@cyclonedx/cdxgen 9.8.6 → 9.8.7

package/README.md

@@ -27,7 +27,7 @@ A typical application might have several repos, components, and libraries. Tradi
 | go                              | binary, go.mod, go.sum, Gopkg.lock                                                                                | Yes except binary                                                                                 |
 | ruby                            | Gemfile.lock, gemspec                                                                                             | Only for Gemfile.lock                                                                             |
 | rust                            | binary, Cargo.toml, Cargo.lock                                                                                    | Only for Cargo.lock                                                                               |
-| .Net                            | .csproj, packages.config, project.assets.json [3], packages.lock.json, .nupkg                                     | Only for project.assets.json, packages.lock.json                                                  |
+| .Net                            | .csproj, packages.config, project.assets.json [3], packages.lock.json, .nupkg, paket.lock                         | Only for project.assets.json, packages.lock.json, paket.lock                                      |
 | dart                            | pubspec.lock, pubspec.yaml                                                                                        | Only for pubspec.lock                                                                             |
 | haskell                         | cabal.project.freeze                                                                                              | Yes                                                                                               |
 | elixir                          | mix.lock                                                                                                          | Yes                                                                                               |

package/index.js

@@ -92,6 +92,7 @@ import {
   parseCsPkgLockData,
   parseCsPkgData,
   parseCsProjData,
+  parsePaketLockData,
   DEBUG_MODE,
   parsePyProjectToml,
   addEvidenceForImports,
@@ -3963,6 +3964,10 @@ export const createCsharpBom = async (
     path,
     (options.multiProject ? "**/" : "") + "packages.lock.json"
   );
+  const paketLockFiles = getAllFiles(
+    path,
+    (options.multiProject ? "**/" : "") + "paket.lock"
+  );
   const nupkgFiles = getAllFiles(
     path,
     (options.multiProject ? "**/" : "") + "*.nupkg"
@@ -4046,6 +4051,20 @@ export const createCsharpBom = async (
       }
     }
   }
+  if (paketLockFiles.length) {
+    manifestFiles = manifestFiles.concat(paketLockFiles);
+    // paket.lock parsing
+    for (const f of paketLockFiles) {
+      if (DEBUG_MODE) {
+        console.log(`Parsing ${f}`);
+      }
+      pkgData = readFileSync(f, { encoding: "utf-8" });
+      const dlist = await parsePaketLockData(pkgData);
+      if (dlist && dlist.length) {
+        pkgList = pkgList.concat(dlist);
+      }
+    }
+  }
   if (!parentComponent) {
     parentComponent = createDefaultParentComponent(path, options.type, options);
   }
@@ -4110,13 +4129,16 @@ export const trimComponents = (components, format) => {
   const filteredComponents = [];
   for (const comp of components) {
     if (format === "xml" && comp.component) {
-      const key = comp.component.purl || comp.component["bom-ref"];
+      const key =
+        comp.component.purl ||
+        comp.component["bom-ref"] ||
+        comp.name + comp.version;
       if (!keyCache[key]) {
         keyCache[key] = true;
         filteredComponents.push(comp);
       }
     } else {
-      const key = comp.purl || comp["bom-ref"];
+      const key = comp.purl || comp["bom-ref"] || comp.name + comp.version;
       if (!keyCache[key]) {
         keyCache[key] = true;
         filteredComponents.push(comp);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cyclonedx/cdxgen",
-  "version": "9.8.6",
+  "version": "9.8.7",
   "description": "Creates CycloneDX Software Bill of Materials (SBOM) from source or container image",
   "homepage": "http://github.com/cyclonedx/cdxgen",
   "author": "Prabhu Subramanian <prabhu@appthreat.com>",
@@ -82,7 +82,7 @@
     "yargs": "^17.7.2"
   },
   "optionalDependencies": {
-    "@appthreat/atom": "^1.2.3",
+    "@appthreat/atom": "1.2.5",
     "@cyclonedx/cdxgen-plugins-bin": "^1.4.0",
     "@cyclonedx/cdxgen-plugins-bin-arm64": "^1.4.0",
     "@cyclonedx/cdxgen-plugins-bin-ppc64": "^1.4.0",

package/server.js

@@ -8,6 +8,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { createBom, submitBom } from "./index.js";
 import compression from "compression";
+import { URL } from "url";
 
