@cyclonedx/cdxgen 9.2.2 → 9.3.1

package/index.js

@@ -90,7 +90,8 @@ import {
   parseCsPkgLockData,
   parseCsPkgData,
   parseCsProjData,
-  DEBUG_MODE
+  DEBUG_MODE,
+  parsePyProjectToml
 } from "./utils.js";
 import { spawnSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
@@ -180,6 +181,7 @@ const createDefaultParentComponent = (path, type = "application") => {
   const parentComponent = {
     group: "",
     name: dirName,
+    version: "latest",
     type: "application"
   };
   const ppurl = new PackageURL(
@@ -1148,7 +1150,7 @@ export const createJavaBom = async (path, options) => {
               );
             } else {
               console.log(
-                "1. Java version requirement: cdxgen container image bundles Java 19 with maven 3.9 which might be incompatible."
+                "1. Java version requirement: cdxgen container image bundles Java 20 with maven 3.9 which might be incompatible."
               );
             }
             console.log(
@@ -1775,6 +1777,16 @@ export const createNodejsBom = async (path, options) => {
         if (pcs.length) {
           parentComponent = pcs[0];
           parentComponent.type = "application";
+          ppurl = new PackageURL(
+            "npm",
+            parentComponent.group,
+            parentComponent.name,
+            parentComponent.version,
+            null,
+            null
+          ).toString();
+          parentComponent["bom-ref"] = decodeURIComponent(ppurl);
+          parentComponent["purl"] = ppurl;
         }
       } else {
         let dirName = dirname(f);
@@ -1793,7 +1805,7 @@ export const createNodejsBom = async (path, options) => {
           null,
           null
         ).toString();
-        parentComponent["bom-ref"] = ppurl;
+        parentComponent["bom-ref"] = decodeURIComponent(ppurl);
         parentComponent["purl"] = ppurl;
       }
       // Parse the pnpm file
@@ -1906,6 +1918,16 @@ export const createNodejsBom = async (path, options) => {
         if (pcs.length) {
           const tmpParentComponent = pcs[0];
           tmpParentComponent.type = "application";
+          ppurl = new PackageURL(
+            "npm",
+            tmpParentComponent.group,
+            tmpParentComponent.name,
+            tmpParentComponent.version,
+            null,
+            null
+          ).toString();
+          tmpParentComponent["bom-ref"] = decodeURIComponent(ppurl);
+          tmpParentComponent["purl"] = ppurl;
           if (!Object.keys(parentComponent).length) {
             parentComponent = tmpParentComponent;
           } else {
@@ -2019,12 +2041,19 @@ export const createPythonBom = async (path, options) => {
   let dependencies = [];
   let pkgList = [];
   const tempDir = mkdtempSync(join(tmpdir(), "cdxgen-venv-"));
-  const parentComponent = createDefaultParentComponent(path, "pypi");
+  let parentComponent = createDefaultParentComponent(path, "pypi");
   const pipenvMode = existsSync(join(path, "Pipfile"));
-  const poetryFiles = getAllFiles(
+  let poetryFiles = getAllFiles(
     path,
     (options.multiProject ? "**/" : "") + "poetry.lock"
   );
+  const pdmLockFiles = getAllFiles(
+    path,
+    (options.multiProject ? "**/" : "") + "pdm.lock"
+  );
+  if (pdmLockFiles && pdmLockFiles.length) {
+    poetryFiles = poetryFiles.concat(pdmLockFiles);
+  }
   const reqFiles = getAllFiles(
     path,
     (options.multiProject ? "**/" : "") + "*requirements*.txt"
@@ -2048,6 +2077,25 @@ export const createPythonBom = async (path, options) => {
   const setupPy = join(path, "setup.py");
   const pyProjectFile = join(path, "pyproject.toml");
   const pyProjectMode = existsSync(pyProjectFile);
+  if (pyProjectMode) {
+    const tmpParentComponent = parsePyProjectToml(pyProjectFile);
+    if (tmpParentComponent && tmpParentComponent.name) {
+      parentComponent = tmpParentComponent;
+      delete parentComponent.homepage;
+      delete parentComponent.repository;
+      parentComponent.type = "application";
+      const ppurl = new PackageURL(
+        "pypi",
+        parentComponent.group || "",
+        parentComponent.name,
+        parentComponent.version || "latest",
+        null,
+        null
+      ).toString();
+      parentComponent["bom-ref"] = decodeURIComponent(ppurl);
+      parentComponent["purl"] = ppurl;
+    }
+  }
   const requirementsMode =
     (reqFiles && reqFiles.length) || (reqDirFiles && reqDirFiles.length);
   const poetryMode = poetryFiles && poetryFiles.length;
@@ -2056,15 +2104,39 @@ export const createPythonBom = async (path, options) => {
   // we give preference to poetry lock file. Issue# 129
   if (poetryMode) {
     for (const f of poetryFiles) {
+      const basePath = dirname(f);
       const lockData = readFileSync(f, { encoding: "utf-8" });
-      const dlist = await parsePoetrylockData(lockData);
+      const dlist = await parsePoetrylockData(lockData, f);
       if (dlist && dlist.length) {
         pkgList = pkgList.concat(dlist);
       }
+      const pkgMap = getPipFrozenTree(basePath, f, tempDir);
+      if (pkgMap.pkgList && pkgMap.pkgList.length) {
+        pkgList = pkgList.concat(pkgMap.pkgList);
+      }
+      if (pkgMap.dependenciesList) {
+        dependencies = mergeDependencies(
+          dependencies,
+          pkgMap.dependenciesList,
+          parentComponent
+        );
+      }
+      const parentDependsOn = [];
+      // Complete the dependency tree by making parent component depend on the first level
+      for (const p of pkgMap.rootList) {
+        parentDependsOn.push(`pkg:pypi/${p.name}@${p.version}`);
+      }
+      const pdependencies = {
+        ref: parentComponent["bom-ref"],
+        dependsOn: parentDependsOn
+      };
+      dependencies.splice(0, 0, pdependencies);
     }
     return buildBomNSData(options, pkgList, "pypi", {
       src: path,
-      filename: poetryFiles.join(", ")
+      filename: poetryFiles.join(", "),
+      dependencies,
+      parentComponent
     });
   } else if (metadataFiles && metadataFiles.length) {
     // dist-info directories
@@ -2130,7 +2202,8 @@ export const createPythonBom = async (path, options) => {
             if (pkgMap.dependenciesList) {
               dependencies = mergeDependencies(
                 dependencies,
-                pkgMap.dependenciesList
+                pkgMap.dependenciesList,
+                parentComponent
               );
             }
           }
@@ -2188,24 +2261,41 @@ export const createPythonBom = async (path, options) => {
         }
       }
       if (retMap.dependenciesList) {
-        dependencies = mergeDependencies(dependencies, retMap.dependenciesList);
+        dependencies = mergeDependencies(
+          dependencies,
+          retMap.dependenciesList,
+          parentComponent
+        );
       }
       if (retMap.allImports) {
         allImports = { ...allImports, ...retMap.allImports };
       }
       // Complete the dependency tree by making parent component depend on the first level
       for (const p of pkgMap.rootList) {
+        if (
+          parentComponent &&
+          p.name === parentComponent.name &&
+          p.version === parentComponent.version
+        ) {
+          continue;
+        }
         parentDependsOn.push(`pkg:pypi/${p.name}@${p.version}`);
       }
       if (pkgMap.pkgList && pkgMap.pkgList.length) {
         pkgList = pkgList.concat(pkgMap.pkgList);
       }
       if (pkgMap.dependenciesList) {
-        dependencies = mergeDependencies(dependencies, pkgMap.dependenciesList);
+        dependencies = mergeDependencies(
+          dependencies,
+          pkgMap.dependenciesList,
+          parentComponent
+        );
       }
       const pdependencies = {
-        ref: parentComponent.purl,
-        dependsOn: parentDependsOn
+        ref: parentComponent["bom-ref"],
+        dependsOn: parentDependsOn.filter(
+          (r) => parentComponent && r !== parentComponent["bom-ref"]
+        )
       };
       dependencies.splice(0, 0, pdependencies);
     }
@@ -3628,15 +3718,25 @@ export const createCsharpBom = async (path, options) => {
   return {};
 };
 
