@cyclonedx/webpack-plugin
Version:
Creates CycloneDX Software Bill of Materials (SBoM) from webpack projects
155 lines (150 loc) • 6.36 kB
JavaScript
;
/*!
This file is part of CycloneDX Webpack plugin.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
SPDX-License-Identifier: Apache-2.0
Copyright (c) OWASP Foundation. All Rights Reserved.
*/
var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
if (k2 === undefined) k2 = k;
var desc = Object.getOwnPropertyDescriptor(m, k);
if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
desc = { enumerable: true, get: function() { return m[k]; } };
}
Object.defineProperty(o, k2, desc);
}) : (function(o, m, k, k2) {
if (k2 === undefined) k2 = k;
o[k2] = m[k];
}));
var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
Object.defineProperty(o, "default", { enumerable: true, value: v });
}) : function(o, v) {
o["default"] = v;
});
var __importStar = (this && this.__importStar) || (function () {
var ownKeys = function(o) {
ownKeys = Object.getOwnPropertyNames || function (o) {
var ar = [];
for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
return ar;
};
return ownKeys(o);
};
return function (mod) {
if (mod && mod.__esModule) return mod;
var result = {};
if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
__setModuleDefault(result, mod);
return result;
};
})();
Object.defineProperty(exports, "__esModule", { value: true });
exports.Extractor = void 0;
const node_path_1 = require("node:path");
const CDX = __importStar(require("@cyclonedx/cyclonedx-library"));
const _helpers_1 = require("./_helpers");
class Extractor {
#compilation;
#componentBuilder;
#purlFactory;
#leGatherer;
constructor(compilation, componentBuilder, purlFactory, leFetcher) {
this.#compilation = compilation;
this.#componentBuilder = componentBuilder;
this.#purlFactory = purlFactory;
this.#leGatherer = leFetcher;
}
generateComponents(modules, collectEvidence, logger) {
const pkgs = {};
const components = new Map();
logger?.log('start building Components from modules...');
for (const module of modules) {
if (module.context === null) {
logger?.debug('skipping', module);
continue;
}
const pkg = (0, _helpers_1.getPackageDescription)(module.context);
if (pkg === undefined) {
logger?.debug('skipped package for', module.context);
continue;
}
let component = pkgs[pkg.path];
if (component === undefined) {
logger?.log('try to build new Component from PkgPath:', pkg.path);
try {
component = this.makeComponent(pkg, collectEvidence, logger);
}
catch (err) {
logger?.debug('unexpected error:', err);
logger?.warn('skipped Component from PkgPath', pkg.path);
continue;
}
logger?.debug('built', component, 'based on', pkg, 'for module', module);
pkgs[pkg.path] = component;
}
components.set(module, component);
}
logger?.log('linking Component.dependencies...');
this.#linkDependencies(components);
logger?.log('done building Components from modules...');
return components.values();
}
makeComponent(pkg, collectEvidence, logger) {
try {
const _packageJson = (0, _helpers_1.structuredClonePolyfill)(pkg.packageJson);
(0, _helpers_1.normalizePackageManifest)(_packageJson);
pkg.packageJson = _packageJson;
}
catch (e) {
logger?.warn('normalizePackageJson from PkgPath', pkg.path, 'failed:', e);
}
const component = this.#componentBuilder.makeComponent(pkg.packageJson);
if (component === undefined) {
throw new Error(`failed building Component from PkgPath ${pkg.path}`);
}
component.licenses.forEach(l => {
l.acknowledgement = CDX.Enums.LicenseAcknowledgement.Declared;
});
if (collectEvidence) {
component.evidence = new CDX.Models.ComponentEvidence({
licenses: new CDX.Models.LicenseRepository(this.getLicenseEvidence((0, node_path_1.dirname)(pkg.path), logger))
});
}
component.purl = this.#purlFactory.makeFromComponent(component);
component.bomRef.value = component.purl?.toString();
return component;
}
#linkDependencies(modulesComponents) {
for (const [module, component] of modulesComponents) {
for (const dependencyModule of module.dependencies.map(d => this.#compilation.moduleGraph.getModule(d)).filter(_helpers_1.isNonNullable)) {
const dependencyBomRef = modulesComponents.get(dependencyModule)?.bomRef;
if (dependencyBomRef !== undefined) {
component.dependencies.add(dependencyBomRef);
}
}
}
}
*getLicenseEvidence(packageDir, logger) {
const files = this.#leGatherer.getFileAttachments(packageDir, (error) => {
logger?.info(error.message);
logger?.debug(error.message, error);
});
try {
for (const { file, text } of files) {
yield new CDX.Models.NamedLicense(`file: ${file}`, { text });
}
}
catch (e) {
logger?.warn('collecting license evidence in', packageDir, 'failed:', e);
}
}
}
exports.Extractor = Extractor;