@cyclonedx/cdxgen 12.4.1 → 12.4.3

package/lib/helpers/cbomutils.js

@@ -3,6 +3,7 @@ import { join } from "node:path";
 
 import { executeOsQuery } from "../managers/binary.js";
 import { detectJsCryptoInventory } from "./analyzer.js";
+import { analyzeDosaiCrypto } from "./dosai.js";
 import {
   createOccurrenceEvidence,
   formatOccurrenceEvidence,
@@ -239,16 +240,19 @@ function mergeAlgorithmComponentUsage(component, usage, src, options) {
     }
   }
   if (usage.source) {
+    const sourceType =
+      usage.source === "dosai" ? undefined : `js-ast:${usage.source}`;
     if (
+      sourceType &&
       !properties.some(
         (property) =>
           property.name === "cdx:crypto:sourceType" &&
-          property.value === `js-ast:${usage.source}`,
+          property.value === sourceType,
       )
     ) {
       properties.push({
         name: "cdx:crypto:sourceType",
-        value: `js-ast:${usage.source}`,
+        value: sourceType,
       });
     }
   }
@@ -271,6 +275,93 @@ function mergeAlgorithmComponentUsage(component, usage, src, options) {
   return component;
 }
 
+function normalizeDosaiCryptoNames(cryptoObject) {
+  const rawName = cryptoObject?.Name || cryptoObject;
+  const names = new Set([rawName]);
+  const cleanName = String(rawName || "").trim();
+  if (!cleanName) {
+    return [];
+  }
+  if (cleanName.includes("/")) {
+    for (const part of cleanName
+      .split("/")
+      .map((candidate) => candidate.trim())
+      .filter(Boolean)) {
+      names.add(part);
+    }
+  }
+  if (/^SHA-?256$/i.test(cleanName)) {
+    names.add("sha-256");
+  } else if (/^SHA-?384$/i.test(cleanName)) {
+    names.add("sha-384");
+  } else if (/^SHA-?512$/i.test(cleanName)) {
+    names.add("sha-512");
+  } else if (/^SHA-?1$/i.test(cleanName)) {
+    names.add("sha-1");
+  }
+  const context = [
+    cryptoObject?.Symbol,
+    cryptoObject?.Code,
+    cryptoObject?.Algorithm,
+  ]
+    .filter(Boolean)
+    .join(" ");
+  if (/^SHA-?2$/i.test(cleanName)) {
+    if (/SHA-?256/i.test(context)) {
+      names.add("sha-256");
+    }
+    if (/SHA-?384/i.test(context)) {
+      names.add("sha-384");
+    }
+    if (/SHA-?512/i.test(context)) {
+      names.add("sha-512");
+    }
+  }
+  return Array.from(names);
+}
+
+function dosaiCryptoUsage(assetOrOperation) {
+  const location = assetOrOperation.Location || {};
+  return {
+    fileName: location.Path || location.FileName,
+    lineNumber: location.LineNumber || undefined,
+    columnNumber: location.ColumnNumber || undefined,
+    primitive: assetOrOperation.Family || assetOrOperation.OperationType,
+    source: "dosai",
+  };
+}
+
+function addDosaiProperties(component, dosaiObject, evidenceType) {
+  const properties = component.properties || [];
+  const addProperty = (name, value) => {
+    if (value === undefined || value === null || value === "") {
+      return;
+    }
+    if (
+      !properties.some(
+        (property) =>
+          property.name === name && property.value === String(value),
+      )
+    ) {
+      properties.push({ name, value: String(value) });
+    }
+  };
+  addProperty("cdx:crypto:sourceType", `dosai:${evidenceType}`);
+  addProperty("cdx:dosai:crypto:id", dosaiObject.Id);
+  addProperty("cdx:dosai:crypto:strength", dosaiObject.Strength);
+  addProperty(
+    "cdx:dosai:crypto:reachableFromEntryPoint",
+    dosaiObject.ReachableFromEntryPoint,
+  );
+  if (dosaiObject.EntryPointIds?.length) {
+    addProperty(
+      "cdx:dosai:crypto:entryPointCount",
+      dosaiObject.EntryPointIds.length,
+    );
+  }
+  component.properties = properties;
+}
+
 export async function collectSourceCryptoComponents(src, options = {}) {
   const inventory = await detectJsCryptoInventory(src, Boolean(options.deep));
   const componentsByRef = new Map();
@@ -317,6 +408,75 @@ export async function collectSourceCryptoComponents(src, options = {}) {
   );
 }
 
