@cyclonedx/cdxgen 9.10.1 → 9.11.0

package/README.md

@@ -22,7 +22,7 @@ Most SBOM tools are like barcode scanners. They can scan a few package manifest
 | ------------------------------- | ----------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------- | -------- |
 | Node.js                         | npm-shrinkwrap.json, package-lock.json, pnpm-lock.yaml, yarn.lock, rush.js, bower.json, .min.js                   | Yes except .min.js                                                                                | Yes      |
 | Java                            | maven (pom.xml [1]), gradle (build.gradle, .kts), scala (sbt), bazel                                              | Yes unless pom.xml is manually parsed due to unavailability of maven or errors                    | Yes      |
-| PHP                             | composer.lock                                                                                                     | Yes                                                                                               |          |
+| PHP                             | composer.lock                                                                                                     | Yes                                                                                               | Yes      |
 | Python                          | pyproject.toml, setup.py, requirements.txt [2], Pipfile.lock, poetry.lock, pdm.lock, bdist_wheel, .whl, .egg-info | Yes using the automatic pip install/freeze. When disabled, only with Pipfile.lock and poetry.lock | Yes      |
 | Go                              | binary, go.mod, go.sum, Gopkg.lock                                                                                | Yes except binary                                                                                 | Yes      |
 | Ruby                            | Gemfile.lock, gemspec                                                                                             | Only for Gemfile.lock                                                                             |          |
@@ -347,6 +347,7 @@ cdxgen can retain the dependency tree under the `dependencies` attribute for a s
 - Python (requirements.txt, setup.py, pyproject.toml, poetry.lock)
 - .NET (project.assets.json, paket.lock)
 - Go (go.mod)
+- PHP (composer.lock)
 
 ## Environment variables
 

package/bin/cdxgen.js

@@ -220,6 +220,17 @@ const args = yargs(hideBin(process.argv))
     description: "Additional glob pattern(s) to ignore",
     hidden: true
   })
+  .option("export-proto", {
+    type: "boolean",
+    default: false,
+    description: "Serialize and export BOM as protobuf binary.",
+    hidden: true
+  })
+  .option("proto-bin-file", {
+    description: "Path for the serialized protobuf binary.",
+    default: "bom.cdx",
+    hidden: true
+  })
   .completion("completion", "Generate bash/zsh completion")
   .array("filter")
   .array("only")
@@ -582,7 +593,11 @@ const checkPermissions = (filePath) => {
       console.log(err);
     }
   }
-
+  // Protobuf serialization
+  if (options.exportProto) {
+    const protobomModule = await import("../protobom.js");
+    protobomModule.writeBinary(bomNSData.bomJson, options.protoBinFile);
+  }
   if (options.print && bomNSData.bomJson && bomNSData.bomJson.components) {
     printDependencyTree(bomNSData.bomJson);
     printTable(bomNSData.bomJson);

package/bin/evinse.js

@@ -63,7 +63,8 @@ const args = yargs(hideBin(process.argv))
       "python",
       "android",
       "c",
-      "cpp"
+      "cpp",
+      "php"
     ]
   })
   .option("db-path", {

package/data/frameworks-list.json

@@ -160,6 +160,31 @@
     "pkg:generic/userver",
     "pkg:generic/Wt/",
     "pkg:generic/klone",
-    "pkg:generic/kcgi"
+    "pkg:generic/kcgi",
+    "pkg:composer/laravel",
+    "pkg:composer/symfony",
+    "pkg:composer/codeigniter",
+    "pkg:composer/cakephp",
+    "pkg:composer/zend",
+    "pkg:composer/yii",
+    "pkg:composer/aura",
+    "pkg:composer/phalcon",
+    "pkg:composer/fatfree",
+    "pkg:composer/qcodo",
+    "pkg:composer/fuelphp",
+    "pkg:composer/slim",
+    "pkg:composer/phpixie",
+    "pkg:composer/ice",
+    "pkg:composer/modx",
+    "pkg:composer/typo",
+    "pkg:composer/cappuccino",
+    "pkg:composer/pop",
+    "pkg:composer/zest",
+    "pkg:composer/silverstripe",
+    "pkg:composer/dash",
+    "pkg:composer/roducks",
+    "pkg:composer/queryphp",
+    "pkg:composer/silex",
+    "pkg:composer/psr"
   ]
 }

package/evinser.js

@@ -207,7 +207,9 @@ export const createSlice = (
   if (!filePath) {
     return;
   }
-  console.log(`Create ${sliceType} slice for ${purlOrLanguage} ${filePath}`);
+  console.log(
+    `Create ${sliceType} slice for ${path.resolve(filePath)}. Please wait ...`
+  );
   const language = purlOrLanguage.startsWith("pkg:")
     ? purlToLanguage(purlOrLanguage, filePath)
     : purlOrLanguage;
@@ -271,22 +273,35 @@ export const purlToLanguage = (purl, filePath) => {
     case "pypi":
       language = "python";
       break;
+    case "composer":
+      language = "php";
+      break;
+    case "generic":
+      language = "c";
   }
   return language;
 };
 
