@cyclonedx/cdxgen 9.9.2 → 9.9.4

package/README.md

@@ -49,6 +49,8 @@ Most SBOM tools are like barcode scanners. They can scan a few package manifest
 | Gradle Cache                    | $HOME/caches/modules-2/files-2.1/\*\*/\*.jar                                                                      | N/A                                                                                               |          |
 | Helm Index                      | $HOME/.cache/helm/repository/\*\*/\*.yaml                                                                         | N/A                                                                                               |          |
 | Docker compose                  | docker-compose\*.yml. Images would also be scanned.                                                               | N/A                                                                                               |          |
+| Dockerfile                      | `*Dockerfile*` Images would also be scanned.                                                                      | N/A                                                                                               |          |
+| Containerfile                   | `*Containerfile*`. Images would also be scanned.                                                                  | N/A                                                                                               |          |
 | Google CloudBuild configuration | cloudbuild.yaml                                                                                                   | N/A                                                                                               |          |
 | OpenAPI                         | openapi\*.json, openapi\*.yaml                                                                                    | N/A                                                                                               |          |
 
@@ -173,9 +175,9 @@ Options:
                                es.                    [boolean] [default: false]
       --spec-version           CycloneDX Specification version to use. Defaults
                                to 1.5                             [default: 1.5]
-      --filter                 Filter components containining this word in purl.
+      --filter                 Filter components containing this word in purl.
                                 Multiple values allowed.                 [array]
-      --only                   Include components only containining this word in
+      --only                   Include components only containing this word in
                                 purl. Useful to generate BOM with first party co
                                mponents alone. Multiple values allowed.  [array]
       --author                 The person(s) who created the BOM. Set this value

package/bin/cdxgen.js

@@ -150,6 +150,7 @@ const args = yargs(hideBin(process.argv))
   })
   .option("install-deps", {
     type: "boolean",
+    hidden: true,
     default: true,
     description:
       "Install dependencies automatically for some projects. Defaults to true but disabled for containers and oci scans. Use --no-install-deps to disable this feature."
@@ -192,11 +193,11 @@ const args = yargs(hideBin(process.argv))
   })
   .option("filter", {
     description:
-      "Filter components containining this word in purl. Multiple values allowed."
+      "Filter components containing this word in purl. Multiple values allowed."
   })
   .option("only", {
     description:
-      "Include components only containining this word in purl. Useful to generate BOM with first party components alone. Multiple values allowed."
+      "Include components only containing this word in purl. Useful to generate BOM with first party components alone. Multiple values allowed."
   })
   .option("author", {
     description:
@@ -215,10 +216,15 @@ const args = yargs(hideBin(process.argv))
       "generic"
     ]
   })
+  .option("exclude", {
+    description: "Additional glob pattern(s) to ignore",
+    hidden: true
+  })
   .completion("completion", "Generate bash/zsh completion")
   .array("filter")
   .array("only")
   .array("author")
+  .array("exclude")
   .option("auto-compositions", {
     type: "boolean",
     default: true,
@@ -514,7 +520,6 @@ const checkPermissions = (filePath) => {
       if (bomNSData.nsMapping && Object.keys(bomNSData.nsMapping).length) {
         const nsFile = jsonFile + ".map";
         fs.writeFileSync(nsFile, JSON.stringify(bomNSData.nsMapping));
-        console.log("Namespace mapping file written to", nsFile);
       }
     }
   } else if (!options.print) {

package/docker.js

@@ -126,8 +126,8 @@ const getDefaultOptions = () => {
         opts.prefixUrl = isWin
           ? WIN_LOCAL_TLS
           : isDockerRootless
-          ? `http://unix:${homedir()}/.docker/run/docker.sock:`
-          : "http://unix:/var/run/docker.sock:";
+            ? `http://unix:${homedir()}/.docker/run/docker.sock:`
+            : "http://unix:/var/run/docker.sock:";
       }
     }
   } else {

