security-use 0.1.1__py3-none-any.whl → 0.2.9__py3-none-any.whl

security_use/parsers/npm.py

@@ -0,0 +1,196 @@
+"""npm package.json and package-lock.json parser."""
+
+import json
+import re
+from typing import Optional
+
+from security_use.parsers.base import Dependency, DependencyParser
+
+
+class NpmParser(DependencyParser):
+    """Parser for npm package.json files."""
+
+    def parse(self, content: str) -> list[Dependency]:
+        """Parse npm package.json content.
+
+        Args:
+            content: The package.json file content.
+
+        Returns:
+            List of dependencies found.
+        """
+        dependencies = []
+
+        try:
+            data = json.loads(content)
+        except json.JSONDecodeError:
+            return dependencies
+
+        # Parse regular dependencies
+        for name, version in data.get("dependencies", {}).items():
+            parsed_version = self._parse_version(version)
+            if parsed_version:
+                dependencies.append(
+                    Dependency(
+                        name=name,
+                        version=parsed_version,
+                        version_spec=version,
+                        ecosystem="npm",
+                    )
+                )
+
+        # Parse dev dependencies
+        for name, version in data.get("devDependencies", {}).items():
+            parsed_version = self._parse_version(version)
+            if parsed_version:
+                dependencies.append(
+                    Dependency(
+                        name=name,
+                        version=parsed_version,
+                        version_spec=version,
+                        ecosystem="npm",
+                    )
+                )
+
+        # Parse peer dependencies
+        for name, version in data.get("peerDependencies", {}).items():
+            parsed_version = self._parse_version(version)
+            if parsed_version:
+                dependencies.append(
+                    Dependency(
+                        name=name,
+                        version=parsed_version,
+                        version_spec=version,
+                        ecosystem="npm",
+                    )
+                )
+
+        # Parse overrides (may have pinned versions)
+        for name, version in data.get("overrides", {}).items():
+            if isinstance(version, str):
+                parsed_version = self._parse_version(version)
+                if parsed_version:
+                    dependencies.append(
+                        Dependency(
+                            name=name,
+                            version=parsed_version,
+                            version_spec=version,
+                            ecosystem="npm",
+                        )
+                    )
+
+        return dependencies
+
+    def _parse_version(self, version_spec: str) -> Optional[str]:
+        """Extract a concrete version from a version specifier.
+
+        Args:
+            version_spec: npm version specifier (e.g., "^1.2.3", "~1.2.3", "1.2.3")
+
+        Returns:
+            Concrete version string or None if can't be determined.
+        """
+        if not version_spec or not isinstance(version_spec, str):
+            return None
+
+        # Skip workspace references, URLs, git refs, etc.
+        if version_spec.startswith(("workspace:", "file:", "git:", "git+", "http:", "https:")):
+            return None
+
+        # Skip "latest", "*", etc.
+        if version_spec in ("*", "latest", "next", "canary"):
+            return None
+
+        # Remove npm: prefix if present
+        if version_spec.startswith("npm:"):
+            version_spec = version_spec.split("@")[-1]
+
+        # Extract version from common patterns
+        # ^1.2.3, ~1.2.3, >=1.2.3, >1.2.3, =1.2.3, 1.2.3
+        match = re.match(r'^[\^~>=<]*(\d+\.\d+\.\d+(?:-[\w.]+)?)', version_spec)
+        if match:
+            return match.group(1)
+
+        # Handle version ranges like "1.2.3 - 2.0.0" - use the lower bound
+        range_match = re.match(r'^(\d+\.\d+\.\d+)\s*-', version_spec)
+        if range_match:
+            return range_match.group(1)
+
+        return None
+
+    @classmethod
+    def supported_filenames(cls) -> list[str]:
+        """Return supported filenames."""
+        return ["package.json"]
+
+
+class NpmLockParser(DependencyParser):
+    """Parser for npm package-lock.json files."""
+
+    def parse(self, content: str) -> list[Dependency]:
+        """Parse npm package-lock.json content.
+
+        Args:
+            content: The package-lock.json file content.
+
+        Returns:
+            List of dependencies found with exact versions.
+        """
+        dependencies = []
+
+        try:
+            data = json.loads(content)
+        except json.JSONDecodeError:
+            return dependencies
+
+        lock_version = data.get("lockfileVersion", 1)
+
+        if lock_version >= 2:
+            # npm v7+ lockfile format - use "packages" field
+            packages = data.get("packages", {})
+            for path, pkg_data in packages.items():
+                if not path:  # Skip root package
+                    continue
+
+                # Extract package name from path (e.g., "node_modules/lodash")
+                name = path.split("node_modules/")[-1]
+                version = pkg_data.get("version")
+
+                if name and version:
+                    dependencies.append(
+                        Dependency(
+                            name=name,
+                            version=version,
+                            ecosystem="npm",
+                        )
+                    )
+        else:
+            # npm v6 lockfile format - use "dependencies" field
+            self._parse_dependencies_v1(data.get("dependencies", {}), dependencies)
+
+        return dependencies
+
+    def _parse_dependencies_v1(
+        self, deps: dict, result: list[Dependency], prefix: str = ""
+    ) -> None:
+        """Recursively parse dependencies from npm v6 lockfile format."""
+        for name, dep_data in deps.items():
+            version = dep_data.get("version")
+            if version:
+                result.append(
+                    Dependency(
+                        name=name,
+                        version=version,
+                        ecosystem="npm",
+                    )
+                )
+
+            # Parse nested dependencies
+            nested = dep_data.get("dependencies", {})
+            if nested:
+                self._parse_dependencies_v1(nested, result, f"{prefix}{name}/")
+
+    @classmethod
+    def supported_filenames(cls) -> list[str]:
+        """Return supported filenames."""
+        return ["package-lock.json"]