-export const initFromSbom = (components) => {
+export const initFromSbom = (components, language) => {
   const purlLocationMap = {};
   const purlImportsMap = {};
   for (const comp of components) {
     if (!comp || !comp.evidence) {
       continue;
     }
-    (comp.properties || [])
-      .filter((v) => v.name === "ImportedModules")
-      .forEach((v) => {
-        purlImportsMap[comp.purl] = (v.value || "").split(",");
-      });
+    if (language === "php") {
+      (comp.properties || [])
+        .filter((v) => v.name === "Namespaces")
+        .forEach((v) => {
+          purlImportsMap[comp.purl] = (v.value || "").split(", ");
+        });
+    } else {
+      (comp.properties || [])
+        .filter((v) => v.name === "ImportedModules")
+        .forEach((v) => {
+          purlImportsMap[comp.purl] = (v.value || "").split(",");
+        });
+    }
     if (comp.evidence.occurrences) {
       purlLocationMap[comp.purl] = new Set(
         comp.evidence.occurrences.map((v) => v.location)
@@ -323,7 +338,7 @@ export const analyzeProject = async (dbObjMap, options) => {
   const components = bomJson.components || [];
   // Load any existing purl-location information from the sbom.
   // For eg: cdxgen populates this information for javascript projects
-  let { purlLocationMap, purlImportsMap } = initFromSbom(components);
+  let { purlLocationMap, purlImportsMap } = initFromSbom(components, language);
   // Do reachables first so that usages slicing can reuse the atom file
   if (options.withReachables) {
     if (
@@ -487,6 +502,11 @@ export const parseSliceUsages = async (
     typesToLookup.add(slice.fullName);
     addToOverrides(lKeyOverrides, slice.fullName, fileName, slice.lineNumber);
   }
+  // PHP imports from usages
+  if (slice.code && slice.code.startsWith("use") && !usages.length) {
+    typesToLookup.add(slice.fullName);
+    addToOverrides(lKeyOverrides, slice.fullName, fileName, slice.lineNumber);
+  }
   for (const ausage of usages) {
     const ausageLine =
       ausage?.targetObj?.lineNumber || ausage?.definedBy?.lineNumber;
@@ -616,12 +636,25 @@ export const parseSliceUsages = async (
     if (purlImportsMap && Object.keys(purlImportsMap).length) {
       for (const apurl of Object.keys(purlImportsMap)) {
         const apurlImports = purlImportsMap[apurl];
-        if (apurlImports && apurlImports.includes(atype)) {
-          if (!purlLocationMap[apurl]) {
-            purlLocationMap[apurl] = new Set();
+        if (language === "php") {
+          for (const aimp of apurlImports) {
+            if (atype.startsWith(aimp)) {
+              if (!purlLocationMap[apurl]) {
+                purlLocationMap[apurl] = new Set();
+              }
+              if (lKeyOverrides[atype]) {
+                purlLocationMap[apurl].add(...lKeyOverrides[atype]);
+              }
+            }
           }
-          if (lKeyOverrides[atype]) {
-            purlLocationMap[apurl].add(...lKeyOverrides[atype]);
+        } else {
+          if (apurlImports && apurlImports.includes(atype)) {
+            if (!purlLocationMap[apurl]) {
+              purlLocationMap[apurl] = new Set();
+            }
+            if (lKeyOverrides[atype]) {
+              purlLocationMap[apurl].add(...lKeyOverrides[atype]);
+            }
           }
         }
       }
@@ -715,6 +748,11 @@ export const isFilterableType = (
       return true;
     }
   }
+  if (["php"].includes(language)) {
+    if (!typeFullName.includes("\\") && !typeFullName.startsWith("use")) {
+      return true;
+    }
+  }
   if (userDefinedTypesMap[typeFullName]) {
     return true;
   }
@@ -739,12 +777,16 @@ export const detectServicesFromUsages = (language, slice, servicesMap = {}) => {
     let endpoints = [];
     let authenticated = undefined;
     if (targetObj && targetObj?.resolvedMethod) {
-      endpoints = extractEndpoints(language, targetObj?.resolvedMethod);
+      if (language != "php") {
+        endpoints = extractEndpoints(language, targetObj?.resolvedMethod);
+      }
       if (targetObj?.resolvedMethod.toLowerCase().includes("auth")) {
         authenticated = true;
       }
     } else if (definedBy && definedBy?.resolvedMethod) {
-      endpoints = extractEndpoints(language, definedBy?.resolvedMethod);
+      if (language != "php") {
