@cyclonedx/cyclonedx-library 1.0.2 → 1.2.0

package/src/serialize/json/normalize.ts

@@ -23,6 +23,7 @@ import * as Models from '../../models'
 import { Protocol as Spec, Version as SpecVersion } from '../../spec'
 import { NormalizerOptions } from '../types'
 import { JsonSchema, Normalized } from './types'
+import { treeIterator } from '../../helpers/tree'
 
 export class Factory {
   readonly #spec: Spec
@@ -103,6 +104,10 @@ abstract class Base implements Normalizer {
     this._factory = factory
   }
 
+  get factory (): Factory {
+    return this._factory
+  }
+
   abstract normalize (data: object, options: NormalizerOptions): object | undefined
 }
 
@@ -238,13 +243,16 @@ export class OrganizationalEntityNormalizer extends Base {
 
 export class ComponentNormalizer extends Base {
   normalize (data: Models.Component, options: NormalizerOptions): Normalized.Component | undefined {
-    return this._factory.spec.supportsComponentType(data.type)
+    const spec = this._factory.spec
+    const version: string = data.version ?? ''
+    return spec.supportsComponentType(data.type)
       ? {
           type: data.type,
           name: data.name,
           group: data.group || undefined,
-          // version fallback to string for spec < 1.4
-          version: data.version || '',
+          version: version.length > 0 || spec.requiresComponentVersion
+            ? version
+            : undefined,
           'bom-ref': data.bomRef.value || undefined,
           supplier: data.supplier === undefined
             ? undefined
@@ -267,6 +275,9 @@ export class ComponentNormalizer extends Base {
             : this._factory.makeForSWID().normalize(data.swid, options),
           externalReferences: data.externalReferences.size > 0
             ? this._factory.makeForExternalReference().normalizeRepository(data.externalReferences, options)
+            : undefined,
+          components: data.components.size > 0
+            ? this.normalizeRepository(data.components, options)
             : undefined
         }
       : undefined
@@ -391,9 +402,12 @@ export class DependencyGraphNormalizer extends Base {
     const allRefs = new Map<Models.BomRef, Models.BomRefRepository>()
     if (data.metadata.component !== undefined) {
       allRefs.set(data.metadata.component.bomRef, data.metadata.component.dependencies)
+      for (const component of data.metadata.component.components[treeIterator]()) {
+        allRefs.set(component.bomRef, component.dependencies)
+      }
     }
-    for (const c of data.components) {
-      allRefs.set(c.bomRef, new Models.BomRefRepository(c.dependencies))
+    for (const component of data.components[treeIterator]()) {
+      allRefs.set(component.bomRef, component.dependencies)
     }
 
     const normalized: Normalized.Dependency[] = []

package/src/serialize/jsonSerializer.ts

@@ -42,6 +42,10 @@ export class JsonSerializer extends BaseSerializer<Normalized.Bom> {
     this.#normalizerFactory = normalizerFactory
   }
 
+  get normalizerFactory (): NormalizerFactory {
+    return this.#normalizerFactory
+  }
+
   protected _normalize (
     bom: Bom,
     options: NormalizerOptions = {}

package/src/serialize/xml/normalize.ts

@@ -23,6 +23,7 @@ import * as Models from '../../models'
 import { Protocol as Spec, Version as SpecVersion } from '../../spec'
 import { NormalizerOptions } from '../types'
 import { SimpleXml, XmlSchema } from './types'
+import { treeIterator } from '../../helpers/tree'
 
 export class Factory {
   readonly #spec: Spec
@@ -103,6 +104,10 @@ abstract class Base implements Normalizer {
     this._factory = factory
   }
 
+  get factory (): Factory {
+    return this._factory
+  }
+
   /**
    * @param {*} data
    * @param {NormalizerOptions} options
@@ -295,12 +300,21 @@ export class OrganizationalEntityNormalizer extends Base {
 
