@cyclonedx/cdxgen 8.0.0

package/analyzer.js

@@ -0,0 +1,189 @@
+const babelParser = require("@babel/parser");
+const babelTraverse = require("@babel/traverse").default;
+const { join } = require("path");
+const fs = require("fs");
+const path = require("path");
+
+const IGNORE_DIRS = [
+  "node_modules",
+  "venv",
+  "docs",
+  "test",
+  "tests",
+  "e2e",
+  "examples",
+  "cypress",
+  "site-packages"
+];
+
+const IGNORE_FILE_PATTERN = new RegExp("(conf|test|spec|mock)\\.(js|ts)$", "i");
+
+const getAllFiles = (dir, extn, files, result, regex) => {
+  files = files || fs.readdirSync(dir);
+  result = result || [];
+  regex = regex || new RegExp(`\\${extn}$`);
+
+  for (let i = 0; i < files.length; i++) {
+    if (IGNORE_FILE_PATTERN.test(files[i])) {
+      continue;
+    }
+    let file = join(dir, files[i]);
+    if (fs.statSync(file).isDirectory()) {
+      // Ignore directories
+      const dirName = path.basename(file);
+      if (
+        dirName.startsWith(".") ||
+        IGNORE_DIRS.includes(dirName.toLowerCase())
+      ) {
+        continue;
+      }
+      try {
+        result = getAllFiles(file, extn, fs.readdirSync(file), result, regex);
+      } catch (error) {
+        continue;
+      }
+    } else {
+      if (regex.test(file)) {
+        result.push(file);
+      }
+    }
+  }
+  return result;
+};
+
+const babelParserOptions = {
+  sourceType: "unambiguous",
+  allowImportExportEverywhere: true,
+  allowAwaitOutsideFunction: true,
+  allowReturnOutsideFunction: true,
+  allowSuperOutsideMethod: true,
+  errorRecovery: true,
+  allowUndeclaredExports: true,
+  attachComment: false,
+  plugins: [
+    "optionalChaining",
+    "classProperties",
+    "decorators-legacy",
+    "exportDefaultFrom",
+    "doExpressions",
+    "numericSeparator",
+    "dynamicImport",
+    "jsx",
+    "typescript"
+  ]
+};
+
+/**
+ * Filter only references to (t|jsx?) or (less|scss) files for now.
+ * Opt to use our relative paths.
+ */
+const setFileRef = (allImports, file, pathway) => {
+  // remove unexpected extension imports
+  if (/\.(svg|png|jpg|d\.ts)/.test(pathway)) {
+    return;
+  }
+
+  // replace relative imports with full path
+  let module = pathway;
+  if (/\.\//g.test(pathway) || /\.\.\//g.test(pathway)) {
+    module = path.resolve(file, "..", pathway);
+  }
+
+  // initialise or increase reference count for file
+  if (allImports.hasOwnProperty(module)) {
+    allImports[module] = allImports[module] + 1;
+  } else {
+    allImports[module] = 1;
+  }
+
+  // Handle module package name
+  // Eg: zone.js/dist/zone will be referred to as zone.js in package.json
+  if (!path.isAbsolute(module) && module.includes("/")) {
+    const modPkg = module.split("/")[0];
+    if (allImports.hasOwnProperty(modPkg)) {
+      allImports[modPkg] = allImports[modPkg] + 1;
+    } else {
+      allImports[modPkg] = 1;
+    }
+  }
+};
+
+/**
+ * Check AST tree for any (j|tsx?) files and set a file
+ * references for any import, require or dynamic import files.
