Skip to content

Commit 96b78e8

Browse files
Ly-JoeyLy-Joey
authored
feat: Add CycloneDX 1.7 support (#2815)
Bump cyclonedx-go to v0.11.0 and add support for spec 1.7 in output format - [x] TODO: Update osv-scalibr dependency to a version that contains the cyclonedx-go update Resolves: #2787 Related PR: [osv-scalibr#2117](google/osv-scalibr#2117)
1 parent 6364546 commit 96b78e8

9 files changed

Lines changed: 3077 additions & 3 deletions

File tree

‎cmd/osv-scanner/scan/source/__snapshots__/command_test.snap‎

Lines changed: 228 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,44 @@ Loaded filter from: <rootdir>/testdata/locks-many/osv-scanner-test.toml
5050

5151
---
5252

53+
[TestCommand/Empty_cyclonedx_1.6_output - 1]
54+
{
55+
"$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
56+
"bomFormat": "CycloneDX",
57+
"specVersion": "1.6",
58+
"version": 1,
59+
"components": [],
60+
"vulnerabilities": []
61+
}
62+
63+
---
64+
65+
[TestCommand/Empty_cyclonedx_1.6_output - 2]
66+
Scanning dir ./testdata/locks-many/composer.lock
67+
Scanned <rootdir>/testdata/locks-many/composer.lock file and found 1 package
68+
Loaded filter from: <rootdir>/testdata/locks-many/osv-scanner-test.toml
69+
70+
---
71+
72+
[TestCommand/Empty_cyclonedx_1.7_output - 1]
73+
{
74+
"$schema": "http://cyclonedx.org/schema/bom-1.7.schema.json",
75+
"bomFormat": "CycloneDX",
76+
"specVersion": "1.7",
77+
"version": 1,
78+
"components": [],
79+
"vulnerabilities": []
80+
}
81+
82+
---
83+
84+
[TestCommand/Empty_cyclonedx_1.7_output - 2]
85+
Scanning dir ./testdata/locks-many/composer.lock
86+
Scanned <rootdir>/testdata/locks-many/composer.lock file and found 1 package
87+
Loaded filter from: <rootdir>/testdata/locks-many/osv-scanner-test.toml
88+
89+
---
90+
5391
[TestCommand/Empty_gh-annotations_output - 1]
5492

5593
---
@@ -785,6 +823,194 @@ Scanned <rootdir>/testdata/locks-insecure/osv-scanner-custom.json file and found
785823

