@cyclonedx/cdxgen 9.5.0 → 9.6.0

package/README.md

@@ -282,39 +282,42 @@ cdxgen can retain the dependency tree under the `dependencies` attribute for a s
 - pnpm-lock.yaml
 - Maven (pom.xml)
 - Gradle
+- Scala SBT
 - Python (requirements.txt, setup.py, pyproject.toml, poetry.lock)
 
 ## Environment variables
 
-| Variable                     | Description                                                                                                                 |
-| ---------------------------- | --------------------------------------------------------------------------------------------------------------------------- |
-| CDXGEN_DEBUG_MODE            | Set to `debug` to enable debug messages                                                                                     |
-| GITHUB_TOKEN                 | Specify GitHub token to prevent traffic shaping while querying license and repo information                                 |
-| MVN_CMD                      | Set to override maven command                                                                                               |
-| MVN_ARGS                     | Set to pass additional arguments such as profile or settings to maven                                                       |
-| MAVEN_HOME                   | Specify maven home                                                                                                          |
-| GRADLE_CACHE_DIR             | Specify gradle cache directory. Useful for class name resolving                                                             |
-| GRADLE_MULTI_PROJECT_MODE    | Unused. Automatically handled                                                                                               |
-| GRADLE_ARGS                  | Set to pass additional arguments such as profile or settings to gradle (all tasks). Eg: --configuration runtimeClassPath    |
-| GRADLE_ARGS_PROPERTIES       | Set to pass additional arguments only to the `gradle properties` task, used for collecting metadata about the project       |
-| GRADLE_ARGS_DEPENDENCIES     | Set to pass additional arguments only to the `gradle dependencies` task, used for listing actual project dependencies       |
-| GRADLE_HOME                  | Specify gradle home                                                                                                         |
-| GRADLE_CMD                   | Set to override gradle command                                                                                              |
-| GRADLE_DEPENDENCY_TASK       | By default cdxgen use the task "dependencies" to collect packages. Set to override the task name.                           |
-| SBT_CACHE_DIR                | Specify sbt cache directory. Useful for class name resolving                                                                |
-| FETCH_LICENSE                | Set this variable to `true` or `1` to fetch license information from the registry. npm and golang                           |
-| USE_GOSUM                    | Set to `true` or `1` to generate BOMs for golang projects using go.sum as the dependency source of truth, instead of go.mod |
-| CDXGEN_TIMEOUT_MS            | Default timeout for known execution involving maven, gradle or sbt                                                          |
-| CDXGEN_SERVER_TIMEOUT_MS     | Default timeout in server mode                                                                                              |
-| BAZEL_TARGET                 | Bazel target to build. Default :all (Eg: //java-maven)                                                                      |
-| CLJ_CMD                      | Set to override the clojure cli command                                                                                     |
-| LEIN_CMD                     | Set to override the leiningen command                                                                                       |
-| SBOM_SIGN_ALGORITHM          | Signature algorithm. Some valid values are RS256, RS384, RS512, PS256, PS384, PS512, ES256 etc                              |
-| SBOM_SIGN_PRIVATE_KEY        | Private key to use for signing                                                                                              |
-| SBOM_SIGN_PUBLIC_KEY         | Optional. Public key to include in the SBoM signature                                                                       |
-| CDX_MAVEN_PLUGIN             | CycloneDX Maven plugin to use. Default "org.cyclonedx:cyclonedx-maven-plugin:2.7.8"                                         |
-| CDX_MAVEN_GOAL               | CycloneDX Maven plugin goal to use. Default makeAggregateBom. Other options: makeBom, makePackageBom                        |
-| CDX_MAVEN_INCLUDE_TEST_SCOPE | Whether test scoped dependencies should be included from Maven projects, Default: true                                      |
+| Variable                     | Description                                                                                                                          |
+| ---------------------------- | ------------------------------------------------------------------------------------------------------------------------------------ |
+| CDXGEN_DEBUG_MODE            | Set to `debug` to enable debug messages                                                                                              |
+| GITHUB_TOKEN                 | Specify GitHub token to prevent traffic shaping while querying license and repo information                                          |
+| MVN_CMD                      | Set to override maven command                                                                                                        |
+| MVN_ARGS                     | Set to pass additional arguments such as profile or settings to maven                                                                |
+| MAVEN_HOME                   | Specify maven home                                                                                                                   |
+| GRADLE_CACHE_DIR             | Specify gradle cache directory. Useful for class name resolving                                                                      |
+| GRADLE_MULTI_PROJECT_MODE    | Unused. Automatically handled                                                                                                        |
+| GRADLE_ARGS                  | Set to pass additional arguments such as profile or settings to gradle (all tasks). Eg: --configuration runtimeClassPath             |
+| GRADLE_ARGS_PROPERTIES       | Set to pass additional arguments only to the `gradle properties` task, used for collecting metadata about the project                |
+| GRADLE_ARGS_DEPENDENCIES     | Set to pass additional arguments only to the `gradle dependencies` task, used for listing actual project dependencies                |
+| GRADLE_HOME                  | Specify gradle home                                                                                                                  |
+| GRADLE_CMD                   | Set to override gradle command                                                                                                       |
+| GRADLE_DEPENDENCY_TASK       | By default cdxgen use the task "dependencies" to collect packages. Set to override the task name.                                    |
+| SBT_CACHE_DIR                | Specify sbt cache directory. Useful for class name resolving                                                                         |
+| FETCH_LICENSE                | Set this variable to `true` or `1` to fetch license information from the registry. npm and golang                                    |
+| USE_GOSUM                    | Set to `true` or `1` to generate BOMs for golang projects using go.sum as the dependency source of truth, instead of go.mod          |
+| CDXGEN_TIMEOUT_MS            | Default timeout for known execution involving maven, gradle or sbt                                                                   |
+| CDXGEN_SERVER_TIMEOUT_MS     | Default timeout in server mode                                                                                                       |
+| BAZEL_TARGET                 | Bazel target to build. Default :all (Eg: //java-maven)                                                                               |
+| CLJ_CMD                      | Set to override the clojure cli command                                                                                              |
+| LEIN_CMD                     | Set to override the leiningen command                                                                                                |
+| SBOM_SIGN_ALGORITHM          | Signature algorithm. Some valid values are RS256, RS384, RS512, PS256, PS384, PS512, ES256 etc                                       |
+| SBOM_SIGN_PRIVATE_KEY        | Private key to use for signing                                                                                                       |
+| SBOM_SIGN_PUBLIC_KEY         | Optional. Public key to include in the SBoM signature                                                                                |
+| CDX_MAVEN_PLUGIN             | CycloneDX Maven plugin to use. Default "org.cyclonedx:cyclonedx-maven-plugin:2.7.8"                                                  |
+| CDX_MAVEN_GOAL               | CycloneDX Maven plugin goal to use. Default makeAggregateBom. Other options: makeBom, makePackageBom                                 |
+| CDX_MAVEN_INCLUDE_TEST_SCOPE | Whether test scoped dependencies should be included from Maven projects, Default: true                                               |
+| ASTGEN_IGNORE_DIRS           | Comma separated list of directories to ignore while analyzing using babel. The environment variable is also used by atom and astgen. |
+| ASTGEN_IGNORE_FILE_PATTERN   | Ignore regex to use                                                                                                                  |
 