+ */
+const parseFileASTTree = (file, allImports) => {
+  const ast = babelParser.parse(
+    fs.readFileSync(file, "utf-8"),
+    babelParserOptions
+  );
+  babelTraverse(ast, {
+    // Used for all ES6 import statements
+    ImportDeclaration: (path) => {
+      if (path && path.node) {
+        setFileRef(allImports, file, path.node.source.value);
+      }
+    },
+    // For require('') statements
+    Identifier: (path) => {
+      if (
+        path &&
+        path.node &&
+        path.node.name === "require" &&
+        path.parent.type === "CallExpression"
+      ) {
+        setFileRef(allImports, file, path.parent.arguments[0].value);
+      }
+    },
+    // Use for dynamic imports like routes.jsx
+    CallExpression: (path) => {
+      if (path && path.node && path.node.callee.type === "Import") {
+        setFileRef(allImports, file, path.node.arguments[0].value);
+      }
+    },
+    // Use for export barrells
+    ExportAllDeclaration: (path) => {
+      setFileRef(allImports, file, path.node.source.value);
+    },
+    ExportNamedDeclaration: (path) => {
+      // ensure there is a path export
+      if (path && path.node && path.node.source) {
+        setFileRef(allImports, file, path.node.source.value);
+      }
+    }
+  });
+};
+
+/**
+ * Return paths to all (j|tsx?) files.
+ */
+const getAllSrcJSAndTSFiles = (src) =>
+  Promise.all([
+    getAllFiles(src, ".js"),
+    getAllFiles(src, ".jsx"),
+    getAllFiles(src, ".ts"),
+    getAllFiles(src, ".tsx")
+  ]);
+
+/**
+ * Where Node CLI runs from.
+ */
+const findJSImports = async (src) => {
+  const allImports = {};
+  const errFiles = [];
+  try {
+    const promiseMap = await getAllSrcJSAndTSFiles(src);
+    const srcFiles = promiseMap.flatMap((d) => d);
+    for (const file of srcFiles) {
+      try {
+        parseFileASTTree(file, allImports);
+      } catch (err) {
+        errFiles.push(file);
+      }
+    }
+    return allImports;
+  } catch (err) {
+    return allImports;
+  }
+};
+exports.findJSImports = findJSImports;

package/bin/cdxgen

@@ -0,0 +1,316 @@
+#!/usr/bin/env node
+
+const bom = require("../index.js");
+const fs = require("fs");
+const path = require("path");
+const jws = require("jws");
+const crypto = require("crypto");
+const bomServer = require("../server.js");
+
+const args = require("yargs")
+  .option("output", {
+    alias: "o",
+    description: "Output file for bom.xml or bom.json. Default console"
+  })
+  .option("type", {
+    alias: "t",
+    description: "Project type"
+  })
+  .option("recurse", {
+    alias: "r",
+    type: "boolean",
+    description: "Recurse mode suitable for mono-repos"
+  })
+  .option("print", {
+    alias: "p",
+    type: "boolean",
+    description: "Print the SBoM as a table"
+  })
+  .option("resolve-class", {
+    alias: "c",
+    type: "boolean",
+    description: "Resolve class names for packages. jars only for now."
+  })
+  .option("deep", {
+    type: "boolean",
+    description:
+      "Perform deep searches for components. Useful while scanning live OS and oci images."
+  })
+  .option("server-url", {
+    description: "Dependency track url. Eg: https://deptrack.cyclonedx.io"
+  })
+  .option("api-key", {
+    description: "Dependency track api key"
+  })
+  .option("project-group", {
+    description: "Dependency track project group"
+  })
+  .option("project-name", {
+    description: "Dependency track project name. Default use the directory name"
+  })
+  .option("project-version", {
+    description: "Dependency track project version",
+    default: ""
+  })
+  .option("project-id", {
+    description:
+      "Dependency track project id. Either provide the id or the project name and version together"
+  })
+  .option("required-only", {
+    type: "boolean",
+    description: "Include only the packages with required scope on the SBoM."
+  })
+  .option("fail-on-error", {
+    type: "boolean",
+    description: "Fail if any dependency extractor fails."
+  })
+  .option("no-babel", {
+    type: "boolean",
+    description:
+      "Do not use babel to perform usage analysis for JavaScript/TypeScript projects."
+  })
+  .option("generate-key-and-sign", {
+    type: "boolean",
+    description:
+      "Generate an RSA public/private key pair and then sign the generated SBoM using JSON Web Signatures."
