@cyclonedx/cyclonedx-library 6.1.3 → 6.2.0

package/dist.web/lib.dev.js

@@ -187,6 +187,56 @@ exports.treeIteratorSymbol = void 0;
 exports.treeIteratorSymbol = Symbol('iterator of a tree/nesting-like structure');
 
 
+/***/ }),
+
+/***/ "./src/_helpers/uri.ts":
+/*!*****************************!*\
+  !*** ./src/_helpers/uri.ts ***!
+  \*****************************/
+/***/ ((__unused_webpack_module, exports) => {
+
+
+/*!
+This file is part of CycloneDX JavaScript Library.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+   http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+
+SPDX-License-Identifier: Apache-2.0
+Copyright (c) OWASP Foundation. All Rights Reserved.
+*/
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.escapeUri = void 0;
+const escapeMap = Object.freeze({
+    ' ': '%20',
+    '[': '%5B',
+    ']': '%5D',
+    '<': '%3C',
+    '>': '%3E',
+    '{': '%7B',
+    '}': '%7D'
+});
+function escapeUri(value) {
+    if (value === undefined) {
+        return value;
+    }
+    for (const [s, r] of Object.entries(escapeMap)) {
+        value = value.replace(s, r);
+    }
+    return value;
+}
+exports.escapeUri = escapeUri;
+
+
 /***/ }),
 
 /***/ "./src/enums/attachmentEncoding.ts":
@@ -2992,6 +3042,7 @@ Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.VulnerabilityAnalysisNormalizer = exports.VulnerabilityAffectedVersionNormalizer = exports.VulnerabilityAffectNormalizer = exports.VulnerabilityCreditsNormalizer = exports.VulnerabilityAdvisoryNormalizer = exports.VulnerabilityRatingNormalizer = exports.VulnerabilityReferenceNormalizer = exports.VulnerabilitySourceNormalizer = exports.VulnerabilityNormalizer = exports.DependencyGraphNormalizer = exports.PropertyNormalizer = exports.AttachmentNormalizer = exports.ExternalReferenceNormalizer = exports.SWIDNormalizer = exports.LicenseNormalizer = exports.ComponentEvidenceNormalizer = exports.ComponentNormalizer = exports.OrganizationalEntityNormalizer = exports.OrganizationalContactNormalizer = exports.HashNormalizer = exports.ToolNormalizer = exports.LifecycleNormalizer = exports.MetadataNormalizer = exports.BomNormalizer = exports.Factory = void 0;
 const notUndefined_1 = __webpack_require__(/*! ../../_helpers/notUndefined */ "./src/_helpers/notUndefined.ts");
 const tree_1 = __webpack_require__(/*! ../../_helpers/tree */ "./src/_helpers/tree.ts");
+const uri_1 = __webpack_require__(/*! ../../_helpers/uri */ "./src/_helpers/uri.ts");
 const Models = __webpack_require__(/*! ../../models */ "./src/models/index.ts");
 const spdx_1 = __webpack_require__(/*! ../../spdx */ "./src/spdx.ts");
 const spec_1 = __webpack_require__(/*! ../../spec */ "./src/spec/index.ts");
@@ -3222,8 +3273,7 @@ class OrganizationalContactNormalizer extends BaseJsonNormalizer {
 exports.OrganizationalContactNormalizer = OrganizationalContactNormalizer;
 class OrganizationalEntityNormalizer extends BaseJsonNormalizer {
     normalize(data, options) {
-        const urls = normalizeStringableIter(data.url, options)
-            .filter(types_1.JsonSchema.isIriReference);
+        const urls = normalizeStringableIter(Array.from(data.url, (s) => (0, uri_1.escapeUri)(s.toString())), options).filter(types_1.JsonSchema.isIriReference);
         return {
             name: data.name || undefined,
             url: urls.length > 0
@@ -3348,7 +3398,7 @@ class LicenseNormalizer extends BaseJsonNormalizer {
 }
 exports.LicenseNormalizer = LicenseNormalizer;
 _LicenseNormalizer_instances = new WeakSet(), _LicenseNormalizer_normalizeNamedLicense = function _LicenseNormalizer_normalizeNamedLicense(data, options) {
