@cyclonedx/cdxgen 12.3.3 → 12.4.1

package/lib/evinser/evinser.js

@@ -5,6 +5,7 @@ import process from "node:process";
 import { PackageURL } from "packageurl-js";
 
 import { findCryptoAlgos } from "../helpers/cbomutils.js";
+import { parseOccurrenceEvidenceLocation } from "../helpers/evidenceUtils.js";
 import {
   collectGradleDependencies,
   collectMvnDependencies,
@@ -238,12 +239,15 @@ export async function createSlice(
   }
 
   let sliceOutputDir = safeMkdtempSync(join(getTmpDir(), `atom-${sliceType}-`));
+  let tempDirOwned = true;
   if (options?.output) {
+    const resolvedOutputPath = resolve(options.output);
     sliceOutputDir =
-      safeExistsSync(options.output) &&
-      fs.lstatSync(options.output).isDirectory()
-        ? path.basename(options.output)
-        : path.dirname(options.output);
+      safeExistsSync(resolvedOutputPath) &&
+      fs.lstatSync(resolvedOutputPath).isDirectory()
+        ? resolvedOutputPath
+        : path.dirname(resolvedOutputPath);
+    tempDirOwned = false;
   }
   const slicesFile =
     options[`${sliceType}SlicesFile`] ||
@@ -264,7 +268,7 @@ export async function createSlice(
         JSON.stringify(slicesData, null, options.jsonPretty ? 2 : null),
       );
     }
-    return { tempDir: sliceOutputDir, slicesFile };
+    return { tempDir: sliceOutputDir, tempDirOwned, slicesFile };
   }
   console.log(
     `Creating ${sliceType} slice for ${resolve(filePath)}. Please wait ...`,
@@ -362,6 +366,7 @@ export async function createSlice(
   }
   return {
     tempDir: sliceOutputDir,
+    tempDirOwned,
     slicesFile,
     atomFile,
     openapiSpecFile: resolve(join(filePath, openapiSpecFile)),
@@ -609,6 +614,7 @@ export async function analyzeProject(dbObjMap, options) {
     servicesMap,
     dataFlowFrames,
     tempDir: retMap?.tempDir,
+    tempDirOwned: retMap?.tempDirOwned,
     userDefinedTypesMap,
     cryptoComponents,
     cryptoGeneratePurls,
@@ -1396,6 +1402,7 @@ export function extractEndpoints(language, code) {
 export function createEvinseFile(sliceArtefacts, options) {
   const {
     tempDir,
+    tempDirOwned,
     usagesSlicesFile,
     dataFlowSlicesFile,
     reachablesSlicesFile,
@@ -1430,9 +1437,7 @@ export function createEvinseFile(sliceArtefacts, options) {
       // This is fine as long as the input sbom was also generated by cdxgen
       comp.evidence.occurrences = locationOccurrences
         .filter((l) => !!l)
-        .map((l) => ({
-          location: l,
-        }));
+        .map((l) => parseOccurrenceEvidenceLocation(l));
       occEvidencePresent = true;
     }
     const dfFrames = dataFlowFrames[comp.purl];
@@ -1557,7 +1562,7 @@ export function createEvinseFile(sliceArtefacts, options) {
       );
     }
   }
-  if (tempDir?.startsWith(getTmpDir())) {
+  if (tempDirOwned && tempDir?.startsWith(getTmpDir())) {
     safeRmSync(tempDir, { recursive: true, force: true });
   }
   return bomNSData?.bomJson;