File Coverage

blib/lib/SBOM/CycloneDX.pm

Criterion	Covered	Total	%
statement	115	146	78.7
branch	23	46	50.0
condition	0	6	0.0
subroutine	25	29	86.2
pod	7	7	100.0
total	170	234	72.6

package SBOM::CycloneDX;

use 5.010001;
use strict;
use warnings;
use utf8;

use Types::Standard qw(Str StrMatch Int Num InstanceOf HashRef);
use Types::TypeTiny qw(ArrayLike);

use SBOM::CycloneDX::Declarations;
use SBOM::CycloneDX::Definitions;
use SBOM::CycloneDX::Dependency;
use SBOM::CycloneDX::List;
use SBOM::CycloneDX::Metadata;
use SBOM::CycloneDX::Schema;
use SBOM::CycloneDX::Util qw(urn_uuid);

use List::Util qw(uniq);

use Moo;
use namespace::autoclean;

extends 'SBOM::CycloneDX::Base';

use constant JSON_SCHEMA_1_2 => 'http://cyclonedx.org/schema/bom-1.2b.schema.json';
use constant JSON_SCHEMA_1_3 => 'http://cyclonedx.org/schema/bom-1.3a.schema.json';
use constant JSON_SCHEMA_1_4 => 'http://cyclonedx.org/schema/bom-1.4.schema.json';
use constant JSON_SCHEMA_1_5 => 'http://cyclonedx.org/schema/bom-1.5.schema.json';
use constant JSON_SCHEMA_1_6 => 'http://cyclonedx.org/schema/bom-1.6.schema.json';
use constant JSON_SCHEMA_1_7 => 'http://cyclonedx.org/schema/bom-1.7.schema.json';

our $VERSION = 1.08;

our %JSON_SCHEMA = (
    '1.2' => JSON_SCHEMA_1_2,
    '1.3' => JSON_SCHEMA_1_3,
    '1.4' => JSON_SCHEMA_1_4,
    '1.5' => JSON_SCHEMA_1_5,
    '1.6' => JSON_SCHEMA_1_6,
    '1.7' => JSON_SCHEMA_1_7
);

has bom_format => (is => 'ro', isa => Str, required => 1, default => 'CycloneDX');

has spec_version => (is => 'rw', isa => Num->where(sub { defined $JSON_SCHEMA{$_} }), required => 1, default => 1.7);

has serial_number => (
    is      => 'rw',
    isa     => StrMatch [qr{^urn:uuid:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$}],
    default => sub {urn_uuid}
);

has version => (is => 'rw', isa => Int, default => 1);

has metadata =>
    (is => 'rw', isa => InstanceOf ['SBOM::CycloneDX::Metadata'], default => sub { SBOM::CycloneDX::Metadata->new });

has components => (
    is      => 'rw',
    isa     => ArrayLike [InstanceOf ['SBOM::CycloneDX::Component']],
    default => sub { SBOM::CycloneDX::List->new }
);

has services => (
    is      => 'rw',
    isa     => ArrayLike [InstanceOf ['SBOM::CycloneDX::Service']],
    default => sub { SBOM::CycloneDX::List->new }
);

has external_references => (
    is      => 'rw',
    isa     => ArrayLike [InstanceOf ['SBOM::CycloneDX::ExternalReference']],
    default => sub { SBOM::CycloneDX::List->new }
);

has dependencies => (
    is      => 'rw',
    isa     => ArrayLike [InstanceOf ['SBOM::CycloneDX::Dependency']],
    default => sub { SBOM::CycloneDX::List->new }
);

has compositions => (
    is      => 'rw',
    isa     => ArrayLike [InstanceOf ['SBOM::CycloneDX::Composition']],
    default => sub { SBOM::CycloneDX::List->new }
);

has vulnerabilities => (
    is      => 'rw',
    isa     => ArrayLike [InstanceOf ['SBOM::CycloneDX::Vulnerability']],
    default => sub { SBOM::CycloneDX::List->new }
);

has annotations => (
    is      => 'rw',
    isa     => ArrayLike [InstanceOf ['SBOM::CycloneDX::Annotations']],
    default => sub { SBOM::CycloneDX::List->new }
);

has formulation => (
    is      => 'rw',
    isa     => ArrayLike [InstanceOf ['SBOM::CycloneDX::Formulation']],
    default => sub { SBOM::CycloneDX::List->new }
);

has declarations => (
    is      => 'rw',
    isa     => InstanceOf ['SBOM::CycloneDX::Declarations'],
    default => sub { SBOM::CycloneDX::Declarations->new }
);

has definitions => (
    is      => 'rw',
    isa     => InstanceOf ['SBOM::CycloneDX::Definitions'],
    default => sub { SBOM::CycloneDX::Definitions->new }
);

has citations => (
    is      => 'rw',
    isa     => ArrayLike [InstanceOf ['SBOM::CycloneDX::Citation']],
    default => sub { SBOM::CycloneDX::List->new }
);

has properties => (
    is      => 'rw',
    isa     => ArrayLike [InstanceOf ['SBOM::CycloneDX::Property']],
    default => sub { SBOM::CycloneDX::List->new }
);