 ## Plugins
 

package/analyzer.js

@@ -2,28 +2,37 @@ import { parse } from "@babel/parser";
 import traverse from "@babel/traverse";
 import { join } from "path";
 import { readdirSync, statSync, readFileSync } from "fs";
-import { basename, resolve, isAbsolute } from "path";
+import { basename, resolve, isAbsolute, relative } from "path";
 
-const IGNORE_DIRS = [
-  "node_modules",
-  "venv",
-  "docs",
-  "test",
-  "tests",
-  "e2e",
-  "examples",
-  "cypress",
-  "site-packages",
-  "typings",
-  "api_docs",
-  "dev_docs",
-  "types",
-  "mock",
-  "mocks"
-];
+const IGNORE_DIRS = process.env.ASTGEN_IGNORE_DIRS
+  ? process.env.ASTGEN_IGNORE_DIRS.split(",")
+  : [
+      "node_modules",
+      "venv",
+      "docs",
+      "test",
+      "tests",
+      "e2e",
+      "examples",
+      "cypress",
+      "site-packages",
+      "typings",
+      "api_docs",
+      "dev_docs",
+      "types",
+      "mock",
+      "mocks",
+      "jest-cache",
+      "eslint-rules",
+      "codemods",
+      "flow-typed",
+      "i18n",
+      "__tests__"
+    ];
 
 const IGNORE_FILE_PATTERN = new RegExp(
-  "(conf|config|test|spec|mock|\\.d)\\.(js|ts|tsx)$",
+  process.env.ASTGEN_IGNORE_FILE_PATTERN ||
+    "(conf|config|test|spec|mock|\\.d)\\.(js|ts|tsx)$",
   "i"
 );
 