security_use/parsers/yarn.py

@@ -0,0 +1,108 @@
+"""Parser for Yarn lock files (yarn.lock)."""
+
+import re
+from typing import Optional
+
+from security_use.parsers.base import Dependency, DependencyParser
+
+
+class YarnLockParser(DependencyParser):
+    """Parser for yarn.lock files."""
+
+    # Regex to match package entries in yarn.lock v1 format
+    # Example: "package-name@^1.0.0":
+    PACKAGE_HEADER_RE = re.compile(
+        r'^"?(?P<name>@?[^@\s]+)@(?P<version_spec>[^":\s]+)"?:?\s*$'
+    )
+
+    # Regex to match resolved version
+    VERSION_RE = re.compile(r'^\s+version\s+"?(?P<version>[^"\s]+)"?\s*$')
+
+    def parse(self, content: str) -> list[Dependency]:
+        """Parse yarn.lock content."""
+        dependencies = []
+        current_package: Optional[str] = None
+        current_version_spec: Optional[str] = None
+        current_line: Optional[int] = None
+
+        for line_num, line in enumerate(content.splitlines(), start=1):
+            # Check for package header
+            header_match = self.PACKAGE_HEADER_RE.match(line)
+            if header_match:
+                current_package = header_match.group("name")
+                current_version_spec = header_match.group("version_spec")
+                current_line = line_num
+                continue
+
+            # Check for version line
+            if current_package:
+                version_match = self.VERSION_RE.match(line)
+                if version_match:
+                    version = version_match.group("version")
+                    dependencies.append(
+                        Dependency(
+                            name=current_package,
+                            version=version,
+                            version_spec=current_version_spec,
+                            line_number=current_line,
+                            ecosystem="npm",
+                        )
+                    )
+                    current_package = None
+                    current_version_spec = None
+                    current_line = None
+
+            # Reset on empty line (end of entry)
+            if not line.strip():
+                current_package = None
+                current_version_spec = None
+                current_line = None
+
+        return dependencies
+
+    @classmethod
+    def supported_filenames(cls) -> list[str]:
+        """Return supported filenames."""
+        return ["yarn.lock"]
+
+
+class PnpmLockParser(DependencyParser):
+    """Parser for pnpm-lock.yaml files."""
+
+    # Simple regex for YAML package entries
+    # Matches: /package-name@version or /@scope/package-name@version
+    PACKAGE_RE = re.compile(r"^  ['\"]?/?(?P<name>@?[^@\s:]+)@(?P<version>[^'\":\s]+)")
+
+    def parse(self, content: str) -> list[Dependency]:
+        """Parse pnpm-lock.yaml content."""
+        dependencies = []
+        seen_packages: set[str] = set()
+
+        for line_num, line in enumerate(content.splitlines(), start=1):
+            match = self.PACKAGE_RE.match(line)
+            if match:
+                name = match.group("name")
+                version = match.group("version")
+
+                # Deduplicate
+                key = f"{name}@{version}"
+                if key in seen_packages:
+                    continue
+                seen_packages.add(key)
+
+                dependencies.append(
+                    Dependency(
+                        name=name,
+                        version=version,
+                        version_spec=f"={version}",
+                        line_number=line_num,
+                        ecosystem="npm",
+                    )
+                )
+
+        return dependencies
+
+    @classmethod
+    def supported_filenames(cls) -> list[str]:
+        """Return supported filenames."""
+        return ["pnpm-lock.yaml"]