-    const url = data.url?.toString();
+    const url = (0, uri_1.escapeUri)(data.url?.toString());
     return {
         license: {
             name: data.name,
@@ -3361,13 +3411,16 @@ _LicenseNormalizer_instances = new WeakSet(), _LicenseNormalizer_normalizeNamedL
         }
     };
 }, _LicenseNormalizer_normalizeSpdxLicense = function _LicenseNormalizer_normalizeSpdxLicense(data, options) {
+    const url = (0, uri_1.escapeUri)(data.url?.toString());
     return {
         license: {
             id: data.id,
             text: data.text === undefined
                 ? undefined
                 : this._factory.makeForAttachment().normalize(data.text, options),
-            url: data.url?.toString()
+            url: types_1.JsonSchema.isIriReference(url)
+                ? url
+                : undefined
         }
     };
 }, _LicenseNormalizer_normalizeLicenseExpression = function _LicenseNormalizer_normalizeLicenseExpression(data) {
@@ -3377,7 +3430,7 @@ _LicenseNormalizer_instances = new WeakSet(), _LicenseNormalizer_normalizeNamedL
 };
 class SWIDNormalizer extends BaseJsonNormalizer {
     normalize(data, options) {
-        const url = data.url?.toString();
+        const url = (0, uri_1.escapeUri)(data.url?.toString());
         return {
             tagId: data.tagId,
             name: data.name,
@@ -3398,7 +3451,7 @@ class ExternalReferenceNormalizer extends BaseJsonNormalizer {
     normalize(data, options) {
         return this._factory.spec.supportsExternalReferenceType(data.type)
             ? {
-                url: data.url.toString(),
+                url: (0, uri_1.escapeUri)(data.url.toString()),
                 type: data.type,
                 hashes: this._factory.spec.supportsExternalReferenceHashes && data.hashes.size > 0
                     ? this._factory.makeForHash().normalizeIterable(data.hashes, options)
@@ -3580,7 +3633,7 @@ class VulnerabilityRatingNormalizer extends BaseJsonNormalizer {
 exports.VulnerabilityRatingNormalizer = VulnerabilityRatingNormalizer;
 class VulnerabilityAdvisoryNormalizer extends BaseJsonNormalizer {
     normalize(data, options) {
-        const url = data.url.toString();
+        const url = (0, uri_1.escapeUri)(data.url.toString());
         if (!types_1.JsonSchema.isIriReference(url)) {
             return undefined;
         }
@@ -3903,6 +3956,7 @@ Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.VulnerabilityAffectedVersionNormalizer = exports.VulnerabilityAffectNormalizer = exports.VulnerabilityAnalysisNormalizer = exports.VulnerabilityCreditsNormalizer = exports.VulnerabilityAdvisoryNormalizer = exports.VulnerabilityRatingNormalizer = exports.VulnerabilityReferenceNormalizer = exports.VulnerabilitySourceNormalizer = exports.VulnerabilityNormalizer = exports.DependencyGraphNormalizer = exports.PropertyNormalizer = exports.AttachmentNormalizer = exports.ExternalReferenceNormalizer = exports.SWIDNormalizer = exports.LicenseNormalizer = exports.ComponentEvidenceNormalizer = exports.ComponentNormalizer = exports.OrganizationalEntityNormalizer = exports.OrganizationalContactNormalizer = exports.HashNormalizer = exports.ToolNormalizer = exports.LifecycleNormalizer = exports.MetadataNormalizer = exports.BomNormalizer = exports.Factory = void 0;
 const notUndefined_1 = __webpack_require__(/*! ../../_helpers/notUndefined */ "./src/_helpers/notUndefined.ts");
 const tree_1 = __webpack_require__(/*! ../../_helpers/tree */ "./src/_helpers/tree.ts");
+const uri_1 = __webpack_require__(/*! ../../_helpers/uri */ "./src/_helpers/uri.ts");