+        endpoints = extractEndpoints(language, definedBy?.resolvedMethod);
+      }
       if (definedBy?.resolvedMethod.toLowerCase().includes("auth")) {
         authenticated = true;
       }
@@ -752,12 +794,17 @@ export const detectServicesFromUsages = (language, slice, servicesMap = {}) => {
     if (usage.invokedCalls) {
       for (const acall of usage.invokedCalls) {
         if (acall.resolvedMethod) {
-          const tmpEndpoints = extractEndpoints(language, acall.resolvedMethod);
-          if (acall.resolvedMethod.toLowerCase().includes("auth")) {
-            authenticated = true;
-          }
-          if (tmpEndpoints && tmpEndpoints.length) {
-            endpoints = (endpoints || []).concat(tmpEndpoints);
+          if (language != "php") {
+            const tmpEndpoints = extractEndpoints(
+              language,
+              acall.resolvedMethod
+            );
+            if (acall.resolvedMethod.toLowerCase().includes("auth")) {
+              authenticated = true;
+            }
+            if (tmpEndpoints && tmpEndpoints.length) {
+              endpoints = (endpoints || []).concat(tmpEndpoints);
+            }
           }
         }
       }
@@ -791,7 +838,7 @@ export const detectServicesFromUDT = (
   servicesMap
 ) => {
   if (
-    ["python", "py", "c", "cpp", "c++"].includes(language) &&
+    ["python", "py", "c", "cpp", "c++", "php"].includes(language) &&
     userDefinedTypes &&
     userDefinedTypes.length
   ) {
@@ -803,7 +850,15 @@ export const detectServicesFromUDT = (
         audt.name.toLowerCase().includes("registerhandler") ||
         audt.name.toLowerCase().includes("endpoint") ||
         audt.name.toLowerCase().includes("api") ||
-        audt.name.toLowerCase().includes("add_method")
+        audt.name.toLowerCase().includes("add_method") ||
+        audt.name.toLowerCase().includes("get") ||
+        audt.name.toLowerCase().includes("post") ||
+        audt.name.toLowerCase().includes("delete") ||
+        audt.name.toLowerCase().includes("put") ||
+        audt.name.toLowerCase().includes("head") ||
+        audt.name.toLowerCase().includes("options") ||
+        audt.name.toLowerCase().includes("addRoute") ||
+        audt.name.toLowerCase().includes("connect")
       ) {
         const fields = audt.fields || [];
         if (
@@ -819,14 +874,14 @@ export const detectServicesFromUDT = (
               audt.fileName.replace(".py", "")
             )}-service`;
           }
-          if (!servicesMap[serviceName]) {
-            servicesMap[serviceName] = {
-              endpoints: new Set(),
-              authenticated: false,
-              xTrustBoundary: undefined
-            };
-          }
-          if (endpoints) {
+          if (endpoints && endpoints.length) {
+            if (!servicesMap[serviceName]) {
+              servicesMap[serviceName] = {
+                endpoints: new Set(),
+                authenticated: false,
+                xTrustBoundary: undefined
+              };
+            }
             for (const endpoint of endpoints) {
               servicesMap[serviceName].endpoints.add(endpoint);
             }
@@ -897,7 +952,7 @@ export const extractEndpoints = (language, code) => {
     default:
       endpoints = (code.match(/['"](.*?)['"]/gi) || [])
         .map((v) => v.replace(/["']/g, "").replace("\n", ""))
-        .filter((v) => v.length > 2);
+        .filter((v) => v.length > 2 && v.includes("/"));
       break;
   }
   return endpoints;
@@ -1015,7 +1070,7 @@ export const createEvinseFile = (sliceArtefacts, options) => {
     console.log(evinseOutFile, "created successfully.");
   } else {
     console.log(
-      "Unable to identify component evidence for the input SBOM. Only java, javascript and python projects are supported by evinse."
+      "Unable to identify component evidence for the input SBOM. Only java, javascript, python, and php projects are supported by evinse."
     );
   }
   if (tempDir && tempDir.startsWith(tmpdir())) {
@@ -1249,6 +1304,8 @@ export const getClassTypeFromSignature = (language, typeFullName) => {
       .replace(".<body>", "")
       .replace(".__iter__", "")
       .replace(".__init__", "");
+  } else if (["php"].includes(language)) {
+    typeFullName = typeFullName.split("->")[0].split("::")[0];
   }
   if (
     typeFullName.startsWith("<unresolved") ||

