@mitre/hdf-converters 2.12.2 → 2.13.0

package/lib/src/cyclonedx-sbom-mapper.js

@@ -22,31 +22,36 @@ const IMPACT_MAPPING = new Map([
     ['none', 0.0],
     ['unknown', 0.5]
 ]);
+// Convert object type to string[] and prepend `CWE` if used directly for tag display
 function formatCWETags(input, addPrefix = true) {
     return input && Array.isArray(input)
         ? input.map((cwe) => (addPrefix ? `CWE-${cwe}` : `${cwe}`))
         : [];
 }
+// Convert gathered CWEs to corresponding NIST 800-53s
 function getNISTTags(input) {
     return CWE_NIST_MAPPING.nistFilter(formatCWETags(input, false), DEFAULT_NIST_TAG);
 }
+// A single SBOM vulnerability can contain multiple security ratings
+// Find the max of any existing ratings and then pass to `impact`
 function maxImpact(ratings) {
     return ratings
-        .map((rating) => {
-        var _a, _b, _c;
-        return rating.score &&
-            rating.method &&
-            cvssMethods.includes(rating.method)
-            ?
-                rating.score / 10
-            :
-                ((_c = IMPACT_MAPPING.get((_b = (_a = rating.severity) === null || _a === void 0 ? void 0 : _a.toLowerCase()) !== null && _b !== void 0 ? _b : '')) !== null && _c !== void 0 ? _c : 0.5);
-    })
-        .reduce((maxValue, newValue) => maxValue > newValue ? maxValue : newValue, 0);
+        .map((rating) => rating.score &&
+        rating.method &&
+        cvssMethods.includes(rating.method) // cast required since .includes expects the parameter to be a subtype
+        ? // Prefer to use CVSS-based `score` field when possible
+            rating.score / 10
+        : // Else interpret it from `severity` field, defaulting to medium/0.5
+            (IMPACT_MAPPING.get(rating.severity?.toLowerCase() ?? '') ?? 0.5))
+        .reduce((maxValue, newValue) => 
+    // Find max of existing ratings
+    maxValue > newValue ? maxValue : newValue, 0);
 }
+// If the highest rating severity for a control is `info` or `unknown`, set the results to skipped and request a manual review
 function skipSeverityInfoOrUnknown(controls) {
     if (controls) {
         controls
+            // Filter to controls whose highest rating severity is either `info` or `unknown`
             .filter((control) => {
             const ratings = lodash_1.default.get(control, 'tags.ratings', '').split(/ - |, /);
             return ((ratings.includes('info') || ratings.includes('unknown')) &&
@@ -56,6 +61,7 @@ function skipSeverityInfoOrUnknown(controls) {
                     ratings.includes('low') ||
                     ratings.includes('none')));
         })
+            // For every result contained by that control, set the status to skipped and request a manual review
             .map((control) => control.results.map((result) => {
             result.status = inspecjs_1.ExecJSON.ControlResultStatus.Skipped;
             result.skip_message =
@@ -65,6 +71,8 @@ function skipSeverityInfoOrUnknown(controls) {
     return controls;
 }
 class CycloneDXSBOMResults {
+    data;
+    withRaw;
     constructor(sbomJson, withRaw = false) {
         this.data = {
             components: [],
@@ -73,37 +81,78 @@ class CycloneDXSBOMResults {
         };
         this.withRaw = withRaw;
         if (this.data.raw.components) {
+            // We know this is SBOM data
             this.flattenComponents(this.data);
             if (this.data.raw.vulnerabilities) {
+                // If this SBOM data has a vulnerabilities field, we can create an intermediary object
                 this.generateIntermediary(this.data);
             }
         }
         else if (this.data.raw.vulnerabilities) {
+            // Back up in case we ingest VEX data instead
             this.formatVEX(this.data);
         }
         else {
             throw new Error('Unrecognized CycloneDX format detected. We currently only support SBOM and VEX formats.');
         }
     }
+    // Flatten any arbitrarily nested components list
     flattenComponents(data) {
+        // Pull components from raw data
         data.components = lodash_1.default.cloneDeep(data.raw.components);
+        // Look through every component at the top level of the list
         for (const component of data.components) {
+            // Identify if subcomponents exist
             if (component.components) {
+                // If so, pull out the subcomponents and push them to end of top level component list for further flattening
                 data.components.push(...component.components);
                 delete component.components;
             }
         }
     }
+    /*
+    Copy the indices of all components that are affected by a vulnerability and place them under that corresponding vulnerability
+    Also note in each component the IDs of the vulnerabilities that affect them
+    This allows for bidirectional traversal in SBOM view
+  
+    Should result in the following general structure:
+    {
+      components: [
+        component: {
+          affectingVulnerabilities: [ // Added field
+            vulnID,
+            ...
