@cyclonedx/cdxgen 8.4.6 → 8.4.7

package/README.md

@@ -248,7 +248,7 @@ cdxgen can retain the dependency tree under the `dependencies` attribute for a s
 
 | Variable                     | Description                                                                                                                 |
 | ---------------------------- | --------------------------------------------------------------------------------------------------------------------------- |
-| SCAN_DEBUG_MODE              | Set to `debug` to enable debug messages                                                                                     |
+| CDXGEN_DEBUG_MODE            | Set to `debug` to enable debug messages                                                                                     |
 | GITHUB_TOKEN                 | Specify GitHub token to prevent traffic shaping while querying license and repo information                                 |
 | MVN_CMD                      | Set to override maven command                                                                                               |
 | MVN_ARGS                     | Set to pass additional arguments such as profile or settings to maven                                                       |

package/binary.js

@@ -7,6 +7,7 @@ const isWin = require("os").platform() === "win32";
 
 // Debug mode flag
 const DEBUG_MODE =
+  process.env.CDXGEN_DEBUG_MODE === "debug" ||
   process.env.SCAN_DEBUG_MODE === "debug" ||
   process.env.SHIFTLEFT_LOGGING_LEVEL === "debug" ||
   process.env.NODE_ENV === "development";

package/docker.js

@@ -21,6 +21,7 @@ let isWinLocalTLS = false;
 
 // Debug mode flag
 const DEBUG_MODE =
+  process.env.CDXGEN_DEBUG_MODE === "debug" ||
   process.env.SCAN_DEBUG_MODE === "debug" ||
   process.env.SHIFTLEFT_LOGGING_LEVEL === "debug";
 

package/index.js

@@ -55,6 +55,7 @@ let SBT_CACHE_DIR =
 
 // Debug mode flag
 const DEBUG_MODE =
+  process.env.CDXGEN_DEBUG_MODE === "debug" ||
   process.env.SCAN_DEBUG_MODE === "debug" ||
   process.env.SHIFTLEFT_LOGGING_LEVEL === "debug" ||
   process.env.NODE_ENV === "development";
@@ -1189,6 +1190,15 @@ const createJavaBom = async (path, options) => {
           const retMap = utils.parseGradleProjects(cmdOutput);
           const allProjects = retMap.projects || [];
           let rootProject = retMap.rootProject;
+          if (rootProject) {
+            parentComponent = {
+              group: "",
+              name: rootProject,
+              version: "latest",
+              type: "maven",
+              qualifiers: { type: "jar" }
+            };
+          }
           if (!allProjects) {
             console.log(
               "No projects found. Is this a gradle multi-project application?"
@@ -1200,6 +1210,37 @@ const createJavaBom = async (path, options) => {
               allProjects.length,
               "gradle sub-projects. This might take a while ..."
             );
+            // We need the first dependency between the root project and child projects
+            // See: #249 and #315
+            const rootDependsOn = [];
+            for (let sp of allProjects) {
+              sp = sp.replace(":", "");
+              rootDependsOn.push(
+                decodeURIComponent(
+                  new PackageURL(
+                    "maven",
+                    "",
+                    sp,
+                    parentComponent.version,
+                    parentComponent.qualifiers,
+                    null
+                  ).toString()
+                )
+              );
+            }
+            dependencies.push({
+              ref: decodeURIComponent(
+                new PackageURL(
+                  "maven",
+                  parentComponent.group,
+                  parentComponent.name,
+                  parentComponent.version,
+                  parentComponent.qualifiers,
+                  null
+                ).toString()
+              ),
+              dependsOn: rootDependsOn
+            });
             for (let sp of allProjects) {
               let gradleDepArgs = [
                 sp + ":dependencies",
@@ -1232,15 +1273,20 @@ const createJavaBom = async (path, options) => {
               }
               const sstdout = sresult.stdout;
               if (sstdout) {
+                sp = sp.replace(":", "");
                 const cmdOutput = Buffer.from(sstdout).toString();
-                const parsedList = utils.parseGradleDep(cmdOutput, rootProject);
+                const parsedList = utils.parseGradleDep(cmdOutput, sp);
                 const dlist = parsedList.pkgList;
-                parentComponent = dlist.splice(0, 1)[0];
+                // Do not overwrite the parentComponent in multi-project mode
+                if (!parentComponent) {
+                  parentComponent = dlist.splice(0, 1)[0];
+                }
                 if (
                   parsedList.dependenciesList &&
                   parsedList.dependenciesList
                 ) {
-                  dependencies = dependencies.concat(
+                  dependencies = mergeDependencies(
+                    dependencies,
                     parsedList.dependenciesList
                   );
                 }
@@ -1347,7 +1393,10 @@ const createJavaBom = async (path, options) => {
             const dlist = parsedList.pkgList;
             parentComponent = dlist.splice(0, 1)[0];
             if (parsedList.dependenciesList && parsedList.dependenciesList) {
-              dependencies = dependencies.concat(parsedList.dependenciesList);
+              dependencies = mergeDependencies(
+                dependencies,
+                parsedList.dependenciesList
+              );
             }
             if (dlist && dlist.length) {
               pkgList = pkgList.concat(dlist);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cyclonedx/cdxgen",
-  "version": "8.4.6",
+  "version": "8.4.7",
   "description": "Creates CycloneDX Software Bill-of-Materials (SBOM) from source or container image",
   "homepage": "http://github.com/cyclonedx/cdxgen",
   "author": "Prabhu Subramanian <prabhu@appthreat.com>",
@@ -89,6 +89,6 @@
   ],
   "devDependencies": {
     "eslint": "^8.40.0",
-    "jest": "^26.6.3"
+    "jest": "^29.5.0"
   }
 }