 export class ComponentNormalizer extends Base {
   normalize (data: Models.Component, options: NormalizerOptions, elementName: string): SimpleXml.Element | undefined {
-    if (!this._factory.spec.supportsComponentType(data.type)) {
+    const spec = this._factory.spec
+    if (!spec.supportsComponentType(data.type)) {
       return undefined
     }
     const supplier: SimpleXml.Element | undefined = data.supplier === undefined
       ? undefined
       : this._factory.makeForOrganizationalEntity().normalize(data.supplier, options, 'supplier')
+    const version: SimpleXml.Element | undefined = (
+      spec.requiresComponentVersion
+        ? makeTextElement
+        : makeOptionalTextElement
+    )(
+      data.version ?? '',
+      'version'
+    )
     const hashes: SimpleXml.Element | undefined = data.hashes.size > 0
       ? {
           type: 'element',
@@ -326,6 +340,13 @@ export class ComponentNormalizer extends Base {
             .normalizeRepository(data.externalReferences, options, 'reference')
         }
       : undefined
+    const components: SimpleXml.Element | undefined = data.components.size > 0
+      ? {
+          type: 'element',
+          name: 'components',
+          children: this.normalizeRepository(data.components, options, 'component')
+        }
+      : undefined
     return {
       type: 'element',
       name: elementName,
@@ -339,11 +360,7 @@ export class ComponentNormalizer extends Base {
         makeOptionalTextElement(data.publisher, 'publisher'),
         makeOptionalTextElement(data.group, 'group'),
         makeTextElement(data.name, 'name'),
-        makeTextElement(
-          // version fallback to string for spec < 1.4
-          data.version ?? '',
-          'version'
-        ),
+        version,
         makeOptionalTextElement(data.description, 'description'),
         makeOptionalTextElement(data.scope, 'scope'),
         hashes,
@@ -352,7 +369,8 @@ export class ComponentNormalizer extends Base {
         makeOptionalTextElement(data.cpe, 'cpe'),
         makeOptionalTextElement(data.purl, 'purl'),
         swid,
-        extRefs
+        extRefs,
+        components
       ].filter(isNotUndefined)
     }
   }
@@ -504,9 +522,12 @@ export class DependencyGraphNormalizer extends Base {
     const allRefs = new Map<Models.BomRef, Models.BomRefRepository>()
     if (data.metadata.component !== undefined) {
       allRefs.set(data.metadata.component.bomRef, data.metadata.component.dependencies)
+      for (const component of data.metadata.component.components[treeIterator]()) {
+        allRefs.set(component.bomRef, component.dependencies)
+      }
     }
-    for (const c of data.components) {
-      allRefs.set(c.bomRef, new Models.BomRefRepository(c.dependencies))
+    for (const component of data.components[treeIterator]()) {
+      allRefs.set(component.bomRef, component.dependencies)
     }
 
     const normalized: Array<(SimpleXml.Element & { attributes: { ref: string } })> = []

package/src/serialize/xmlBaseSerializer.ts

@@ -42,6 +42,10 @@ export abstract class XmlBaseSerializer extends BaseSerializer<SimpleXml.Element
     this.#normalizerFactory = normalizerFactory
   }
 
+  get normalizerFactory (): NormalizerFactory {
+    return this.#normalizerFactory
+  }
+
   protected _normalize (
     bom: Bom,
     options: NormalizerOptions = {}

package/src/spec.ts

@@ -52,6 +52,8 @@ export interface Protocol {
   readonly supportsDependencyGraph: boolean
 
   readonly supportsToolReferences: boolean
+
+  readonly requiresComponentVersion: boolean
 }
 
 /**
@@ -67,6 +69,7 @@ class Spec implements Protocol {
   readonly #externalReferenceTypes: ReadonlySet<ExternalReferenceType>
   readonly #supportsDependencyGraph: boolean
   readonly #supportsToolReferences: boolean
+  readonly #requiresComponentVersion: boolean
 
   constructor (
     version: Version,
@@ -76,7 +79,8 @@ class Spec implements Protocol {
     hashValuePattern: RegExp,
     externalReferenceTypes: Iterable<ExternalReferenceType>,
     supportsDependencyGraph: boolean,
-    supportsToolReferences: boolean
+    supportsToolReferences: boolean,
+    requiresComponentVersion: boolean
   ) {
     this.#version = version
     this.#formats = new Set(formats)
@@ -86,6 +90,7 @@ class Spec implements Protocol {
     this.#externalReferenceTypes = new Set(externalReferenceTypes)
     this.#supportsDependencyGraph = supportsDependencyGraph
     this.#supportsToolReferences = supportsToolReferences
+    this.#requiresComponentVersion = requiresComponentVersion
   }
 
   get version (): Version {
@@ -120,6 +125,10 @@ class Spec implements Protocol {
   get supportsToolReferences (): boolean {
     return this.#supportsToolReferences
   }
+
+  get requiresComponentVersion (): boolean {
+    return this.#requiresComponentVersion
+  }
 }
 
 /** Specification v1.2 */
@@ -172,7 +181,8 @@ export const Spec1dot2: Readonly<Protocol> = Object.freeze(new Spec(
     ExternalReferenceType.Other
   ],
   true,
-  false
+  false,
+  true
 ))
 
 /** Specification v1.3 */
@@ -225,7 +235,8 @@ export const Spec1dot3: Readonly<Protocol> = Object.freeze(new Spec(
     ExternalReferenceType.Other
   ],
   true,
-  false
+  false,
+  true
 ))
 