+          ],
+          ...
+        },
+        ...
+      ],
+      vulnerabilities: [
+        vulnerability: {
+          affectedComponents: [       // Added field
+            componentIndex,
+            ...
+          ],
+          ...
+        },
+        ...
+      ],
+      ...
+    }
+    */
     generateIntermediary(data) {
+        // Pull vulnerabilities from raw data
         data.vulnerabilities = lodash_1.default.cloneDeep(data.raw.vulnerabilities);
         for (const vulnerability of data.vulnerabilities) {
             vulnerability.affectedComponents = [];
             vulnerability.affectedComponents.push(...Array.from(data.components.entries())
-                .filter(([_index, component]) => {
-                var _a;
-                return (_a = vulnerability.affects) === null || _a === void 0 ? void 0 : _a.map((id) => id.ref.toString()).includes(component['bom-ref']);
-            })
+                // Find every component that is affected via listed bom-refs
+                .filter(([_index, component]) => vulnerability.affects
+                ?.map((id) => id.ref.toString())
+                .includes(component['bom-ref']))
+                // Add the index of that affected component to the corresponding vulnerability object
                 .map(([index, _component]) => index));
+            // Also record the ID of the vulnerability in the component for use in bidirectional traversal
             for (const index of vulnerability.affectedComponents) {
                 if (!data.components[index].affectingVulnerabilities) {
                     data.components[index].affectingVulnerabilities = [];
@@ -112,20 +161,25 @@ class CycloneDXSBOMResults {
             }
         }
     }
+    // VEX by default has no component info, resulting in profile errors when parsing the vulnerabilities for OHDF
+    // Fix that by adding a temporary result that refers the vulnerability back to its associated BOM
     formatVEX(data) {
-        var _a;
+        // Pull vulnerabilities from raw data
         data.vulnerabilities = [
             ...lodash_1.default.cloneDeep(data.raw.vulnerabilities)
         ];
         for (const vulnerability of data.vulnerabilities) {
-            vulnerability.affectedComponents = (_a = vulnerability.affects) === null || _a === void 0 ? void 0 : _a.map((id) => {
+            vulnerability.affectedComponents = vulnerability.affects?.map((id) => {
+                // Build a dummy component for each bom-ref identified as being affected by the vulnerability
                 const dummy = {
                     name: `${id.ref}`,
                     'bom-ref': `${id.ref}`,
                     isDummy: true,
-                    type: 'application'
+                    type: 'application' // a type must be provided, and "application" is the default classification
                 };
+                // Add that component to the corresponding vulnerability object
                 data.components.push(dummy);
+                // Return the index of that dummy object
                 return data.components.length - 1;
             });
         }
@@ -136,318 +190,332 @@ class CycloneDXSBOMResults {
 }
 exports.CycloneDXSBOMResults = CycloneDXSBOMResults;
 class CycloneDXSBOMMapper extends base_converter_1.BaseConverter {
+    withRaw;
+    // Pull any keys from a given index for the stored components listing
     getComponentValueAtIndex(index, keys) {
         return lodash_1.default.pick(this.data.components[index], keys);
     }
-    constructor(exportJson, withRaw = false) {
-        super(exportJson, true);
-        this.mappings = {
-            platform: {
-                name: 'Heimdall Tools',
-                release: package_json_1.version
-            },
-            version: package_json_1.version,
-            statistics: {},
-            profiles: [
-                {
-                    name: {
-                        path: 'raw.metadata.component',
-                        transformer: (input) => lodash_1.default.has(input, 'bom-ref')
-                            ? `CycloneDX BOM Report: ${input.type}/${input['bom-ref']}`
-                            : 'CycloneDX BOM Report'
-                    },
-                    title: {
-                        path: 'raw.metadata.component',
-                        transformer: (input) => {
-                            if (input.name) {
-                                const group = input.group ? `${input.group}/` : '';
-                                return `${group}${input.name} CycloneDX BOM Report`;
-                            }
-                            else {
-                                return 'CycloneDX BOM Report';
-                            }
+    mappings = {
+        platform: {
+            name: 'Heimdall Tools',
+            release: package_json_1.version
+        },
+        version: package_json_1.version,
+        statistics: {},
+        profiles: [
+            {
+                name: {
+                    path: 'raw.metadata.component',
+                    transformer: (input) => lodash_1.default.has(input, 'bom-ref')
+                        ? `CycloneDX BOM Report: ${input.type}/${input['bom-ref']}`
+                        : 'CycloneDX BOM Report'
+                },
+                title: {
+                    path: 'raw.metadata.component',
+                    transformer: (input) => {
+                        if (input.name) {
+                            const group = input.group ? `${input.group}/` : '';
+                            return `${group}${input.name} CycloneDX BOM Report`;
                         }
-                    },
-                    version: {
-                        path: 'raw.metadata.component.version',
-                        transformer: global_1.filterString
-                    },
-                    maintainer: {
-                        path: 'raw.metadata.component',
-                        transformer: (input) => {
-                            const manufacturer = lodash_1.default.has(input, 'manufacturer')
-                                ? ` (${input.manufacturer.name})`
-                                : '';
-                            if (lodash_1.default.has(input, 'authors')) {
-                                return input.authors
