@cyclonedx/cdxgen 9.9.3 → 9.9.4

package/README.md

@@ -49,6 +49,8 @@ Most SBOM tools are like barcode scanners. They can scan a few package manifest
 | Gradle Cache                    | $HOME/caches/modules-2/files-2.1/\*\*/\*.jar                                                                      | N/A                                                                                               |          |
 | Helm Index                      | $HOME/.cache/helm/repository/\*\*/\*.yaml                                                                         | N/A                                                                                               |          |
 | Docker compose                  | docker-compose\*.yml. Images would also be scanned.                                                               | N/A                                                                                               |          |
+| Dockerfile                      | `*Dockerfile*` Images would also be scanned.                                                                      | N/A                                                                                               |          |
+| Containerfile                   | `*Containerfile*`. Images would also be scanned.                                                                  | N/A                                                                                               |          |
 | Google CloudBuild configuration | cloudbuild.yaml                                                                                                   | N/A                                                                                               |          |
 | OpenAPI                         | openapi\*.json, openapi\*.yaml                                                                                    | N/A                                                                                               |          |
 
@@ -173,9 +175,9 @@ Options:
                                es.                    [boolean] [default: false]
       --spec-version           CycloneDX Specification version to use. Defaults
                                to 1.5                             [default: 1.5]
-      --filter                 Filter components containining this word in purl.
+      --filter                 Filter components containing this word in purl.
                                 Multiple values allowed.                 [array]
-      --only                   Include components only containining this word in
+      --only                   Include components only containing this word in
                                 purl. Useful to generate BOM with first party co
                                mponents alone. Multiple values allowed.  [array]
       --author                 The person(s) who created the BOM. Set this value

package/bin/cdxgen.js

@@ -193,11 +193,11 @@ const args = yargs(hideBin(process.argv))
   })
   .option("filter", {
     description:
-      "Filter components containining this word in purl. Multiple values allowed."
+      "Filter components containing this word in purl. Multiple values allowed."
   })
   .option("only", {
     description:
-      "Include components only containining this word in purl. Useful to generate BOM with first party components alone. Multiple values allowed."
+      "Include components only containing this word in purl. Useful to generate BOM with first party components alone. Multiple values allowed."
   })
   .option("author", {
     description:
@@ -520,7 +520,6 @@ const checkPermissions = (filePath) => {
       if (bomNSData.nsMapping && Object.keys(bomNSData.nsMapping).length) {
         const nsFile = jsonFile + ".map";
         fs.writeFileSync(nsFile, JSON.stringify(bomNSData.nsMapping));
-        console.log("Namespace mapping file written to", nsFile);
       }
     }
   } else if (!options.print) {

package/docker.js

@@ -126,8 +126,8 @@ const getDefaultOptions = () => {
         opts.prefixUrl = isWin
           ? WIN_LOCAL_TLS
           : isDockerRootless
-          ? `http://unix:${homedir()}/.docker/run/docker.sock:`
-          : "http://unix:/var/run/docker.sock:";
+            ? `http://unix:${homedir()}/.docker/run/docker.sock:`
+            : "http://unix:/var/run/docker.sock:";
       }
     }
   } else {