package/utils.js

@@ -20,6 +20,7 @@ const { PackageURL } = require("packageurl-js");
 
 // Debug mode flag
 const DEBUG_MODE =
+  process.env.CDXGEN_DEBUG_MODE === "debug" ||
   process.env.SCAN_DEBUG_MODE === "debug" ||
   process.env.SHIFTLEFT_LOGGING_LEVEL === "debug";
 
@@ -1203,8 +1204,28 @@ const parseGradleDep = function (
     const keys_cache = {};
     let last_level = 0;
     let last_purl = `pkg:maven/${rootProjectName}@${rootProjectVersion}?type=jar`;
+    // Bug: 249. Get any sub-projects refered here
+    const retMap = parseGradleProjects(rawOutput);
     const level_trees = {};
     level_trees[last_purl] = [];
+    if (retMap && retMap.projects) {
+      const subDependsOn = [];
+      for (const sd of retMap.projects) {
+        subDependsOn.push(
+          decodeURIComponent(
+            new PackageURL(
+              "maven",
+              "",
+              sd.replace(":", ""),
+              rootProject.version,
+              rootProject.qualifiers,
+              null
+            ).toString()
+          )
+        );
+      }
+      level_trees[last_purl] = subDependsOn;
+    }
     let stack = [last_purl];
     const depRegex =
       /^.*?--- +(?<group>[^\s:]+):(?<name>[^\s:]+)(?::(?:{strictly [[]?)?(?<versionspecified>[^,\s:}]+))?(?:})?(?:[^->]* +-> +(?<versionoverride>[^\s:]+))?/gm;
@@ -1387,6 +1408,14 @@ const parseGradleProjects = function (rawOutput) {
             projects.add(projName);
           }
         }
+      } else if (l.includes("--- project ")) {
+        const tmpB = l.split("--- project ");
+        if (tmpB && tmpB.length > 1) {
+          let projName = tmpB[1];
+          if (projName.startsWith(":")) {
+            projects.add(projName);
+          }
+        }
       }
     });
     return {

package/utils.test.js

@@ -206,6 +206,11 @@ test("parse gradle dependencies", () => {
   );
   expect(parsedList.pkgList.length).toEqual(68);
   expect(parsedList.dependenciesList.length).toEqual(69);
+  parsedList = utils.parseGradleDep(
+    fs.readFileSync("./test/data/gradle-out-249.dep", { encoding: "utf-8" })
+  );
+  expect(parsedList.pkgList.length).toEqual(21);
+  expect(parsedList.dependenciesList.length).toEqual(21);
 });
 
 test("parse gradle projects", () => {