@cyclonedx/cdxgen 8.0.0 → 8.0.2

package/README.md

@@ -2,7 +2,7 @@
 
 ![cdxgen logo](cdxgen.png)
 
-This tool creates a valid and compliant CycloneDX Software Bill-of-Materials (SBOM) containing an aggregate of all project dependencies for c/c++, node.js, php, python, ruby, rust, java, .Net, dart, haskell, elixir, and Go projects in XML and JSON format. CycloneDX 1.4 is a lightweight SBOM specification that is easily created, human and machine-readable, and simple to parse.
+This tool creates a valid and compliant [CycloneDX][cyclonedx-homepage] Software Bill-of-Materials (SBOM) containing an aggregate of all project dependencies for c/c++, node.js, php, python, ruby, rust, java, .Net, dart, haskell, elixir, and Go projects in XML and JSON format. CycloneDX 1.4 is a lightweight SBOM specification that is easily created, human and machine-readable, and simple to parse.
 
 When used with plugins, cdxgen could generate an SBoM for Linux docker images and even VMs running Linux or Windows operating system.
 
@@ -352,3 +352,6 @@ Permission to modify and redistribute is granted under the terms of the Apache 2
 ## Discord support
 
 The developers could be reached via the [discord](https://discord.gg/DCNxzaeUpd) channel.
+
+
+[cyclonedx-homepage]: https://cyclonedx.org

package/index.js

@@ -3079,6 +3079,9 @@ const createPHPBom = async (path, options) => {
   const composerLockMode = composerLockFiles.length;
   // Create a composer.lock file for each composer.json file if needed.
   if (!composerLockMode && composerJsonMode && options.installDeps) {
+    if (DEBUG_MODE) {
+      console.log("About to invoke composer --version");
+    }
     const versionResult = spawnSync("composer", ["--version"], {
       encoding: "utf-8"
     });
@@ -3086,18 +3089,26 @@ const createPHPBom = async (path, options) => {
       console.error(
         "No composer version found. Check if composer is installed and available in PATH."
       );
-      console.log(versionResult.error, versionResult.stderr);
+      if (DEBUG_MODE) {
+        console.log(versionResult.error, versionResult.stderr);
+      }
       options.failOnError && process.exit(1);
-      return {};
     }
-    const composerVersion = versionResult.stdout.match(/version (\d)/)[1];
+    let composerVersion = undefined;
     if (DEBUG_MODE) {
-      console.log("Detected composer version:", composerVersion);
+      console.log("Parsing version", versionResult.stdout);
+    }
+    let tmpV = undefined;
+    if (versionResult && versionResult.stdout) {
+      versionResult.stdout.split(" ");
+    }
+    if (tmpV && tmpV.length > 1) {
+      composerVersion = tmpV[1];
     }
     for (let f of composerJsonFiles) {
       const basePath = pathLib.dirname(f);
       let args = [];
-      if (composerVersion > 1) {
+      if (composerVersion && !composerVersion.startsWith("1")) {
         console.log("Generating composer.lock in", basePath);
         args = ["update", "--no-install", "--ignore-platform-reqs"];
       } else {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cyclonedx/cdxgen",
-  "version": "8.0.0",
+  "version": "8.0.2",
   "description": "Creates CycloneDX Software Bill-of-Materials (SBOM) from source or container image",
   "homepage": "http://github.com/cyclonedx/cdxgen",
   "author": "Prabhu Subramanian <prabhu@appthreat.com>",

package/utils.js

@@ -3616,6 +3616,10 @@ const parseComposerLock = function (pkgLockFile) {
       for (let compScope in packages) {
         for (let i in packages[compScope]) {
           const pkg = packages[compScope][i];
+          // Be extra cautious. Potential fix for #236
+          if (!pkg || !pkg.name || !pkg.version) {
+            continue;
+          }
           let group = path.dirname(pkg.name);
           if (group === ".") {
             group = "";

package/utils.test.js

@@ -1285,6 +1285,23 @@ test("parseComposerLock", () => {
       }
     ]
   });
+
+  deps = utils.parseComposerLock("./test/data/composer-3.lock");
+  expect(deps.length).toEqual(62);
+  expect(deps[0]).toEqual({
+    group: "amphp",
+    name: "amp",
+    version: "2.6.2",
+    repository: {
+      type: "git",
+      url: "https://github.com/amphp/amp.git",
+      reference: "9d5100cebffa729aaffecd3ad25dc5aeea4f13bb"
+    },
+    license: ["MIT"],
+    description: "A non-blocking concurrency framework for PHP applications.",
+    scope: "required",
+    properties: [{ name: "SrcFile", value: "./test/data/composer-3.lock" }]
+  });
 });
 
 test("parseGemfileLockData", async () => {