package/evinser.js

@@ -7,7 +7,7 @@ import {
   collectMvnDependencies
 } from "./utils.js";
 import { tmpdir } from "node:os";
-import path, { basename } from "node:path";
+import path from "node:path";
 import fs from "node:fs";
 import * as db from "./db.js";
 import { PackageURL } from "packageurl-js";
@@ -94,15 +94,30 @@ export const catalogMavenDeps = async (
   Namespaces,
   options = {}
 ) => {
-  console.log("About to collect jar dependencies for the path", dirPath);
-  const mavenCmd = getMavenCommand(dirPath, dirPath);
-  // collect all jars including from the cache if data-flow mode is enabled
-  const jarNSMapping = collectMvnDependencies(
-    mavenCmd,
-    dirPath,
-    false,
-    options.withDeepJarCollector
-  );
+  let jarNSMapping = undefined;
+  if (fs.existsSync(path.join(dirPath, "bom.json.map"))) {
+    try {
+      const mapData = JSON.parse(
+        fs.readFileSync(path.join(dirPath, "bom.json.map"))
+      );
+      if (mapData && Object.keys(mapData).length) {
+        jarNSMapping = mapData;
+      }
+    } catch (err) {
+      // ignore
+    }
+  }
+  if (!jarNSMapping) {
+    console.log("About to collect jar dependencies for the path", dirPath);
+    const mavenCmd = getMavenCommand(dirPath, dirPath);
+    // collect all jars including from the cache if data-flow mode is enabled
+    jarNSMapping = collectMvnDependencies(
+      mavenCmd,
+      dirPath,
+      false,
+      options.withDeepJarCollector
+    );
+  }
   if (jarNSMapping) {
     for (const purl of Object.keys(jarNSMapping)) {
       purlsJars[purl] = jarNSMapping[purl].jarFile;
@@ -317,9 +332,6 @@ export const analyzeProject = async (dbObjMap, options) => {
     if (retMap && retMap.slicesFile && fs.existsSync(retMap.slicesFile)) {
       usageSlice = JSON.parse(fs.readFileSync(retMap.slicesFile, "utf-8"));
       usagesSlicesFile = retMap.slicesFile;
-      console.log(
-        `To speed up this step, cache ${usagesSlicesFile} and invoke evinse with the --usages-slices-file argument.`
-      );
     }
   }
   if (usageSlice && Object.keys(usageSlice).length) {
@@ -349,9 +361,6 @@ export const analyzeProject = async (dbObjMap, options) => {
       if (retMap && retMap.slicesFile && fs.existsSync(retMap.slicesFile)) {
         dataFlowSlicesFile = retMap.slicesFile;
         dataFlowSlice = JSON.parse(fs.readFileSync(retMap.slicesFile, "utf-8"));
-        console.log(
-          `To speed up this step, cache ${dataFlowSlicesFile} and invoke evinse with the --data-flow-slices-file argument.`
-        );
       }
     }
   }
@@ -381,9 +390,6 @@ export const analyzeProject = async (dbObjMap, options) => {
         reachablesSlice = JSON.parse(
           fs.readFileSync(retMap.slicesFile, "utf-8")
         );
-        console.log(
-          `To speed up this step, cache ${reachablesSlicesFile} and invoke evinse with the --reachables-slices-file argument.`
-        );
       }
     }
   }
@@ -492,14 +498,16 @@ export const parseSliceUsages = async (
         !isFilterableType(language, userDefinedTypesMap, atype[1])
       ) {
         if (!atype[1].includes("(") && !atype[1].includes(".py")) {
-          typesToLookup.add(atype[1]);
+          typesToLookup.add(simplifyType(atype[1]));
           // Javascript calls can be resolved to a precise line number only from the call nodes
           if (
             ["javascript", "js", "ts", "typescript"].includes(language) &&
             ausageLine
           ) {
             if (atype[1].includes(":")) {
-              typesToLookup.add(atype[1].split("::")[0].replace(/:/g, "/"));
+              typesToLookup.add(