786824
---
787825

826+
[TestCommand/cyclonedx_1.6_output - 1]
827+
{
828+
"$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
829+
"bomFormat": "CycloneDX",
830+
"specVersion": "1.6",
831+
"version": 1,
832+
"components": [
833+
{
834+
"bom-ref": "pkg:composer/league/flysystem@1.0.8",
835+
"type": "library",
836+
"name": "league/flysystem",
837+
"version": "1.0.8",
838+
"licenses": [],
839+
"purl": "pkg:composer/league/flysystem@1.0.8"
840+
},
841+
{
842+
"bom-ref": "pkg:golang/stdlib@1.99.9",
843+
"type": "library",
844+
"name": "stdlib",
845+
"version": "1.99.9",
846+
"licenses": [],
847+
"purl": "pkg:golang/stdlib@1.99.9"
848+
},
849+
{
850+
"bom-ref": "pkg:golang/toolchain@1.99.9",
851+
"type": "library",
852+
"name": "toolchain",
853+
"version": "1.99.9",
854+
"licenses": [],
855+
"purl": "pkg:golang/toolchain@1.99.9"
856+
},
857+
{
858+
"bom-ref": "pkg:npm/has-flag@4.0.0",
859+
"type": "library",
860+
"name": "has-flag",
861+
"version": "4.0.0",
862+
"licenses": [],
863+
"purl": "pkg:npm/has-flag@4.0.0"
864+
},
865+
{
866+
"bom-ref": "pkg:npm/wrappy@1.0.2",
867+
"type": "library",
868+
"name": "wrappy",
869+
"version": "1.0.2",
870+
"licenses": [],
871+
"purl": "pkg:npm/wrappy@1.0.2"
872+
}
873+
],
874+
"vulnerabilities": [
875+
{
876+
"id": "GHSA-9f46-5r25-5wfm",
877+
"references": [
878+
{
879+
"id": "CVE-2021-32708",
880+
"source": {}
881+
}
882+
],
883+
"ratings": [
884+
{
885+
"method": "CVSSv3",
886+
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
887+
}
888+
],
889+
"description": "Time-of-check Time-of-use (TOCTOU) Race Condition in league/flysystem",
890+
"detail": "### Impact\n\nThe whitespace normalisation using in 1.x and 2.x removes any unicode whitespace. Under certain specific conditions this could potentially allow a malicious user to execute code remotely.\n\nThe conditions: \n\n- A user is allowed to supply the path or filename of an uploaded file.\n- The supplied path or filename is not checked against unicode chars.\n- The supplied pathname checked against an extension deny-list, not an allow-list.\n- The supplied path or filename contains a unicode whitespace char in the extension.\n- The uploaded file is stored in a directory that allows PHP code to be executed.\n\nGiven these conditions are met a user can upload and execute arbitrary code on the system under attack.\n\n### Patches\n\nThe unicode whitespace removal has been replaced with a rejection (exception).\n\nThe library has been patched in:\n- 1.x: https://github.com/thephpleague/flysystem/commit/f3ad69181b8afed2c9edf7be5a2918144ff4ea32\n- 2.x: https://github.com/thephpleague/flysystem/commit/a3c694de9f7e844b76f9d1b61296ebf6e8d89d74\n\n### Workarounds\n\nFor 1.x users, upgrade to 1.1.4. For 2.x users, upgrade to 2.1.1.\n",
891+
"advisories": [
892+
{
893+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-32708"
894+
}
895+
],
896+
"published": "2021-06-29T03:13:28Z",
897+
"updated": "2026-03-13T22:01:08Z",
898+
"credits": {
899+
"organizations": []
900+
},
901+
"affects": [
902+
{
903+
"ref": "pkg:composer/league/flysystem"
904+
}
905+
]
906+
}
907+
]
908+
}
909+
910+
---
911+
912+
[TestCommand/cyclonedx_1.6_output - 2]
913+
Scanning dir ./testdata/locks-insecure
914+
Scanned <rootdir>/testdata/locks-insecure/bun.lock file and found 2 packages
915+
Scanned <rootdir>/testdata/locks-insecure/composer.lock file and found 1 package
916+
Scanned <rootdir>/testdata/locks-insecure/osv-scanner-custom.json file and found 2 packages
917+
918+
---
919+
920+
[TestCommand/cyclonedx_1.7_output - 1]
921+
{
922+
"$schema": "http://cyclonedx.org/schema/bom-1.7.schema.json",
923+
"bomFormat": "CycloneDX",
924+
"specVersion": "1.7",
925+
"version": 1,
926+
"components": [
927+
{
928+
"bom-ref": "pkg:composer/league/flysystem@1.0.8",
929+
"type": "library",
930+
"name": "league/flysystem",
931+
"version": "1.0.8",
932+
"licenses": [],
933+
"purl": "pkg:composer/league/flysystem@1.0.8"
934+
},
935+
{
936+
"bom-ref": "pkg:golang/stdlib@1.99.9",
937+
"type": "library",
938+
"name": "stdlib",
939+
"version": "1.99.9",
940+
"licenses": [],
941+
"purl": "pkg:golang/stdlib@1.99.9"
942+
},
943+
{
944+
"bom-ref": "pkg:golang/toolchain@1.99.9",
945+
"type": "library",
946+
"name": "toolchain",
947+
"version": "1.99.9",
948+
"licenses": [],
949+
"purl": "pkg:golang/toolchain@1.99.9"
950+
},
951+
{
952+
"bom-ref": "pkg:npm/has-flag@4.0.0",
953+
"type": "library",
954+
"name": "has-flag",
955+
"version": "4.0.0",
956+
"licenses": [],
957+
"purl": "pkg:npm/has-flag@4.0.0"
958+
},
959+
{
960+
"bom-ref": "pkg:npm/wrappy@1.0.2",
961+
"type": "library",
962+
"name": "wrappy",
963+
"version": "1.0.2",
964+
"licenses": [],
965+
"purl": "pkg:npm/wrappy@1.0.2"
966+
}
967+
],
968+
"vulnerabilities": [
969+
{
970+
"id": "GHSA-9f46-5r25-5wfm",
971+
"references": [
972+
{
973+
"id": "CVE-2021-32708",
974+
"source": {}
975+
}
976+
],
977+
"ratings": [
978+
{
979+
"method": "CVSSv3",
980+
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
981+
}
982+
],
983+
"description": "Time-of-check Time-of-use (TOCTOU) Race Condition in league/flysystem",
984+
"detail": "### Impact\n\nThe whitespace normalisation using in 1.x and 2.x removes any unicode whitespace. Under certain specific conditions this could potentially allow a malicious user to execute code remotely.\n\nThe conditions: \n\n- A user is allowed to supply the path or filename of an uploaded file.\n- The supplied path or filename is not checked against unicode chars.\n- The supplied pathname checked against an extension deny-list, not an allow-list.\n- The supplied path or filename contains a unicode whitespace char in the extension.\n- The uploaded file is stored in a directory that allows PHP code to be executed.\n\nGiven these conditions are met a user can upload and execute arbitrary code on the system under attack.\n\n### Patches\n\nThe unicode whitespace removal has been replaced with a rejection (exception).\n\nThe library has been patched in:\n- 1.x: https://github.com/thephpleague/flysystem/commit/f3ad69181b8afed2c9edf7be5a2918144ff4ea32\n- 2.x: https://github.com/thephpleague/flysystem/commit/a3c694de9f7e844b76f9d1b61296ebf6e8d89d74\n\n### Workarounds\n\nFor 1.x users, upgrade to 1.1.4. For 2.x users, upgrade to 2.1.1.\n",
985+
"advisories": [
986+
{
987+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-32708"
988+
}
989+
],
990+
"published": "2021-06-29T03:13:28Z",
991+
"updated": "2026-03-13T22:01:08Z",
992+
"credits": {
993+
"organizations": []
994+
},
995+
"affects": [
996+
{
997+
"ref": "pkg:composer/league/flysystem"
998+
}
999+
]
1000+
}
1001+
]
1002+
}
1003+
1004+
---
1005+
1006+
[TestCommand/cyclonedx_1.7_output - 2]
1007+
Scanning dir ./testdata/locks-insecure
1008+
Scanned <rootdir>/testdata/locks-insecure/bun.lock file and found 2 packages
1009+
Scanned <rootdir>/testdata/locks-insecure/composer.lock file and found 1 package
1010+
Scanned <rootdir>/testdata/locks-insecure/osv-scanner-custom.json file and found 2 packages
1011+
1012+
---
1013+
7881014
[TestCommand/exclude_with_exact_directory_name - 1]
7891015
Scanning dir ./testdata/locks-one-with-nested
7901016
Scanned <rootdir>/testdata/locks-one-with-nested/nested/composer.lock file and found 1 package
@@ -1237,7 +1463,7 @@ OPTIONS:
12371463
--data-source string source to fetch package information from; value can be: deps.dev, native (default: "deps.dev")
12381464
--maven-registry string URL of the default registry to fetch Maven metadata
12391465
--config string set/override config file
1240-
--format string, -f string sets the output format; value can be: table, html, vertical, json, markdown, sarif, gh-annotations, cyclonedx-1-4, cyclonedx-1-5, spdx-2-3 (default: "table")
1466+
--format string, -f string sets the output format; value can be: table, html, vertical, json, markdown, sarif, gh-annotations, cyclonedx-1-4, cyclonedx-1-5, cyclonedx-1-6, cyclonedx-1-7, spdx-2-3 (default: "table")
12411467
--serve output as HTML result and serve it locally
12421468
--port string port number to use when serving HTML report (default: 8000)
12431469
--output string [DEPRECATED] (Use "--output-file" instead) saves the result to the given file path
@@ -1633,7 +1859,7 @@ Total 1 package affected by 1 known vulnerability (0 Critical, 1 High, 0 Medium,
16331859
---
16341860