package/evinser.js

@@ -498,14 +498,16 @@ export const parseSliceUsages = async (
         !isFilterableType(language, userDefinedTypesMap, atype[1])
       ) {
         if (!atype[1].includes("(") && !atype[1].includes(".py")) {
-          typesToLookup.add(atype[1]);
+          typesToLookup.add(simplifyType(atype[1]));
           // Javascript calls can be resolved to a precise line number only from the call nodes
           if (
             ["javascript", "js", "ts", "typescript"].includes(language) &&
             ausageLine
           ) {
             if (atype[1].includes(":")) {
-              typesToLookup.add(atype[1].split("::")[0].replace(/:/g, "/"));
+              typesToLookup.add(
+                simplifyType(atype[1].split("::")[0].replace(/:/g, "/"))
+              );
             }
             addToOverrides(lKeyOverrides, atype[1], fileName, ausageLine);
           }
@@ -532,7 +534,7 @@ export const parseSliceUsages = async (
           !acall?.resolvedMethod.includes("(") &&
           !acall?.resolvedMethod.includes(".py")
         ) {
-          typesToLookup.add(acall?.resolvedMethod);
+          typesToLookup.add(simplifyType(acall?.resolvedMethod));
           // Javascript calls can be resolved to a precise line number only from the call nodes
           if (acall.lineNumber) {
             addToOverrides(
@@ -560,10 +562,12 @@ export const parseSliceUsages = async (
       for (const aparamType of acall?.paramTypes || []) {
         if (!isFilterableType(language, userDefinedTypesMap, aparamType)) {
           if (!aparamType.includes("(") && !aparamType.includes(".py")) {
-            typesToLookup.add(aparamType);
+            typesToLookup.add(simplifyType(aparamType));
             if (acall.lineNumber) {
               if (aparamType.includes(":")) {
-                typesToLookup.add(aparamType.split("::")[0].replace(/:/g, "/"));
+                typesToLookup.add(
+                  simplifyType(aparamType.split("::")[0].replace(/:/g, "/"))
+                );
               }
               addToOverrides(
                 lKeyOverrides,
@@ -609,7 +613,7 @@ export const parseSliceUsages = async (
     } else {
       // Check the namespaces db
       let nsHits = typePurlsCache[atype];
-      if (["java", "jar"].includes(language)) {
+      if (!nsHits && ["java", "jar"].includes(language)) {
         nsHits = await dbObjMap.Namespaces.findAll({
           attributes: ["purl"],
           where: {
@@ -629,6 +633,9 @@ export const parseSliceUsages = async (
           }
         }
         typePurlsCache[atype] = nsHits;
+      } else {
+        // Avoid persistent lookups
+        typePurlsCache[atype] = [];
       }
     }
   }
@@ -834,7 +841,7 @@ export const extractEndpoints = (language, code) => {
     case "jar":
       if (
         code.startsWith("@") &&
-        code.includes("Mapping") &&
+        (code.includes("Mapping") || code.includes("Path")) &&
         code.includes("(")
       ) {
         const matches = code.match(/['"](.*?)['"]/gi) || [];
@@ -1190,6 +1197,16 @@ export const framePicker = (dfFrames) => {
   return aframe;
 };
 
+/**
+ * Method to simplify types. For example, arrays ending with [] could be simplified.
+ *
+ * @param {string} typeFullName Full name of the type to simplify
+ * @returns Simplified type string
+ */
+export const simplifyType = (typeFullName) => {
+  return typeFullName.replace("[]", "");
+};
+
 export const getClassTypeFromSignature = (language, typeFullName) => {
   if (["java", "jar"].includes(language) && typeFullName.includes(":")) {
     typeFullName = typeFullName.split(":")[0];
@@ -1225,7 +1242,7 @@ export const getClassTypeFromSignature = (language, typeFullName) => {
   if (typeFullName.includes("$")) {
     typeFullName = typeFullName.split("$")[0];
   }
-  return typeFullName;
+  return simplifyType(typeFullName);
 };
 
