@cyclonedx/cdxgen 8.3.1 → 8.3.3

package/README.md

@@ -298,6 +298,7 @@ cdxgen shiftleft/scan-slim -o /tmp/bom.json -t docker
 You can also pass the .tar file of a container image.
 
 ```shell
+docker pull shiftleft/scan-slim
 docker save -o /tmp/slim.tar shiftleft/scan-slim
 podman save -q --format oci-archive -o /tmp/slim.tar shiftleft/scan-slim
 cdxgen /tmp/slim.tar -o /tmp/bom.json -t docker

package/binary.js

@@ -280,7 +280,6 @@ const getOSPackages = (src) => {
     const args = [
       imageType,
       "--skip-db-update",
-      "--skip-java-db-update",
       "--offline-scan",
       "--no-progress",
       "--exit-code",

package/docker.js

@@ -424,7 +424,8 @@ const extractTar = async (fullImageName, dir) => {
         portable: true,
         onwarn: () => {},
         filter: (path) => {
-          if (path.endsWith("cacerts")) {
+          // Some files are known to cause issues with extract
+          if (path.includes("cacerts") || path.includes("ssl/certs")) {
             return false;
           }
           return true;
@@ -433,9 +434,12 @@ const extractTar = async (fullImageName, dir) => {
     );
     return true;
   } catch (err) {
-    if (DEBUG_MODE) {
-      console.log(err);
-    }
+    console.log(
+      "Error during extraction. Please file this bug to the cdxgen repo. https://github.com/CycloneDX/cdxgen/issues"
+    );
+    console.log("------------");
+    console.log(err);
+    console.log("------------");
     return false;
   }
 };

package/docker.test.js

@@ -1,4 +1,5 @@
 const dockerLib = require("./docker");
+const { jest, expect, test } = require("@jest/globals");
 
 test("docker connection", async () => {
   const dockerConn = await dockerLib.getConnection();

package/index.js

@@ -536,11 +536,11 @@ function addComponent(
       pkg.purl ||
       new PackageURL(
         ptype,
-        encodeURIComponent(group),
-        encodeURIComponent(name),
+        utils.encodeForPurl(group),
+        utils.encodeForPurl(name),
         version,
         pkg.qualifiers,
-        pkg.subpath
+        utils.encodeForPurl(pkg.subpath)
       );
     let purlString = purl.toString();
     purlString = decodeURIComponent(purlString);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cyclonedx/cdxgen",
-  "version": "8.3.1",
+  "version": "8.3.3",
   "description": "Creates CycloneDX Software Bill-of-Materials (SBOM) from source or container image",
   "homepage": "http://github.com/cyclonedx/cdxgen",
   "author": "Prabhu Subramanian <prabhu@appthreat.com>",
@@ -33,9 +33,9 @@
     "cdxgen": "./bin/cdxgen"
   },
   "scripts": {
-    "test": "jest",
-    "watch": "jest --watch",
-    "lint": "eslint index.js utils.js binary.js server.js docker.js bin/cdxgen",
+    "test": "jest --inject-globals false",
+    "watch": "jest --watch --inject-globals false",
+    "lint": "eslint index.js utils.js binary.js server.js docker.js *.test.js bin/cdxgen",
     "pretty": "prettier --write *.js bin/cdxgen --trailing-comma=none"
   },
   "engines": {

package/utils.js

@@ -4188,6 +4188,13 @@ const parseJarManifest = function (jarMetadata) {
 };
 exports.parseJarManifest = parseJarManifest;
 
+const encodeForPurl = (s) => {
+  return s
+    ? encodeURIComponent(s).replace(/%3A/g, ":").replace(/%2F/g, "/")
+    : s;
+};
+exports.encodeForPurl = encodeForPurl;
+
 /**
  * Method to extract a war or ear file
  *
@@ -4272,7 +4279,8 @@ const extractJarArchive = function (jarFile, tempDir) {
             jarMetadata["Implementation-Vendor-Id"] ||
             jarMetadata["Bundle-SymbolicName"] ||
             jarMetadata["Bundle-Vendor"] ||
-            jarMetadata["Automatic-Module-Name"];
+            jarMetadata["Automatic-Module-Name"] ||
+            "";
           let name = "";
           if (
             jarMetadata["Bundle-Name"] &&
@@ -4338,8 +4346,8 @@ const extractJarArchive = function (jarFile, tempDir) {
           }
           if (name && version) {
             pkgList.push({
-              group: group === "." ? "" : encodeURIComponent(group) || "",
-              name: name ? encodeURIComponent(name) : "",