-                                    .map((author) => `${author.name}${manufacturer}`)
-                                    .join(', ');
-                            }
-                            else if (input.author) {
-                                return `${input.author}${manufacturer}`;
-                            }
-                            else {
-                                return undefined;
-                            }
+                        else {
+                            return 'CycloneDX BOM Report';
                         }
-                    },
-                    summary: {
-                        path: 'raw.metadata.component.description',
-                        transformer: global_1.filterString
-                    },
-                    copyright: {
-                        path: 'raw.metadata.component.copyright',
-                        transformer: global_1.filterString
-                    },
-                    license: {
-                        path: 'raw.metadata.component',
-                        transformer: (input) => {
-                            var _a;
-                            if (!input.licenses) {
-                                return undefined;
-                            }
-                            return (_a = input.licenses) === null || _a === void 0 ? void 0 : _a.map((license) => {
-                                var _a, _b;
-                                return ((_a = license === null || license === void 0 ? void 0 : license.license) === null || _a === void 0 ? void 0 : _a.name)
-                                    ? license.license.name
-                                    : (_b = license === null || license === void 0 ? void 0 : license.license) === null || _b === void 0 ? void 0 : _b.id;
-                            }).filter((identifier) => identifier).join(', ');
+                    }
+                },
+                version: {
+                    path: 'raw.metadata.component.version',
+                    transformer: global_1.filterString
+                },
+                maintainer: {
+                    path: 'raw.metadata.component',
+                    transformer: (input) => {
+                        // Find organization of authors if possible
+                        const manufacturer = lodash_1.default.has(input, 'manufacturer')
+                            ? ` (${input.manufacturer.name})`
+                            : '';
+                        // Check through every single possible field which may hold ownership over this component
+                        if (lodash_1.default.has(input, 'authors')) {
+                            // Join list of component authors
+                            return input.authors
+                                .map((author) => `${author.name}${manufacturer}`)
+                                .join(', ');
                         }
-                    },
-                    supports: [],
-                    attributes: [],
-                    groups: [],
-                    status: 'loaded',
-                    controls: [
-                        {
-                            path: 'vulnerabilities',
-                            key: 'id',
-                            tags: {
-                                nist: {
-                                    path: 'cwes',
-                                    transformer: getNISTTags
-                                },
-                                cci: {
-                                    path: 'cwes',
-                                    transformer: (input) => (0, global_1.getCCIsForNISTTags)(getNISTTags(input))
-                                },
-                                cwe: { path: 'cwes', transformer: formatCWETags },
-                                'bom-ref': {
-                                    path: 'bom-ref',
-                                    transformer: global_1.filterString
-                                },
-                                ratings: {
-                                    path: 'ratings',
-                                    transformer: (input) => input
-                                        ? [...input]
-                                            .map((rating) => {
-                                            var _a, _b;
-                                            const ratingSource = ((_a = rating.source) === null || _a === void 0 ? void 0 : _a.name)
-                                                ? `${(_b = rating.source) === null || _b === void 0 ? void 0 : _b.name} - `
-                                                : 'Unidentified Source - ';
-                                            return `${ratingSource}${rating.severity}`;
-                                        })
-                                            .join(', ')
-                                        : undefined
-                                },
-                                created: {
-                                    path: 'created',
-                                    transformer: global_1.filterString
-                                },
-                                published: {
-                                    path: 'published',
-                                    transformer: global_1.filterString
-                                },
-                                updated: {
-                                    path: 'updated',
-                                    transformer: global_1.filterString
-                                },
-                                rejected: {
-                                    path: 'rejected',
-                                    transformer: global_1.filterString
-                                },
-                                credits: {
-                                    path: 'credits',
-                                    transformer: (input) => {
-                                        var _a;
-                                        return input
-                                            ? `${(_a = input.individuals) === null || _a === void 0 ? void 0 : _a.map((individual) => individual.name).filter((name) => name).join(', ')}`
-                                            : undefined;
-                                    }
