@cyclonedx/cdxgen 8.1.2 → 8.1.4

package/index.js

@@ -1692,7 +1692,7 @@ const createNodejsBom = async (path, options) => {
       // Parse package-lock.json if available
       const parsedList = await utils.parsePkgLock(f);
       const dlist = parsedList.pkgList;
-      parentComponent = dlist.splice(0, 1)[0];
+      parentComponent = dlist.splice(0, 1)[0] || {};
       parentComponent.type = "application";
       if (dlist && dlist.length) {
         pkgList = pkgList.concat(dlist);
@@ -1858,7 +1858,7 @@ const createNodejsBom = async (path, options) => {
     });
   }
   // Projects containing just min files or bower
-  if (pkgList.length) {
+  if (pkgList) {
     return buildBomNSData(options, pkgList, "npm", {
       allImports,
       src: path,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cyclonedx/cdxgen",
-  "version": "8.1.2",
+  "version": "8.1.4",
   "description": "Creates CycloneDX Software Bill-of-Materials (SBOM) from source or container image",
   "homepage": "http://github.com/cyclonedx/cdxgen",
   "author": "Prabhu Subramanian <prabhu@appthreat.com>",

package/utils.js

@@ -352,9 +352,10 @@ const parsePkgLock = async (pkgLockFile) => {
   let pkgList = [];
   let dependenciesList = [];
   let depKeys = {};
-  let rootPkg = undefined;
+  let rootPkg = {};
   if (fs.existsSync(pkgLockFile)) {
     const lockData = JSON.parse(fs.readFileSync(pkgLockFile, "utf8"));
+    rootPkg.name = lockData.name || "";
     // lockfile v2 onwards
     if (lockData.name && lockData.packages && lockData.packages[""]) {
       // Build the initial dependency tree for the root package
@@ -390,7 +391,7 @@ const parsePkgLock = async (pkgLockFile) => {
       pkgList.push(rootPkg);
       // npm ls command seems to include both dependencies and devDependencies
       // For tree purposes, including only the dependencies should be enough
-      let rootPkgDeps = undefined;
+      let rootPkgDeps = [];
       if (
         lockData.packages &&
         lockData.packages[""] &&
@@ -982,7 +983,9 @@ const parsePom = function (pomFile) {
   if (project && project.dependencies) {
     let dependencies = project.dependencies.dependency;
     // Convert to an array
-    if (dependencies && !Array.isArray(dependencies)) {
+    if (!dependencies) {
+      dependencies = [];
+    } else if (dependencies && !Array.isArray(dependencies)) {
       dependencies = [dependencies];
     }
     for (let adep of dependencies) {

package/utils.test.js

@@ -978,6 +978,13 @@ test("parsePkgLock", async () => {
     "sha512-/r5HiDwOXTjucbBYkrTMpzWQAwil9MH7zSEfKH+RWWZv27r4vDiUd2FiBJItyQoPThLPxaf82IO6gCXyJR0ZnQ=="
   );
   expect(parsedList.dependenciesList.length).toEqual(572);
+  parsedList = await utils.parsePkgLock("./test/data/package-lock2.json");
+  deps = parsedList.pkgList;
+  expect(deps.length).toEqual(1);
+  expect(deps[0]).toEqual({
+    "bom-ref": "pkg:application/MyProject",
+    name: "MyProject"
+  });
 });
 
 test("parseBowerJson", async () => {