owasp-depscan 5.3.1__tar.gz → 5.3.3__tar.gz

{owasp-depscan-5.3.1/owasp_depscan.egg-info → owasp_depscan-5.3.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: owasp-depscan
-Version: 5.3.1
+Version: 5.3.3
 Summary: Fully open-source security audit for project dependencies based on known vulnerabilities and advisories.
 Author-email: Team AppThreat <cloud@appthreat.com>
 License: MIT

{owasp-depscan-5.3.1 → owasp_depscan-5.3.3}/depscan/cli.py

@@ -133,6 +133,12 @@ def build_args():
         dest="risk_audit",
         help="Perform package risk audit (slow operation). Npm only.",
     )
+    parser.add_argument(
+        "--cdxgen-args",
+        default=os.getenv("CDXGEN_ARGS"),
+        dest="cdxgen_args",
+        help="Additional arguments to pass to cdxgen"
+    )
     parser.add_argument(
         "--private-ns",
         dest="private_ns",
@@ -864,7 +870,7 @@ def main():
                 bom_file,
                 src_dir,
                 args.deep_scan,
-                {"cdxgen_server": args.cdxgen_server, "profile": args.profile},
+                {"cdxgen_server": args.cdxgen_server, "profile": args.profile, "cdxgen_args": args.cdxgen_args},
             )
         if not creation_status:
             LOG.debug("Bom file %s was not created successfully", bom_file)

{owasp-depscan-5.3.1 → owasp_depscan-5.3.3}/depscan/lib/bom.py

@@ -1,5 +1,6 @@
 import json
 import os
+import shlex
 import shutil
 import subprocess
 import sys
@@ -390,6 +391,8 @@ def create_bom(project_type, bom_file, src_dir=".", deep=False, options={}):
         args.append(options.get("profile"))
         if options.get("profile") != "generic":
             LOG.debug("BOM Profile: %s", options.get("profile"))
+    if options.get("cdxgen_args"):
+        args += shlex.split(options.get("cdxgen_args"))
     # Bug #233 - Source directory could be None when working with url
     if src_dir:
         args.append(src_dir)

{owasp-depscan-5.3.1 → owasp_depscan-5.3.3}/depscan/lib/utils.py

@@ -232,23 +232,21 @@ def search_pkgs(db, project_type, pkg_list):
         vendor, name = get_pkg_vendor_name(pkg)
         version = pkg.get("version")
         if pkg.get("purl"):
+            ppurl = pkg.get("purl")
             purl_aliases[pkg.get("purl")] = pkg.get("purl")
-            purl_aliases[
-                f"{vendor.lower()}:{name.lower()}:{version}"
-            ] = pkg.get("purl")
+            purl_aliases[f"{vendor.lower()}:{name.lower()}:{version}"] = ppurl
+            if ppurl.startswith("pkg:npm"):
+                purl_aliases[f"npm:{vendor.lower()}/{name.lower()}:{version}"] = ppurl
             if not purl_aliases.get(f"{vendor.lower()}:{name.lower()}"):
-                purl_aliases[f"{vendor.lower()}:{name.lower()}"] = pkg.get(
-                    "purl"
-                )
+                purl_aliases[f"{vendor.lower()}:{name.lower()}"] = ppurl
         if variations:
             for vari in variations:
                 vari_full_pkg = f"""{vari.get("vendor")}:{vari.get("name")}"""
                 pkg_aliases[
                     f"{vendor.lower()}:{name.lower()}:{version}"
                 ].append(vari_full_pkg)
-                purl_aliases[f"{vari_full_pkg.lower()}:{version}"] = pkg.get(
-                    "purl"
-                )
+                if pkg.get("purl"):
+                    purl_aliases[f"{vari_full_pkg.lower()}:{version}"] = pkg.get("purl")
     quick_res = db_lib.bulk_index_search(expanded_list)
     raw_results = db_lib.pkg_bulk_search(db, quick_res)
     raw_results = normalize.dedup(project_type, raw_results)

{owasp-depscan-5.3.1 → owasp_depscan-5.3.3/owasp_depscan.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: owasp-depscan
-Version: 5.3.1
+Version: 5.3.3
 Summary: Fully open-source security audit for project dependencies based on known vulnerabilities and advisories.
 Author-email: Team AppThreat <cloud@appthreat.com>
 License: MIT

{owasp-depscan-5.3.1 → owasp_depscan-5.3.3}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "owasp-depscan"
-version = "5.3.1"
+version = "5.3.3"
 description = "Fully open-source security audit for project dependencies based on known vulnerabilities and advisories."
 authors = [
     {name = "Team AppThreat", email = "cloud@appthreat.com"},