@cyclonedx/cdxgen 8.2.0 → 8.2.2

package/README.md

@@ -166,7 +166,7 @@ cdxgen --server
 Or use the container image.
 
 ```bash
-docker run --rm -v /tmp:/tmp -p 9090:9090 -v $(pwd):/app:rw -t ghcr.io/cyclonedx/cdxgen -r /app --server
+docker run --rm -v /tmp:/tmp -p 9090:9090 -v $(pwd):/app:rw -t ghcr.io/cyclonedx/cdxgen -r /app --server --server-host 0.0.0.0
 ```
 
 Use curl or your favourite tool to pass arguments to the `/sbom` route.

package/binary.js

@@ -312,7 +312,9 @@ const getOSPackages = (src) => {
         if (DEBUG_MODE) {
           console.log(`Cleaning up ${tempDir}`);
         }
-        fs.rmSync(tempDir, { recursive: true, force: true });
+        if (fs.rmSync) {
+          fs.rmSync(tempDir, { recursive: true, force: true });
+        }
       }
       if (tmpBom && tmpBom.components) {
         for (const comp of tmpBom.components) {

package/docker.js

@@ -619,7 +619,9 @@ const exportImage = async (fullImageName) => {
       if (DEBUG_MODE) {
         console.log(`Cleaning up ${imageTarFile}`);
       }
-      fs.rmSync(imageTarFile, { force: true });
+      if (fs.rmSync) {
+        fs.rmSync(imageTarFile, { force: true });
+      }
     }
   } else {
     let client = await getConnection();

package/index.js

@@ -519,7 +519,10 @@ function addComponent(
     // Skip @types package for npm
     if (
       ptype == "npm" &&
-      (group === "types" || !name || name.startsWith("@types"))
+      (group === "types" ||
+        group === "@types" ||
+        !name ||
+        name.startsWith("@types"))
     ) {
       return;
     }
@@ -531,7 +534,14 @@ function addComponent(
 
     let purl =
       pkg.purl ||
-      new PackageURL(ptype, group, name, version, pkg.qualifiers, pkg.subpath);
+      new PackageURL(
+        ptype,
+        encodeURIComponent(group),
+        encodeURIComponent(name),
+        version,
+        pkg.qualifiers,
+        pkg.subpath
+      );
     let purlString = purl.toString();
     purlString = decodeURIComponent(purlString);
     let description = { "#cdata": pkg.description };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cyclonedx/cdxgen",
-  "version": "8.2.0",
+  "version": "8.2.2",
   "description": "Creates CycloneDX Software Bill-of-Materials (SBOM) from source or container image",
   "homepage": "http://github.com/cyclonedx/cdxgen",
   "author": "Prabhu Subramanian <prabhu@appthreat.com>",

package/server.js

@@ -115,7 +115,7 @@ const start = async (options) => {
       }
     }
     res.end("\n");
-    if (cleanup && srcDir && srcDir.startsWith(os.tmpdir())) {
+    if (cleanup && srcDir && srcDir.startsWith(os.tmpdir()) && fs.rmSync) {
       console.log(`Cleaning up ${srcDir}`);
       fs.rmSync(srcDir, { recursive: true, force: true });
     }

