
+  );
+};
+
+const getWasmExportMemberInfo = (astNode) => {
+  if (!astNode) {
+    return undefined;
+  }
+  if (astNode.type === "AssignmentExpression") {
+    return getWasmExportMemberInfo(astNode.right);
+  }
+  if (
+    astNode.type !== "MemberExpression" ||
+    astNode.object?.type !== "Identifier"
+  ) {
+    return undefined;
+  }
+  return {
+    aliasName: astNode.object.name,
+    exportName: getMemberExpressionPropertyName(astNode.property),
+  };
+};
+
+const getAssignmentTargetName = (astNode) => {
+  if (!astNode) {
+    return undefined;
+  }
+  if (astNode.type === "Identifier") {
+    return astNode.name;
+  }
+  if (
+    astNode.type === "MemberExpression" &&
+    astNode.object?.type === "Identifier" &&
+    astNode.object.name === "Module"
+  ) {
+    return getMemberExpressionPropertyName(astNode.property);
+  }
+  return undefined;
+};
+
 /**
  * Check AST tree for any (j|tsx?) files and set a file
  * references for any import, require or dynamic import files.
  */
 const parseFileASTTree = (src, file, allImports, allExports) => {
   const ast = parse(fileToParseableCode(file), babelParserOptions);
+  const wasmBufferByVarName = new Map();
+  const wasmResultByVarName = new Map();
+  const wasmInstanceByVarName = new Map();
+  const wasiConstructorAliases = new Set(["WASI"]);
+  const wasiNamespaceAliases = new Set();
+  const wasiInstanceAliases = new Set();
+  const wasmPathLiterals = new Set();
+  const wasmExportAliases = new Set(["wasmExports"]);
   traverse.default(ast, {
     ImportDeclaration: (path) => {
       if (path?.node) {
@@ -233,6 +473,20 @@ const parseFileASTTree = (src, file, allImports, allExports) => {
           path.node.source,
           path.node.specifiers,
         );
+        const sourceValue = path.node.source?.value;
+        if (sourceValue === "node:wasi" || sourceValue === "wasi") {
+          for (const specifier of path.node.specifiers || []) {
+            if (
+              specifier.type === "ImportSpecifier" &&
+              specifier.imported?.name === "WASI"
+            ) {
+              wasiConstructorAliases.add(specifier.local?.name || "WASI");
+            }
+            if (specifier.type === "ImportNamespaceSpecifier") {
+              wasiNamespaceAliases.add(specifier.local?.name);
+            }
+          }
+        }
       }
     },
     // For require('') statements
@@ -250,6 +504,355 @@ const parseFileASTTree = (src, file, allImports, allExports) => {
       if (path?.node && path.node.callee.type === "Import") {
         setFileRef(allImports, allExports, src, file, path.node.arguments[0]);
       }
+      const wasmSourceLiteral = getWasmSourceFromCallExpression(
+        path?.node,
+        wasmBufferByVarName,
+      );
+      if (wasmSourceLiteral) {
+        wasmPathLiterals.add(wasmSourceLiteral);
+        setSyntheticImportRef(
+          allImports,
+          allExports,
+          src,
+          file,
+          wasmSourceLiteral,
+          [],
+          path.node.loc?.start,
+        );
+      }
+      if (
+        path?.node?.callee?.type === "MemberExpression" &&
+        path.node.callee.object?.type === "Identifier" &&
+        wasiInstanceAliases.has(path.node.callee.object.name)
+      ) {
+        const methodName = getMemberExpressionPropertyName(
+          path.node.callee.property,
+        );
+        if (methodName === "start" || methodName === "initialize") {
+          setSyntheticImportRef(
+            allImports,
+            allExports,
+            src,
+            file,
+            "node:wasi",
+            [methodName],
+            path.node.loc?.start,
+          );
+        }
+      }
+    },
+    ImportExpression: (path) => {
+      if (path?.node?.source) {
+        setFileRef(allImports, allExports, src, file, path.node.source);
+      }
+    },
+    VariableDeclarator: (path) => {
+      const idNode = path?.node?.id;
+      const initNode = unwrapAwait(path?.node?.init);
+      if (!idNode || !initNode) {
+        return;
+      }
+      if (
+        idNode.type === "Identifier" &&
+        initNode.type === "CallExpression" &&
+        initNode.callee?.type === "MemberExpression"
+      ) {
+        const calleePropertyName = getMemberExpressionPropertyName(
+          initNode.callee.property,
+        );
+        if (
+          calleePropertyName === "readFile" ||
+          calleePropertyName === "readFileSync"
+        ) {
+          const pathArg = initNode.arguments?.[0];
+          const wasmPath = getStringValue(pathArg);
+          if (isWasmPath(wasmPath)) {
