GO-2025-3767: OSV-SCALIBR's Container Image Unpacking Vulnerable to Arbitrary File Write via Path Traversal in github.com/google/osv-scalibr

spdx

package

v0.1.7 Latest Latest Go to latest Published: Mar 13, 2025 License: Apache-2.0 Imports: 15 Imported by: 1

Details

Package spdx extracts software dependencies from an SPDX SBOM.

View Source

const (
	// Name is the unique name of this extractor.
	Name = "sbom/spdx"
)

This section is empty.

func New() filesystem.Extractor

New returns a new instance of the extractor.

type Extractor struct{}

Extractor extracts software dependencies from an spdx SBOM.

func (Extractor) Ecosystem(i *extractor.Inventory) string

Ecosystem returns the OSV Ecosystem of the software extracted by this extractor.

func (e Extractor) Extract(ctx context.Context, input *filesystem.ScanInput) ([]*extractor.Inventory, error)

Extract parses the SPDX SBOM and returns a list purls from the SBOM.

func (e Extractor) FileRequired(api filesystem.FileAPI) bool

FileRequired returns true if the specified file is a supported spdx file.

func (e Extractor) Name() string

Name of the extractor.

func (e Extractor) Requirements() *plugin.Capabilities

Requirements of the extractor.

func (e Extractor) ToPURL(i *extractor.Inventory) *purl.PackageURL

ToPURL converts an inventory created by this extractor into a PURL.

func (e Extractor) Version() int

Version of the extractor.

type Metadata struct {
	PURL *purl.PackageURL
	CPEs []string
}

Metadata holds parsing information for packages extracted from SPDX files.