fix:GH-1502 name root from package json

CycloneDX · Dec 18, 2024 · d9ca0f7 · d9ca0f7
1 parent bc98665
commit d9ca0f7
Showing 1 changed file with 20 additions and 2 deletions.
diff --git a/lib/cli/index.js b/lib/cli/index.js
@@ -2537,9 +2537,27 @@ export async function createNodejsBom(path, options) {
       // Parse package-lock.json if available
       const parsedList = await parsePkgLock(f, options);
       const dlist = parsedList.pkgList;
-      const tmpParentComponent = dlist.splice(0, 1)[0] || {};
-      tmpParentComponent.type = "application";
+      let tmpParentComponent = dlist.splice(0, 1)[0] || {};
       if (!Object.keys(parentComponent).length) {
+          const basePath = dirname(f);
+          const packageJsonF = join(basePath, "package.json");
+          if (existsSync(packageJsonF)) {
+              const pcs = await parsePkgJson(packageJsonF, true);
+              if (pcs.length) {
+                  tmpParentComponent = pcs[0];
+                  tmpParentComponent.type = "application";
+                  ppurl = new PackageURL(
+                      "npm",
+                      options.projectGroup || tmpParentComponent.group,
+                      "project-name" in options ? options.projectName : tmpParentComponent.name,
+                      options.projectVersion || tmpParentComponent.version,
+                      null,
+                      null,
+                  ).toString();
+                  tmpParentComponent["bom-ref"] = decodeURIComponent(ppurl);
+                  tmpParentComponent["purl"] = ppurl;
+              }
+          }
         parentComponent = tmpParentComponent;
       } else {
         parentSubComponents.push(tmpParentComponent);