+export async function collectDosaiCryptoComponents(src, options = {}) {
+  const dosaiCrypto = analyzeDosaiCrypto(src, options);
+  if (!dosaiCrypto) {
+    return [];
+  }
+  const componentsByRef = new Map();
+  const cryptoObjects = [
+    ...(dosaiCrypto.Assets || []).filter(
+      (asset) => asset.AssetType === "algorithm",
+    ),
+    ...(dosaiCrypto.Operations || []).map((operation) => ({
+      ...operation,
+      Name: operation.Algorithm,
+      Family: operation.OperationType,
+    })),
+  ];
+  for (const cryptoObject of cryptoObjects) {
+    for (const candidateName of normalizeDosaiCryptoNames(cryptoObject)) {
+      const normalizedName = normalizeDetectedCryptoAlgorithmName(
+        candidateName,
+        "algorithm",
+      );
+      const algorithmMetadata =
+        cbomCryptoOids[normalizedName] || cbomCryptoOids[candidateName];
+      if (!algorithmMetadata?.oid) {
+        continue;
+      }
+      const bomRef = cryptoAlgorithmBomRef(
+        normalizedName,
+        algorithmMetadata.oid,
+      );
+      const component = componentsByRef.get(bomRef) || {
+        type: "cryptographic-asset",
+        name: normalizedName,
+        "bom-ref": bomRef,
+        description:
+          algorithmMetadata.description ||
+          "Cryptographic algorithm detected by dosai source analysis",
+        cryptoProperties: {
+          assetType: "algorithm",
+          oid: algorithmMetadata.oid,
+        },
+        properties: [],
+      };
+      mergeAlgorithmComponentUsage(
+        component,
+        dosaiCryptoUsage(cryptoObject),
+        src,
+        options,
+      );
+      addDosaiProperties(
+        component,
+        cryptoObject,
+        cryptoObject.OperationType ? "operation" : "asset",
+      );
+      componentsByRef.set(bomRef, component);
+    }
+  }
+  const components = Array.from(componentsByRef.values());
+  components.forEach((component) => {
+    normalizeCryptoComponentEvidence(component, options);
+  });
+  return components.sort((left, right) =>
+    `${left.name}:${left["bom-ref"]}`.localeCompare(
+      `${right.name}:${right["bom-ref"]}`,
+    ),
+  );
+}
+
 /**
  * Find crypto algorithm in the given code snippet
  *

package/lib/helpers/cbomutils.poku.js

@@ -2,6 +2,7 @@ import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 
+import esmock from "esmock";
 import { assert, describe, it } from "poku";
 
 import {
@@ -248,4 +249,103 @@ describe("cbom utils", () => {
       rmSync(projectDir, { recursive: true, force: true });
     }
   });
+
+  it("collectDosaiCryptoComponents() maps dosai algorithms to CBOM components with OIDs", async () => {
+    const { collectDosaiCryptoComponents } = await esmock("./cbomutils.js", {
+      "./dosai.js": {
+        analyzeDosaiCrypto: () => ({
+          Assets: [
+            {
+              Id: "cas1",
+              AssetType: "algorithm",
+              Name: "SHA-256",
+              Family: "hash",
+              Strength: "strong",
+              Location: {
+                Path: "Program.cs",
+                FileName: "Program.cs",
+                LineNumber: 12,
+                ColumnNumber: 9,
+              },
+              ReachableFromEntryPoint: true,
+              EntryPointIds: ["ep1"],
+            },
+            {
+              Id: "cas2",
+              AssetType: "algorithm",
+              Name: "UnknownCipher",
+              Location: {
+                Path: "Program.cs",
+                FileName: "Program.cs",
+                LineNumber: 20,
+                ColumnNumber: 9,
+              },
+            },
+          ],
+          Operations: [
+            {
+              Id: "cop1",
+              OperationType: "hash",
+              Algorithm: "SHA-256",
+              Location: {
+                Path: "Program.cs",
+                FileName: "Program.cs",
+                LineNumber: 12,
+                ColumnNumber: 9,
+              },
+            },
+            {
+              Id: "cop2",
+              OperationType: "use",
+              Algorithm: "SHA-2",
+              Symbol: "SHA256.HashData",
+              Location: {
+                Path: "Program.vb",
+                FileName: "Program.vb",
+                LineNumber: 42,
+                ColumnNumber: 22,
+              },
+            },
+          ],
+        }),
+      },
+    });
+
+    const components = await collectDosaiCryptoComponents("/tmp/project", {
+      evidence: true,
+      specVersion: 1.7,
+    });
+
+    assert.strictEqual(components.length, 1);
+    assert.strictEqual(components[0].name, "sha-256");
+    assert.strictEqual(components[0].type, "cryptographic-asset");
+    assert.strictEqual(components[0].cryptoProperties.assetType, "algorithm");
+    assert.ok(components[0].cryptoProperties.oid);
+    assert.ok(
+      components[0].properties.some(
+        (property) =>
+          property.name === "cdx:crypto:sourceType" &&
+          property.value === "dosai:operation",
+      ),
+    );
+    assert.ok(
+      !components[0].properties.some(
+        (property) =>
+          property.name === "cdx:crypto:sourceType" &&
+          ["dosai", "js-ast:dosai"].includes(property.value),
+      ),
+    );
+    assert.ok(
+      components[0].evidence.occurrences.some(
+        (occurrence) =>
+          occurrence.location === "Program.cs" && occurrence.line === 12,
+      ),
+    );
+    assert.ok(
+      components[0].evidence.occurrences.some(
+        (occurrence) =>
+          occurrence.location === "Program.vb" && occurrence.line === 42,
+      ),
+    );
+  });
 });