package/index.js

@@ -4048,11 +4048,18 @@ export const createContainerSpecLikeBom = async (path, options) => {
  * @param options Parse options from the cli
  */
 export const createPHPBom = (path, options) => {
+  let dependencies = [];
+  let parentComponent = {};
   const composerJsonFiles = getAllFiles(
     path,
     (options.multiProject ? "**/" : "") + "composer.json",
     options
   );
+  if (!options.exclude) {
+    options.exclude = [];
+  }
+  // Ignore vendor directories for lock files
+  options.exclude.push("**/vendor/**");
   let composerLockFiles = getAllFiles(
     path,
     (options.multiProject ? "**/" : "") + "composer.lock",
@@ -4117,17 +4124,75 @@ export const createPHPBom = (path, options) => {
   );
   if (composerLockFiles.length) {
     for (const f of composerLockFiles) {
+      const basePath = dirname(f);
       if (DEBUG_MODE) {
         console.log(`Parsing ${f}`);
       }
-      const dlist = parseComposerLock(f);
-      if (dlist && dlist.length) {
-        pkgList = pkgList.concat(dlist);
+      let rootRequires = [];
+      // Is there a composer.json to find the parent component
+      if (
+        !Object.keys(parentComponent).length &&
+        existsSync(join(basePath, "composer.json"))
+      ) {
+        const composerData = JSON.parse(
+          readFileSync(join(basePath, "composer.json"), { encoding: "utf-8" })
+        );
+        rootRequires = composerData.require;
+        const pkgName = composerData.name;
+        if (pkgName) {
+          parentComponent.group = dirname(pkgName);
+          if (parentComponent.group === ".") {
+            parentComponent.group = "";
+          }
+          parentComponent.name = basename(pkgName);
+          parentComponent.type = "application";
+          parentComponent.version = composerData.version || "latest";
+          parentComponent["bom-ref"] = decodeURIComponent(
+            new PackageURL(
+              "composer",
+              parentComponent.group,
+              parentComponent.name,
+              parentComponent.version,
+              null,
+              null
+            ).toString()
+          );
+        }
+      }
+      const retMap = parseComposerLock(f, rootRequires);
+      if (retMap.pkgList && retMap.pkgList.length) {
+        pkgList = pkgList.concat(retMap.pkgList);
+      }
+      if (retMap.dependenciesList) {
+        if (!Object.keys(parentComponent).length) {
+          parentComponent = createDefaultParentComponent(
+            path,
+            "composer",
+            options
+          );
+        }
+        // Complete the dependency tree by making parent component depend on the first level
+        const parentDependsOn = [];
+        for (const p of retMap.rootList) {
+          parentDependsOn.push(p["bom-ref"]);
+        }
+        const pdependencies = {
+          ref: parentComponent["bom-ref"],
+          dependsOn: parentDependsOn
+        };
+        dependencies = mergeDependencies(
+          dependencies,
+          retMap.dependenciesList,
+          parentComponent
+        );
+        dependencies.splice(0, 0, pdependencies);
       }
     }
     return buildBomNSData(options, pkgList, "composer", {
       src: path,
-      filename: composerLockFiles.join(", ")
+      filename: composerLockFiles.join(", "),
+      dependencies,
+      parentComponent
     });
   }
   return {};
@@ -4331,7 +4396,7 @@ export const createCsharpBom = async (
         console.log(`Parsing ${f}`);
       }
       pkgData = readFileSync(f, { encoding: "utf-8" });
-      const results = await parsePaketLockData(pkgData);
+      const results = await parsePaketLockData(pkgData, f);
       const dlist = results.pkgList;
       const deps = results.dependenciesList;
       if (dlist && dlist.length) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cyclonedx/cdxgen",
-  "version": "9.10.1",
+  "version": "9.11.0",
   "description": "Creates CycloneDX Software Bill of Materials (SBOM) from source or container image",
   "homepage": "http://github.com/cyclonedx/cdxgen",
   "author": "Prabhu Subramanian <prabhu@appthreat.com>",
@@ -56,8 +56,8 @@
   },
   "dependencies": {
     "@babel/parser": "^7.23.6",
-    "@babel/traverse": "^7.23.6",
-    "@npmcli/arborist": "7.2.0",
+    "@babel/traverse": "^7.23.7",
+    "@npmcli/arborist": "7.2.2",
     "ajv": "^8.12.0",
     "ajv-formats": "^2.1.1",
     "cheerio": "^1.0.0-rc.12",
@@ -83,7 +83,8 @@
     "yargs": "^17.7.2"
   },
   "optionalDependencies": {
-    "@appthreat/atom": "1.7.5",
+    "@appthreat/atom": "1.8.3",
+    "@appthreat/cdx-proto": "^0.0.4",
     "@cyclonedx/cdxgen-plugins-bin": "^1.5.4",
     "@cyclonedx/cdxgen-plugins-bin-windows-amd64": "^1.5.4",
     "@cyclonedx/cdxgen-plugins-bin-arm64": "^1.5.4",
@@ -93,7 +94,7 @@
     "connect": "^3.7.0",
     "jsonata": "^2.0.3",
     "sequelize": "^6.35.2",
-    "sqlite3": "^5.1.6"
+    "sqlite3": "^5.1.7"
   },
   "files": [
     "*.js",
@@ -105,7 +106,7 @@
     "docsify-cli": "^4.4.4",
     "eslint": "^8.56.0",
     "eslint-config-prettier": "^9.1.0",
-    "eslint-plugin-prettier": "^5.0.1",
+    "eslint-plugin-prettier": "^5.1.2",
     "jest": "^29.7.0",
     "prettier": "3.1.1"
   }

package/protobom.js

@@ -0,0 +1,36 @@
+import { Bom } from "@appthreat/cdx-proto";
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+
+const stringifyIfNeeded = (bomJson) => {
+  if (typeof bomJson === "string" || bomJson instanceof String) {
+    return bomJson;
+  }
+  return JSON.stringify(bomJson);
+};
+
+export const writeBinary = (bomJson, binFile) => {
+  if (bomJson && binFile) {
+    const bomObject = new Bom();
+    writeFileSync(
+      binFile,
+      bomObject
+        .fromJsonString(stringifyIfNeeded(bomJson), {
+          ignoreUnknownFields: true
+        })
+        .toBinary({ writeUnknownFields: true })
+    );
+  }
+};
+
+export const readBinary = (binFile, asJson = true) => {
+  if (!existsSync(binFile)) {
+    return undefined;
+  }
+  const bomObject = new Bom().fromBinary(readFileSync(binFile), {
+    readUnknownFields: true
+  });
+  if (asJson) {
+    return bomObject.toJson({ emitDefaultValues: true });
+  }
+  return bomObject;
+};