+  })
+  .option("server", {
+    type: "boolean",
+    description: "Run cdxgen as a server"
+  })
+  .option("server-host", {
+    description: "Listen address",
+    default: "127.0.0.1"
+  })
+  .option("server-port", {
+    description: "Listen port",
+    default: "9090"
+  })
+  .scriptName("cdxgen")
+  .version()
+  .help("h").argv;
+
+if (args.version) {
+  const packageJsonAsString = fs.readFileSync(
+    path.join(__dirname, "../", "package.json"),
+    "utf-8"
+  );
+  const packageJson = JSON.parse(packageJsonAsString);
+
+  console.log(packageJson.version);
+  process.exit(0);
+}
+
+if (process.env.GLOBAL_AGENT_HTTP_PROXY || process.env.HTTP_PROXY) {
+  // Support standard HTTP_PROXY variable if the user doesn't override the namespace
+  if (!process.env.GLOBAL_AGENT_ENVIRONMENT_VARIABLE_NAMESPACE) {
+    process.env.GLOBAL_AGENT_ENVIRONMENT_VARIABLE_NAMESPACE = "";
+  }
+  const globalAgent = require("global-agent");
+  globalAgent.bootstrap();
+}
+
+let filePath = args._[0] || ".";
+if (!args.projectName) {
+  if (filePath !== ".") {
+    args.projectName = path.basename(filePath);
+  } else {
+    args.projectName = path.basename(path.resolve(filePath));
+  }
+}
+
+/**
+ * projectType: python, nodejs, java, golang
+ * multiProject: Boolean to indicate monorepo or multi-module projects
+ */
+let options = {
+  dev: true,
+  projectType: args.type,
+  multiProject: args.recurse,
+  depth: 3,
+  output: args.output,
+  resolveClass: args.resolveClass,
+  installDeps: true,
+  requiredOnly: args.requiredOnly,
+  failOnError: args.failOnError,
+  noBabel: args.noBabel || args.babel === false,
+  deep: args.deep,
+  generateKeyAndSign: args.generateKeyAndSign,
+  project: args.projectId,
+  projectName: args.projectName,
+  projectGroup: args.projectGroup,
+  projectVersion: args.projectVersion,
+  server: args.server,
+  serverHost: args.serverHost,
+  serverPort: args.serverPort
+};
+
+/**
+ * Method to start the bom creation process
+ */
+(async () => {
+  // Start SBoM server
+  if (args.server) {
+    return await bomServer.start(options);
+  }
+  const bomNSData = (await bom.createBom(filePath, options)) || {};
+
+  if (args.output) {
+    if (bomNSData.bomXmlFiles) {
+      console.log("BOM files produced:", bomNSData.bomXmlFiles);
+    } else {
+      const jsonFile = args.output.replace(".xml", ".json");
+      // Create bom json file
+      if (bomNSData.bomJson) {
+        let jsonPayload = undefined;
+        if (
+          typeof bomNSData.bomJson === "string" ||
+          bomNSData.bomJson instanceof String
+        ) {
+          fs.writeFileSync(jsonFile, bomNSData.bomJson);
+          jsonPayload = bomNSData.bomJson;
+        } else {
+          jsonPayload = JSON.stringify(bomNSData.bomJson, null, 2);
+          fs.writeFileSync(jsonFile, jsonPayload);
+        }
+        if (
+          jsonPayload &&
+          (args.generateKeyAndSign ||
+            (process.env.SBOM_SIGN_ALGORITHM &&
+              process.env.SBOM_SIGN_ALGORITHM !== "none" &&
+              process.env.SBOM_SIGN_PRIVATE_KEY &&
+              fs.existsSync(process.env.SBOM_SIGN_PRIVATE_KEY)))
+        ) {
+          let alg = process.env.SBOM_SIGN_ALGORITHM || "RS512";
+          if (alg.includes("none")) {
+            alg = "RS512";
+          }
+          let privateKeyToUse = undefined;
+          let jwkPublicKey = undefined;
+          if (args.generateKeyAndSign) {
+            const dirName = path.dirname(jsonFile);
+            const publicKeyFile = path.join(dirName, "public.key");
+            const privateKeyFile = path.join(dirName, "private.key");
+            const { privateKey, publicKey } = crypto.generateKeyPairSync(
+              "rsa",
+              {
+                modulusLength: 4096,
+                publicKeyEncoding: {
+                  type: "spki",
+                  format: "pem"
+                },
