@cyclonedx/cdxgen 12.3.1 → 12.3.3

package/lib/server/server.js

@@ -76,23 +76,26 @@ const ALLOWED_PARAMS = [
 
 const app = connect();
 
-function isAllowedHttpHost(hostname) {
+export function isAllowedHttpHost(hostname) {
   if (!process.env.CDXGEN_ALLOWED_HOSTS) {
     return true;
   }
   if (!hostname || hasDangerousUnicode(hostname)) {
     return false;
   }
+  const normalizedHostname = hostname.toLowerCase();
   const allowHosts = process.env.CDXGEN_ALLOWED_HOSTS.split(",")
     .map((host) => host.trim())
     .filter(Boolean);
   for (const allowedHost of allowHosts) {
-    if (hostname === allowedHost) {
+    const normalizedAllowedHost = allowedHost.toLowerCase();
+    if (normalizedHostname === normalizedAllowedHost) {
       return true;
     }
     if (
-      allowedHost.startsWith("*.") &&
-      hostname.endsWith(allowedHost.slice(1))
+      normalizedAllowedHost.startsWith("*.") &&
+      normalizedHostname.length > normalizedAllowedHost.length - 1 &&
+      normalizedHostname.endsWith(`.${normalizedAllowedHost.slice(2)}`)
     ) {
       return true;
     }

package/lib/server/server.poku.js

@@ -12,7 +12,12 @@ import {
   validateAndRejectGitSource,
 } from "../helpers/source.js";
 import { isWin } from "../helpers/utils.js";
-import { getQueryParams, parseQueryString, parseValue } from "./server.js";
+import {
+  getQueryParams,
+  isAllowedHttpHost,
+  parseQueryString,
+  parseValue,
+} from "./server.js";
 
 function nullProtoObj(obj) {
   if (obj === null || typeof obj !== "object") {
@@ -171,6 +176,36 @@ describe("isAllowedHost()", () => {
   });
 });
 
+describe("isAllowedHttpHost()", () => {
+  let originalAllowedHosts;
+
+  beforeEach(() => {
+    originalAllowedHosts = process.env.CDXGEN_ALLOWED_HOSTS;
+  });
+
+  afterEach(() => {
+    if (originalAllowedHosts === undefined) {
+      delete process.env.CDXGEN_ALLOWED_HOSTS;
+    } else {
+      process.env.CDXGEN_ALLOWED_HOSTS = originalAllowedHosts;
+    }
+  });
+
+  it("allows exact host matches", () => {
+    process.env.CDXGEN_ALLOWED_HOSTS = "dependencytrack.example.com";
+    assert.strictEqual(isAllowedHttpHost("dependencytrack.example.com"), true);
+    assert.strictEqual(isAllowedHttpHost("other.example.com"), false);
+  });
+
+  it("allows only real subdomains for wildcard entries", () => {
+    process.env.CDXGEN_ALLOWED_HOSTS = "*.example.com";
+    assert.strictEqual(isAllowedHttpHost("api.example.com"), true);
+    assert.strictEqual(isAllowedHttpHost("deep.api.example.com"), true);
+    assert.strictEqual(isAllowedHttpHost("example.com"), false);
+    assert.strictEqual(isAllowedHttpHost("evil-example.com"), false);
+  });
+});
+
 describe("isAllowedPath()", () => {
   let originalPaths;
 

package/lib/stages/postgen/annotator.js

@@ -285,7 +285,8 @@ export function textualMetadata(bomJson) {
   const { bomType, bomTypeDescription } = findBomType(bomJson);
   const metadata = bomJson.metadata;
   const lifecycles = metadata?.lifecycles || [];
-  const tlpClassification = metadata.distribution;
+  const tlpClassification =
+    metadata.distributionConstraints?.tlp || metadata.distribution;
   const cryptoAssetsCount = bomJson?.components?.filter(
     (c) => c.type === "cryptographic-asset",
   ).length;

package/lib/stages/postgen/annotator.poku.js

@@ -311,3 +311,18 @@ it("extractTags tests", () => {
     "security",
   ]);
 });
+
+it("textualMetadata includes the CycloneDX 1.7 TLP classification from distributionConstraints", () => {
+  assert.match(
+    textualMetadata({
+      bomFormat: "CycloneDX",
+      specVersion: "1.7",
+      metadata: {
+        distributionConstraints: {
+          tlp: "AMBER_AND_STRICT",
+        },
+      },
+    }),
+    /TLP\) classification for this document is 'AMBER_AND_STRICT'/,
+  );
+});

package/lib/stages/postgen/auditBom.js

@@ -6,6 +6,10 @@ import { join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 
 import { buildAnnotationText } from "../../helpers/annotationFormatter.js";
+import {
+  expandBomAuditCategories,
+  validateBomAuditCategories,
+} from "../../helpers/auditCategories.js";
 import { table } from "../../helpers/table.js";
 import {
   DEBUG_MODE,
@@ -45,15 +49,17 @@ export async function auditBom(bomJson, options) {
   }
   let activeRules = rules;
   if (options.bomAuditCategories) {
-    const categories = options.bomAuditCategories
-      .split(",")
-      .map((c) => c.trim())
-      .filter(Boolean);
+    const { categories, expandedCategories } = validateBomAuditCategories(
+      options.bomAuditCategories,
+      rules,
+    );
     if (categories.length > 0) {
-      activeRules = rules.filter((r) => categories.includes(r.category));
+      activeRules = rules.filter((r) =>
+        expandedCategories.includes(r.category),
+      );
       if (DEBUG_MODE) {
         console.log(
-          `Filtering rules by categories: ${categories.join(", ")} (${activeRules.length} active)`,
+          `Filtering rules by categories: ${categories.join(", ")} -> ${expandBomAuditCategories(categories).join(", ")} (${activeRules.length} active)`,
         );
       }
     }