@cyclonedx/cdxgen 8.4.3 → 8.4.7

package/README.md

@@ -248,7 +248,7 @@ cdxgen can retain the dependency tree under the `dependencies` attribute for a s
 
 | Variable                     | Description                                                                                                                 |
 | ---------------------------- | --------------------------------------------------------------------------------------------------------------------------- |
-| SCAN_DEBUG_MODE              | Set to `debug` to enable debug messages                                                                                     |
+| CDXGEN_DEBUG_MODE            | Set to `debug` to enable debug messages                                                                                     |
 | GITHUB_TOKEN                 | Specify GitHub token to prevent traffic shaping while querying license and repo information                                 |
 | MVN_CMD                      | Set to override maven command                                                                                               |
 | MVN_ARGS                     | Set to pass additional arguments such as profile or settings to maven                                                       |

package/binary.js

@@ -7,6 +7,7 @@ const isWin = require("os").platform() === "win32";
 
 // Debug mode flag
 const DEBUG_MODE =
+  process.env.CDXGEN_DEBUG_MODE === "debug" ||
   process.env.SCAN_DEBUG_MODE === "debug" ||
   process.env.SHIFTLEFT_LOGGING_LEVEL === "debug" ||
   process.env.NODE_ENV === "development";

package/docker.js

@@ -21,6 +21,7 @@ let isWinLocalTLS = false;
 
 // Debug mode flag
 const DEBUG_MODE =
+  process.env.CDXGEN_DEBUG_MODE === "debug" ||
   process.env.SCAN_DEBUG_MODE === "debug" ||
   process.env.SHIFTLEFT_LOGGING_LEVEL === "debug";
 

package/index.js

@@ -55,6 +55,7 @@ let SBT_CACHE_DIR =
 
 // Debug mode flag
 const DEBUG_MODE =
+  process.env.CDXGEN_DEBUG_MODE === "debug" ||
   process.env.SCAN_DEBUG_MODE === "debug" ||
   process.env.SHIFTLEFT_LOGGING_LEVEL === "debug" ||
   process.env.NODE_ENV === "development";
@@ -1189,6 +1190,15 @@ const createJavaBom = async (path, options) => {
           const retMap = utils.parseGradleProjects(cmdOutput);
           const allProjects = retMap.projects || [];
           let rootProject = retMap.rootProject;
+          if (rootProject) {
+            parentComponent = {
+              group: "",
+              name: rootProject,
+              version: "latest",
+              type: "maven",
+              qualifiers: { type: "jar" }
+            };
+          }
           if (!allProjects) {
             console.log(
               "No projects found. Is this a gradle multi-project application?"
@@ -1200,6 +1210,37 @@ const createJavaBom = async (path, options) => {
               allProjects.length,
               "gradle sub-projects. This might take a while ..."
             );
+            // We need the first dependency between the root project and child projects
+            // See: #249 and #315
+            const rootDependsOn = [];
+            for (let sp of allProjects) {
+              sp = sp.replace(":", "");
+              rootDependsOn.push(
+                decodeURIComponent(
+                  new PackageURL(
+                    "maven",
+                    "",
+                    sp,
+                    parentComponent.version,
+                    parentComponent.qualifiers,
+                    null
+                  ).toString()
+                )
+              );