package/utils.js

@@ -754,11 +754,15 @@ const parsePnpmLock = async function (pnpmLock, parentComponent = null) {
       const ddeps = yamlObj.dependencies || {};
       const ddeplist = [];
       for (const dk of Object.keys(ddeps)) {
+        let version = ddeps[dk];
+        if (typeof version === "object" && version.version) {
+          version = version.version;
+        }
         const dpurl = new PackageURL(
           "npm",
           "",
           dk,
-          ddeps[dk],
+          version,
           null,
           null
         ).toString();
@@ -769,10 +773,12 @@ const parsePnpmLock = async function (pnpmLock, parentComponent = null) {
         dependsOn: ddeplist
       });
     }
+    const lockfileVersion = yamlObj.lockfileVersion;
     const packages = yamlObj.packages;
     const pkgKeys = Object.keys(packages);
     for (var k in pkgKeys) {
       // Eg: @babel/code-frame/7.10.1
+      // In lockfileVersion 6, /@babel/code-frame@7.18.6
       const fullName = pkgKeys[k].replace("/@", "@");
       const parts = fullName.split("/");
       const integrity = packages[pkgKeys[k]].resolution.integrity;
@@ -782,13 +788,22 @@ const parsePnpmLock = async function (pnpmLock, parentComponent = null) {
         let name = "";
         let version = "";
         let group = "";
-        if (parts.length === 2) {
-          name = parts[0];
-          version = parts[1];
-        } else if (parts.length === 3) {
+        if (lockfileVersion === "6.0" && fullName.includes("@")) {
+          const tmpA = parts[parts.length - 1].split("@");
           group = parts[0];
-          name = parts[1];
-          version = parts[2];
+          if (parts.length === 2 && tmpA.length > 1) {
+            name = tmpA[0];
+            version = tmpA[1];
+          }
+        } else {
+          if (parts.length === 2) {
+            name = parts[0];
+            version = parts[1];
+          } else if (parts.length === 3) {
+            group = parts[0];
+            name = parts[1];
+            version = parts[2];
+          }
         }
         if (group !== "@types" && name.indexOf("file:") !== 0) {
           const purlString = new PackageURL(
@@ -4208,6 +4223,7 @@ const extractJarArchive = function (jarFile, tempDir) {
             jarMetadata["Extension-Name"] ||
             jarMetadata["Implementation-Vendor-Id"] ||
             jarMetadata["Bundle-SymbolicName"] ||
+            jarMetadata["Bundle-Vendor"] ||
             jarMetadata["Automatic-Module-Name"];
           let name = "";
           if (
@@ -4274,8 +4290,8 @@ const extractJarArchive = function (jarFile, tempDir) {
           }
           if (name && version) {
             pkgList.push({
-              group: group === "." ? "" : group || "",
-              name: name || "",
+              group: group === "." ? "" : encodeURIComponent(group) || "",
+              name: name ? encodeURIComponent(name) : "",
               version,
               properties: [
                 {

package/utils.test.js

@@ -1193,6 +1193,28 @@ test("parsePnpmLock", async () => {
 
   parsedList = await utils.parsePnpmLock("./test/data/pnpm-lock4.yaml");
   expect(parsedList.pkgList.length).toEqual(1);
+
+  parsedList = await utils.parsePnpmLock("./test/data/pnpm-lock6.yaml");
+  expect(parsedList.pkgList.length).toEqual(195);
+  expect(parsedList.dependenciesList.length).toEqual(195);
+  expect(parsedList.pkgList[0]).toEqual({
+    group: "@babel",
+    name: "code-frame",
+    version: "7.18.6",
+    scope: "optional",
+    _integrity:
+      "sha512-TDCmlK5eOvH+eH7cdAFlNXeVJqWIQ7gW9tY1GJIpUtFb6CmjVyq2VM3u71bOyR8CRihcCgMUYoDNyLXao3+70Q==",
+    properties: [{ name: "SrcFile", value: "./test/data/pnpm-lock6.yaml" }]
+  });
+  expect(parsedList.pkgList[parsedList.pkgList.length - 1]).toEqual({
+    group: "",
+    name: "yargs",
+    version: "17.7.1",
+    scope: "optional",
+    _integrity:
+      "sha512-cwiTb08Xuv5fqF4AovYacTFNxk62th7LKJ6BL9IGUpTJrWoU7/7WdQGTP2SjKf1dUNBGzDd28p/Yfs/GI6JrLw==",
+    properties: [{ name: "SrcFile", value: "./test/data/pnpm-lock6.yaml" }]
+  });
 });
 
 test("parseYarnLock", async () => {
@@ -1214,7 +1236,7 @@ test("parseYarnLock", async () => {
       }
     ]
   });
-
+  expect(parsedList.dependenciesList.length).toEqual(56);
   identMap = utils.yarnLockToIdentMap(
     fs.readFileSync("./test/data/yarn_locks/yarn.lock", "utf8")
   );
@@ -1329,6 +1351,7 @@ test("parseYarnLock", async () => {
   });
   parsedList = await utils.parseYarnLock("./test/data/yarn_locks/yarn4.lock");
   expect(parsedList.pkgList.length).toEqual(1);
+  expect(parsedList.dependenciesList.length).toEqual(1);
   parsedList = await utils.parseYarnLock("./test/data/yarn_locks/yarn-at.lock");
   expect(parsedList.pkgList.length).toEqual(4);
   expect(parsedList.dependenciesList.length).toEqual(4);