+              group: group === "." ? "" : encodeForPurl(group || "") || "",
+              name: name ? encodeForPurl(name) : "",
               version,
               properties: [
                 {

package/utils.test.js

@@ -1,10 +1,11 @@
 const utils = require("./utils");
 const fs = require("fs");
 const ssri = require("ssri");
+const { jest, expect, test } = require("@jest/globals");
 
 test("SSRI test", () => {
   // gopkg.lock hash
-  ss = ssri.parse(
+  let ss = ssri.parse(
     "2ca532a6bc655663344004ba102436d29031018eab236247678db1d8978627bf"
   );
   expect(ss).toEqual(null);
@@ -529,7 +530,7 @@ test("parse go version data", async () => {
 
 test("parse cargo lock", async () => {
   expect(await utils.parseCargoData(null)).toEqual([]);
-  dep_list = await utils.parseCargoData(
+  let dep_list = await utils.parseCargoData(
     fs.readFileSync("./test/Cargo.lock", { encoding: "utf-8" })
   );
   expect(dep_list.length).toEqual(224);
@@ -555,7 +556,7 @@ test("parse cargo lock", async () => {
 
 test("parse cargo toml", async () => {
   expect(await utils.parseCargoTomlData(null)).toEqual([]);
-  dep_list = await utils.parseCargoTomlData(
+  let dep_list = await utils.parseCargoTomlData(
     fs.readFileSync("./test/data/Cargo1.toml", { encoding: "utf-8" })
   );
   expect(dep_list.length).toEqual(4);
@@ -581,7 +582,7 @@ test("parse cargo toml", async () => {
 
 test("parse cargo auditable data", async () => {
   expect(await utils.parseCargoAuditableData(null)).toEqual([]);
-  dep_list = await utils.parseCargoAuditableData(
+  let dep_list = await utils.parseCargoAuditableData(
     fs.readFileSync("./test/data/cargo-auditable.txt", { encoding: "utf-8" })
   );
   expect(dep_list.length).toEqual(32);
@@ -621,7 +622,7 @@ test("get crates metadata", async () => {
 
 test("parse pub lock", async () => {
   expect(await utils.parsePubLockData(null)).toEqual([]);
-  dep_list = await utils.parsePubLockData(
+  let dep_list = await utils.parsePubLockData(
     fs.readFileSync("./test/data/pubspec.lock", { encoding: "utf-8" })
   );
   expect(dep_list.length).toEqual(26);
@@ -668,7 +669,7 @@ test("get dart metadata", async () => {
 
 test("parse cabal freeze", async () => {
   expect(await utils.parseCabalData(null)).toEqual([]);
-  dep_list = await utils.parseCabalData(
+  let dep_list = await utils.parseCabalData(
     fs.readFileSync("./test/data/cabal.project.freeze", { encoding: "utf-8" })
   );
   expect(dep_list.length).toEqual(24);
@@ -688,7 +689,7 @@ test("parse cabal freeze", async () => {
 
 test("parse conan data", async () => {
   expect(await utils.parseConanLockData(null)).toEqual([]);
-  dep_list = await utils.parseConanLockData(
+  let dep_list = await utils.parseConanLockData(
     fs.readFileSync("./test/data/conan.lock", { encoding: "utf-8" })
   );
   expect(dep_list.length).toEqual(3);
@@ -786,7 +787,7 @@ test("parse clojure data", () => {
 
 test("parse mix lock data", async () => {
   expect(await utils.parseMixLockData(null)).toEqual([]);
-  dep_list = await utils.parseMixLockData(
+  let dep_list = await utils.parseMixLockData(
     fs.readFileSync("./test/data/mix.lock", { encoding: "utf-8" })
   );
   expect(dep_list.length).toEqual(16);
@@ -806,7 +807,7 @@ test("parse mix lock data", async () => {
 
 test("parse github actions workflow data", async () => {
   expect(await utils.parseGitHubWorkflowData(null)).toEqual([]);
-  dep_list = await utils.parseGitHubWorkflowData(
+  let dep_list = await utils.parseGitHubWorkflowData(
     fs.readFileSync("./.github/workflows/nodejs.yml", { encoding: "utf-8" })
   );
   expect(dep_list.length).toEqual(3);
@@ -1722,7 +1723,7 @@ test("parse container spec like files", async () => {
 
 test("parse cloudbuild data", async () => {
   expect(await utils.parseCloudBuildData(null)).toEqual([]);
-  dep_list = await utils.parseCloudBuildData(
+  let dep_list = await utils.parseCloudBuildData(
     fs.readFileSync("./test/data/cloudbuild.yaml", { encoding: "utf-8" })
   );
   expect(dep_list.length).toEqual(1);