 const addToOverrides = (lKeyOverrides, atype, fileName, ausageLineNumber) => {

package/index.js

@@ -104,7 +104,8 @@ import {
   TIMEOUT_MS,
   MAX_BUFFER,
   getNugetMetadata,
-  frameworksList
+  frameworksList,
+  parseContainerFile
 } from "./utils.js";
 import { spawnSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
@@ -3713,6 +3714,16 @@ export const createContainerSpecLikeBom = async (path, options) => {
     (options.multiProject ? "**/" : "") + "*.yml",
     options
   );
+  const dfFiles = getAllFiles(
+    path,
+    (options.multiProject ? "**/" : "") + "*Dockerfile*",
+    options
+  );
+  const cfFiles = getAllFiles(
+    path,
+    (options.multiProject ? "**/" : "") + "*Containerfile*",
+    options
+  );
   const yamlFiles = getAllFiles(
     path,
     (options.multiProject ? "**/" : "") + "*.yaml",
@@ -3736,14 +3747,22 @@ export const createContainerSpecLikeBom = async (path, options) => {
   }
   // Privado.ai json files
   const privadoFiles = getAllFiles(path, ".privado/" + "*.json", options);
-  // parse yaml manifest files
-  if (dcFiles.length) {
-    for (const f of dcFiles) {
+  // Parse yaml manifest files, dockerfiles or containerfiles
+  if (dcFiles.length || dfFiles.length || cfFiles.length) {
+    for (const f of [...dcFiles, ...dfFiles, ...cfFiles]) {
       if (DEBUG_MODE) {
         console.log(`Parsing ${f}`);
       }
-      const dcData = readFileSync(f, { encoding: "utf-8" });
-      const imglist = parseContainerSpecData(dcData);
+
+      const dData = readFileSync(f, { encoding: "utf-8" });
+      let imglist = [];
+      // parse yaml manifest files
+      if (f.endsWith(".yml") || f.endsWith(".yaml")) {
+        imglist = parseContainerSpecData(dData);
+      } else {
+        imglist = parseContainerFile(dData);
+      }
+
       if (imglist && imglist.length) {
         if (DEBUG_MODE) {
           console.log("Images identified in", f, "are", imglist);
@@ -5186,12 +5205,22 @@ export const createXBom = async (path, options) => {
     return createHelmBom(path, options);
   }
 
-  // Docker compose, kubernetes and skaffold
+  // Docker compose, dockerfile, containerfile, kubernetes and skaffold
   const dcFiles = getAllFiles(
     path,
     (options.multiProject ? "**/" : "") + "docker-compose*.yml",
     options
   );
+  const dfFiles = getAllFiles(
+    path,
+    (options.multiProject ? "**/" : "") + "*Dockerfile*",
+    options
+  );
+  const cfFiles = getAllFiles(
+    path,
+    (options.multiProject ? "**/" : "") + "*Containerfile*",
+    options
+  );
   const skFiles = getAllFiles(
     path,
     (options.multiProject ? "**/" : "") + "skaffold.yaml",
@@ -5202,7 +5231,13 @@ export const createXBom = async (path, options) => {
     (options.multiProject ? "**/" : "") + "deployment.yaml",
     options
   );
-  if (dcFiles.length || skFiles.length || deplFiles.length) {
+  if (
+    dcFiles.length ||
+    dfFiles.length ||
+    cfFiles.length ||
+    skFiles.length ||
+    deplFiles.length
+  ) {
     return await createContainerSpecLikeBom(path, options);
   }
 
@@ -5468,7 +5503,9 @@ export const createBom = async (path, options) => {
         options
       );
     case "universal":
+    case "containerfile":
     case "docker-compose":
+    case "dockerfile":
     case "swarm":
     case "tekton":
     case "kustomize":

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cyclonedx/cdxgen",
-  "version": "9.9.3",
+  "version": "9.9.4",
   "description": "Creates CycloneDX Software Bill of Materials (SBOM) from source or container image",
   "homepage": "http://github.com/cyclonedx/cdxgen",
   "author": "Prabhu Subramanian <prabhu@appthreat.com>",
@@ -55,8 +55,8 @@
     "url": "https://github.com/cyclonedx/cdxgen/issues"
   },
   "dependencies": {
-    "@babel/parser": "^7.23.0",
-    "@babel/traverse": "^7.23.2",
+    "@babel/parser": "^7.23.3",
+    "@babel/traverse": "^7.23.3",
     "@npmcli/arborist": "7.2.0",
     "ajv": "^8.12.0",
     "ajv-formats": "^2.1.1",
@@ -83,7 +83,7 @@
     "yargs": "^17.7.2"
   },
   "optionalDependencies": {
-    "@appthreat/atom": "1.5.6",
+    "@appthreat/atom": "1.6.3",
     "@cyclonedx/cdxgen-plugins-bin": "^1.4.0",
     "@cyclonedx/cdxgen-plugins-bin-arm64": "^1.4.0",
     "@cyclonedx/cdxgen-plugins-bin-ppc64": "^1.4.0",
@@ -91,7 +91,7 @@
     "compression": "^1.7.4",
     "connect": "^3.7.0",
     "jsonata": "^2.0.3",
-    "sequelize": "^6.33.0",
+    "sequelize": "^6.35.0",
     "sqlite3": "^5.1.6"
   },
   "files": [
@@ -102,10 +102,10 @@
   "devDependencies": {
     "caxa": "^3.0.1",
     "docsify-cli": "^4.4.4",
-    "eslint": "^8.52.0",
+    "eslint": "^8.53.0",
     "eslint-config-prettier": "^9.0.0",
     "eslint-plugin-prettier": "^5.0.1",
     "jest": "^29.7.0",
-    "prettier": "3.0.3"
+    "prettier": "3.1.0"
   }
 }