package/protobom.test.js

@@ -0,0 +1,32 @@
+import { expect, test } from "@jest/globals";
+import { tmpdir } from "node:os";
+import { existsSync, rmSync, mkdtempSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+
+import { writeBinary, readBinary } from "./protobom.js";
+
+const tempDir = mkdtempSync(join(tmpdir(), "bin-tests-"));
+const testBom = JSON.parse(
+  readFileSync("./test/data/bom-java.json", { encoding: "utf-8" })
+);
+
+test("proto binary tests", async () => {
+  const binFile = join(tempDir, "test.cdx.bin");
+  writeBinary({}, binFile);
+  expect(existsSync(binFile)).toBeTruthy();
+  writeBinary(testBom, binFile);
+  expect(existsSync(binFile)).toBeTruthy();
+  let bomObject = readBinary(binFile);
+  expect(bomObject).toBeDefined();
+  expect(bomObject.serialNumber).toEqual(
+    "urn:uuid:cc8b5a04-2698-4375-b04c-cedfa4317fee"
+  );
+  bomObject = readBinary(binFile, false);
+  expect(bomObject).toBeDefined();
+  expect(bomObject.serialNumber).toEqual(
+    "urn:uuid:cc8b5a04-2698-4375-b04c-cedfa4317fee"
+  );
+  if (tempDir && tempDir.startsWith(tmpdir()) && rmSync) {
+    rmSync(tempDir, { recursive: true, force: true });
+  }
+});

package/utils.js

@@ -666,6 +666,12 @@ export const parsePkgLock = async (pkgLockFile, options = {}) => {
         purl: purlString,
         "bom-ref": decodeURIComponent(purlString)
       };
+      if (node.resolved) {
+        pkg.properties.push({
+          name: "ResolvedUrl",
+          value: node.resolved
+        });
+      }
     }
     const packageLicense = node.package.license;
     if (packageLicense) {
@@ -694,8 +700,9 @@ export const parsePkgLock = async (pkgLockFile, options = {}) => {
             null
           ).toString()
         );
-
-        workspaceDependsOn.push(depWorkspacePurlString);
+        if (decodeURIComponent(purlString) !== depWorkspacePurlString) {
+          workspaceDependsOn.push(depWorkspacePurlString);
+        }
       }
     }
 
@@ -726,7 +733,9 @@ export const parsePkgLock = async (pkgLockFile, options = {}) => {
             null
           ).toString()
         );
-        childrenDependsOn.push(depChildString);
+        if (decodeURIComponent(purlString) !== depChildString) {
+          childrenDependsOn.push(depChildString);
+        }
       }
     }
 
@@ -735,31 +744,35 @@ export const parsePkgLock = async (pkgLockFile, options = {}) => {
     for (const edge of node.edgesOut.values()) {
       let targetVersion;
       let targetName;
-
+      let foundMatch = false;
       // if the edge doesn't have an integrity, it's likely a peer dependency
       // which isn't installed
-      let edgeToIntegrity = edge.to ? edge.to.integrity : null;
-      // let packageName = node.packageName;
-      // let edgeName = edge.name;
+      // Bug #795. At times, npm loses the integrity node completely and such packages are getting missed out
+      // To keep things safe, we include these packages.
+      let edgeToIntegrity = edge.to ? edge.to.integrity : undefined;
       if (!edgeToIntegrity) {
-        continue;
-      }
-
-      // the edges don't actually contain a version, so we need to search the root node
-      // children to find the correct version. we check the node children first, then
-      // we check the root node children
-      let foundMatch = false;
-      for (const child of node.children) {
-        if (child[1].integrity == edgeToIntegrity) {
-          targetName = child[0].replace(/node_modules\//g, "");
-          // The package name could be different from the targetName retrieved
-          // Eg: "string-width-cjs": "npm:string-width@^4.2.0",
-          if (child[1].packageName && child[1].packageName !== targetName) {
-            targetName = child[1].packageName;
-          }
-          targetVersion = child[1].version;
-          foundMatch = true;
-          break;
+        // This hack is required to fix the package name
+        targetName = node.name.replace(/-cjs$/, "");
+        targetVersion = node.version;
+        foundMatch = true;
+      } else {
+        // the edges don't actually contain a version, so we need to search the root node
+        // children to find the correct version. we check the node children first, then
+        // we check the root node children
+        for (const child of node.children) {
+          if (edgeToIntegrity) {
+            if (child[1].integrity == edgeToIntegrity) {
+              targetName = child[0].replace(/node_modules\//g, "");
+              // The package name could be different from the targetName retrieved
+              // Eg: "string-width-cjs": "npm:string-width@^4.2.0",
+              if (child[1].packageName && child[1].packageName !== targetName) {
+                targetName = child[1].packageName;
+              }
+              targetVersion = child[1].version;
+              foundMatch = true;
+              break;
+            }
+          }
         }
       }
       if (!foundMatch) {
@@ -792,8 +805,12 @@ export const parsePkgLock = async (pkgLockFile, options = {}) => {
           null
         ).toString()
       );
-      pkgDependsOn.push(depPurlString);
-      if (edge.to == null) continue;
+      if (decodeURIComponent(purlString) !== depPurlString) {
+        pkgDependsOn.push(depPurlString);
+      }
+      if (edge.to == null) {
+        continue;
+      }
       const { pkgList: childPkgList, dependenciesList: childDependenciesList } =
         parseArboristNode(
           edge.to,
@@ -4042,6 +4059,9 @@ export const parseGemfileLockData = async function (gemLockData) {
       const tmpA = l.split(" ");
       if (tmpA && tmpA.length == 2) {
         const name = tmpA[0];
+        if (name === "remote:") {
+          return;
+        }
         if (!pkgnames[name]) {
           let version = tmpA[1].split(", ")[0];
           version = version.replace(/[(>=<)~ ]/g, "");
@@ -4060,7 +4080,8 @@ export const parseGemfileLockData = async function (gemLockData) {
       l === "PLATFORMS" ||
       l === "DEPENDENCIES" ||
       l === "RUBY VERSION" ||
-      l === "BUNDLED WITH"
+      l === "BUNDLED WITH" ||
+      l === "PATH"
     ) {
       specsFound = false;
     }
@@ -5577,7 +5598,7 @@ export const parseCsPkgLockData = async function (csLockData) {
   return pkgList;
 };
 