+            }
+            dependencies.push({
+              ref: decodeURIComponent(
+                new PackageURL(
+                  "maven",
+                  parentComponent.group,
+                  parentComponent.name,
+                  parentComponent.version,
+                  parentComponent.qualifiers,
+                  null
+                ).toString()
+              ),
+              dependsOn: rootDependsOn
+            });
             for (let sp of allProjects) {
               let gradleDepArgs = [
                 sp + ":dependencies",
@@ -1232,15 +1273,20 @@ const createJavaBom = async (path, options) => {
               }
               const sstdout = sresult.stdout;
               if (sstdout) {
+                sp = sp.replace(":", "");
                 const cmdOutput = Buffer.from(sstdout).toString();
-                const parsedList = utils.parseGradleDep(cmdOutput, rootProject);
+                const parsedList = utils.parseGradleDep(cmdOutput, sp);
                 const dlist = parsedList.pkgList;
-                parentComponent = dlist.splice(0, 1)[0];
+                // Do not overwrite the parentComponent in multi-project mode
+                if (!parentComponent) {
+                  parentComponent = dlist.splice(0, 1)[0];
+                }
                 if (
                   parsedList.dependenciesList &&
                   parsedList.dependenciesList
                 ) {
-                  dependencies = dependencies.concat(
+                  dependencies = mergeDependencies(
+                    dependencies,
                     parsedList.dependenciesList
                   );
                 }
@@ -1347,7 +1393,10 @@ const createJavaBom = async (path, options) => {
             const dlist = parsedList.pkgList;
             parentComponent = dlist.splice(0, 1)[0];
             if (parsedList.dependenciesList && parsedList.dependenciesList) {
-              dependencies = dependencies.concat(parsedList.dependenciesList);
+              dependencies = mergeDependencies(
+                dependencies,
+                parsedList.dependenciesList
+              );
             }
             if (dlist && dlist.length) {
               pkgList = pkgList.concat(dlist);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cyclonedx/cdxgen",
-  "version": "8.4.3",
+  "version": "8.4.7",
   "description": "Creates CycloneDX Software Bill-of-Materials (SBOM) from source or container image",
   "homepage": "http://github.com/cyclonedx/cdxgen",
   "author": "Prabhu Subramanian <prabhu@appthreat.com>",
@@ -43,14 +43,14 @@
   },
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/cyclonedx/cdxgen.git"
+    "url": "git+https://github.com/CycloneDX/cdxgen"
   },
   "bugs": {
     "url": "https://github.com/cyclonedx/cdxgen/issues"
   },
   "dependencies": {
-    "@babel/parser": "^7.21.4",
-    "@babel/traverse": "^7.21.4",
+    "@babel/parser": "^7.21.8",
+    "@babel/traverse": "^7.21.5",
     "cheerio": "^1.0.0-rc.12",
     "edn-data": "^1.0.0",
     "glob": "^8.1.0",
@@ -66,11 +66,11 @@
     "semver": "^7.5.0",
     "ssri": "^8.0.1",
     "table": "^6.8.1",
-    "tar": "^6.1.13",
+    "tar": "^6.1.14",
     "uuid": "^9.0.0",
     "xml-js": "^1.6.11",
     "xmlbuilder": "^15.1.1",
-    "yargs": "^17.7.1"
+    "yargs": "^17.7.2"
   },
   "optionalDependencies": {
     "@cyclonedx/cdxgen-plugins-bin": "^1.1.0",
@@ -88,7 +88,7 @@
     "queries.json"
   ],
   "devDependencies": {
-    "eslint": "^8.39.0",
-    "jest": "^26.6.3"
+    "eslint": "^8.40.0",
+    "jest": "^29.5.0"
   }
 }