 // Timeout milliseconds. Default 10 mins
 const TIMEOUT_MS =
@@ -24,10 +25,14 @@ app.use(
 app.use(compression());
 
 const gitClone = (repoUrl) => {
+  const parsedUrl = new URL(repoUrl);
+
+  const sanitizedRepoUrl = `${parsedUrl.protocol}//${parsedUrl.host}${parsedUrl.pathname}`;
+
   const tempDir = fs.mkdtempSync(
-    path.join(os.tmpdir(), path.basename(repoUrl))
+    path.join(os.tmpdir(), path.basename(parsedUrl.pathname))
   );
-  console.log("Cloning", repoUrl, "to", tempDir);
+  console.log("Cloning", sanitizedRepoUrl, "to", tempDir);
   const result = spawnSync("git", ["clone", repoUrl, "--depth", "1", tempDir], {
     encoding: "utf-8",
     shell: false

package/utils.js

@@ -4639,6 +4639,28 @@ export const parseCsPkgLockData = async function (csLockData) {
   return pkgList;
 };
 
+export const parsePaketLockData = async function (paketLockData) {
+  const pkgList = [];
+  let pkg = null;
+  if (!paketLockData) {
+    return pkgList;
+  }
+  const pkgRegex = /\s+([a-zA-Z0-9-.]+) \(((?=.*?\.)[a-zA-Z0-9-.]+)\)/g;
+  for (const [, name, version] of paketLockData.matchAll(pkgRegex)) {
+    const purl = decodeURIComponent(
+      new PackageURL("nuget", "", name, version, null, null).toString()
+    );
+    pkg = {
+      group: "",
+      name: name,
+      version: version,
+      purl: purl
+    };
+    pkgList.push(pkg);
+  }
+  return pkgList;
+};
+
 /**
  * Parse composer lock file
  *
@@ -5381,11 +5403,7 @@ export const collectMvnDependencies = function (
     "-Dmdep.stripVersion=" + (process.env.MAVEN_STRIP_VERSION || "false")
   ];
   if (basePath && basePath !== MAVEN_CACHE_DIR) {
-    console.log(
-      `Executing '${mavenCmd} dependency:copy-dependencies ${copyArgs.join(
-        " "
-      )}' in ${basePath}`
-    );
+    console.log(`Executing '${mavenCmd} ${copyArgs.join(" ")}' in ${basePath}`);
     const result = spawnSync(mavenCmd, copyArgs, {
       cwd: basePath,
       encoding: "utf-8",

package/utils.test.js

@@ -32,6 +32,7 @@ import {
   parseCsProjData,
   parseCsProjAssetsData,
   parseCsPkgLockData,
+  parsePaketLockData,
   getNugetMetadata,
   parsePom,
   getMvnMetadata,
@@ -1246,6 +1247,20 @@ test("parse packages.lock.json", async () => {
   });
 });
 
+test("parse paket.lock", async () => {
+  expect(await parsePaketLockData(null)).toEqual([]);
+  const dep_list = await parsePaketLockData(
+    readFileSync("./test/data/paket.lock", { encoding: "utf-8" })
+  );
+  expect(dep_list.length).toEqual(13);
+  expect(dep_list[0]).toEqual({
+    group: "",
+    name: "0x53A.ReferenceAssemblies.Paket",
+    version: "0.2",
+    purl: "pkg:nuget/0x53A.ReferenceAssemblies.Paket@0.2"
+  });
+});
+
 test("parse .net cs proj", async () => {
   expect(await parseCsProjData(null)).toEqual([]);
   const dep_list = await parseCsProjData(