-                                },
-                                tools: {
-                                    path: 'tools',
-                                    transformer: (input) => {
-                                        var _a, _b, _c, _d;
-                                        if (!input) {
-                                            return undefined;
-                                        }
-                                        if (Array.isArray(input)) {
-                                            return input
-                                                .map((tool) => tool.name)
-                                                .filter((name) => name)
-                                                .join(', ');
-                                        }
-                                        return [
-                                            ...((_b = (_a = input.components) === null || _a === void 0 ? void 0 : _a.map((component) => component.name)) !== null && _b !== void 0 ? _b : []),
-                                            ...((_d = (_c = input.services) === null || _c === void 0 ? void 0 : _c.map((component) => component.name)) !== null && _d !== void 0 ? _d : [])
-                                        ].join(', ');
-                                    }
-                                },
-                                'analysis.state': {
-                                    path: 'analysis.state',
-                                    transformer: global_1.filterString
-                                },
-                                'analysis.justification': {
-                                    path: 'analysis.justification',
-                                    transformer: global_1.filterString
-                                },
-                                'analysis.response': {
-                                    path: 'analysis.response',
-                                    transformer: (input) => input && input.length > 0 ? input.join(', ') : undefined
-                                },
-                                'analysis.detail': {
-                                    path: 'analysis.detail',
-                                    transformer: global_1.filterString
-                                },
-                                'analysis.firstIssued': {
-                                    path: 'analysis.firstIssued',
-                                    transformer: global_1.filterString
-                                },
-                                'analysis.lastUpdated': {
-                                    path: 'analysis.lastUpdated',
-                                    transformer: global_1.filterString
-                                }
+                        else if (input.author) {
+                            // `author` is deprecated in v1.6 but may still appear
+                            return `${input.author}${manufacturer}`;
+                        }
+                        else {
+                            return undefined;
+                        }
+                    }
+                },
+                summary: {
+                    path: 'raw.metadata.component.description',
+                    transformer: global_1.filterString
+                },
+                copyright: {
+                    path: 'raw.metadata.component.copyright',
+                    transformer: global_1.filterString
+                },
+                license: {
+                    path: 'raw.metadata.component',
+                    transformer: (input) => {
+                        if (!input.licenses) {
+                            return undefined;
+                        }
+                        // Certain license reports only provide the license name in the `name` field
+                        // Check there first and then default to `id`
+                        return input.licenses
+                            ?.map((license) => license?.license?.name
+                            ? license.license.name
+                            : license?.license?.id)
+                            .filter((identifier) => identifier)
+                            .join(', ');
+                    }
+                },
+                supports: [],
+                attributes: [],
+                groups: [],
+                status: 'loaded',
+                controls: [
+                    {
+                        path: 'vulnerabilities',
+                        key: 'id',
+                        tags: {
+                            nist: {
+                                path: 'cwes',
+                                transformer: getNISTTags
+                            },
+                            cci: {
+                                path: 'cwes',
+                                transformer: (input) => (0, global_1.getCCIsForNISTTags)(getNISTTags(input))
+                            },
+                            cwe: { path: 'cwes', transformer: formatCWETags },
+                            'bom-ref': {
+                                path: 'bom-ref',
+                                transformer: global_1.filterString
+                            },
+                            ratings: {
+                                path: 'ratings',
+                                transformer: (input) => input
+                                    ? [...input]
+                                        .map((rating) => {
+                                        const ratingSource = rating.source?.name
+                                            ? `${rating.source?.name} - `
+                                            : 'Unidentified Source - ';
+                                        return `${ratingSource}${rating.severity}`;
+                                    })
+                                        .join(', ')
+                                    : undefined
+                            },
+                            created: {
+                                path: 'created',
+                                transformer: global_1.filterString
                             },
-                            descriptions: {
+                            published: {
+                                path: 'published',
