@cyclonedx/cdxgen 9.3.1 → 9.3.2

package/README.md

@@ -289,7 +289,9 @@ cdxgen can retain the dependency tree under the `dependencies` attribute for a s
 | MAVEN_HOME                   | Specify maven home                                                                                                          |
 | GRADLE_CACHE_DIR             | Specify gradle cache directory. Useful for class name resolving                                                             |
 | GRADLE_MULTI_PROJECT_MODE    | Unused. Automatically handled                                                                                               |
-| GRADLE_ARGS                  | Set to pass additional arguments such as profile or settings to gradle. Eg: --configuration runtimeClassPath                |
+| GRADLE_ARGS                  | Set to pass additional arguments such as profile or settings to gradle (all tasks). Eg: --configuration runtimeClassPath    |
+| GRADLE_ARGS_PROPERTIES       | Set to pass additional arguments only to the `gradle properties` task, used for collecting metadata about the project       |
+| GRADLE_ARGS_DEPENDENCIES     | Set to pass additional arguments only to the `gradle dependencies` task, used for listing actual project dependencies       |
 | GRADLE_HOME                  | Specify gradle home                                                                                                         |
 | GRADLE_CMD                   | Set to override gradle command                                                                                              |
 | GRADLE_DEPENDENCY_TASK       | By default cdxgen use the task "dependencies" to collect packages. Set to override the task name.                           |

package/index.js

@@ -1216,7 +1216,8 @@ export const createJavaBom = async (path, options) => {
             if (bomJsonObj.dependencies && !options.requiredOnly) {
               dependencies = mergeDependencies(
                 dependencies,
-                bomJsonObj.dependencies
+                bomJsonObj.dependencies,
+                parentComponent
               );
             }
           }
@@ -1340,11 +1341,16 @@ export const createJavaBom = async (path, options) => {
         gradleDepArgs = gradleDepArgs
           .concat(depTaskWithArgs.slice(1))
           .concat(defaultDepTaskArgs);
-        // Support custom GRADLE_ARGS such as --configuration runtimeClassPath
+        // Support custom GRADLE_ARGS such as --configuration runtimeClassPath (used for all tasks)
         if (process.env.GRADLE_ARGS) {
           const addArgs = process.env.GRADLE_ARGS.split(" ");
           gradleDepArgs = gradleDepArgs.concat(addArgs);
         }
+        // gradle args only for the dependencies task
+        if (process.env.GRADLE_ARGS_DEPENDENCIES) {
+          const addArgs = process.env.GRADLE_ARGS_DEPENDENCIES.split(" ");
+          gradleDepArgs = gradleDepArgs.concat(addArgs);
+        }
         console.log(
           "Executing",
           gradleCmd,
@@ -1376,7 +1382,8 @@ export const createJavaBom = async (path, options) => {
           if (parsedList.dependenciesList && parsedList.dependenciesList) {
             dependencies = mergeDependencies(
               dependencies,
-              parsedList.dependenciesList
+              parsedList.dependenciesList,
+              parentComponent
             );
           }
           if (dlist && dlist.length) {
@@ -1817,7 +1824,8 @@ export const createNodejsBom = async (path, options) => {
       if (parsedList.dependenciesList && parsedList.dependenciesList) {
         dependencies = mergeDependencies(
           dependencies,
-          parsedList.dependenciesList
+          parsedList.dependenciesList,
+          parentComponent
         );
       }
     }
@@ -1845,7 +1853,8 @@ export const createNodejsBom = async (path, options) => {
       if (parsedList.dependenciesList && parsedList.dependenciesList) {
         dependencies = mergeDependencies(
           dependencies,
-          parsedList.dependenciesList
+          parsedList.dependenciesList,
+          parentComponent
         );
       }
     }
@@ -1991,7 +2000,8 @@ export const createNodejsBom = async (path, options) => {
         }
         dependencies = mergeDependencies(
           dependencies,
-          parsedList.dependenciesList
+          parsedList.dependenciesList,
+          parentComponent
         );
       }
     }
@@ -3158,7 +3168,8 @@ export const createSwiftBom = (path, options) => {
         if (retData.dependenciesList) {
           dependencies = mergeDependencies(
             dependencies,
-            retData.dependenciesList
+            retData.dependenciesList,
+            parentComponent
           );
         }
       } else {
@@ -3434,7 +3445,8 @@ export const createContainerSpecLikeBom = async (path, options) => {
         if (mbomData.bomJson.dependencies) {
           dependencies = mergeDependencies(
             dependencies,
-            mbomData.bomJson.dependencies
+            mbomData.bomJson.dependencies,
+            parentComponent
           );
         }
         if (mbomData.bomJson.services) {
@@ -3723,6 +3735,9 @@ export const mergeDependencies = (
   newDependencies,
   parentComponent = {}
 ) => {
+  if (!parentComponent && DEBUG_MODE) {
+    console.log("Unable to determine parent component. Dependencies will be flattened.");
+  }
   const deps_map = {};
   const parentRef =
     parentComponent && parentComponent["bom-ref"]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cyclonedx/cdxgen",
-  "version": "9.3.1",
+  "version": "9.3.2",
   "description": "Creates CycloneDX Software Bill-of-Materials (SBOM) from source or container image",
   "homepage": "http://github.com/cyclonedx/cdxgen",
   "author": "Prabhu Subramanian <prabhu@appthreat.com>",