package/lib/helpers/ciParsers/githubActions.js

@@ -342,9 +342,21 @@ function normalizeRunnerLabels(runsOn) {
       .map((label) => label.trim())
       .filter(Boolean);
   }
+  if (typeof runsOn === "object") {
+    return normalizeRunnerLabels(runsOn.labels);
+  }
   return [];
 }
 
+function normalizeRunnerValue(runsOn) {
+  const labels = normalizeRunnerLabels(runsOn);
+  if (runsOn && typeof runsOn === "object" && !Array.isArray(runsOn)) {
+    const group = runsOn.group ? String(runsOn.group).trim() : "";
+    return [group, ...labels].filter(Boolean).join(",") || "unknown";
+  }
+  return labels.join(",") || "unknown";
+}
+
 function isSelfHostedRunner(runsOn) {
   return normalizeRunnerLabels(runsOn).some((label) =>
     label.toLowerCase().includes("self-hosted"),
@@ -1761,7 +1773,7 @@ function buildReusableWorkflowComponent(
     { name: "cdx:github:job:name", value: jobName },
     {
       name: "cdx:github:job:runner",
-      value: Array.isArray(jobRunner) ? jobRunner.join(",") : jobRunner,
+      value: normalizeRunnerValue(jobRunner),
     },
     { name: "cdx:github:reusableWorkflow:uses", value: uses },
     {
@@ -1951,7 +1963,7 @@ export function parseWorkflowFile(f, options) {
       { name: "cdx:github:job:name", value: jobName },
       {
         name: "cdx:github:job:runner",
-        value: Array.isArray(jobRunner) ? jobRunner.join(",") : jobRunner,
+        value: normalizeRunnerValue(jobRunner),
       },
     ];
     if (jobEnvironment) {
@@ -2042,7 +2054,7 @@ export function parseWorkflowFile(f, options) {
             { name: "cdx:github:job:name", value: jobName },
             {
               name: "cdx:github:job:runner",
-              value: Array.isArray(jobRunner) ? jobRunner.join(",") : jobRunner,
+              value: normalizeRunnerValue(jobRunner),
             },
             { name: "cdx:github:action:uses", value: step.uses },
             {

package/lib/helpers/ciParsers/githubActions.poku.js

@@ -180,6 +180,58 @@ describe("githubActionsParser", () => {
     }
   });
 
+  it("normalizes object-form runs-on values", () => {
+    const tmpDir = mkdtempSync(path.join(os.tmpdir(), "cdxgen-gha-"));
+    const workflowFile = path.join(tmpDir, "object-runs-on.yml");
+    writeFileSync(
+      workflowFile,
+      [
+        "name: Object runs-on",
+        "on: push",
+        "jobs:",
+        "  grouped:",
+        "    runs-on:",
+        "      group: ubuntu-runners",
+        "      labels: ubuntu-20.04-16core",
+        "    steps:",
+        "      - uses: actions/checkout@v4",
+        "  selfHosted:",
+        "    runs-on:",
+        "      group: larger-runners",
+        "      labels: [self-hosted, linux, x64]",
+        "    steps:",
+        '      - run: echo "ok"',
+      ].join("\n"),
+    );
+
+    try {
+      const result = parseWorkflowFile(workflowFile, { specVersion: 1.7 });
+      const actionComp = result.components.find(
+        (component) =>
+          getProp(component, "cdx:github:action:uses") ===
+          "actions/checkout@v4",
+      );
+      assert.strictEqual(
+        getProp(actionComp, "cdx:github:job:runner"),
+        "ubuntu-runners,ubuntu-20.04-16core",
+      );
+
+      const selfHostedTask = result.workflows[0].tasks.find(
+        (task) => task.name === "selfHosted",
+      );
+      assert.strictEqual(
+        getProp(selfHostedTask, "cdx:github:job:runner"),
+        "larger-runners,self-hosted,linux,x64",
+      );
+      assert.strictEqual(
+        getProp(selfHostedTask, "cdx:github:job:isSelfHosted"),
+        "true",
+      );
+    } finally {
+      rmSync(tmpDir, { force: true, recursive: true });
+    }
+  });
+
   it("derives unnamed workflow names from the file stem without leaking Windows-style path segments", () => {
     const tmpDir = mkdtempSync(path.join(os.tmpdir(), "cdxgen-gha-"));
     const workflowFile = path.join(tmpDir, "nested\\workflow-file.yml");