+                simplifyType(atype[1].split("::")[0].replace(/:/g, "/"))
+              );
             }
             addToOverrides(lKeyOverrides, atype[1], fileName, ausageLine);
           }
@@ -526,7 +534,7 @@ export const parseSliceUsages = async (
           !acall?.resolvedMethod.includes("(") &&
           !acall?.resolvedMethod.includes(".py")
         ) {
-          typesToLookup.add(acall?.resolvedMethod);
+          typesToLookup.add(simplifyType(acall?.resolvedMethod));
           // Javascript calls can be resolved to a precise line number only from the call nodes
           if (acall.lineNumber) {
             addToOverrides(
@@ -554,10 +562,12 @@ export const parseSliceUsages = async (
       for (const aparamType of acall?.paramTypes || []) {
         if (!isFilterableType(language, userDefinedTypesMap, aparamType)) {
           if (!aparamType.includes("(") && !aparamType.includes(".py")) {
-            typesToLookup.add(aparamType);
+            typesToLookup.add(simplifyType(aparamType));
             if (acall.lineNumber) {
               if (aparamType.includes(":")) {
-                typesToLookup.add(aparamType.split("::")[0].replace(/:/g, "/"));
+                typesToLookup.add(
+                  simplifyType(aparamType.split("::")[0].replace(/:/g, "/"))
+                );
               }
               addToOverrides(
                 lKeyOverrides,
@@ -603,7 +613,7 @@ export const parseSliceUsages = async (
     } else {
       // Check the namespaces db
       let nsHits = typePurlsCache[atype];
-      if (["java", "jar"].includes(language)) {
+      if (!nsHits && ["java", "jar"].includes(language)) {
         nsHits = await dbObjMap.Namespaces.findAll({
           attributes: ["purl"],
           where: {
@@ -623,6 +633,9 @@ export const parseSliceUsages = async (
           }
         }
         typePurlsCache[atype] = nsHits;
+      } else {
+        // Avoid persistent lookups
+        typePurlsCache[atype] = [];
       }
     }
   }
@@ -783,7 +796,7 @@ export const detectServicesFromUDT = (
           const endpoints = extractEndpoints(language, fields[0].name);
           let serviceName = "service";
           if (audt.fileName) {
-            serviceName = `${basename(
+            serviceName = `${path.basename(
               audt.fileName.replace(".py", "")
             )}-service`;
           }
@@ -828,7 +841,7 @@ export const extractEndpoints = (language, code) => {
     case "jar":
       if (
         code.startsWith("@") &&
-        code.includes("Mapping") &&
+        (code.includes("Mapping") || code.includes("Path")) &&
         code.includes("(")
       ) {
         const matches = code.match(/['"](.*?)['"]/gi) || [];
@@ -1184,6 +1197,16 @@ export const framePicker = (dfFrames) => {
   return aframe;
 };
 
+/**
+ * Method to simplify types. For example, arrays ending with [] could be simplified.
+ *
+ * @param {string} typeFullName Full name of the type to simplify
+ * @returns Simplified type string
+ */
+export const simplifyType = (typeFullName) => {
+  return typeFullName.replace("[]", "");
+};
+
 export const getClassTypeFromSignature = (language, typeFullName) => {
   if (["java", "jar"].includes(language) && typeFullName.includes(":")) {
     typeFullName = typeFullName.split(":")[0];
@@ -1219,7 +1242,7 @@ export const getClassTypeFromSignature = (language, typeFullName) => {
   if (typeFullName.includes("$")) {
     typeFullName = typeFullName.split("$")[0];
   }
-  return typeFullName;
+  return simplifyType(typeFullName);
 };
 
 const addToOverrides = (lKeyOverrides, atype, fileName, ausageLineNumber) => {