@cyclonedx/cdxgen 9.10.2 → 9.11.0

package/bin/evinse.js

@@ -63,7 +63,8 @@ const args = yargs(hideBin(process.argv))
       "python",
       "android",
       "c",
-      "cpp"
+      "cpp",
+      "php"
     ]
   })
   .option("db-path", {

package/data/frameworks-list.json

@@ -160,6 +160,31 @@
     "pkg:generic/userver",
     "pkg:generic/Wt/",
     "pkg:generic/klone",
-    "pkg:generic/kcgi"
+    "pkg:generic/kcgi",
+    "pkg:composer/laravel",
+    "pkg:composer/symfony",
+    "pkg:composer/codeigniter",
+    "pkg:composer/cakephp",
+    "pkg:composer/zend",
+    "pkg:composer/yii",
+    "pkg:composer/aura",
+    "pkg:composer/phalcon",
+    "pkg:composer/fatfree",
+    "pkg:composer/qcodo",
+    "pkg:composer/fuelphp",
+    "pkg:composer/slim",
+    "pkg:composer/phpixie",
+    "pkg:composer/ice",
+    "pkg:composer/modx",
+    "pkg:composer/typo",
+    "pkg:composer/cappuccino",
+    "pkg:composer/pop",
+    "pkg:composer/zest",
+    "pkg:composer/silverstripe",
+    "pkg:composer/dash",
+    "pkg:composer/roducks",
+    "pkg:composer/queryphp",
+    "pkg:composer/silex",
+    "pkg:composer/psr"
   ]
 }

package/evinser.js

@@ -207,7 +207,9 @@ export const createSlice = (
   if (!filePath) {
     return;
   }
-  console.log(`Create ${sliceType} slice for ${purlOrLanguage} ${filePath}`);
+  console.log(
+    `Create ${sliceType} slice for ${path.resolve(filePath)}. Please wait ...`
+  );
   const language = purlOrLanguage.startsWith("pkg:")
     ? purlToLanguage(purlOrLanguage, filePath)
     : purlOrLanguage;
@@ -271,22 +273,35 @@ export const purlToLanguage = (purl, filePath) => {
     case "pypi":
       language = "python";
       break;
+    case "composer":
+      language = "php";
+      break;
+    case "generic":
+      language = "c";
   }
   return language;
 };
 