security_use/reporter.py

@@ -76,7 +76,14 @@ class TableReporter(ReportGenerator):
             self._render_iac_findings(result.iac_findings)
 
         if result.errors:
-            self._render_errors(result.errors)
+            # Separate parse/unsupported file errors from real errors
+            unsupported = [e for e in result.errors if "Failed to parse" in e or "not a valid" in e]
+            real_errors = [e for e in result.errors if e not in unsupported]
+
+            if unsupported:
+                self._render_unsupported(unsupported)
+            if real_errors:
+                self._render_errors(real_errors)
 
         return self.console.export_text()
 
@@ -168,6 +175,27 @@ class TableReporter(ReportGenerator):
 
         self.console.print(table)
 
+    def _render_unsupported(self, files: list[str]) -> None:
+        """Render unsupported files panel."""
+        text = Text()
+        for item in files:
+            # Extract just the filename from the error message
+            if "Failed to parse" in item:
+                filename = item.replace("Failed to parse ", "").replace(": Invalid YAML/JSON", "")
+                text.append(f"• {filename}\n", style="dim")
+            elif "not a valid" in item:
+                filename = item.split(" is not")[0]
+                text.append(f"• {filename}\n", style="dim")
+            else:
+                text.append(f"• {item}\n", style="dim")
+
+        panel = Panel(
+            text,
+            title="Unsupported Files (skipped)",
+            border_style="dim",
+        )
+        self.console.print(panel)
+
     def _render_errors(self, errors: list[str]) -> None:
         """Render errors panel."""
         error_text = Text()

security_use/sbom/__init__.py

@@ -0,0 +1,10 @@
+"""SBOM (Software Bill of Materials) generation module."""
+
+from security_use.sbom.generator import SBOMGenerator
+from security_use.sbom.models import SBOMFormat, SBOMOutput
+
+__all__ = [
+    "SBOMGenerator",
+    "SBOMFormat",
+    "SBOMOutput",
+]