package/utils.js

@@ -1292,6 +1292,7 @@ export const parseMavenTree = function (rawOutput) {
   let last_purl = "";
   const stack = [];
   tmpA.forEach((l) => {
+    l = l.replace("\r", "");
     if (!includeMavenTestScope && l.trim().endsWith(":test")) {
       return;
     }
@@ -1447,6 +1448,13 @@ export const parseGradleDep = function (
       if (!rline) {
         continue;
       }
+      if (
+        (rline.startsWith("+--- ") || rline.startsWith("\\--- ")) &&
+        rline.includes("{strictly") &&
+        rline.includes("(c)")
+      ) {
+        continue;
+      }
       if (
         rline.trim() === "" ||
         rline.startsWith("+--- ") ||
@@ -1656,6 +1664,7 @@ export const parseGradleProjects = function (rawOutput) {
   if (typeof rawOutput === "string") {
     const tmpA = rawOutput.split("\n");
     tmpA.forEach((l) => {
+      l = l.replace("\r", "")
       if (l.startsWith("Root project ")) {
         rootProject = l
           .split("Root project ")[1]
@@ -1699,6 +1708,7 @@ export const parseGradleProperties = function (rawOutput) {
   if (typeof rawOutput === "string") {
     const tmpA = rawOutput.split("\n");
     tmpA.forEach((l) => {
+      l = l.replace("\r", "");
       if (l.startsWith("----") || l.startsWith(">") || !l.includes(": ")) {
         return;
       }
@@ -1749,7 +1759,7 @@ export const executeGradleProperties = function (dir, rootPath, subProject) {
   if (subProject && subProject.match(/:/g).length >= 2) {
     return defaultProps;
   }
-  const gradlePropertiesArgs = [
+  let gradlePropertiesArgs = [
     subProject ? `${subProject}:properties` : "properties",
     "-q",
     "--console",
@@ -1757,6 +1767,16 @@ export const executeGradleProperties = function (dir, rootPath, subProject) {
     "--build-cache"
   ];
   const gradleCmd = getGradleCommand(dir, rootPath);
+  // common gradle args, used for all tasks
+  if (process.env.GRADLE_ARGS) {
+    const addArgs = process.env.GRADLE_ARGS.split(" ");
+    gradlePropertiesArgs = gradlePropertiesArgs.concat(addArgs);
+  }
+  // gradle args only for the properties task
+  if (process.env.GRADLE_ARGS_PROPERTIES) {
+    const addArgs = process.env.GRADLE_ARGS_PROPERTIES.split(" ");
+    gradlePropertiesArgs = gradlePropertiesArgs.concat(addArgs);
+  }
   console.log(
     "Executing",
     gradleCmd,
@@ -1798,6 +1818,7 @@ export const parseBazelSkyframe = function (rawOutput) {
     const keys_cache = {};
     const tmpA = rawOutput.split("\n");
     tmpA.forEach((l) => {
+      l = l.replace("\r", "");
       if (l.indexOf("external/maven") >= 0) {
         l = l.replace("arguments: ", "").replace(/"/g, "");
         // Skyframe could have duplicate entries
@@ -2244,6 +2265,7 @@ export const getPyMetadata = async function (pkgList, fetchDepsInfo) {
 export const parseBdistMetadata = function (mData) {
   const pkg = {};
   mData.split("\n").forEach((l) => {
+    l = l.replace("\r", "");
     if (l.indexOf("Name: ") > -1) {
       pkg.name = l.split("Name: ")[1];
     } else if (l.indexOf("Version: ") > -1) {
@@ -2296,6 +2318,7 @@ export const parsePyProjectToml = (tomlFile) => {
     return pkg;
   }
   tomlData.split("\n").forEach((l) => {
+    l = l.replace("\r", "");
     if (l.indexOf("=") > -1) {
       const tmpA = l.split("=");
       let key = tmpA[0].trim();
@@ -2915,9 +2938,10 @@ export const parseGosumData = async function (gosumData) {
   }
   const pkgs = gosumData.split("\n");
   for (const l of pkgs) {
+    let m = l.replace("\r", "");
     // look for lines containing go.mod
-    if (l.indexOf("go.mod") > -1) {
-      const tmpA = l.split(" ");
+    if (m.indexOf("go.mod") > -1) {
+      const tmpA = m.split(" ");
       const name = tmpA[0];
       const version = tmpA[1].replace("/go.mod", "");
       const hash = tmpA[tmpA.length - 1].replace("h1:", "sha256-");
@@ -3251,6 +3275,7 @@ export const parseCargoTomlData = async function (cargoData) {
   cargoData.split("\n").forEach((l) => {
     let key = null;
     let value = null;
+    l = l.replace("\r", "");
     if (l.indexOf("[package]") > -1) {
       packageMode = true;
       if (pkg) {
@@ -3973,6 +3998,7 @@ export const parseConanData = function (conanData) {
     return pkgList;
   }
   conanData.split("\n").forEach((l) => {
+    l = l.replace("\r", "");
     if (!l.includes("/")) {
       return;
     }

package/utils.test.js

@@ -163,8 +163,8 @@ test("parse gradle dependencies", () => {
   parsedList = parseGradleDep(
     readFileSync("./test/data/gradle-android-dep.out", { encoding: "utf-8" })
   );
-  expect(parsedList.pkgList.length).toEqual(105);
-  expect(parsedList.dependenciesList.length).toEqual(106);
+  expect(parsedList.pkgList.length).toEqual(104);
+  expect(parsedList.dependenciesList.length).toEqual(105);
   expect(parsedList.pkgList[0]).toEqual({
     group: "com.android.support.test",
     name: "runner",
@@ -181,12 +181,12 @@ test("parse gradle dependencies", () => {
     ]
   });
   expect(parsedList.pkgList[103]).toEqual({
-    group: "androidx.print",
-    name: "print",
+    group: "androidx.core",
+    name: "core",
     qualifiers: {
       type: "jar"
     },
-    version: "1.0.0",
+    version: "1.7.0",
     scope: "optional",
     properties: [
       {