 /** Specification v1.4 */
@@ -279,7 +290,8 @@ export const Spec1dot4: Readonly<Protocol> = Object.freeze(new Spec(
     ExternalReferenceType.Other
   ],
   true,
-  true
+  true,
+  false
 ))
 
 export const SpecVersionDict = Object.freeze(Object.fromEntries([

package/src/types/cpe.ts

@@ -24,8 +24,8 @@ Copyright (c) OWASP Foundation. All Rights Reserved.
  */
 export type CPE = string
 
-/* eslint-disable-next-line no-useless-escape -- value directly from XML or JSON spec, surrounded with ^$ */
-const cpePattern = /^([c][pP][eE]:\/[AHOaho]?(:[A-Za-z0-9\._\-~%]*){0,6})$|^(cpe:2\.3:[aho\*\-](:(((\?*|\*?)([a-zA-Z0-9\-\._]|(\\[\\\*\?!"#$$%&'\(\)\+,\/:;<=>@\[\]\^`\{\|}~]))+(\?*|\*?))|[\*\-])){5}(:(([a-zA-Z]{2,3}(-([a-zA-Z]{2}|[0-9]{3}))?)|[\*\-]))(:(((\?*|\*?)([a-zA-Z0-9\-\._]|(\\[\\\*\?!"#$$%&'\(\)\+,\/:;<=>@\[\]\^`\{\|}~]))+(\?*|\*?))|[\*\-])){4})$/
+/* eslint-disable-next-line no-useless-escape -- value directly from XML, revert special-chars(like `&` -> `&`), and surrounded with `^` and `$` */
+const cpePattern = /^([c][pP][eE]:\/[AHOaho]?(:[A-Za-z0-9\._\-~%]*){0,6})$|^(cpe:2\.3:[aho\*\-](:(((\?*|\*?)([a-zA-Z0-9\-\._]|(\\[\\\*\?!"#$$%&'\(\)\+,\/:;<=>@\[\]\^`\{\|}~]))+(\?*|\*?))|[\*\-])){5}(:(([a-zA-Z]{2,3}(-([a-zA-Z]{2}|[0-9]{3}))?)|[\*\-]))(:(((\?*|\*?)([a-zA-Z0-9\-\._]|(\\[\\\*\?!"#$$%&'\(\)\+,\/:;<=>@\[\]\^`\{\|}~]))+(\?*|\*?))|[\*\-])){4})$/
 
 export function isCPE (value: any): value is CPE {
   return typeof value === 'string' &&

package/dist.node/builders/fromPackageJson.node.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"fromPackageJson.node.js","sourceRoot":"","sources":["../../src/builders/fromPackageJson.node.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;EAiBE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEF,gDAAiC;AACjC,kDAAmC;AAEnC,wDAAoE;AAMpE,MAAa,WAAW;IAGtB,YAAa,aAAiE;QAF9E,6CAA2E;QAGzE,uBAAA,IAAI,8BAAkB,aAAa,MAAA,CAAA;IACrC,CAAC;IAED,QAAQ,CAAE,IAAiB;QACzB,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;YAClD,CAAC,CAAC,IAAA,4BAAc,EAAC,IAAI,CAAC,IAAI,CAAC;YAC3B,CAAC,CAAC,EAAE,CAAA;QAEN,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC;YACrB,MAAM;YACN,IAAI;YACJ,OAAO,EAAE,CAAC,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC;gBACzC,CAAC,CAAC,IAAI,CAAC,OAAO;gBACd,CAAC,CAAC,SAAS;YACb,kBAAkB,EAAE,IAAI,MAAM,CAAC,2BAA2B,CAAC,uBAAA,IAAI,kCAAe,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;SAC7G,CAAC,CAAA;IACJ,CAAC;CACF;AArBD,kCAqBC;;AAED,MAAa,gBAAgB;IAI3B,YACE,aAAiE,EACjE,cAAwC;QAL1C,kDAA2E;QAC3E,mDAAkD;QAMhD,uBAAA,IAAI,mCAAkB,aAAa,MAAA,CAAA;QACnC,uBAAA,IAAI,oCAAmB,cAAc,MAAA,CAAA;IACvC,CAAC;IAED,aAAa,CAAE,IAAiB,EAAE,OAA4B,KAAK,CAAC,aAAa,CAAC,OAAO;QACvF,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE;YACjC,OAAO,SAAS,CAAA;SACjB;QAED,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,IAAA,4BAAc,EAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/C,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,EAAE;YACpB,OAAO,SAAS,CAAA;SACjB;QAGD,MAAM,MAAM,GAAG,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ;YAC5C,CAAC,CAAC,IAAI,CAAC,MAAM;YACb,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,MAAM,EAAE,IAAI,KAAK,QAAQ;gBACpC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI;gBAClB,CAAC,CAAC,SAAS,CAAC,CAAA;QAElB,MAAM,WAAW,GAAG,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ;YACtD,CAAC,CAAC,IAAI,CAAC,WAAW;YAClB,CAAC,CAAC,SAAS,CAAA;QAEb,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;YAC9C,CAAC,CAAC,IAAI,CAAC,OAAO;YACd,CAAC,CAAC,SAAS,CAAA;QACb,MAAM,kBAAkB,GAAG,uBAAA,IAAI,uCAAe,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAA;QAE3E,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;YAC9C,CAAC,CAAC,uBAAA,IAAI,wCAAgB,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC;YACnD,CAAC,CAAC,SAAS,CAAA;QAEb,OAAO,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE;YACtC,MAAM;YACN,WAAW;YACX,kBAAkB,EAAE,IAAI,MAAM,CAAC,2BAA2B,CAAC,kBAAkB,CAAC;YAC9E,KAAK;YACL,QAAQ,EAAE,IAAI,MAAM,CAAC,iBAAiB,CACpC,OAAO,KAAK,SAAS;gBACnB,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,CAAC,OAAO,CAAC,CACd;YACD,OAAO;SACR,CAAC,CAAA;IACJ,CAAC;CACF;AAvDD,4CAuDC"}