package/utils.js

@@ -20,6 +20,7 @@ const { PackageURL } = require("packageurl-js");
 
 // Debug mode flag
 const DEBUG_MODE =
+  process.env.CDXGEN_DEBUG_MODE === "debug" ||
   process.env.SCAN_DEBUG_MODE === "debug" ||
   process.env.SHIFTLEFT_LOGGING_LEVEL === "debug";
 
@@ -256,18 +257,33 @@ const _getDepPkgList = async function (
   depKeys,
   pkg
 ) {
-  if (pkg && pkg.dependencies) {
-    const pkgKeys = Object.keys(pkg.dependencies);
-    for (var k in pkgKeys) {
-      const name = pkgKeys[k];
-      const version = pkg.dependencies[name].version;
-      const purl = new PackageURL("npm", "", name, version, null, null);
+  let pkgDependencies =
+    pkg.lockfileVersion && pkg.lockfileVersion >= 3
+      ? pkg.packages
+      : pkg.dependencies;
+  if (pkg && pkgDependencies) {
+    const pkgKeys = Object.keys(pkgDependencies);
+    for (const k of pkgKeys) {
+      // Skip the root package in lockFileVersion 3 and above
+      if (k === "") {
+        continue;
+      }
+      let name = k;
+      const version = pkgDependencies[name].version;
+      const purl = new PackageURL(
+        "npm",
+        "",
+        name.replace("node_modules/", ""),
+        version,
+        null,
+        null
+      );
       const purlString = decodeURIComponent(purl.toString());
-      let scope = pkg.dependencies[name].dev === true ? "optional" : undefined;
+      let scope = pkgDependencies[name].dev === true ? "optional" : undefined;
       const apkg = {
-        name,
+        name: name.replace("node_modules/", ""),
         version,
-        _integrity: pkg.dependencies[name].integrity,
+        _integrity: pkgDependencies[name].integrity,
         scope,
         properties: [
           {
@@ -277,9 +293,9 @@ const _getDepPkgList = async function (
         ]
       };
       pkgList.push(apkg);
-      if (pkg.dependencies[name].dependencies) {
+      if (pkgDependencies[name].dependencies) {
         // Include child dependencies
-        const dependencies = pkg.dependencies[name].dependencies;
+        const dependencies = pkgDependencies[name].dependencies;
         const pkgDepKeys = Object.keys(dependencies);
         const deplist = [];
         for (const j in pkgDepKeys) {
@@ -288,7 +304,7 @@ const _getDepPkgList = async function (
           const deppurl = new PackageURL(
             "npm",
             "",
-            depName,
+            depName.replace("node_modules/", ""),
             depVersion,
             null,
             null
@@ -303,13 +319,17 @@ const _getDepPkgList = async function (
           });
           depKeys[purlString] = true;
         }
-        await _getDepPkgList(
-          pkgLockFile,
-          pkgList,
-          dependenciesList,
-          depKeys,
-          pkg.dependencies[name]
-        );
+        if (pkg.lockfileVersion && pkg.lockfileVersion >= 3) {
+          // Do not recurse for lock file v3 and above
+        } else {
+          await _getDepPkgList(
+            pkgLockFile,
+            pkgList,
+            dependenciesList,
+            depKeys,
+            pkgDependencies[name]
+          );
+        }
       } else {
         if (!depKeys[purlString]) {
           dependenciesList.push({
@@ -1184,8 +1204,28 @@ const parseGradleDep = function (
     const keys_cache = {};
     let last_level = 0;
     let last_purl = `pkg:maven/${rootProjectName}@${rootProjectVersion}?type=jar`;
+    // Bug: 249. Get any sub-projects refered here
+    const retMap = parseGradleProjects(rawOutput);
     const level_trees = {};
     level_trees[last_purl] = [];
+    if (retMap && retMap.projects) {
+      const subDependsOn = [];
+      for (const sd of retMap.projects) {
+        subDependsOn.push(
+          decodeURIComponent(
+            new PackageURL(
+              "maven",
+              "",
+              sd.replace(":", ""),
+              rootProject.version,
+              rootProject.qualifiers,
+              null
+            ).toString()
+          )
+        );
+      }
+      level_trees[last_purl] = subDependsOn;
+    }
     let stack = [last_purl];
     const depRegex =
       /^.*?--- +(?<group>[^\s:]+):(?<name>[^\s:]+)(?::(?:{strictly [[]?)?(?<versionspecified>[^,\s:}]+))?(?:})?(?:[^->]* +-> +(?<versionoverride>[^\s:]+))?/gm;
@@ -1368,6 +1408,14 @@ const parseGradleProjects = function (rawOutput) {
             projects.add(projName);
           }
         }
+      } else if (l.includes("--- project ")) {
+        const tmpB = l.split("--- project ");
+        if (tmpB && tmpB.length > 1) {
+          let projName = tmpB[1];
+          if (projName.startsWith(":")) {
+            projects.add(projName);
+          }
+        }
       }
     });
     return {

package/utils.test.js

@@ -206,6 +206,11 @@ test("parse gradle dependencies", () => {
   );
   expect(parsedList.pkgList.length).toEqual(68);
   expect(parsedList.dependenciesList.length).toEqual(69);
+  parsedList = utils.parseGradleDep(
+    fs.readFileSync("./test/data/gradle-out-249.dep", { encoding: "utf-8" })
+  );
+  expect(parsedList.pkgList.length).toEqual(21);
+  expect(parsedList.dependenciesList.length).toEqual(21);
 });
 
 test("parse gradle projects", () => {
@@ -1097,6 +1102,30 @@ test("parsePkgLock", async () => {
     "bom-ref": "pkg:application/MyProject",
     name: "MyProject"
   });
+  parsedList = await utils.parsePkgLock("./test/data/package-lock-v2.json");
+  deps = parsedList.pkgList;
+  expect(deps.length).toEqual(1467);
+  expect(parsedList.dependenciesList.length).toEqual(1280);
+  expect(deps[0]).toEqual({
+    "bom-ref": "pkg:application/flink-dashboard@2.0.0",
+    group: "",
+    name: "flink-dashboard",
+    type: "application",
+    version: "2.0.0"
+  });
+  expect(deps[deps.length - 1].name).toEqual("zone.js");
+  parsedList = await utils.parsePkgLock("./test/data/package-lock-v3.json");
+  deps = parsedList.pkgList;
+  expect(deps.length).toEqual(879);
+  expect(parsedList.dependenciesList.length).toEqual(879);
+  expect(deps[0]).toEqual({
+    "bom-ref": "pkg:application/@cyclonedx/cdxgen@8.4.3",
+    group: "",
+    name: "@cyclonedx/cdxgen",
+    type: "application",
+    version: "8.4.3"
+  });
+  expect(deps[deps.length - 1].name).toEqual("yocto-queue");
 });
 
 test("parseBowerJson", async () => {