 const Models = __webpack_require__(/*! ../../models */ "./src/models/index.ts");
 const spdx_1 = __webpack_require__(/*! ../../spdx */ "./src/spdx.ts");
 const spec_1 = __webpack_require__(/*! ../../spec */ "./src/spec/index.ts");
@@ -4206,8 +4260,7 @@ class OrganizationalEntityNormalizer extends BaseXmlNormalizer {
             name: elementName,
             children: [
                 makeOptionalTextElement(data.name, 'name'),
-                ...makeTextElementIter(data.url, options, 'url')
-                    .filter(({ children: u }) => types_1.XmlSchema.isAnyURI(u)),
+                ...makeTextElementIter(Array.from(data.url, (s) => (0, uri_1.escapeUri)(s.toString())), options, 'url').filter(({ children: u }) => types_1.XmlSchema.isAnyURI(u)),
                 ...this._factory.makeForOrganizationalContact().normalizeIterable(data.contact, options, 'contact')
             ].filter(notUndefined_1.isNotUndefined)
         };
@@ -4369,7 +4422,7 @@ class LicenseNormalizer extends BaseXmlNormalizer {
 }
 exports.LicenseNormalizer = LicenseNormalizer;
 _LicenseNormalizer_instances = new WeakSet(), _LicenseNormalizer_normalizeNamedLicense = function _LicenseNormalizer_normalizeNamedLicense(data, options) {
-    const url = data.url?.toString();
+    const url = (0, uri_1.escapeUri)(data.url?.toString());
     return {
         type: 'element',
         name: 'license',
@@ -4384,7 +4437,7 @@ _LicenseNormalizer_instances = new WeakSet(), _LicenseNormalizer_normalizeNamedL
         ].filter(notUndefined_1.isNotUndefined)
     };
 }, _LicenseNormalizer_normalizeSpdxLicense = function _LicenseNormalizer_normalizeSpdxLicense(data, options) {
-    const url = data.url?.toString();
+    const url = (0, uri_1.escapeUri)(data.url?.toString());
     return {
         type: 'element',
         name: 'license',
@@ -4403,7 +4456,7 @@ _LicenseNormalizer_instances = new WeakSet(), _LicenseNormalizer_normalizeNamedL
 };
 class SWIDNormalizer extends BaseXmlNormalizer {
     normalize(data, options, elementName) {
-        const url = data.url?.toString();
+        const url = (0, uri_1.escapeUri)(data.url?.toString());
         return {
             type: 'element',
             name: elementName,
@@ -4430,7 +4483,7 @@ class SWIDNormalizer extends BaseXmlNormalizer {
 exports.SWIDNormalizer = SWIDNormalizer;
 class ExternalReferenceNormalizer extends BaseXmlNormalizer {
     normalize(data, options, elementName) {
-        const url = data.url.toString();
+        const url = (0, uri_1.escapeUri)(data.url.toString());
         const hashes = this._factory.spec.supportsExternalReferenceHashes && data.hashes.size > 0
             ? {
                 type: 'element',
@@ -4641,7 +4694,7 @@ class VulnerabilityNormalizer extends BaseXmlNormalizer {
 exports.VulnerabilityNormalizer = VulnerabilityNormalizer;
 class VulnerabilitySourceNormalizer extends BaseXmlNormalizer {
     normalize(data, options, elementName) {
-        const url = data.url?.toString();
+        const url = (0, uri_1.escapeUri)(data.url?.toString());
         return {
             type: 'element',
             name: elementName,
@@ -4701,7 +4754,7 @@ class VulnerabilityRatingNormalizer extends BaseXmlNormalizer {
 exports.VulnerabilityRatingNormalizer = VulnerabilityRatingNormalizer;
 class VulnerabilityAdvisoryNormalizer extends BaseXmlNormalizer {
     normalize(data, options, elementName) {
-        const url = data.url.toString();
+        const url = (0, uri_1.escapeUri)(data.url.toString());
         if (!types_1.XmlSchema.isAnyURI(url)) {
             return undefined;
         }