[K9VULN-2465] Add validation of package names

src/commands/sbom/__tests__/validation.test.ts

@@ -1,4 +1,10 @@
-import {getValidator, validateFileAgainstToolRequirements, validateSbomFileAgainstSchema} from '../validation'
+import {DependencyLanguage} from '../types'
+import {
+  getValidator,
+  validateDependencyName,
+  validateFileAgainstToolRequirements,
+  validateSbomFileAgainstSchema,
+} from '../validation'
 
 const validator = getValidator()
 
@@ -70,4 +76,58 @@ describe('validation of sbom file', () => {
     ).toBeFalsy()
     expect(validateFileAgainstToolRequirements('./src/commands/sbom/__tests__/fixtures/random-data', true)).toBeFalsy()
   })
+  test('should have valid package name', () => {
+    expect(
+      validateDependencyName({
+        name: 'foo bar',
+        language: DependencyLanguage.PYTHON,
+        version: undefined,
+        group: undefined,
+        licenses: [],
+        purl: '',
+        locations: [],
+        is_direct: undefined,
+        package_manager: 'pypi',
+      })
+    ).toBeFalsy()
+    expect(
+      validateDependencyName({
+        name: 'foobar',
+        language: DependencyLanguage.PYTHON,
+        version: undefined,
+        group: undefined,
+        licenses: [],
+        purl: '',
+        locations: [],
+        is_direct: undefined,
+        package_manager: 'pypi',
+      })
+    ).toBeTruthy()
+    expect(
+      validateDependencyName({
+        name: 'py',
+        language: DependencyLanguage.PYTHON,
+        version: undefined,
+        group: undefined,
+        licenses: [],
+        purl: '',
+        locations: [],
+        is_direct: undefined,
+        package_manager: 'pypi',
+      })
+    ).toBeTruthy()
+    expect(
+      validateDependencyName({
+        name: 'rx',
+        language: DependencyLanguage.PYTHON,
+        version: undefined,
+        group: undefined,
+        licenses: [],
+        purl: '',
+        locations: [],
+        is_direct: undefined,
+        package_manager: 'pypi',
+      })
+    ).toBeTruthy()
+  })
 })

src/commands/sbom/payload.ts

@@ -105,6 +105,7 @@ export const generatePayload = (
 
         if (component['type'] === 'library') {
           const dependency = extractingDependency(component)
+
           if (dependency !== undefined) {
             dependencies.push(dependency)
           }

src/commands/sbom/renderer.ts

@@ -2,6 +2,9 @@ import chalk from 'chalk'
 
 import {getBaseUrl} from '../junit/utils'
 
+import {Dependency} from './types'
+import {validateDependencyName} from './validation'
+
 const ICONS = {
   FAILED: '❌',
   SUCCESS: '✅',
@@ -74,3 +77,15 @@ export const renderSuccessfulCommand = (duration: number) => {
 
   return fullStr
 }
+
+export const renderPayloadWarning = (dependencies: Dependency[]): string => {
+  let ret = ''
+
+  for (const dep of dependencies) {
+    if (!validateDependencyName(dep)) {
+      ret += `invalid dependency name ${dep.name}\n`
+    }
+  }
+
+  return ret
+}

src/commands/sbom/upload.ts

@@ -20,6 +20,7 @@ import {
   renderInvalidFile,
   renderInvalidPayload,
   renderNoDefaultBranch,
+  renderPayloadWarning,
   renderSuccessfulCommand,
   renderUploading,
 } from './renderer'
@@ -130,12 +131,16 @@ export class UploadSbomCommand extends Command {
     // Upload content
     try {
       const scaPayload = generatePayload(jsonContent, tags, service, environment)
+
       if (!scaPayload) {
         this.context.stdout.write(renderInvalidPayload(basePath))
 
         return 1
       }
+      this.context.stdout.write(renderPayloadWarning(scaPayload.dependencies))
+
       this.context.stdout.write(renderUploading(basePath))
+
       await api(scaPayload)
       if (this.debug) {
         this.context.stdout.write(`Upload done for ${basePath}.\n`)

src/commands/sbom/validation.ts

@@ -8,6 +8,7 @@ import cycloneDxSchema14 from './json-schema/cyclonedx/bom-1.4.schema.json'
 import cycloneDxSchema15 from './json-schema/cyclonedx/bom-1.5.schema.json'
 import jsfSchema from './json-schema/jsf/jsf-0.82.schema.json'
 import spdxSchema from './json-schema/spdx/spdx.schema.json'
+import {Dependency, DependencyLanguage} from './types'
 
 /**
  * Get the validate function. Read all the schemas and return
@@ -147,3 +148,13 @@ export const validateFileAgainstToolRequirements = (path: string, debug: boolean
 
   return true
 }
+
+const pythonPackaNameRegex = new RegExp('^[a-zA-Z0-9][a-zA-Z0-9\\-_.]*[a-zA-Z0-9]$')
+
+export const validateDependencyName = (dependency: Dependency): boolean => {
+  if (dependency.language === DependencyLanguage.PYTHON && !pythonPackaNameRegex.test(dependency.name)) {
+    return false
+  }
+
+  return true
+}