package/utils.js

@@ -4388,6 +4388,43 @@ export const recurseImageNameLookup = (keyValueObj, pkgList, imgList) => {
   return imgList;
 };
 
+export const parseContainerFile = function (fileContents) {
+  const imgList = [];
+
+  let buildStageNames = [];
+  for (const line of fileContents.split("\n")) {
+    if (line.trim().startsWith("#")) {
+      continue; // skip commented out lines
+    }
+
+    if (line.includes("FROM")) {
+      const fromStatement = line.split("FROM")[1].split("AS");
+
+      const imageStatement = fromStatement[0].trim();
+      const buildStageName = fromStatement[1]?.trim();
+
+      if (buildStageNames.includes(imageStatement)) {
+        if (DEBUG_MODE) {
+          console.log(
+            `Skipping image ${imageStatement} which uses previously seen build stage name.`
+          );
+        }
+        continue;
+      }
+
+      imgList.push({
+        image: imageStatement
+      });
+
+      if (buildStageName) {
+        buildStageNames.push(buildStageName);
+      }
+    }
+  }
+
+  return imgList;
+};
+
 export const parseContainerSpecData = function (dcData) {
   const pkgList = [];
   const imgList = [];
@@ -7690,7 +7727,7 @@ export const parseCmakeLikeFile = (cmakeListFile, pkgType, options = {}) => {
           .split(")")[0]
           .split(",")
           .filter((v) => v.length > 1);
-        const parentName = tmpB[0];
+        const parentName = tmpB[0].replace(":", "");
         let parentVersion = undefined;
         // In case of meson.build we can find the version number after the word version
         // thanks to our replaces and splits

package/utils.test.js

@@ -73,7 +73,8 @@ import {
   parsePyProjectToml,
   parseSbtTree,
   parseCmakeDotFile,
-  parseCmakeLikeFile
+  parseCmakeLikeFile,
+  parseContainerFile
 } from "./utils.js";
 import { readFileSync } from "node:fs";
 import { parse } from "ssri";
@@ -2727,6 +2728,31 @@ test("parse container spec like files", async () => {
   });
 });
 
+test("parse containerfiles / dockerfiles", async () => {
+  let dep_list = parseContainerFile(
+    readFileSync("./test/data/Dockerfile", { encoding: "utf-8" })
+  );
+  expect(dep_list.length).toEqual(5);
+  expect(dep_list[0]).toEqual({
+    image: "hello-world"
+  });
+  expect(dep_list[0]).toEqual({
+    image: "hello-world"
+  });
+  expect(dep_list[1]).toEqual({
+    image: "hello-world"
+  });
+  expect(dep_list[2]).toEqual({
+    image: "hello-world:latest"
+  });
+  expect(dep_list[3]).toEqual({
+    image: "hello-world@sha256:1234567890abcdef"
+  });
+  expect(dep_list[4]).toEqual({
+    image: "hello-world:latest@sha256:1234567890abcdef"
+  });
+});
+
 test("parse cloudbuild data", async () => {
   expect(parseCloudBuildData(null)).toEqual([]);
   const dep_list = parseCloudBuildData(