-export const parsePaketLockData = async function (paketLockData) {
+export const parsePaketLockData = async function (paketLockData, pkgLockFile) {
   const pkgList = [];
   const dependenciesList = [];
   const dependenciesMap = {};
@@ -5605,14 +5626,39 @@ export const parsePaketLockData = async function (paketLockData) {
     if (match) {
       const name = match[1];
       const version = match[2];
-      const purl = decodeURIComponent(
-        new PackageURL("nuget", "", name, version, null, null).toString()
-      );
+      const purl = new PackageURL(
+        "nuget",
+        "",
+        name,
+        version,
+        null,
+        null
+      ).toString();
       pkg = {
         group: "",
-        name: name,
-        version: version,
-        purl: purl
+        name,
+        version,
+        purl,
+        "bom-ref": decodeURIComponent(purl),
+        properties: [
+          {
+            name: "SrcFile",
+            value: pkgLockFile
+          }
+        ],
+        evidence: {
+          identity: {
+            field: "purl",
+            confidence: 1,
+            methods: [
+              {
+                technique: "manifest-analysis",
+                confidence: 1,
+                value: pkgLockFile
+              }
+            ]
+          }
+        }
       };
       pkgList.push(pkg);
       dependenciesMap[purl] = new Set();
@@ -5664,13 +5710,25 @@ export const parsePaketLockData = async function (paketLockData) {
     dependenciesList
   };
 };
+
 /**
  * Parse composer lock file
  *
  * @param {string} pkgLockFile composer.lock file
+ * @param {array} rootRequires require section from composer.json
  */
-export const parseComposerLock = function (pkgLockFile) {
+export const parseComposerLock = function (pkgLockFile, rootRequires) {
   const pkgList = [];
+  const dependenciesList = [];
+  const dependenciesMap = {};
+  const pkgNamePurlMap = {};
+  const rootList = [];
+  const rootRequiresMap = {};
+  if (rootRequires) {
+    for (const rr of Object.keys(rootRequires)) {
+      rootRequiresMap[rr] = true;
+    }
+  }
   if (existsSync(pkgLockFile)) {
     let lockData = {};
     try {
@@ -5687,6 +5745,7 @@ export const parseComposerLock = function (pkgLockFile) {
       if (lockData["packages-dev"]) {
         packages["optional"] = lockData["packages-dev"];
       }
+      // Pass 1: Collect all packages
       for (const compScope in packages) {
         for (const i in packages[compScope]) {
           const pkg = packages[compScope][i];
@@ -5694,19 +5753,26 @@ export const parseComposerLock = function (pkgLockFile) {
           if (!pkg || !pkg.name || !pkg.version) {
             continue;
           }
+
           let group = dirname(pkg.name);
           if (group === ".") {
             group = "";
           }
           const name = basename(pkg.name);
-          pkgList.push({
+          const purl = new PackageURL(
+            "composer",
+            group,
+            name,
+            pkg.version,
+            null,
+            null
+          ).toString();
+          const apkg = {
             group: group,
             name: name,
-            // Remove leading v from version to work around bug
-            //  https://github.com/OSSIndex/vulns/issues/231
-            // @TODO: remove workaround when DependencyTrack v4.4 is released,
-            //  which has it's own workaround. Or when the 231 bug is fixed.
-            version: pkg.version.replace(/^v/, ""),
+            purl,
+            "bom-ref": decodeURIComponent(purl),
+            version: pkg.version,
             repository: pkg.source,
             license: pkg.license,
             description: pkg.description,
@@ -5730,12 +5796,63 @@ export const parseComposerLock = function (pkgLockFile) {
                 ]
               }
             }
-          });
+          };
+          if (pkg.autoload && Object.keys(pkg.autoload).length) {
+            const namespaces = [];
+            for (const aaload of Object.keys(pkg.autoload)) {
+              if (aaload.startsWith("psr")) {
+                for (const ans of Object.keys(pkg.autoload[aaload])) {
+                  namespaces.push(ans.trim());
+                }
+              }
+            }
+            if (namespaces.length) {
+              apkg.properties.push({
+                name: "Namespaces",
+                value: namespaces.join(", ")
+              });
+            }
+          }
+          pkgList.push(apkg);
+          dependenciesMap[purl] = new Set();
+          pkgNamePurlMap[pkg.name] = purl;
+          // Add this package to the root list if needed
+          if (rootRequiresMap[pkg.name]) {
+            rootList.push(apkg);
+          }
+        }
+      }
+      // Pass 2: Construct dependency tree
+      for (const compScope in packages) {
+        for (const i in packages[compScope]) {
+          const pkg = packages[compScope][i];
+          if (!pkg || !pkg.name || !pkg.version) {
+            continue;
+          }
+          if (!pkg.require || !Object.keys(pkg.require).length) {
+            continue;
+          }
+          const purl = pkgNamePurlMap[pkg.name];
+          for (const adepName of Object.keys(pkg.require)) {
+            if (pkgNamePurlMap[adepName]) {
+              dependenciesMap[purl].add(pkgNamePurlMap[adepName]);
+            }
+          }
         }
       }
     }
   }
-  return pkgList;
+  for (const ref in dependenciesMap) {
+    dependenciesList.push({
+      ref: ref,
+      dependsOn: Array.from(dependenciesMap[ref])
+    });
+  }
+  return {
+    pkgList,
+    dependenciesList,
+    rootList
+  };
 };
 