@@ -33,7 +42,7 @@ const getAllFiles = (dir, extn, files, result, regex) => {
   regex = regex || new RegExp(`\\${extn}$`);
 
   for (let i = 0; i < files.length; i++) {
-    if (IGNORE_FILE_PATTERN.test(files[i])) {
+    if (IGNORE_FILE_PATTERN.test(files[i]) || files[i].startsWith(".")) {
       continue;
     }
     const file = join(dir, files[i]);
@@ -87,72 +96,95 @@ const babelParserOptions = {
  * Filter only references to (t|jsx?) or (less|scss) files for now.
  * Opt to use our relative paths.
  */
-const setFileRef = (allImports, file, pathway) => {
+const setFileRef = (allImports, src, file, pathnode, specifiers = []) => {
+  const pathway = pathnode.value || pathnode.name;
+  const sourceLoc = pathnode.loc?.start;
+  if (!pathway) {
+    return;
+  }
+  const fileRelativeLoc = relative(src, file);
   // remove unexpected extension imports
   if (/\.(svg|png|jpg|d\.ts)/.test(pathway)) {
     return;
   }
-
+  const importedModules = specifiers
+    .map((s) => s.imported?.name)
+    .filter((v) => v !== undefined);
+  const occurrence = {
+    importedAs: pathway,
+    importedModules,
+    isExternal: true,
+    fileName: fileRelativeLoc,
+    lineNumber: sourceLoc && sourceLoc.line ? sourceLoc.line : undefined,
+    columnNumber: sourceLoc && sourceLoc.column ? sourceLoc.column : undefined
+  };
   // replace relative imports with full path
-  let module = pathway;
+  let moduleFullPath = pathway;
+  let wasAbsolute = false;
   if (/\.\//g.test(pathway) || /\.\.\//g.test(pathway)) {
-    module = resolve(file, "..", pathway);
-  }
-
-  // initialise or increase reference count for file
-  if (Object.prototype.hasOwnProperty.call(allImports, module)) {
-    allImports[module] = allImports[module] + 1;
-  } else {
-    allImports[module] = 1;
+    moduleFullPath = resolve(file, "..", pathway);
+    if (isAbsolute(moduleFullPath)) {
+      moduleFullPath = relative(src, moduleFullPath);
+      wasAbsolute = true;
+    }
+    occurrence.isExternal = false;
   }
-
+  allImports[moduleFullPath] = allImports[moduleFullPath] || new Set();
+  allImports[moduleFullPath].add(occurrence);
   // Handle module package name
   // Eg: zone.js/dist/zone will be referred to as zone.js in package.json
-  if (!isAbsolute(module) && module.includes("/")) {
-    const modPkg = module.split("/")[0];
-    if (Object.prototype.hasOwnProperty.call(allImports, modPkg)) {
-      allImports[modPkg] = allImports[modPkg] + 1;
-    } else {
-      allImports[modPkg] = 1;
-    }
+  if (!wasAbsolute && moduleFullPath.includes("/")) {
+    const modPkg = moduleFullPath.split("/")[0];
+    allImports[modPkg] = allImports[modPkg] || new Set();
+    allImports[modPkg].add(occurrence);
   }
 };
 