security_use/sbom/generator.py

@@ -0,0 +1,340 @@
+"""SBOM generator for creating CycloneDX and SPDX documents."""
+
+import json
+import uuid
+from datetime import datetime
+from pathlib import Path
+from typing import Optional
+
+from security_use.dependency_scanner import DependencyScanner
+from security_use.parsers.base import Dependency
+from security_use.sbom.models import SBOMComponent, SBOMFormat, SBOMOutput
+
+
+class SBOMGenerator:
+    """Generate Software Bill of Materials in various formats."""
+
+    # Ecosystem to PURL type mapping
+    PURL_TYPES = {
+        "PyPI": "pypi",
+        "npm": "npm",
+        "Maven": "maven",
+        "NuGet": "nuget",
+        "Packagist": "composer",
+        "conda": "conda",
+    }
+
+    def __init__(self) -> None:
+        """Initialize the SBOM generator."""
+        self.scanner = DependencyScanner()
+
+    def generate(
+        self,
+        path: Path,
+        format: SBOMFormat = SBOMFormat.CYCLONEDX_JSON,
+        include_vulnerabilities: bool = False,
+    ) -> SBOMOutput:
+        """Generate an SBOM for the given path.
+
+        Args:
+            path: Path to the project directory.
+            format: Output format for the SBOM.
+            include_vulnerabilities: Include vulnerability information (VEX).
+
+        Returns:
+            SBOMOutput containing the generated SBOM.
+        """
+        # Scan for dependencies
+        result = self.scanner.scan_path(path)
+
+        # Convert to SBOM components
+        components = self._create_components(result.scanned_files, include_vulnerabilities)
+
+        # Generate output in requested format
+        if format == SBOMFormat.CYCLONEDX_JSON:
+            content = self._generate_cyclonedx_json(components, path)
+        elif format == SBOMFormat.CYCLONEDX_XML:
+            content = self._generate_cyclonedx_xml(components, path)
+        elif format == SBOMFormat.SPDX_JSON:
+            content = self._generate_spdx_json(components, path)
+        elif format == SBOMFormat.SPDX_TV:
+            content = self._generate_spdx_tv(components, path)
+        else:
+            raise ValueError(f"Unsupported format: {format}")
+
+        return SBOMOutput(
+            format=format,
+            content=content,
+            component_count=len(components),
+        )
+
+    def _create_components(
+        self,
+        scanned_files: list[str],
+        include_vulnerabilities: bool = False,
+    ) -> list[SBOMComponent]:
+        """Create SBOM components from scanned files."""
+        components: list[SBOMComponent] = []
+        seen: set[tuple[str, str]] = set()
+
+        for file_path in scanned_files:
+            try:
+                path = Path(file_path)
+                content = path.read_text(encoding="utf-8")
+                dependencies = self.scanner.parse_dependencies(content, path.name)
+
+                for dep in dependencies:
+                    if dep.version is None:
+                        continue
+
+                    key = (dep.name.lower(), dep.version)
+                    if key in seen:
+                        continue
+                    seen.add(key)
+
+                    component = SBOMComponent(
+                        name=dep.name,
+                        version=dep.version,
+                        ecosystem=dep.ecosystem,
+                        purl=self._create_purl(dep),
+                    )
+                    components.append(component)
+
+            except Exception:
+                continue
+
+        return components
+
+    def _create_purl(self, dep: Dependency) -> str:
+        """Create a Package URL (PURL) for a dependency."""
+        purl_type = self.PURL_TYPES.get(dep.ecosystem, "generic")
+
+        # Handle scoped packages (e.g., @scope/package for npm)
+        if dep.name.startswith("@"):
+            # npm scoped package
+            parts = dep.name.split("/")
+            namespace = parts[0][1:]  # Remove @
+            name = parts[1] if len(parts) > 1 else parts[0]
+            return f"pkg:{purl_type}/{namespace}/{name}@{dep.version}"
+
+        # Handle Maven coordinates (group:artifact)
+        if ":" in dep.name:
+            parts = dep.name.split(":")
+            group = parts[0]
+            artifact = parts[1] if len(parts) > 1 else parts[0]
+            return f"pkg:{purl_type}/{group}/{artifact}@{dep.version}"
+
+        return f"pkg:{purl_type}/{dep.name}@{dep.version}"
+
+    def _generate_cyclonedx_json(
+        self,
+        components: list[SBOMComponent],
+        path: Path,
+    ) -> str:
+        """Generate CycloneDX 1.5 JSON format."""
+        bom = {
+            "bomFormat": "CycloneDX",
+            "specVersion": "1.5",
+            "serialNumber": f"urn:uuid:{uuid.uuid4()}",
+            "version": 1,
+            "metadata": {
+                "timestamp": datetime.utcnow().isoformat() + "Z",
+                "tools": [
+                    {
+                        "vendor": "security-use",
+                        "name": "security-use",
+                        "version": "0.2.9",
+                    }
+                ],
+                "component": {
+                    "type": "application",
+                    "name": path.name,
+                    "version": "0.0.0",
+                },
+            },
+            "components": [
+                {
+                    "type": "library",
+                    "name": c.name,
+                    "version": c.version,
+                    "purl": c.purl,
+                    "bom-ref": c.purl,
+                }
+                for c in components
+            ],
+        }
+
+        return json.dumps(bom, indent=2)
+
+    def _generate_cyclonedx_xml(
+        self,
+        components: list[SBOMComponent],
