GO-2025-3767: OSV-SCALIBR's Container Image Unpacking Vulnerable to Arbitrary File Write via Path Traversal in github.com/google/osv-scalibr

cdx

package

v0.1.6 Latest Latest Go to latest Published: Feb 5, 2025 License: Apache-2.0 Imports: 11 Imported by: 2

Details

Package cdx extracts software dependencies from an CycloneDX SBOM.

This section is empty.

This section is empty.

This section is empty.

type Extractor struct{}

Extractor extracts software dependencies from an CycloneDX SBOM.

func (Extractor) Ecosystem(i *extractor.Inventory) string

Ecosystem returns the OSV Ecosystem of the software extracted by this extractor.

func (e Extractor) Extract(ctx context.Context, input *filesystem.ScanInput) ([]*extractor.Inventory, error)

Extract parses the CycloneDX SBOM and returns a list purls from the SBOM.

func (e Extractor) FileRequired(api filesystem.FileAPI) bool

FileRequired returns true if the specified file is a supported cdx file.

func (e Extractor) Name() string

Name of the extractor.

func (e Extractor) Requirements() *plugin.Capabilities

Requirements of the extractor.

func (e Extractor) ToPURL(i *extractor.Inventory) *purl.PackageURL

ToPURL converts an inventory created by this extractor into a PURL.

func (e Extractor) Version() int

Version of the extractor.

type Metadata struct {
	PURL *purl.PackageURL
	CPEs []string
}

Metadata holds parsing information for packages extracted from CDX files.