+            wasmBufferByVarName.set(idNode.name, wasmPath);
+            wasmPathLiterals.add(wasmPath);
+            setSyntheticImportRef(
+              allImports,
+              allExports,
+              src,
+              file,
+              wasmPath,
+              [],
+              path.node.loc?.start,
+            );
+          }
+        }
+        const wasmSource = getWasmSourceFromInstantiateCall(
+          initNode,
+          wasmBufferByVarName,
+        );
+        if (wasmSource) {
+          wasmResultByVarName.set(idNode.name, wasmSource);
+          wasmPathLiterals.add(wasmSource);
+          setSyntheticImportRef(
+            allImports,
+            allExports,
+            src,
+            file,
+            wasmSource,
+            [],
+            path.node.loc?.start,
+          );
+        }
+        if (
+          initNode.callee?.type === "MemberExpression" &&
+          initNode.callee.object?.type === "Identifier" &&
+          wasiNamespaceAliases.has(initNode.callee.object.name) &&
+          getMemberExpressionPropertyName(initNode.callee.property) === "WASI"
+        ) {
+          wasiInstanceAliases.add(idNode.name);
+          setSyntheticImportRef(
+            allImports,
+            allExports,
+            src,
+            file,
+            "node:wasi",
+            ["WASI"],
+            path.node.loc?.start,
+          );
+        }
+      }
+      if (
+        idNode.type === "Identifier" &&
+        initNode.type === "CallExpression" &&
+        initNode.callee?.type === "Identifier" &&
+        wasiConstructorAliases.has(initNode.callee.name)
+      ) {
+        wasiInstanceAliases.add(idNode.name);
+        setSyntheticImportRef(
+          allImports,
+          allExports,
+          src,
+          file,
+          "node:wasi",
+          ["WASI"],
+          path.node.loc?.start,
+        );
+      }
+      if (idNode.type === "Identifier" && initNode.type === "NewExpression") {
+        if (
+          initNode.callee?.type === "Identifier" &&
+          wasiConstructorAliases.has(initNode.callee.name)
+        ) {
+          wasiInstanceAliases.add(idNode.name);
+          setSyntheticImportRef(
+            allImports,
+            allExports,
+            src,
+            file,
+            "node:wasi",
+            ["WASI"],
+            path.node.loc?.start,
+          );
+        }
+        if (
+          initNode.callee?.type === "MemberExpression" &&
+          initNode.callee.object?.type === "Identifier" &&
+          wasiNamespaceAliases.has(initNode.callee.object.name) &&
+          getMemberExpressionPropertyName(initNode.callee.property) === "WASI"
+        ) {
+          wasiInstanceAliases.add(idNode.name);
+          setSyntheticImportRef(
+            allImports,
+            allExports,
+            src,
+            file,
+            "node:wasi",
+            ["WASI"],
+            path.node.loc?.start,
+          );
+        }
+      }
+      if (idNode.type === "ObjectPattern") {
+        if (initNode.type === "CallExpression") {
+          const wasmSource = getWasmSourceFromInstantiateCall(
+            initNode,
+            wasmBufferByVarName,
+          );
+          if (wasmSource) {
+            wasmPathLiterals.add(wasmSource);
+            for (const prop of idNode.properties || []) {
+              if (
+                prop.type === "ObjectProperty" &&
+                getMemberExpressionPropertyName(prop.key) === "instance" &&
+                prop.value?.type === "Identifier"
+              ) {
+                wasmInstanceByVarName.set(prop.value.name, wasmSource);
+              }
+            }
+            setSyntheticImportRef(
+              allImports,
+              allExports,
+              src,
+              file,
+              wasmSource,
+              [],
+              path.node.loc?.start,
+            );
+          }
+          if (
+            initNode.callee?.type === "Identifier" &&
+            initNode.callee.name === "require"
+          ) {
+            const requiredModule = getStringValue(initNode.arguments?.[0]);
+            if (requiredModule === "node:wasi" || requiredModule === "wasi") {
+              for (const prop of idNode.properties || []) {
+                if (
+                  prop.type === "ObjectProperty" &&
+                  getMemberExpressionPropertyName(prop.key) === "WASI" &&
+                  prop.value?.type === "Identifier"
+                ) {
+                  wasiConstructorAliases.add(prop.value.name);
+                }