+                                transformer: global_1.filterString
+                            },
+                            updated: {
+                                path: 'updated',
+                                transformer: global_1.filterString
+                            },
+                            // Workflow items will not affect `impact`
+                            rejected: {
+                                path: 'rejected',
+                                transformer: global_1.filterString
+                            },
+                            credits: {
+                                path: 'credits',
+                                transformer: (input) => input
+                                    ? `${input.individuals
+                                        ?.map((individual) => individual.name)
+                                        .filter((name) => name)
+                                        .join(', ')}`
+                                    : undefined
+                            },
+                            tools: {
+                                path: 'tools',
                                 transformer: (input) => {
-                                    const recommendation = input.recommendation
-                                        ? `Recommendation: ${input.recommendation}`
-                                        : '';
-                                    const workaround = lodash_1.default.has(input, 'workaround')
-                                        ? `Workaround: ${input.workaround}`
-                                        : '';
+                                    if (!input) {
+                                        return undefined;
+                                    }
+                                    if (Array.isArray(input)) {
+                                        return input
+                                            .map((tool) => tool.name)
+                                            .filter((name) => name)
+                                            .join(', ');
+                                    }
                                     return [
-                                        recommendation || workaround
-                                            ? {
-                                                data: `${recommendation}\n\n${workaround}`.trim(),
-                                                label: 'fix'
-                                            }
-                                            : undefined,
-                                        lodash_1.default.has(input, 'proofOfConcept')
-                                            ? {
-                                                data: `Proof of concept: ${JSON.stringify(lodash_1.default.get(input, 'proofOfConcept'), null, 2)}`,
-                                                label: 'check'
-                                            }
-                                            : undefined
-                                    ].filter((subdescription) => subdescription);
+                                        ...(input.components?.map((component) => component.name) ??
+                                            []),
+                                        ...(input.services?.map((component) => component.name) ??
+                                            [])
+                                    ].join(', ');
                                 }
                             },
-                            refs: [
-                                {
-                                    transformer: (input) => {
-                                        const searchFor = ['source', 'references', 'advisories'];
-                                        const ref = searchFor
-                                            .filter((key) => input.hasOwnProperty(key))
-                                            .map((key) => lodash_1.default.pick(input, key));
-                                        return { ref: ref };
-                                    }
-                                }
-                            ],
-                            source_location: {},
-                            title: {
-                                transformer: (input) => input.description ? `${input.description}` : `${input.id}`
+                            // Workflow items will not affect `impact`
+                            'analysis.state': {
+                                path: 'analysis.state',
+                                transformer: global_1.filterString
                             },
-                            id: { path: 'id' },
-                            desc: {
-                                transformer: (input) => {
-                                    const description = input.description
-                                        ? `Description: ${input.description}`
-                                        : '';
-                                    const detail = input.detail ? `Detail: ${input.detail}` : '';
-                                    return (0, global_1.filterString)(`${description}\n\n${detail}`.trim());
-                                }
+                            'analysis.justification': {
+                                path: 'analysis.justification',
+                                transformer: global_1.filterString
+                            },
+                            'analysis.response': {
+                                path: 'analysis.response',
+                                transformer: (input) => input && input.length > 0 ? input.join(', ') : undefined
                             },
-                            impact: {
-                                transformer: (input) => { var _a; return maxImpact((_a = input.ratings) !== null && _a !== void 0 ? _a : []); }
+                            'analysis.detail': {
+                                path: 'analysis.detail',
+                                transformer: global_1.filterString
                             },
-                            code: {
-                                transformer: (vulnerability) => JSON.stringify(lodash_1.default.omit(vulnerability, 'affectedComponents'), null, 2)
+                            'analysis.firstIssued': {
