Improve root dependency list for Gemfile.lock (#1409)

Signed-off-by: Prabhu Subramanian <[email protected]>

deno.json

@@ -1,6 +1,6 @@
 {
   "name": "@cyclonedx/cdxgen",
-  "version": "10.10.3",
+  "version": "10.10.4",
   "exports": "./lib/cli/index.js",
   "compilerOptions": {
     "allowJs": true,

jsr.json

@@ -1,6 +1,6 @@
 {
   "name": "@cyclonedx/cdxgen",
-  "version": "10.10.3",
+  "version": "10.10.4",
   "exports": "./lib/cli/index.js",
   "include": ["*.js", "lib/**", "bin/**", "data/**", "types/**"],
   "exclude": [

lib/helpers/utils.js

@@ -5517,7 +5517,7 @@ export async function parseGemfileLockData(gemLockData, lockFile) {
   const dependenciesMap = {};
   const pkgVersionMap = {};
   const pkgVersionPlatformMap = {};
-  const rootList = [];
+  const pkgNameRef = {};
   if (!gemLockData) {
     return pkgList;
   }
@@ -5577,6 +5577,9 @@ export async function parseGemfileLockData(gemLockData, lockFile) {
   let lastBranch = undefined;
   let lastTag = undefined;
   let lastParentPlatform = undefined;
+  // Dependencies block would begin with DEPENDENCIES
+  let dependenciesBlock = false;
+  const rootList = [];
   // In the second pass, we use the space in the prefix to figure out the dependency tree
   gemLockData.split("\n").forEach((l) => {
     l = l.replace("\r", "");
@@ -5596,6 +5599,11 @@ export async function parseGemfileLockData(gemLockData, lockFile) {
       lastTag = l.trim().split(" ")[1];
     }
     if (l.trim() === l.trim().toUpperCase()) {
+      if (l.trim() === "DEPENDENCIES") {
+        dependenciesBlock = true;
+        return;
+      }
+      dependenciesBlock = false;
       specsFound = false;
       lastRemote = undefined;
       lastRevision = undefined;
@@ -5670,7 +5678,6 @@ export async function parseGemfileLockData(gemLockData, lockFile) {
       const bomRef = decodeURIComponent(purlString);
       if (level === 1) {
         lastParent = bomRef;
-        rootList.push(bomRef);
       }
       const properties = [
         {
@@ -5737,11 +5744,17 @@ export async function parseGemfileLockData(gemLockData, lockFile) {
       if (!dependenciesMap[bomRef]) {
         dependenciesMap[bomRef] = new Set();
       }
+      pkgNameRef[name] = bomRef;
       // Allow duplicate packages if the version number includes platform
       if (!pkgnames[purlString]) {
         pkgList.push(apkg);
         pkgnames[purlString] = true;
       }
+    } else if (dependenciesBlock) {
+      const rootDepName = l.trim().split(" ")[0].replace("!", "");
+      if (pkgNameRef[rootDepName]) {
+        rootList.push(pkgNameRef[rootDepName]);
+      }
     }
   });
   for (const k of Object.keys(dependenciesMap)) {
@@ -5752,7 +5765,7 @@ export async function parseGemfileLockData(gemLockData, lockFile) {
   }
   if (FETCH_LICENSE) {
     pkgList = await getRubyGemsMetadata(pkgList);
-    return { pkgList, dependenciesList };
+    return { pkgList, dependenciesList, rootList };
   }
   return { pkgList, dependenciesList, rootList };
 }

lib/helpers/utils.test.js

@@ -3863,6 +3863,7 @@ test("parseGemfileLockData", async () => {
     "./test/data/Gemfile.lock",
   );
   expect(retMap.pkgList.length).toEqual(140);
+  expect(retMap.rootList.length).toEqual(42);
   expect(retMap.dependenciesList.length).toEqual(140);
   expect(retMap.pkgList[0]).toEqual({
     name: "actioncable",
@@ -3895,30 +3896,35 @@ test("parseGemfileLockData", async () => {
     "./test/data/Gemfile1.lock",
   );
   expect(retMap.pkgList.length).toEqual(36);
+  expect(retMap.rootList.length).toEqual(2);
   expect(retMap.dependenciesList.length).toEqual(36);
   retMap = await parseGemfileLockData(
     readFileSync("./test/data/Gemfile2.lock", { encoding: "utf-8" }),
     "./test/data/Gemfile2.lock",
   );
   expect(retMap.pkgList.length).toEqual(89);
+  expect(retMap.rootList.length).toEqual(2);
   expect(retMap.dependenciesList.length).toEqual(89);
   retMap = await parseGemfileLockData(
     readFileSync("./test/data/Gemfile4.lock", { encoding: "utf-8" }),
     "./test/data/Gemfile4.lock",
   );
   expect(retMap.pkgList.length).toEqual(182);
+  expect(retMap.rootList.length).toEqual(78);
   expect(retMap.dependenciesList.length).toEqual(182);
   retMap = await parseGemfileLockData(
     readFileSync("./test/data/Gemfile5.lock", { encoding: "utf-8" }),
     "./test/data/Gemfile5.lock",
   );
   expect(retMap.pkgList.length).toEqual(43);
+  expect(retMap.rootList.length).toEqual(11);
   expect(retMap.dependenciesList.length).toEqual(43);
   retMap = await parseGemfileLockData(
     readFileSync("./test/data/Gemfile6.lock", { encoding: "utf-8" }),
     "./test/data/Gemfile6.lock",
   );
   expect(retMap.pkgList.length).toEqual(139);
+  expect(retMap.rootList.length).toEqual(22);
   expect(retMap.dependenciesList.length).toEqual(139);
 });
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cyclonedx/cdxgen",
-  "version": "10.10.3",
+  "version": "10.10.4",
   "description": "Creates CycloneDX Software Bill of Materials (SBOM) from source or container image",
   "homepage": "http://github.com/cyclonedx/cdxgen",
   "author": "Prabhu Subramanian <[email protected]>",

types/lib/helpers/utils.d.ts

@@ -584,13 +584,6 @@ export function parseGemspecData(gemspecData: string): Promise<any[]>;
  * @param {string} lockFile Lock file
  */
 export function parseGemfileLockData(gemLockData: object, lockFile: string): Promise<any[] | {
-    pkgList: any[];
-    dependenciesList: {
-        ref: string;
-        dependsOn: any[];
-    }[];
-    rootList?: undefined;
-} | {
     pkgList: any[];
     dependenciesList: {
         ref: string;