-export const initFromSbom = (components) => {
+export const initFromSbom = (components, language) => {
   const purlLocationMap = {};
   const purlImportsMap = {};
   for (const comp of components) {
     if (!comp || !comp.evidence) {
       continue;
     }
-    (comp.properties || [])
-      .filter((v) => v.name === "ImportedModules")
-      .forEach((v) => {
-        purlImportsMap[comp.purl] = (v.value || "").split(",");
-      });
+    if (language === "php") {
+      (comp.properties || [])
+        .filter((v) => v.name === "Namespaces")
+        .forEach((v) => {
+          purlImportsMap[comp.purl] = (v.value || "").split(", ");
+        });
+    } else {
+      (comp.properties || [])
+        .filter((v) => v.name === "ImportedModules")
+        .forEach((v) => {
+          purlImportsMap[comp.purl] = (v.value || "").split(",");
+        });
+    }
     if (comp.evidence.occurrences) {
       purlLocationMap[comp.purl] = new Set(
         comp.evidence.occurrences.map((v) => v.location)
@@ -323,7 +338,7 @@ export const analyzeProject = async (dbObjMap, options) => {
   const components = bomJson.components || [];
   // Load any existing purl-location information from the sbom.
   // For eg: cdxgen populates this information for javascript projects
-  let { purlLocationMap, purlImportsMap } = initFromSbom(components);
+  let { purlLocationMap, purlImportsMap } = initFromSbom(components, language);
   // Do reachables first so that usages slicing can reuse the atom file
   if (options.withReachables) {
     if (
@@ -487,6 +502,11 @@ export const parseSliceUsages = async (
     typesToLookup.add(slice.fullName);
     addToOverrides(lKeyOverrides, slice.fullName, fileName, slice.lineNumber);
   }
+  // PHP imports from usages
+  if (slice.code && slice.code.startsWith("use") && !usages.length) {
+    typesToLookup.add(slice.fullName);
+    addToOverrides(lKeyOverrides, slice.fullName, fileName, slice.lineNumber);
+  }
   for (const ausage of usages) {
     const ausageLine =
       ausage?.targetObj?.lineNumber || ausage?.definedBy?.lineNumber;
@@ -616,12 +636,25 @@ export const parseSliceUsages = async (
     if (purlImportsMap && Object.keys(purlImportsMap).length) {
       for (const apurl of Object.keys(purlImportsMap)) {
         const apurlImports = purlImportsMap[apurl];
-        if (apurlImports && apurlImports.includes(atype)) {
-          if (!purlLocationMap[apurl]) {
-            purlLocationMap[apurl] = new Set();
+        if (language === "php") {
+          for (const aimp of apurlImports) {
+            if (atype.startsWith(aimp)) {
+              if (!purlLocationMap[apurl]) {
+                purlLocationMap[apurl] = new Set();
+              }
+              if (lKeyOverrides[atype]) {
+                purlLocationMap[apurl].add(...lKeyOverrides[atype]);
+              }
+            }
           }
-          if (lKeyOverrides[atype]) {
-            purlLocationMap[apurl].add(...lKeyOverrides[atype]);
+        } else {
+          if (apurlImports && apurlImports.includes(atype)) {
+            if (!purlLocationMap[apurl]) {
+              purlLocationMap[apurl] = new Set();
+            }
+            if (lKeyOverrides[atype]) {
+              purlLocationMap[apurl].add(...lKeyOverrides[atype]);
+            }
           }
         }
       }
@@ -715,6 +748,11 @@ export const isFilterableType = (
       return true;
     }
   }
+  if (["php"].includes(language)) {
+    if (!typeFullName.includes("\\") && !typeFullName.startsWith("use")) {
+      return true;
+    }
+  }
   if (userDefinedTypesMap[typeFullName]) {
     return true;
   }
@@ -739,12 +777,16 @@ export const detectServicesFromUsages = (language, slice, servicesMap = {}) => {
     let endpoints = [];
     let authenticated = undefined;
     if (targetObj && targetObj?.resolvedMethod) {
-      endpoints = extractEndpoints(language, targetObj?.resolvedMethod);
+      if (language != "php") {
+        endpoints = extractEndpoints(language, targetObj?.resolvedMethod);
+      }
       if (targetObj?.resolvedMethod.toLowerCase().includes("auth")) {
         authenticated = true;
       }
     } else if (definedBy && definedBy?.resolvedMethod) {
-      endpoints = extractEndpoints(language, definedBy?.resolvedMethod);
+      if (language != "php") {
+        endpoints = extractEndpoints(language, definedBy?.resolvedMethod);
+      }
       if (definedBy?.resolvedMethod.toLowerCase().includes("auth")) {
         authenticated = true;
       }
@@ -752,12 +794,17 @@ export const detectServicesFromUsages = (language, slice, servicesMap = {}) => {
     if (usage.invokedCalls) {
       for (const acall of usage.invokedCalls) {
         if (acall.resolvedMethod) {
-          const tmpEndpoints = extractEndpoints(language, acall.resolvedMethod);
-          if (acall.resolvedMethod.toLowerCase().includes("auth")) {
-            authenticated = true;
-          }
-          if (tmpEndpoints && tmpEndpoints.length) {
-            endpoints = (endpoints || []).concat(tmpEndpoints);
+          if (language != "php") {
+            const tmpEndpoints = extractEndpoints(
+              language,
+              acall.resolvedMethod
+            );
+            if (acall.resolvedMethod.toLowerCase().includes("auth")) {
+              authenticated = true;
+            }
+            if (tmpEndpoints && tmpEndpoints.length) {
+              endpoints = (endpoints || []).concat(tmpEndpoints);
+            }
           }
         }
       }
@@ -791,7 +838,7 @@ export const detectServicesFromUDT = (
   servicesMap
 ) => {
   if (
-    ["python", "py", "c", "cpp", "c++"].includes(language) &&
+    ["python", "py", "c", "cpp", "c++", "php"].includes(language) &&
     userDefinedTypes &&
     userDefinedTypes.length
   ) {
@@ -803,7 +850,15 @@ export const detectServicesFromUDT = (
         audt.name.toLowerCase().includes("registerhandler") ||
         audt.name.toLowerCase().includes("endpoint") ||
         audt.name.toLowerCase().includes("api") ||
-        audt.name.toLowerCase().includes("add_method")
+        audt.name.toLowerCase().includes("add_method") ||
+        audt.name.toLowerCase().includes("get") ||
+        audt.name.toLowerCase().includes("post") ||
+        audt.name.toLowerCase().includes("delete") ||
+        audt.name.toLowerCase().includes("put") ||
+        audt.name.toLowerCase().includes("head") ||
+        audt.name.toLowerCase().includes("options") ||
+        audt.name.toLowerCase().includes("addRoute") ||
+        audt.name.toLowerCase().includes("connect")
       ) {
         const fields = audt.fields || [];
         if (
@@ -819,14 +874,14 @@ export const detectServicesFromUDT = (
               audt.fileName.replace(".py", "")
             )}-service`;
           }
-          if (!servicesMap[serviceName]) {
-            servicesMap[serviceName] = {
-              endpoints: new Set(),
-              authenticated: false,
-              xTrustBoundary: undefined
-            };
-          }
-          if (endpoints) {
+          if (endpoints && endpoints.length) {
+            if (!servicesMap[serviceName]) {
+              servicesMap[serviceName] = {
+                endpoints: new Set(),
+                authenticated: false,
+                xTrustBoundary: undefined
+              };
+            }
             for (const endpoint of endpoints) {
               servicesMap[serviceName].endpoints.add(endpoint);
             }
@@ -897,7 +952,7 @@ export const extractEndpoints = (language, code) => {
     default:
       endpoints = (code.match(/['"](.*?)['"]/gi) || [])
         .map((v) => v.replace(/["']/g, "").replace("\n", ""))
-        .filter((v) => v.length > 2);
+        .filter((v) => v.length > 2 && v.includes("/"));
       break;
   }
   return endpoints;
@@ -1015,7 +1070,7 @@ export const createEvinseFile = (sliceArtefacts, options) => {
     console.log(evinseOutFile, "created successfully.");
   } else {
     console.log(
-      "Unable to identify component evidence for the input SBOM. Only java, javascript and python projects are supported by evinse."
+      "Unable to identify component evidence for the input SBOM. Only java, javascript, python, and php projects are supported by evinse."
     );
   }
   if (tempDir && tempDir.startsWith(tmpdir())) {
@@ -1249,6 +1304,8 @@ export const getClassTypeFromSignature = (language, typeFullName) => {
       .replace(".<body>", "")
       .replace(".__iter__", "")
       .replace(".__init__", "");
+  } else if (["php"].includes(language)) {
+    typeFullName = typeFullName.split("->")[0].split("::")[0];
   }
   if (
     typeFullName.startsWith("<unresolved") ||