+                                path: 'analysis.firstIssued',
+                                transformer: global_1.filterString
                             },
-                            arrayTransformer: skipSeverityInfoOrUnknown,
-                            results: [
-                                {
-                                    path: 'affectedComponents',
-                                    status: inspecjs_1.ExecJSON.ControlResultStatus.Failed,
-                                    code_desc: {
-                                        transformer: (index) => {
-                                            const selectComponentValues = this.getComponentValueAtIndex(index, ['group', 'version', 'name']);
-                                            const group = lodash_1.default.has(selectComponentValues, 'group')
-                                                ? `${selectComponentValues.group}/`
-                                                : '';
-                                            const version = lodash_1.default.has(selectComponentValues, 'version')
-                                                ? `@${selectComponentValues.version}`
-                                                : '';
-                                            return `Component ${group}${lodash_1.default.get(selectComponentValues, 'name')}${version} is vulnerable`;
+                            'analysis.lastUpdated': {
+                                path: 'analysis.lastUpdated',
+                                transformer: global_1.filterString
+                            }
+                        },
+                        descriptions: {
+                            transformer: (input) => {
+                                const recommendation = input.recommendation
+                                    ? `Recommendation: ${input.recommendation}`
+                                    : '';
+                                // Workaround not defined by types? Use lodash for now until proper type is implemented
+                                const workaround = lodash_1.default.has(input, 'workaround')
+                                    ? `Workaround: ${input.workaround}`
+                                    : '';
+                                return [
+                                    recommendation || workaround
+                                        ? {
+                                            data: `${recommendation}\n\n${workaround}`.trim(),
+                                            label: 'fix'
                                         }
-                                    },
-                                    message: {
-                                        transformer: (index) => {
-                                            const selectComponentValues = this.getComponentValueAtIndex(index, [
-                                                'type',
-                                                'mime-type',
-                                                'bom-ref',
-                                                'supplier',
-                                                'manufacturer',
-                                                'authors',
-                                                'author',
-                                                'publisher',
-                                                'group',
-                                                'name',
-                                                'version',
-                                                'description',
-                                                'licenses',
-                                                'copyright'
-                                            ]);
-                                            const msg = Object.keys(selectComponentValues)
-                                                .map((key) => {
-                                                return Array.isArray(selectComponentValues[key])
-                                                    ? `\n\n- ${lodash_1.default.capitalize(key)}: ${JSON.stringify(selectComponentValues[key], null, 2)}`
-                                                    : `\n\n- ${lodash_1.default.capitalize(key)}: ${selectComponentValues[key]}`;
-                                            })
-                                                .join('');
-                                            return `-Component Summary-${msg}`;
+                                        : undefined,
+                                    lodash_1.default.has(input, 'proofOfConcept')
+                                        ? {
+                                            data: `Proof of concept: ${JSON.stringify(lodash_1.default.get(input, 'proofOfConcept'), null, 2)}`,
+                                            label: 'check'
                                         }
-                                    },
-                                    start_time: ''
-                                }
-                            ]
-                        }
-                    ],
-                    sha256: ''
-                }
-            ],
-            passthrough: {
-                transformer: (input) => {
-                    const components = input.components.filter((component) => !component.isDummy);
-                    return {
-                        auxiliary_data: [
+                                        : undefined
+                                ].filter((subdescription) => subdescription);
+                            }
+                        },
+                        refs: [
                             {
-                                name: 'SBOM',
-                                components: components.length ? components : undefined,
-                                dependencies: lodash_1.default.get(input, 'raw.dependencies'),
-                                data: lodash_1.default.omit(input.raw, [
-                                    'components',
-                                    'vulnerabilities',
-                                    'dependencies'
-                                ])
+                                transformer: (input) => {
+                                    const searchFor = ['source', 'references', 'advisories'];
