Merge pull request #112 from safedep/jc-staging

feat: CycloneDX SBOM Scanning Introduced by #111

Author: abhisek

README.md

@@ -99,6 +99,23 @@ vet scan --lockfiles /path/to/package-lock.json
 
 > [Example Security Gate](https://github.com/safedep/demo-client-java/pull/2) using `vet` to prevent introducing new OSS dependency risk in an application.
 
+#### Scanning SBOM
+
+- To scan an SBOM in [CycloneDX](https://cyclonedx.org/) format
+
+```bash
+vet scan --lockfiles /path/to/cyclonedx-sbom.json --lockfile-as bom-cyclonedx
+```
+
+> **Note:** SBOM scanning feature is currently in experimental stage
+
+#### Available Parsers
+
+- To list supported package manifest parsers including experimental modules
+
+```bash
+vet scan parsers --experimental
+```
 
 ## 📖 Documentation
 

docs/docs/quick-start.md

@@ -61,4 +61,11 @@ vet scan --lockfiles /path/to/requirements.txt
 vet scan --lockfiles /path/to/package-lock.json
 ```
 
+:::info
+
+To list all available package manifest parsers run
+`vet scan parsers --experimental`
+
+:::
+
 ![vet scan files](/img/vet/vet-scan-files.png)

gen/exceptionsapi/exceptions_spec.pb.go

@@ -3,6 +3,7 @@ module github.com/safedep/vet
 go 1.18
 
 require (
+	github.com/CycloneDX/cyclonedx-go v0.7.1
 	github.com/deepmap/oapi-codegen v1.13.3
 	github.com/golang/protobuf v1.5.3
 	github.com/google/cel-go v0.17.1

gen/filterinput/filter_input_spec.pb.go

@@ -1,5 +1,7 @@
 github.com/BurntSushi/toml v1.3.2 h1:o7IhLm0Msx3BaB+n3Ag7L8EVlByGnpq14C4YWiu/gL8=
 github.com/BurntSushi/toml v1.3.2/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbicEuybxQ=
+github.com/CycloneDX/cyclonedx-go v0.7.1 h1:5w1SxjGm9MTMNTuRbEPyw21ObdbaagTWF/KfF0qHTRE=
+github.com/CycloneDX/cyclonedx-go v0.7.1/go.mod h1:N/nrdWQI2SIjaACyyDs/u7+ddCkyl/zkNs8xFsHF2Ps=
 github.com/Masterminds/semver/v3 v3.2.0 h1:3MEsd0SM6jqZojhjLWWeBY+Kcjy9i6MQAeY7YgDP83g=
 github.com/Masterminds/semver/v3 v3.2.0/go.mod h1:qvl/7zhW3nngYb5+80sSMF+FG2BjYrf8m9wsX0PNOMQ=
 github.com/RaveNoX/go-jsoncommentstrip v1.0.0/go.mod h1:78ihd09MekBnJnxpICcwzCMzGrKSKYe4AqU6PDYYpjk=
@@ -8,6 +10,7 @@ github.com/antlr/antlr4/runtime/Go/antlr/v4 v4.0.0-20230305170008-8188dc5388df/g
 github.com/apapsch/go-jsonmerge/v2 v2.0.0 h1:axGnT1gRIfimI7gJifB699GoE/oq+F2MU7Dml6nw9rQ=
 github.com/apapsch/go-jsonmerge/v2 v2.0.0/go.mod h1:lvDnEdqiQrp0O42VQGgmlKpxL1AP2+08jFMw88y4klk=
 github.com/bmatcuk/doublestar v1.1.1/go.mod h1:UD6OnuiIn0yFxxA2le/rnRU1G4RaI4UvFv1sNto9p6w=
+github.com/bradleyjkemp/cupaloy/v2 v2.8.0 h1:any4BmKE+jGIaMpnU8YgH/I2LPiLBufr6oMMlVBbn9M=
 github.com/bytedance/sonic v1.5.0/go.mod h1:ED5hyg4y6t3/9Ku1R6dU/4KyJ48DZ4jPhfY1O2AihPM=
 github.com/bytedance/sonic v1.10.0-rc/go.mod h1:ElCzW+ufi8qKqNW0FY314xriJhyJhuoJ3gFZdAHF7NM=
 github.com/bytedance/sonic v1.10.0-rc3 h1:uNSnscRapXTwUgTyOF0GVljYD08p9X/Lbr9MweSV3V0=

gen/filtersuite/filter_suite_spec.pb.go

@@ -22,6 +22,7 @@ const (
 	EcosystemPackagist = "Packagist"
 	EcosystemHex       = "Hex"
 	EcosystemPub       = "Pub"
+	EcosystemCyDxSBOM  = "CycloneDxSbom"
 )
 
 // Represents a package manifest that contains a list

go.mod

@@ -0,0 +1,73 @@
+package parser
+
+import (
+	"bufio"
+	"fmt"
+	"os"
+	"strings"
+
+	cdx "github.com/CycloneDX/cyclonedx-go"
+	"github.com/google/osv-scanner/pkg/lockfile"
+	"github.com/safedep/vet/pkg/common/logger"
+)
+
+func parseCyclonedxSBOM(pathToLockfile string) ([]lockfile.PackageDetails, error) {
+	details := []lockfile.PackageDetails{}