+const vueCleaningRegex = /<\/*script.*>|<style[\s\S]*style>|<\/*br>/gi;
+const vueTemplateRegex = /(<template.*>)([\s\S]*)(<\/template>)/gi;
+const vueCommentRegex = /<!--[\s\S]*?-->/gi;
+const vueBindRegex = /(:\[)([\s\S]*?)(\])/gi;
+const vuePropRegex = /\s([.:@])([a-zA-Z]*?=)/gi;
+
+const fileToParseableCode = (file) => {
+  let code = readFileSync(file, "utf-8");
+  if (file.endsWith(".vue") || file.endsWith(".svelte")) {
+    code = code
+      .replace(vueCommentRegex, function (match) {
+        return match.replaceAll(/\S/g, " ");
+      })
+      .replace(vueCleaningRegex, function (match) {
+        return match.replaceAll(/\S/g, " ").substring(1) + ";";
+      })
+      .replace(vueBindRegex, function (match, grA, grB, grC) {
+        return grA.replaceAll(/\S/g, " ") + grB + grC.replaceAll(/\S/g, " ");
+      })
+      .replace(vuePropRegex, function (match, grA, grB) {
+        return " " + grA.replace(/[.:@]/g, " ") + grB;
+      })
+      .replace(vueTemplateRegex, function (match, grA, grB, grC) {
+        return grA + grB.replaceAll("{{", "{ ").replaceAll("}}", " }") + grC;
+      });
+  }
+  return code;
+};
+
 /**
  * Check AST tree for any (j|tsx?) files and set a file
  * references for any import, require or dynamic import files.
  */
-const parseFileASTTree = (file, allImports) => {
-  const ast = parse(readFileSync(file, "utf-8"), babelParserOptions);
+const parseFileASTTree = (src, file, allImports) => {
+  const ast = parse(fileToParseableCode(file), babelParserOptions);
   traverse.default(ast, {
-    Import: (path) => {
-      if (path && path.node) {
-        setFileRef(allImports, file, path.node.source.value);
-      }
-    },
-    ImportDefaultSpecifier: (path) => {
-      if (path && path.node) {
-        setFileRef(allImports, file, path.node.source.value);
-      }
-    },
-    ImportNamespaceSpecifier: (path) => {
-      if (path && path.node) {
-        setFileRef(allImports, file, path.node.source.value);
-      }
-    },
-    ImportAttribute: (path) => {
-      if (path && path.node) {
-        setFileRef(allImports, file, path.node.source.value);
-      }
-    },
-    ImportOrExportDeclaration: (path) => {
-      if (path && path.node) {
-        setFileRef(allImports, file, path.node.source.value);
-      }
-    },
     ImportDeclaration: (path) => {
       if (path && path.node) {
-        setFileRef(allImports, file, path.node.source.value);
+        setFileRef(
+          allImports,
+          src,
+          file,
+          path.node.source,
+          path.node.specifiers
+        );
       }
     },
     // For require('') statements
@@ -163,23 +195,29 @@ const parseFileASTTree = (file, allImports) => {
         path.node.name === "require" &&
         path.parent.type === "CallExpression"
       ) {
-        setFileRef(allImports, file, path.parent.arguments[0].value);
+        setFileRef(allImports, src, file, path.parent.arguments[0]);
       }
     },
     // Use for dynamic imports like routes.jsx
     CallExpression: (path) => {
       if (path && path.node && path.node.callee.type === "Import") {
-        setFileRef(allImports, file, path.node.arguments[0].value);
+        setFileRef(allImports, src, file, path.node.arguments[0]);
       }
     },
     // Use for export barrells
     ExportAllDeclaration: (path) => {
-      setFileRef(allImports, file, path.node.source.value);
+      setFileRef(allImports, src, file, path.node.source);
     },
     ExportNamedDeclaration: (path) => {
       // ensure there is a path export
       if (path && path.node && path.node.source) {
-        setFileRef(allImports, file, path.node.source.value);
+        setFileRef(
+          allImports,
+          src,
+          file,
+          path.node.source,
+          path.node.specifiers
+        );
       }
     }
   });
@@ -192,8 +230,12 @@ const getAllSrcJSAndTSFiles = (src) =>
   Promise.all([
     getAllFiles(src, ".js"),
     getAllFiles(src, ".jsx"),
+    getAllFiles(src, ".cjs"),
+    getAllFiles(src, ".mjs"),
     getAllFiles(src, ".ts"),
-    getAllFiles(src, ".tsx")
+    getAllFiles(src, ".tsx"),
+    getAllFiles(src, ".vue"),
+    getAllFiles(src, ".svelte")
   ]);
 