+                                    const ref = searchFor
+                                        .filter((key) => input.hasOwnProperty(key))
+                                        .map((key) => lodash_1.default.pick(input, key));
+                                    return { ref: ref };
+                                }
                             }
                         ],
-                        ...(this.withRaw && { raw: input.raw })
-                    };
-                }
+                        source_location: {},
+                        title: {
+                            // Give description as title if possible
+                            transformer: (input) => input.description ? `${input.description}` : `${input.id}`
+                        },
+                        id: { path: 'id' },
+                        desc: {
+                            transformer: (input) => {
+                                const description = input.description
+                                    ? `Description: ${input.description}`
+                                    : '';
+                                const detail = input.detail ? `Detail: ${input.detail}` : '';
+                                return (0, global_1.filterString)(`${description}\n\n${detail}`.trim());
+                            }
+                        },
+                        impact: {
+                            transformer: (input) => maxImpact(input.ratings ?? [])
+                        },
+                        code: {
+                            transformer: (vulnerability) => JSON.stringify(lodash_1.default.omit(vulnerability, 'affectedComponents'), null, 2)
+                        },
+                        arrayTransformer: skipSeverityInfoOrUnknown,
+                        results: [
+                            {
+                                path: 'affectedComponents',
+                                status: inspecjs_1.ExecJSON.ControlResultStatus.Failed,
+                                code_desc: {
+                                    transformer: (index) => {
+                                        const selectComponentValues = this.getComponentValueAtIndex(index, ['group', 'version', 'name']);
+                                        const group = lodash_1.default.has(selectComponentValues, 'group')
+                                            ? `${selectComponentValues.group}/`
+                                            : '';
+                                        const version = lodash_1.default.has(selectComponentValues, 'version')
+                                            ? `@${selectComponentValues.version}`
+                                            : '';
+                                        return `Component ${group}${lodash_1.default.get(selectComponentValues, 'name')}${version} is vulnerable`;
+                                    }
+                                },
+                                message: {
+                                    transformer: (index) => {
+                                        // Selectively pick out fields to display; full components are listed in full component structure
+                                        const selectComponentValues = this.getComponentValueAtIndex(index, [
+                                            'type',
+                                            'mime-type',
+                                            'bom-ref',
+                                            'supplier',
+                                            'manufacturer',
+                                            'authors', // Replaces `author` in v1.6
+                                            'author', // Deprecated in v1.6
+                                            'publisher',
+                                            'group',
+                                            'name',
+                                            'version',
+                                            'description',
+                                            'licenses',
+                                            'copyright'
+                                        ]);
+                                        const msg = Object.keys(selectComponentValues)
+                                            .map((key) => {
+                                            return Array.isArray(selectComponentValues[key])
+                                                ? `\n\n- ${lodash_1.default.capitalize(key)}: ${JSON.stringify(selectComponentValues[key], null, 2)}`
+                                                : `\n\n- ${lodash_1.default.capitalize(key)}: ${selectComponentValues[key]}`;
+                                        })
+                                            .join('');
+                                        return `-Component Summary-${msg}`;
+                                    }
+                                },
+                                start_time: ''
+                            }
+                        ]
+                    }
+                ],
+                sha256: ''
             }
-        };
+        ],
+        passthrough: {
+            transformer: (input) => {
+                // VEX files will generate dummy components for control results
+                // Filter them out for the proper components listing
+                const components = input.components.filter((component) => !component.isDummy);
+                return {
+                    auxiliary_data: [
+                        {
+                            name: 'SBOM',
+                            components: components.length ? components : undefined,
+                            dependencies: lodash_1.default.get(input, 'raw.dependencies'),
+                            data: lodash_1.default.omit(input.raw, [
+                                'components',
+                                'vulnerabilities',
+                                'dependencies'
+                            ])
+                        }
+                    ],
+                    ...(this.withRaw && { raw: input.raw })
+                };
+            }
+        }
+    };
+    constructor(exportJson, withRaw = false) {
+        super(exportJson, true);
         this.withRaw = withRaw;
     }
 }