+        path: Path,
+    ) -> str:
+        """Generate CycloneDX 1.5 XML format."""
+        lines = [
+            '<?xml version="1.0" encoding="UTF-8"?>',
+            '<bom xmlns="http://cyclonedx.org/schema/bom/1.5"',
+            f'     serialNumber="urn:uuid:{uuid.uuid4()}"',
+            '     version="1">',
+            "  <metadata>",
+            f"    <timestamp>{datetime.utcnow().isoformat()}Z</timestamp>",
+            "    <tools>",
+            "      <tool>",
+            "        <vendor>security-use</vendor>",
+            "        <name>security-use</name>",
+            "        <version>0.2.9</version>",
+            "      </tool>",
+            "    </tools>",
+            "    <component type=\"application\">",
+            f"      <name>{self._xml_escape(path.name)}</name>",
+            "      <version>0.0.0</version>",
+            "    </component>",
+            "  </metadata>",
+            "  <components>",
+        ]
+
+        for c in components:
+            lines.extend([
+                f'    <component type="library" bom-ref="{self._xml_escape(c.purl or c.name)}">',
+                f"      <name>{self._xml_escape(c.name)}</name>",
+                f"      <version>{self._xml_escape(c.version)}</version>",
+            ])
+            if c.purl:
+                lines.append(f"      <purl>{self._xml_escape(c.purl)}</purl>")
+            lines.append("    </component>")
+
+        lines.extend([
+            "  </components>",
+            "</bom>",
+        ])
+
+        return "\n".join(lines)
+
+    def _generate_spdx_json(
+        self,
+        components: list[SBOMComponent],
+        path: Path,
+    ) -> str:
+        """Generate SPDX 2.3 JSON format."""
+        spdx_id = f"SPDXRef-DOCUMENT"
+        doc_namespace = f"https://security-use.dev/sbom/{uuid.uuid4()}"
+
+        packages = []
+        relationships = []
+
+        # Root package
+        root_spdx_id = "SPDXRef-RootPackage"
+        packages.append({
+            "SPDXID": root_spdx_id,
+            "name": path.name,
+            "versionInfo": "0.0.0",
+            "downloadLocation": "NOASSERTION",
+            "filesAnalyzed": False,
+        })
+
+        relationships.append({
+            "spdxElementId": spdx_id,
+            "relatedSpdxElement": root_spdx_id,
+            "relationshipType": "DESCRIBES",
+        })
+
+        for i, c in enumerate(components):
+            pkg_spdx_id = f"SPDXRef-Package-{i}"
+            packages.append({
+                "SPDXID": pkg_spdx_id,
+                "name": c.name,
+                "versionInfo": c.version,
+                "downloadLocation": "NOASSERTION",
+                "filesAnalyzed": False,
+                "externalRefs": [
+                    {
+                        "referenceCategory": "PACKAGE-MANAGER",
+                        "referenceType": "purl",
+                        "referenceLocator": c.purl,
+                    }
+                ] if c.purl else [],
+            })
+
+            relationships.append({
+                "spdxElementId": root_spdx_id,
+                "relatedSpdxElement": pkg_spdx_id,
+                "relationshipType": "DEPENDS_ON",
+            })
+
+        doc = {
+            "spdxVersion": "SPDX-2.3",
+            "dataLicense": "CC0-1.0",
+            "SPDXID": spdx_id,
+            "name": f"{path.name} SBOM",
+            "documentNamespace": doc_namespace,
+            "creationInfo": {
+                "created": datetime.utcnow().isoformat() + "Z",
+                "creators": ["Tool: security-use-0.2.9"],
+            },
+            "packages": packages,
+            "relationships": relationships,
+        }
+
+        return json.dumps(doc, indent=2)
+
+    def _generate_spdx_tv(
+        self,
+        components: list[SBOMComponent],
+        path: Path,
+    ) -> str:
+        """Generate SPDX 2.3 tag-value format."""
+        doc_namespace = f"https://security-use.dev/sbom/{uuid.uuid4()}"
+        timestamp = datetime.utcnow().isoformat() + "Z"
+
+        lines = [
+            "SPDXVersion: SPDX-2.3",
+            "DataLicense: CC0-1.0",
+            "SPDXID: SPDXRef-DOCUMENT",
+            f"DocumentName: {path.name} SBOM",
+            f"DocumentNamespace: {doc_namespace}",
+            "Creator: Tool: security-use-0.2.9",
+            f"Created: {timestamp}",
+            "",
+            "##### Root Package",
+            "",
+            "PackageName: " + path.name,
+            "SPDXID: SPDXRef-RootPackage",
+            "PackageVersion: 0.0.0",
+            "PackageDownloadLocation: NOASSERTION",
+            "FilesAnalyzed: false",
+            "",
+            "Relationship: SPDXRef-DOCUMENT DESCRIBES SPDXRef-RootPackage",
+            "",
+        ]
+
+        for i, c in enumerate(components):
+            pkg_id = f"SPDXRef-Package-{i}"
+            lines.extend([
+                f"##### Package: {c.name}",
+                "",
+                f"PackageName: {c.name}",
+                f"SPDXID: {pkg_id}",
+                f"PackageVersion: {c.version}",
+                "PackageDownloadLocation: NOASSERTION",
+                "FilesAnalyzed: false",
+            ])
+            if c.purl:
+                lines.append(f"ExternalRef: PACKAGE-MANAGER purl {c.purl}")
+            lines.extend([
+                "",
+                f"Relationship: SPDXRef-RootPackage DEPENDS_ON {pkg_id}",
+                "",
+            ])
+
+        return "\n".join(lines)
+
+    def _xml_escape(self, s: str) -> str:
+        """Escape special characters for XML."""
+        return (
+            s.replace("&", "&amp;")
+            .replace("<", "&lt;")
+            .replace(">", "&gt;")
+            .replace('"', "&quot;")
+            .replace("'", "&apos;")
+        )