+
+	bom := new(cdx.BOM)
+	if file, err := os.Open(pathToLockfile); err != nil {
+		return nil, err
+	} else {
+		sbom_content := bufio.NewReader(file)
+		decoder := cdx.NewBOMDecoder(sbom_content, cdx.BOMFileFormatJSON)
+		if err = decoder.Decode(bom); err != nil {
+			return nil, err
+		}
+	}
+
+	for _, comp := range *bom.Components {
+		if d, err := convertSbomComponent2LPD(&comp); err != nil {
+			logger.Warnf("Failed converting sbom to lockfile component: %v", err)
+		} else {
+			details = append(details, *d)
+		}
+	}
+
+	return details, nil
+}
+
+func convertSbomComponent2LPD(comp *cdx.Component) (*lockfile.PackageDetails, error) {
+	var name string
+	if comp.Group != "" {
+		name = fmt.Sprintf("%s:%s", comp.Group, comp.Name)
+	} else {
+		name = comp.Name
+	}
+
+	var ecosysystem lockfile.Ecosystem
+	if eco, err := convertBomRefAsEcosystem(comp.BOMRef); err != nil {
+		return nil, err
+	} else {
+		ecosysystem = eco
+	}
+
+	d := lockfile.PackageDetails{
+		Name:      name,
+		Version:   comp.Version,
+		Ecosystem: ecosysystem,
+		CompareAs: ecosysystem,
+	}
+
+	return &d, nil
+}
+
+func convertBomRefAsEcosystem(bomref string) (lockfile.Ecosystem, error) {
+	if strings.Contains(bomref, "pkg:pypi") {
+		return lockfile.PipEcosystem, nil
+	} else if strings.Contains(bomref, "pkg:npm") {
+		return lockfile.NpmEcosystem, nil
+	} else {
+		// Return an error, the ecosystem here does not matter
+		return lockfile.NpmEcosystem, fmt.Errorf("failed parsing bomref %s to ecosystem", bomref)
+	}
+}

go.sum

@@ -0,0 +1,74 @@
+package parser
+
+import (
+	"os"
+	"io/ioutil"
+	"testing"
+	"github.com/stretchr/testify/assert"
+	"github.com/google/osv-scanner/pkg/lockfile"
+	cdx "github.com/CycloneDX/cyclonedx-go"
+)
+
+func TestParseCyclonedxSBOM(t *testing.T) {
+	// Create a sample SBOM JSON file
+	tempFile, _ := ioutil.TempFile("", "sbom_*.json")
+	defer os.Remove(tempFile.Name())
+	sbomContent := `{
+		"Components": [
+			{
+				"group": "testGroup",
+				"name": "testName",
+				"version": "1.0",
+				"bom-ref": "pkg:pypi"
+			},
+			{
+				"group": "testGroup2",
+				"name": "testName2",
+				"version": "2.0",
+				"bom-ref": "pkg:npm"
+			}
+		]
+	}`
+	err := ioutil.WriteFile(tempFile.Name(), []byte(sbomContent), 0644)
+	assert.Nil(t, err)
+
+	packages, err := parseCyclonedxSBOM(tempFile.Name())
+
+	assert.Nil(t, err)
+	assert.Len(t, packages, 2)
+	assert.Equal(t, "testGroup:testName", packages[0].Name)
+	assert.Equal(t, "testGroup2:testName2", packages[1].Name)
+}
+
+func TestConvertSbomComponent2LPD(t *testing.T) {
+	component := cdx.Component{
+		Group:   "testGroup",
+		Name:    "testName",
+		Version: "1.0",
+		BOMRef:  "pkg:pypi",
+	}
+
+	pd, err := convertSbomComponent2LPD(&component)
+
+	assert.Nil(t, err)
+	assert.Equal(t, "testGroup:testName", pd.Name)
+	assert.Equal(t, "1.0", pd.Version)
+	assert.Equal(t, lockfile.PipEcosystem, pd.Ecosystem)
+}
+
+func TestConvertBomRefAsEcosystem(t *testing.T) {
+	ecosystem, err := convertBomRefAsEcosystem("pkg:pypi")
+
+	assert.Nil(t, err)
+	assert.Equal(t, lockfile.PipEcosystem, ecosystem)
+
+	ecosystem, err = convertBomRefAsEcosystem("pkg:npm")
+
+	assert.Nil(t, err)
+	assert.Equal(t, lockfile.NpmEcosystem, ecosystem)
+
+	ecosystem, err = convertBomRefAsEcosystem("pkg:unknown")
+
+	assert.NotNil(t, err)
+	assert.Equal(t, lockfile.NpmEcosystem, ecosystem) // As per your code, it defaults to lockfile.NpmEcosystem
+}