 export const parseSbtTree = (sbtTreeFile) => {

package/utils.test.js

@@ -1214,7 +1214,7 @@ test("parse github actions workflow data", async () => {
   dep_list = parseGitHubWorkflowData(
     readFileSync("./.github/workflows/repotests.yml", { encoding: "utf-8" })
   );
-  expect(dep_list.length).toEqual(8);
+  expect(dep_list.length).toEqual(7);
   expect(dep_list[0]).toEqual({
     group: "actions",
     name: "checkout",
@@ -1351,14 +1351,30 @@ test("parse paket.lock", async () => {
     dependenciesList: []
   });
   const dep_list = await parsePaketLockData(
-    readFileSync("./test/data/paket.lock", { encoding: "utf-8" })
+    readFileSync("./test/data/paket.lock", { encoding: "utf-8" }),
+    "./test/data/paket.lock"
   );
   expect(dep_list.pkgList.length).toEqual(13);
   expect(dep_list.pkgList[0]).toEqual({
     group: "",
     name: "0x53A.ReferenceAssemblies.Paket",
     version: "0.2",
-    purl: "pkg:nuget/0x53A.ReferenceAssemblies.Paket@0.2"
+    purl: "pkg:nuget/0x53A.ReferenceAssemblies.Paket@0.2",
+    "bom-ref": "pkg:nuget/0x53A.ReferenceAssemblies.Paket@0.2",
+    properties: [{ name: "SrcFile", value: "./test/data/paket.lock" }],
+    evidence: {
+      identity: {
+        field: "purl",
+        confidence: 1,
+        methods: [
+          {
+            technique: "manifest-analysis",
+            confidence: 1,
+            value: "./test/data/paket.lock"
+          }
+        ]
+      }
+    }
   });
   expect(dep_list.dependenciesList.length).toEqual(13);
   expect(dep_list.dependenciesList[2]).toEqual({
@@ -1694,7 +1710,7 @@ test("parsePkgLock v2 workspace", async () => {
   );
   let pkgs = parsedList.pkgList;
   let deps = parsedList.dependenciesList;
-  expect(pkgs.length).toEqual(1032);
+  expect(pkgs.length).toEqual(1034);
   expect(pkgs[0].license).toEqual("MIT");
   let hasAppWorkspacePkg = pkgs.some(
     (obj) => obj["bom-ref"] === "pkg:npm/app@0.0.0"
@@ -1746,8 +1762,8 @@ test("parsePkgLock v3", async () => {
     projectName: "cdxgen"
   });
   deps = parsedList.pkgList;
-  expect(deps.length).toEqual(1205);
-  expect(parsedList.dependenciesList.length).toEqual(1205);
+  expect(deps.length).toEqual(1199);
+  expect(parsedList.dependenciesList.length).toEqual(1199);
 });
 
 test("parseBowerJson", async () => {
@@ -2315,13 +2331,16 @@ test("parseYarnLock", async () => {
 });
 