 /**
@@ -207,7 +249,7 @@ export const findJSImports = async (src) => {
     const srcFiles = promiseMap.flatMap((d) => d);
     for (const file of srcFiles) {
       try {
-        parseFileASTTree(file, allImports);
+        parseFileASTTree(src, file, allImports);
       } catch (err) {
         errFiles.push(file);
       }

package/bin/cdxgen.js

@@ -313,13 +313,30 @@ const checkPermissions = (filePath) => {
             }
           }
           try {
+            // Sign the individual components
+            // Let's leave the services unsigned for now since it might require additional cleansing
+            const bomJsonUnsignedObj = JSON.parse(jsonPayload);
+            for (const comp of bomJsonUnsignedObj.components) {
+              const compSignature = jws.sign({
+                header: { alg },
+                payload: comp,
+                privateKey: privateKeyToUse
+              });
+              const compSignatureBlock = {
+                algorithm: alg,
+                value: compSignature
+              };
+              if (jwkPublicKey) {
+                compSignatureBlock.publicKey = jwkPublicKey;
+              }
+              comp.signature = compSignatureBlock;
+            }
             const signature = jws.sign({
               header: { alg },
-              payload: jsonPayload,
+              payload: JSON.stringify(bomJsonUnsignedObj, null, 2),
               privateKey: privateKeyToUse
             });
             if (signature) {
-              const bomJsonUnsignedObj = JSON.parse(jsonPayload);
               const signatureBlock = {
                 algorithm: alg,
                 value: signature

package/bin/evinse.js

@@ -1,3 +1,5 @@
+#!/usr/bin/env node
+
 // Evinse (Evinse Verification Is Nearly SBoM Evidence)
 import yargs from "yargs";
 import { hideBin } from "yargs/helpers";
@@ -65,7 +67,7 @@ const args = yargs(hideBin(process.argv))
   })
   .option("annotate", {
     description: "Include contents of atom slices as annotations",
-    default: true,
+    default: false,
     type: "boolean"
   })
   .option("with-data-flow", {

package/bin/repl.js

@@ -1,3 +1,5 @@
+#!/usr/bin/env node
+
 import repl from "node:repl";
 import jsonata from "jsonata";
 import fs from "node:fs";

package/bin/verify.js

@@ -5,6 +5,14 @@ import { hideBin } from "yargs/helpers";
 import fs from "node:fs";
 import jws from "jws";
 import process from "node:process";
+import { fileURLToPath } from "node:url";
+import { dirname, join } from "node:path";
+
+let url = import.meta.url;
+if (!url.startsWith("file://")) {
+  url = new URL(`file://${import.meta.url}`).toString();
+}
+const dirName = import.meta ? dirname(fileURLToPath(url)) : __dirname;
 
 const args = yargs(hideBin(process.argv))
   .option("input", {
@@ -20,8 +28,22 @@ const args = yargs(hideBin(process.argv))
   .version()
   .help("h").argv;
 
+if (args.version) {
+  const packageJsonAsString = fs.readFileSync(
+    join(dirName, "..", "package.json"),
+    "utf-8"
+  );
+  const packageJson = JSON.parse(packageJsonAsString);
+
+  console.log(packageJson.version);
+  process.exit(0);
+}
+
 const bomJson = JSON.parse(fs.readFileSync(args.input, "utf8"));
-const bomSignature = bomJson?.signature?.value;
+const bomSignature =
+  bomJson.signature && bomJson.signature.value
+    ? bomJson.signature.value
+    : undefined;
 if (!bomSignature) {
   console.log("No signature was found!");
 } else {

package/display.js

@@ -58,6 +58,19 @@ export const printServices = (bomJson) => {
   }
 };
 
+const locationComparator = (a, b) => {
+  if (a && b && a.includes("#") && b.includes("#")) {
+    const tmpA = a.split("#");
+    const tmpB = b.split("#");
+    if (tmpA.length === 2 && tmpB.length === 2) {
+      if (tmpA[0] == tmpB[0]) {
+        return tmpA[1] - tmpB[1];
+      }
+    }
+  }
+  return a.localeCompare(b);
+};
+
 export const printOccurrences = (bomJson) => {
   const data = [["Group", "Name", "Version", "Occurrences"]];
   if (!bomJson || !bomJson.components) {
@@ -73,7 +86,7 @@ export const printOccurrences = (bomJson) => {
       comp.version,
       comp.evidence.occurrences
         .map((l) => l.location)
-        .sort()
+        .sort(locationComparator)
         .join("\n")
     ]);
   }
@@ -106,7 +119,7 @@ export const printCallStack = (bomJson) => {
           (c) => `${c.fullFilename}${c.line ? "#" + c.line : ""}`
         )
       )
-    ).sort();
+    ).sort(locationComparator);
     let frameDisplay = [frames[0]];
     if (frames.length > 1) {
       for (let i = 1; i < frames.length - 1; i++) {