package/lib/helpers/display.js

@@ -42,6 +42,7 @@ const MULTIVALUE_ACTIVITY_TARGET_KEYS = new Set([
   "SrcFiles",
 ]);
 const PATH_SEPARATOR_REGEX = /[\\/]+/;
+const SUSPICIOUS_SHELL_PATH_LABEL = "⚠ shell-metacharacters";
 const ENV_AUDIT_SEVERITY_RANK = {
   low: 1,
   medium: 2,
@@ -1220,16 +1221,21 @@ export function printActivitySummary(reportType = undefined) {
     }
     return;
   }
-  const formatActivityTarget = (target) => {
+  const formatActivityTarget = (activity) => {
+    const target = activity?.target;
+    const suspiciousPrefix =
+      activity?.risk === "shell-metacharacters"
+        ? `${SUSPICIOUS_SHELL_PATH_LABEL}\n`
+        : "";
     if (typeof target !== "string" || !target.includes(",")) {
-      return target || "";
+      return `${suspiciousPrefix}${target || ""}`;
     }
     const targetEntries = splitCommaSeparatedActivityEntries(target);
     if (isLikelyActivityPathList(targetEntries)) {
-      return sortActivityTargetEntries(targetEntries).join("\n");
+      return `${suspiciousPrefix}${sortActivityTargetEntries(targetEntries).join("\n")}`;
     }
     if (!(target.includes(":") || target.includes("="))) {
-      return target || "";
+      return `${suspiciousPrefix}${target || ""}`;
     }
     const targetSegments = target.split(/,\s*(?=[A-Za-z][\w-]*\s*[:=])/);
     let didFormat = false;
@@ -1249,7 +1255,7 @@ export function printActivitySummary(reportType = undefined) {
         .map((entry) => `- ${entry}`)
         .join("\n")}`;
     });
-    return didFormat ? renderedSegments.join("\n") : target;
+    return `${suspiciousPrefix}${didFormat ? renderedSegments.join("\n") : target}`;
   };
   const formatActivityType = (type) => {
     if (typeof type !== "string" || !type.includes(",")) {
@@ -1275,7 +1281,7 @@ export function printActivitySummary(reportType = undefined) {
       formatActivityType(activity.projectType),
       activity.packageType || "",
       activity.kind || "",
-      formatActivityTarget(activity.target),
+      formatActivityTarget(activity),
       activity.reason
         ? `${formatStatus(activity.status)}\n${activity.reason}`.trim()
         : formatStatus(activity.status),

package/lib/helpers/display.poku.js

@@ -481,6 +481,44 @@ it("renders plain comma-separated activity paths one per line sorted by depth",
   }
 });
 
+it("highlights suspicious shell-metacharacter paths in the activity summary", async () => {
+  const tableStub = sinon.stub().returns("activity-table");
+  const shellIfs = "$" + "{IFS}";
+  try {
+    const { printActivitySummary: printActivitySummaryMocked } = await esmock(
+      "./display.js",
+      {
+        "./table.js": {
+          createStream: sinon.stub(),
+          table: tableStub,
+        },
+        "./utils.js": {
+          getRecordedActivities: sinon.stub().returns([
+            {
+              identifier: "ACT-0005",
+              kind: "inspect",
+              reason: "Suspicious path contains shell metacharacters.",
+              risk: "shell-metacharacters",
+              status: "completed",
+              target: `/tmp/repo/evil;cd${shellIfs}..;printf${shellIfs}marker>CDXGEN_GITURL_E2E_MARKER;#/pom.xml`,
+            },
+          ]),
+          isDryRun: true,
+          isSecureMode: false,
+          safeExistsSync: sinon.stub(),
+          toCamel: sinon.stub(),
+        },
+      },
+    );
+    printActivitySummaryMocked();
+    const [data] = tableStub.firstCall.args;
+    assert.ok(data[1][4].startsWith("⚠ shell-metacharacters\n"));
+    assert.ok(data[1][4].includes(`evil;cd${shellIfs}..`));
+  } finally {
+    sinon.restore();
+  }
+});
+
 it("prints grouped environment audit findings in a secure-mode panel", async () => {
   const tableStub = sinon.stub().returns("env-audit-table");
   try {