 test("parseComposerLock", () => {
-  let deps = parseComposerLock("./test/data/composer.lock");
-  expect(deps.length).toEqual(1);
-  expect(deps[0]).toEqual({
+  let retMap = parseComposerLock("./test/data/composer.lock");
+  expect(retMap.pkgList.length).toEqual(1);
+  expect(retMap.dependenciesList.length).toEqual(1);
+  expect(retMap.pkgList[0]).toEqual({
     group: "quickbooks",
     name: "v3-php-sdk",
     scope: "required",
-    version: "4.0.6.1",
+    version: "v4.0.6.1",
+    purl: "pkg:composer/quickbooks/v3-php-sdk@v4.0.6.1",
+    "bom-ref": "pkg:composer/quickbooks/v3-php-sdk@v4.0.6.1",
     repository: {
       type: "git",
       url: "https://github.com/intuit/QuickBooks-V3-PHP-SDK.git",
@@ -2333,6 +2352,10 @@ test("parseComposerLock", () => {
       {
         name: "SrcFile",
         value: "./test/data/composer.lock"
+      },
+      {
+        name: "Namespaces",
+        value: "QuickBooksOnline\\API\\"
       }
     ],
     evidence: {
@@ -2350,13 +2373,16 @@ test("parseComposerLock", () => {
     }
   });
 
-  deps = parseComposerLock("./test/data/composer-2.lock");
-  expect(deps.length).toEqual(73);
-  expect(deps[0]).toEqual({
+  retMap = parseComposerLock("./test/data/composer-2.lock");
+  expect(retMap.pkgList.length).toEqual(73);
+  expect(retMap.dependenciesList.length).toEqual(73);
+  expect(retMap.pkgList[0]).toEqual({
     group: "amphp",
     name: "amp",
     scope: "required",
-    version: "2.4.4",
+    version: "v2.4.4",
+    purl: "pkg:composer/amphp/amp@v2.4.4",
+    "bom-ref": "pkg:composer/amphp/amp@v2.4.4",
     repository: {
       type: "git",
       url: "https://github.com/amphp/amp.git",
@@ -2368,6 +2394,10 @@ test("parseComposerLock", () => {
       {
         name: "SrcFile",
         value: "./test/data/composer-2.lock"
+      },
+      {
+        name: "Namespaces",
+        value: "Amp\\"
       }
     ],
     evidence: {
@@ -2385,12 +2415,15 @@ test("parseComposerLock", () => {
     }
   });
 
-  deps = parseComposerLock("./test/data/composer-3.lock");
-  expect(deps.length).toEqual(62);
-  expect(deps[0]).toEqual({
+  retMap = parseComposerLock("./test/data/composer-3.lock");
+  expect(retMap.pkgList.length).toEqual(62);
+  expect(retMap.dependenciesList.length).toEqual(62);
+  expect(retMap.pkgList[0]).toEqual({
     group: "amphp",
     name: "amp",
-    version: "2.6.2",
+    version: "v2.6.2",
+    purl: "pkg:composer/amphp/amp@v2.6.2",
+    "bom-ref": "pkg:composer/amphp/amp@v2.6.2",
     repository: {
       type: "git",
       url: "https://github.com/amphp/amp.git",
@@ -2399,7 +2432,13 @@ test("parseComposerLock", () => {
     license: ["MIT"],
     description: "A non-blocking concurrency framework for PHP applications.",
     scope: "required",
-    properties: [{ name: "SrcFile", value: "./test/data/composer-3.lock" }],
+    properties: [
+      { name: "SrcFile", value: "./test/data/composer-3.lock" },
+      {
+        name: "Namespaces",
+        value: "Amp\\"
+      }
+    ],
     evidence: {
       identity: {
         field: "purl",
@@ -2414,6 +2453,42 @@ test("parseComposerLock", () => {
       }
     }
   });
+  retMap = parseComposerLock("./test/data/composer-4.lock");
+  expect(retMap.pkgList.length).toEqual(50);
+  expect(retMap.dependenciesList.length).toEqual(50);
+  expect(retMap.pkgList[0]).toEqual({
+    group: "apache",
+    name: "log4php",
+    purl: "pkg:composer/apache/log4php@2.3.0",
+    "bom-ref": "pkg:composer/apache/log4php@2.3.0",
+    version: "2.3.0",
+    repository: {
+      type: "git",
+      url: "https://git-wip-us.apache.org/repos/asf/logging-log4php.git",
+      reference: "8c6df2481cd68d0d211d38f700406c5f0a9de0c2"
+    },
+    license: ["Apache-2.0"],
+    description: "A versatile logging framework for PHP",
+    scope: "required",
+    properties: [{ name: "SrcFile", value: "./test/data/composer-4.lock" }],
+    evidence: {
+      identity: {
+        field: "purl",
+        confidence: 1,
+        methods: [
+          {
+            confidence: 1,
+            technique: "manifest-analysis",
+            value: "./test/data/composer-4.lock"
+          }
+        ]
+      }
+    }
+  });
+  expect(retMap.dependenciesList[1]).toEqual({
+    ref: "pkg:composer/doctrine/annotations@v1.2.1",
+    dependsOn: ["pkg:composer/doctrine/lexer@v1.0"]
+  });
 });
 
 test("parseGemfileLockData", async () => {