-export const mergeDependencies = (dependencies, newDependencies) => {
+export const mergeDependencies = (
+  dependencies,
+  newDependencies,
+  parentComponent = {}
+) => {
   const deps_map = {};
+  const parentRef =
+    parentComponent && parentComponent["bom-ref"]
+      ? parentComponent["bom-ref"]
+      : undefined;
   const combinedDeps = dependencies.concat(newDependencies || []);
   for (const adep of combinedDeps) {
     if (!deps_map[adep.ref]) {
       deps_map[adep.ref] = new Set();
     }
     for (const eachDepends of adep["dependsOn"]) {
-      deps_map[adep.ref].add(eachDepends);
+      if (parentRef && eachDepends.toLowerCase() !== parentRef.toLowerCase()) {
+        deps_map[adep.ref].add(eachDepends);
+      }
     }
   }
   const retlist = [];
@@ -4762,7 +4862,7 @@ export async function submitBom(args, bomContents) {
             projectName: args.projectName,
             projectVersion: projectVersion,
             autoCreate: "true",
-            bom: Buffer.from(bomContents).toString()
+            bom: encodedBomContents
           },
           responseType: "json"
         }).json();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cyclonedx/cdxgen",
-  "version": "9.2.2",
+  "version": "9.3.1",
   "description": "Creates CycloneDX Software Bill-of-Materials (SBOM) from source or container image",
   "homepage": "http://github.com/cyclonedx/cdxgen",
   "author": "Prabhu Subramanian <prabhu@appthreat.com>",
@@ -75,7 +75,7 @@
     "yargs": "^17.7.2"
   },
   "optionalDependencies": {
-    "@appthreat/atom": "^0.10.1",
+    "@appthreat/atom": "^1.0.0",
     "@cyclonedx/cdxgen-plugins-bin": "^1.2.0",
     "body-parser": "^1.20.2",
     "compression": "^1.7.4",