# TODO  JSF (JSON Signature Format)
has signature => (is => 'rw', isa => HashRef, default => sub { {} });


sub validate { SBOM::CycloneDX::Schema->new(bom => shift)->validate }

sub add_dependency {

    my ($self, $target, $depends_on) = @_;

    my $target_ref      = $target->bom_ref;
    my @depends_on_refs = map { $_->bom_ref } @{$depends_on};

    my $exists = 0;

    foreach my $dependency ($self->dependencies->each) {

        next unless $dependency->ref eq $target_ref;

        $exists = 1;

        # TODO
        my @old_refs = @{$dependency->depends_on};
        push @old_refs, @depends_on_refs;
        my @new_refs = uniq(@old_refs);

        $dependency->depends_on(\@new_refs);

    }

    if (not $exists) {
        $self->dependencies->push(
            SBOM::CycloneDX::Dependency->new(ref => $target_ref, depends_on => \@depends_on_refs));
    }

    # Add empty dependency entry if not exists "ref"
    $self->add_dependency($_, []) for (@{$depends_on});

}

sub get_component_by_purl {

    my ($self, $purl) = @_;

    foreach my $component (@{$self->components}) {
        return $component if ($component->purl && $component->purl eq $purl);
    }

}

sub get_component_by_bom_ref {

    my ($self, $bom_ref) = @_;

    foreach my $component (@{$self->components}) {
        return $component if ($component->bom_ref && $component->bom_ref eq $bom_ref);
    }

}

sub get_vulnerabilities_for_bom_ref {

    my ($self, $bom_ref) = @_;

    my $list = SBOM::CycloneDX::List->new;

    foreach my $vulnerability (@{$self->vulnerabilities}) {
        foreach my $affect (@{$vulnerability->affects}) {
            $list->add($vulnerability) if $affect->ref eq $bom_ref;
        }
    }

    return $list;

}

sub get_affected_components_by_cve {

    my ($self, $cve_id) = @_;

    my $list = SBOM::CycloneDX::List->new;

    foreach my $vulnerability (@{$self->vulnerabilities}) {
        if ($vulnerability->id eq $cve_id) {
            foreach my $affect (@{$vulnerability->affects}) {
                $list->add($self->get_component_by_bom_ref($affect->ref));
            }
        }
    }

    return $list;

}

sub TO_JSON {

    my $self = shift;

    my $spec_version = $self->spec_version;
    my $schema       = $JSON_SCHEMA{$spec_version};

    my $json = {bomFormat => $self->bom_format, specVersion => "$spec_version"};

    if ($spec_version > 1.5) {
        $json->{'$schema'} = $schema;
    }

    $json->{serialNumber}       = $self->serial_number       if $self->serial_number;
    $json->{version}            = $self->version             if $self->version;
    $json->{metadata}           = $self->metadata            if %{$self->metadata->TO_JSON};
    $json->{components}         = $self->components          if @{$self->components};
    $json->{services}           = $self->services            if @{$self->services};
    $json->{externalReferences} = $self->external_references if @{$self->external_references};
    $json->{dependencies}       = $self->dependencies        if @{$self->dependencies};
    $json->{compositions}       = $self->compositions        if @{$self->compositions};
    $json->{vulnerabilities}    = $self->vulnerabilities     if @{$self->vulnerabilities};
    $json->{annotations}        = $self->annotations         if @{$self->annotations};
    $json->{formulation}        = $self->formulation         if @{$self->formulation};
    $json->{declarations}       = $self->declarations        if %{$self->declarations->TO_JSON};
    $json->{definitions}        = $self->definitions         if %{$self->definitions->TO_JSON};
    $json->{citations}          = $self->citations           if @{$self->citations};
    $json->{properties}         = $self->properties          if @{$self->properties};
    $json->{signature}          = $self->signature           if %{$self->signature};

    return $json;

}


1;

__END__