+                privateKeyEncoding: {
+                  type: "pkcs8",
+                  format: "pem"
+                }
+              }
+            );
+            fs.writeFileSync(publicKeyFile, publicKey);
+            fs.writeFileSync(privateKeyFile, privateKey);
+            console.log(
+              "Created public/private key pairs for testing purposes",
+              publicKeyFile,
+              privateKeyFile
+            );
+            privateKeyToUse = privateKey;
+            jwkPublicKey = crypto
+              .createPublicKey(publicKey)
+              .export({ format: "jwk" });
+          } else {
+            privateKeyToUse = fs.readFileSync(
+              process.env.SBOM_SIGN_PRIVATE_KEY,
+              "utf8"
+            );
+            if (
+              process.env.SBOM_SIGN_PUBLIC_KEY &&
+              fs.existsSync(process.env.SBOM_SIGN_PUBLIC_KEY)
+            ) {
+              jwkPublicKey = crypto
+                .createPublicKey(
+                  fs.readFileSync(process.env.SBOM_SIGN_PUBLIC_KEY, "utf8")
+                )
+                .export({ format: "jwk" });
+            }
+          }
+          try {
+            const signature = jws.sign({
+              header: { alg },
+              payload: jsonPayload,
+              privateKey: privateKeyToUse
+            });
+            if (signature) {
+              const bomJsonUnsignedObj = JSON.parse(jsonPayload);
+              const signatureBlock = {
+                algorithm: alg,
+                value: signature
+              };
+              if (jwkPublicKey) {
+                signatureBlock.publicKey = jwkPublicKey;
+              }
+              bomJsonUnsignedObj.signature = signatureBlock;
+              fs.writeFileSync(
+                jsonFile,
+                JSON.stringify(bomJsonUnsignedObj, null, 2)
+              );
+            }
+          } catch (ex) {
+            console.log("SBoM signing was unsuccessful", ex);
+            console.log("Check if the private key was exported in PEM format");
+          }
+        }
+      }
+      // Create bom xml file
+      if (bomNSData.bomXml) {
+        const xmlFile = args.output.replace(".json", ".xml");
+        fs.writeFileSync(xmlFile, bomNSData.bomXml);
+      }
+      //
+      if (bomNSData.nsMapping && Object.keys(bomNSData.nsMapping).length) {
+        const nsFile = jsonFile + ".map";
+        fs.writeFileSync(nsFile, JSON.stringify(bomNSData.nsMapping));
+        console.log("Namespace mapping file written to", nsFile);
+      }
+    }
+  } else if (!args.print) {
+    if (bomNSData.bomJson) {
+      console.log(JSON.stringify(bomNSData.bomJson, null, 2));
+    } else if (bomNSData.bomXml) {
+      console.log(Buffer.from(bomNSData.bomXml).toString());
+    } else {
+      console.log("Unable to produce BOM for", filePath);
+      console.log("Try running the command with -t <type> or -r argument");
+    }
+  }
+
+  // Automatically submit the bom data
+  if (args.serverUrl && args.apiKey) {
+    try {
+      const dbody = await bom.submitBom(args, bomNSData.bomXml);
+      console.log("Response from server", dbody);
+    } catch (err) {
+      console.log(err);
+    }
+  }
+
+  if (args.print && bomNSData.bomJson && bomNSData.bomJson.components) {
+    const { table } = require("table");
+    const data = [["Group", "Name", "Version", "Scope"]];
+    for (let comp of bomNSData.bomJson.components) {
+      data.push([comp.group || "", comp.name, comp.version, comp.scope || ""]);
+    }
+    const config = {
+      header: {
+        alignment: "center",
+        content: "Software Bill-of-Materials\nGenerated by @cyclonedx/cdxgen"
+      }
+    };
+    console.log(table(data, config));
+    console.log(
+      "BOM includes",
+      bomNSData.bomJson.components.length,
+      "components and",
+      bomNSData.bomJson.dependencies.length,
+      "dependencies"
+    );
+  }
+})();