package/index.js

@@ -4055,6 +4055,11 @@ export const createPHPBom = (path, options) => {
     (options.multiProject ? "**/" : "") + "composer.json",
     options
   );
+  if (!options.exclude) {
+    options.exclude = [];
+  }
+  // Ignore vendor directories for lock files
+  options.exclude.push("**/vendor/**");
   let composerLockFiles = getAllFiles(
     path,
     (options.multiProject ? "**/" : "") + "composer.lock",
@@ -4123,6 +4128,7 @@ export const createPHPBom = (path, options) => {
       if (DEBUG_MODE) {
         console.log(`Parsing ${f}`);
       }
+      let rootRequires = [];
       // Is there a composer.json to find the parent component
       if (
         !Object.keys(parentComponent).length &&
@@ -4131,6 +4137,7 @@ export const createPHPBom = (path, options) => {
         const composerData = JSON.parse(
           readFileSync(join(basePath, "composer.json"), { encoding: "utf-8" })
         );
+        rootRequires = composerData.require;
         const pkgName = composerData.name;
         if (pkgName) {
           parentComponent.group = dirname(pkgName);
@@ -4152,16 +4159,33 @@ export const createPHPBom = (path, options) => {
           );
         }
       }
-      const retMap = parseComposerLock(f);
+      const retMap = parseComposerLock(f, rootRequires);
       if (retMap.pkgList && retMap.pkgList.length) {
         pkgList = pkgList.concat(retMap.pkgList);
       }
       if (retMap.dependenciesList) {
+        if (!Object.keys(parentComponent).length) {
+          parentComponent = createDefaultParentComponent(
+            path,
+            "composer",
+            options
+          );
+        }
+        // Complete the dependency tree by making parent component depend on the first level
+        const parentDependsOn = [];
+        for (const p of retMap.rootList) {
+          parentDependsOn.push(p["bom-ref"]);
+        }
+        const pdependencies = {
+          ref: parentComponent["bom-ref"],
+          dependsOn: parentDependsOn
+        };
         dependencies = mergeDependencies(
           dependencies,
           retMap.dependenciesList,
           parentComponent
         );
+        dependencies.splice(0, 0, pdependencies);
       }
     }
     return buildBomNSData(options, pkgList, "composer", {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cyclonedx/cdxgen",
-  "version": "9.10.2",
+  "version": "9.11.0",
   "description": "Creates CycloneDX Software Bill of Materials (SBOM) from source or container image",
   "homepage": "http://github.com/cyclonedx/cdxgen",
   "author": "Prabhu Subramanian <prabhu@appthreat.com>",
@@ -56,7 +56,7 @@
   },
   "dependencies": {
     "@babel/parser": "^7.23.6",
-    "@babel/traverse": "^7.23.6",
+    "@babel/traverse": "^7.23.7",
     "@npmcli/arborist": "7.2.2",
     "ajv": "^8.12.0",
     "ajv-formats": "^2.1.1",
@@ -83,7 +83,7 @@
     "yargs": "^17.7.2"
   },
   "optionalDependencies": {
-    "@appthreat/atom": "1.8.0",
+    "@appthreat/atom": "1.8.3",
     "@appthreat/cdx-proto": "^0.0.4",
     "@cyclonedx/cdxgen-plugins-bin": "^1.5.4",
     "@cyclonedx/cdxgen-plugins-bin-windows-amd64": "^1.5.4",
@@ -94,7 +94,7 @@
     "connect": "^3.7.0",
     "jsonata": "^2.0.3",
     "sequelize": "^6.35.2",
-    "sqlite3": "^5.1.6"
+    "sqlite3": "^5.1.7"
   },
   "files": [
     "*.js",