16351861
[TestCommand/output_format:_unsupported - 2]
1636-
unsupported output format "unknown" - must be one of: table, html, vertical, json, markdown, sarif, gh-annotations, cyclonedx-1-4, cyclonedx-1-5, spdx-2-3
1862+
unsupported output format "unknown" - must be one of: table, html, vertical, json, markdown, sarif, gh-annotations, cyclonedx-1-4, cyclonedx-1-5, cyclonedx-1-6, cyclonedx-1-7, spdx-2-3
16371863

16381864
---
16391865

‎cmd/osv-scanner/scan/source/command_test.go‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -251,6 +251,28 @@ func TestCommand(t *testing.T) {
251251
Args: []string{"", "source", "--config=./testdata/osv-scanner-empty-config.toml", "--format", "cyclonedx-1-5", "--all-packages", "./testdata/locks-insecure"},
252252
Exit: 1,
253253
},
254+
// output format: cyclonedx 1.6
255+
{
256+
Name: "Empty_cyclonedx_1.6_output",
257+
Args: []string{"", "source", "--format", "cyclonedx-1-6", "./testdata/locks-many/composer.lock"},
258+
Exit: 0,
259+
},
260+
{
261+
Name: "cyclonedx_1.6_output",
262+
Args: []string{"", "source", "--config=./testdata/osv-scanner-empty-config.toml", "--format", "cyclonedx-1-6", "--all-packages", "./testdata/locks-insecure"},
263+
Exit: 1,
264+
},
265+
// output format: cyclonedx 1.7
266+
{
267+
Name: "Empty_cyclonedx_1.7_output",
268+
Args: []string{"", "source", "--format", "cyclonedx-1-7", "./testdata/locks-many/composer.lock"},
269+
Exit: 0,
270+
},
271+
{
272+
Name: "cyclonedx_1.7_output",
273+
Args: []string{"", "source", "--config=./testdata/osv-scanner-empty-config.toml", "--format", "cyclonedx-1-7", "--all-packages", "./testdata/locks-insecure"},
274+
Exit: 1,
275+
},
254276
// output format: spdx 2.3
255277
{
256278
Name: "Empty_spdx_2.3_output",

0 commit comments

Comments
 (0)