GO-2025-3767: OSV-SCALIBR's Container Image Unpacking Vulnerable to Arbitrary File Write via Path Traversal in github.com/google/osv-scalibr

cdx

package

v0.2.0 Latest Latest Go to latest Published: Apr 23, 2025 License: Apache-2.0 Imports: 12 Imported by: 2

Details

Package cdx extracts software dependencies from an CycloneDX SBOM.

View Source

const (
	// Name is the unique name of this extractor.
	Name = "sbom/cdx"
)

This section is empty.

func New() filesystem.Extractor

New returns a new instance of the extractor.

type Extractor struct{}

Extractor extracts software dependencies from an CycloneDX SBOM.

func (Extractor) Ecosystem(p *extractor.Package) string

Ecosystem returns the OSV Ecosystem of the software extracted by this extractor.

func (e Extractor) Extract(ctx context.Context, input *filesystem.ScanInput) (inventory.Inventory, error)

Extract parses the CycloneDX SBOM and returns a list purls from the SBOM.

func (e Extractor) FileRequired(api filesystem.FileAPI) bool

FileRequired returns true if the specified file is a supported cdx file.

func (e Extractor) Name() string

Name of the extractor.

func (e Extractor) Requirements() *plugin.Capabilities

Requirements of the extractor.

func (e Extractor) ToPURL(p *extractor.Package) *purl.PackageURL

ToPURL converts a package created by this extractor into a PURL.

func (e Extractor) Version() int

Version of the extractor.

type Metadata struct {
	PURL *purl.PackageURL
	CPEs []string
}

Metadata holds parsing information for packages extracted from CDX files.