package/utils.js

@@ -4059,6 +4059,9 @@ export const parseGemfileLockData = async function (gemLockData) {
       const tmpA = l.split(" ");
       if (tmpA && tmpA.length == 2) {
         const name = tmpA[0];
+        if (name === "remote:") {
+          return;
+        }
         if (!pkgnames[name]) {
           let version = tmpA[1].split(", ")[0];
           version = version.replace(/[(>=<)~ ]/g, "");
@@ -4077,7 +4080,8 @@ export const parseGemfileLockData = async function (gemLockData) {
       l === "PLATFORMS" ||
       l === "DEPENDENCIES" ||
       l === "RUBY VERSION" ||
-      l === "BUNDLED WITH"
+      l === "BUNDLED WITH" ||
+      l === "PATH"
     ) {
       specsFound = false;
     }
@@ -5711,12 +5715,20 @@ export const parsePaketLockData = async function (paketLockData, pkgLockFile) {
  * Parse composer lock file
  *
  * @param {string} pkgLockFile composer.lock file
+ * @param {array} rootRequires require section from composer.json
  */
-export const parseComposerLock = function (pkgLockFile) {
+export const parseComposerLock = function (pkgLockFile, rootRequires) {
   const pkgList = [];
   const dependenciesList = [];
   const dependenciesMap = {};
   const pkgNamePurlMap = {};
+  const rootList = [];
+  const rootRequiresMap = {};
+  if (rootRequires) {
+    for (const rr of Object.keys(rootRequires)) {
+      rootRequiresMap[rr] = true;
+    }
+  }
   if (existsSync(pkgLockFile)) {
     let lockData = {};
     try {
@@ -5741,6 +5753,7 @@ export const parseComposerLock = function (pkgLockFile) {
           if (!pkg || !pkg.name || !pkg.version) {
             continue;
           }
+
           let group = dirname(pkg.name);
           if (group === ".") {
             group = "";
@@ -5789,7 +5802,7 @@ export const parseComposerLock = function (pkgLockFile) {
             for (const aaload of Object.keys(pkg.autoload)) {
               if (aaload.startsWith("psr")) {
                 for (const ans of Object.keys(pkg.autoload[aaload])) {
-                  namespaces.push(ans);
+                  namespaces.push(ans.trim());
                 }
               }
             }
@@ -5803,6 +5816,10 @@ export const parseComposerLock = function (pkgLockFile) {
           pkgList.push(apkg);
           dependenciesMap[purl] = new Set();
           pkgNamePurlMap[pkg.name] = purl;
+          // Add this package to the root list if needed
+          if (rootRequiresMap[pkg.name]) {
+            rootList.push(apkg);
+          }
         }
       }
       // Pass 2: Construct dependency tree
@@ -5833,7 +5850,8 @@ export const parseComposerLock = function (pkgLockFile) {
   }
   return {
     pkgList,
-    dependenciesList
+    dependenciesList,
+    rootList
   };
 };
 

package/utils.test.js

@@ -1214,7 +1214,7 @@ test("parse github actions workflow data", async () => {
   dep_list = parseGitHubWorkflowData(
     readFileSync("./.github/workflows/repotests.yml", { encoding: "utf-8" })
   );
-  expect(dep_list.length).toEqual(8);
+  expect(dep_list.length).toEqual(7);
   expect(dep_list[0]).toEqual({
     group: "actions",
     name: "checkout",
@@ -1762,8 +1762,8 @@ test("parsePkgLock v3", async () => {
     projectName: "cdxgen"
   });
   deps = parsedList.pkgList;
-  expect(deps.length).toEqual(1195);
-  expect(parsedList.dependenciesList.length).toEqual(1195);
+  expect(deps.length).toEqual(1199);
+  expect(parsedList.dependenciesList.length).toEqual(1199);
 });
 
 test("parseBowerJson", async () => {