package/dist.node/factories/fromPackageJson.node.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"fromPackageJson.node.js","sourceRoot":"","sources":["../../src/factories/fromPackageJson.node.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;EAiBE;;;;;;;;;;;;;;;;;;;;;;;;;;AAEF,kDAAmC;AACnC,gDAAiC;AACjC,0DAAwD;AAOxD,MAAa,wBAAwB;IACnC,sBAAsB,CAAE,IAAiB;QACvC,MAAM,IAAI,GAAgD,EAAE,CAAA;QAE5D,IAAI;YAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA;SAAE;QAAC,MAAM,GAAc;QAC1D,IAAI;YAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAA;SAAE;QAAC,MAAM,GAAc;QAC/D,IAAI;YAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAA;SAAE;QAAC,MAAM,GAAc;QAEnE,OAAO,IAAI,CAAC,MAAM,CAAC,6BAAc,CAAC,CAAA;IACpC,CAAC;IAED,OAAO,CAAE,IAAiB;QAExB,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAA;QAClC,IAAI,GAAG,CAAA;QACP,IAAI,OAA2B,CAAA;QAC/B,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE;YAClC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAA;YACpB,OAAO,GAAG,wDAAwD,CAAA;YAClE,IAAI,OAAO,UAAU,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE;gBAEzF,GAAG,IAAI,GAAG,GAAG,UAAU,CAAC,SAAS,CAAA;gBACjC,OAAO,IAAI,6BAA6B,CAAA;aACzC;SACF;aAAM;YACL,GAAG,GAAG,UAAU,CAAA;YAChB,OAAO,GAAG,oDAAoD,CAAA;SAC/D;QACD,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;YAC9C,CAAC,CAAC,IAAI,MAAM,CAAC,iBAAiB,CAAC,GAAG,EAAE,KAAK,CAAC,qBAAqB,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,CAAC;YACjF,CAAC,CAAC,SAAS,CAAA;IACf,CAAC;IAED,YAAY,CAAE,IAAiB;QAE7B,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAA;QACzB,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;YAC9C,CAAC,CAAC,IAAI,MAAM,CAAC,iBAAiB,CAC5B,GAAG,EAAE,KAAK,CAAC,qBAAqB,CAAC,OAAO,EACxC,EAAE,OAAO,EAAE,kDAAkD,EAAE,CAAC;YAClE,CAAC,CAAC,SAAS,CAAA;IACf,CAAC;IAED,gBAAgB,CAAE,IAAiB;QAEjC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAA;QACtB,IAAI,GAAG,CAAA;QACP,IAAI,OAA2B,CAAA;QAC/B,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE;YAC5B,GAAG,GAAG,IAAI,CAAC,GAAG,CAAA;YACd,OAAO,GAAG,kDAAkD,CAAA;SAC7D;aAAM;YACL,GAAG,GAAG,IAAI,CAAA;YACV,OAAO,GAAG,8CAA8C,CAAA;SACzD;QACD,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;YAC9C,CAAC,CAAC,IAAI,MAAM,CAAC,iBAAiB,CAAC,GAAG,EAAE,KAAK,CAAC,qBAAqB,CAAC,YAAY,EAAE,EAAE,OAAO,EAAE,CAAC;YAC1F,CAAC,CAAC,SAAS,CAAA;IACf,CAAC;CACF;AA3DD,4DA2DC"}