package/piptree.js

@@ -50,19 +50,25 @@ def get_installed_distributions():
     return [d._dist for d in dists]
 
 
-def find_deps(idx, reqs):
+def find_deps(idx, visited, reqs, traverse_count):
     freqs = []
     for r in reqs:
         d = idx.get(r.key)
+        if not d:
+            continue
         r.project_name = d.project_name if d is not None else r.project_name
+        if len(visited) > 100 and visited.get(r.project_name):
+            return freqs
         specs = sorted(r.specs, reverse=True)
         specs_str = ",".join(["".join(sp) for sp in specs]) if specs else ""
+        dreqs = d.requires()
+        visited[r.project_name] = True
         freqs.append(
             {
                 "name": r.project_name,
                 "version": importlib_metadata.version(r.key),
                 "versionSpecifiers": specs_str,
-                "dependencies": find_deps(idx, d.requires()),
+                "dependencies": find_deps(idx, visited, dreqs, traverse_count + 1) if dreqs and traverse_count < 200 else [],
             }
         )
     return freqs
@@ -73,20 +79,26 @@ def main(argv):
     tree = []
     pkgs = get_installed_distributions()
     idx = {p.key: p for p in pkgs}
+    visited = {}
+    traverse_count = 0
     for p in pkgs:
         fr = frozen_req_from_dist(p)
-        tmpA = fr.split("==")
+        if not fr.startswith('# Editable'):
+            tmpA = fr.split("==")
+        else:
+            fr = p.key
+            tmpA = [fr,p.version]
         name = tmpA[0]
         if name.startswith("-e"):
-            continue
-        version = ""
+            name = name.split("#egg=")[-1].split(" ")[0].split("&")[0]
+        version = "latest"
         if len(tmpA) == 2:
             version = tmpA[1]
         tree.append(
             {
-                "name": name,
+                "name": name.split(" ")[0],
                 "version": version,
-                "dependencies": find_deps(idx, p.requires()),
+                "dependencies": find_deps(idx, visited, p.requires(), traverse_count + 1),
             }
         )
     all_deps = {}
@@ -108,7 +120,7 @@ if __name__ == "__main__":
  * Execute the piptree plugin and return the generated tree as json object
  */
 export const getTreeWithPlugin = (env, python_cmd, basePath) => {
-  let tree = undefined;
+  let tree = [];
   const tempDir = mkdtempSync(join(tmpdir(), "cdxgen-piptree-"));
   const pipPlugin = join(tempDir, "piptree.py");
   const pipTreeJson = join(tempDir, "piptree.json");