+              }
+            }
+          }
+        }
+        if (initNode.type === "MemberExpression") {
+          const exportNames = getNamedImportsFromObjectPattern(idNode);
+          if (!exportNames.length) {
+            return;
+          }
+          if (
+            initNode.object?.type === "MemberExpression" &&
+            initNode.object.object?.type === "Identifier" &&
+            getMemberExpressionPropertyName(initNode.object.property) ===
+              "instance" &&
+            getMemberExpressionPropertyName(initNode.property) === "exports"
+          ) {
+            const wasmSource = wasmResultByVarName.get(
+              initNode.object.object.name,
+            );
+            if (wasmSource) {
+              setSyntheticImportRef(
+                allImports,
+                allExports,
+                src,
+                file,
+                wasmSource,
+                exportNames,
+                path.node.loc?.start,
+              );
+            }
+          }
+          if (
+            initNode.object?.type === "Identifier" &&
+            getMemberExpressionPropertyName(initNode.property) === "exports"
+          ) {
+            const wasmSource = wasmInstanceByVarName.get(initNode.object.name);
+            if (wasmSource) {
+              setSyntheticImportRef(
+                allImports,
+                allExports,
+                src,
+                file,
+                wasmSource,
+                exportNames,
+                path.node.loc?.start,
+              );
+            }
+          }
+        }
+      }
+      if (
+        idNode.type === "Identifier" &&
+        initNode.type === "MemberExpression" &&
+        initNode.object?.type === "Identifier" &&
+        getMemberExpressionPropertyName(initNode.property) === "instance"
+      ) {
+        const wasmSource = wasmResultByVarName.get(initNode.object.name);
+        if (wasmSource) {
+          wasmInstanceByVarName.set(idNode.name, wasmSource);
+        }
+      }
+      if (
+        idNode.type === "Identifier" &&
+        initNode.type === "CallExpression" &&
+        initNode.callee?.type === "MemberExpression" &&
+        initNode.callee.object?.type === "Identifier" &&
+        initNode.callee.object.name === "WebAssembly"
+      ) {
+        const wasmSource = getWasmSourceFromInstantiateCall(
+          initNode,
+          wasmBufferByVarName,
+        );
+        if (wasmSource) {
+          wasmResultByVarName.set(idNode.name, wasmSource);
+          wasmPathLiterals.add(wasmSource);
+        }
+      }
+    },
+    AssignmentExpression: (path) => {
+      const wasmExportMemberInfo = getWasmExportMemberInfo(path?.node?.right);
+      if (!wasmExportMemberInfo?.exportName) {
+        return;
+      }
+      if (!wasmExportAliases.has(wasmExportMemberInfo.aliasName)) {
+        return;
+      }
+      if (!wasmPathLiterals.size) {
+        return;
+      }
+      for (const wasmPath of wasmPathLiterals) {
+        setSyntheticImportRef(
+          allImports,
+          allExports,
+          src,
+          file,
+          wasmPath,
+          [wasmExportMemberInfo.exportName],
+          path.node.loc?.start,
+        );
+      }
+      const targetName = getAssignmentTargetName(path?.node?.left);
+      if (!targetName) {
+        return;
+      }
+      for (const wasmPath of wasmPathLiterals) {
+        setSyntheticExportRef(
+          allImports,
+          allExports,
+          src,
+          file,
+          wasmPath,
+          [targetName],
+          path.node.loc?.start,
+        );
+      }
+    },
+    NewExpression: (path) => {
+      if (path?.node?.callee?.type === "Identifier") {
+        if (wasiConstructorAliases.has(path.node.callee.name)) {
+          setSyntheticImportRef(
+            allImports,
+            allExports,
+            src,
+            file,
+            "node:wasi",
+            ["WASI"],
+            path.node.loc?.start,
+          );
+        }
+      }
+      if (
+        path?.node?.callee?.type === "MemberExpression" &&
+        path.node.callee.object?.type === "Identifier" &&
+        wasiNamespaceAliases.has(path.node.callee.object.name) &&
+        getMemberExpressionPropertyName(path.node.callee.property) === "WASI"
+      ) {
+        setSyntheticImportRef(
+          allImports,
+          allExports,
+          src,
+          file,
+          "node:wasi",
+          ["WASI"],
+          path.node.loc?.start,
+        );
+      }
     },
     // Use for export barrells
     ExportAllDeclaration: (path) => {