[WIP] CycloneDX v2.0 Specification

[stevespringett]

Important

WORK IN PROGRESS
see Milestone for progress: https://github.com/CycloneDX/specification/milestone/2

---

BREAKING Changes

• Drop schema for XML.
  To be explained further.
• Drop schema for Protocol Buffers
  Reasoning: Downstream spec users may build ontop of JSON schema.
  To be explained further.

... TBC ...

Added

... TBD ...

Chaned

... TBD ...

Removed

... TBD ...

Misc

... TBD ...

---

• fixes CycloneDX 2.0 #631

The best fix is to validate CLI-supplied paths against an explicit trusted base directory before any filesystem access. Keep current behavior (accept relative or absolute inputs) but enforce that both modelsDirectory and rootSchemaPath resolve inside a chosen safe root (here: process.cwd(), which is a sensible default for CLI execution). This prevents path traversal / arbitrary path targeting while preserving normal usage from project root.

In tools/src/main/js/bundler/bundle-schemas.js, update bundleSchemas so that:

1. Compute safeRoot = path.resolve(process.cwd()).
2. Resolve both inputs relative to that root: path.resolve(safeRoot, input).
3. Add a helper check that ensures resolved paths are within safeRoot using path.relative and rejecting absolute/outside results.
4. Throw a clear error before calling fs.access if validation fails.

No new dependencies are required; use built-in path utilities only.

To fix this safely without changing intended behavior too much, validate that the user-provided rootSchemaPath resolves to a file inside the provided modelsDirectory (the natural safe root in this script). Keep path.resolve, then add a containment check using path.relative (safer than naive startsWith for cross-platform behavior). Reject any path that is outside the models directory or resolves to a different drive/root on Windows.

Concrete changes in tools/src/main/js/bundler/bundle-schemas.js:

1. In bundleSchemas right after:
   • const absoluteModelsDir = path.resolve(modelsDirectory);
   • const absoluteRootPath = path.resolve(rootSchemaPath);
2. Add:
   • const relativeRootToModels = path.relative(absoluteModelsDir, absoluteRootPath);
   • guard that throws if relativeRootToModels starts with '..', is absolute, or (optionally) equals '' (directory itself).
3. Keep existing fs.access checks after validation.

No new imports or dependencies are needed; path is already imported.

The best fix is to constrain both CLI-provided paths to a trusted root directory after normalization, and reject anything outside that root.
In this file, a practical trusted root is process.cwd() for CLI execution (current project/workspace). This preserves existing behavior for normal relative project paths, while blocking unexpected absolute/out-of-tree paths.

What to change

In tools/src/main/js/bundler/bundle-schemas.js, inside bundleSchemas(...) right after:

• const absoluteModelsDir = path.resolve(modelsDirectory);
• const absoluteRootPath = path.resolve(rootSchemaPath);

add:

1. A trustedRoot derived from path.resolve(process.cwd()).
2. A helper check using path.relative(trustedRoot, candidate) to ensure candidate is inside root.
3. Throw an error if either resolved path is outside trusted root.

This avoids relying on string prefix tricks and works cross-platform.

No new dependencies are required.

Use a safe-root containment check for user-provided paths before any filesystem operations. The best fix here is to define an allowed base directory (current working directory is a practical default for this CLI), normalize both CLI paths with path.resolve, then reject execution unless both resolved paths stay inside that base. Also use fs.realpath to canonicalize symlinks before the containment check to avoid symlink traversal bypasses.

Concretely in tools/src/main/js/bundler/bundle-schemas.js:

• In bundleSchemas(...) near lines 182–187, after resolving input paths, add:
  • const allowedBaseDir = path.resolve(process.cwd());
  • a small helper to test containment safely.
  • await fs.realpath(...) for both absoluteModelsDir and absoluteRootPath.
  • throw an error if either canonical path is outside allowedBaseDir.
• Keep existing behavior otherwise (same outputs, same schema processing), only adding validation gates before readdir/readFile.

No new dependency is required.

To fix this without changing intended functionality, constrain user-provided paths to a safe base directory (current working directory) after canonicalization. Specifically:

• In bundleSchemas, canonicalize modelsDirectory and rootSchemaPath with path.resolve.
• Canonicalize a trusted base root (e.g., process.cwd()).
• Verify both resolved paths are within that base root using path.relative(...) and reject paths that escape (.. prefix or absolute relative result).
• Keep existing fs.access checks and subsequent logic unchanged.

This is the safest minimal change in tools/src/main/js/bundler/bundle-schemas.js around lines 180–188, requiring no new dependencies and preserving current behavior for normal in-repo usage.

To fix this safely without changing intended functionality, validate that output paths remain within an allowed base directory derived from the provided models directory.
General approach: normalize paths, compute candidate output paths, then enforce containment using path.relative (or prefix checks on normalized absolute paths) before writing files.

Best concrete fix in tools/src/main/js/bundler/bundle-schemas.js:

• In bundleSchemas, after resolving absoluteModelsDir and absoluteRootPath, compute allowedOutputRoot = absoluteModelsDir.
• Validate absoluteRootPath is inside allowedOutputRoot (prevents choosing a root schema outside safe workspace).
• After computing bundledPath and minifiedPath, validate each is still within allowedOutputRoot.
• If validation fails, throw an error and abort.
• No new dependency is required; use built-in path.relative.

This keeps existing behavior for valid inputs while preventing path traversal / arbitrary write locations.

The best fix is to enforce that all computed output paths remain inside the normalized models directory (safe root), and reject execution otherwise. This preserves existing functionality for valid inputs while preventing path traversal / arbitrary write locations from user-provided rootSchemaPath.

In tools/src/main/js/bundler/bundle-schemas.js, inside bundleSchemas(...) right after computing bundledPath and minifiedPath, add a containment check:

1. Normalize the trusted root with a trailing separator (e.g., absoluteModelsDir + path.sep).
2. Normalize candidate output paths with path.resolve(...).
3. Verify each output path is either exactly the root directory or starts with the root+separator.
4. Throw an error if either path escapes the root.

This requires no new dependency and no import changes.

The best fix is to constrain all file operations to a trusted base directory, then verify normalized paths remain inside that base before read/write. Here, the natural trusted root is modelsDirectory (already a required input and intended schema workspace). Keep existing behavior, but add a containment check after resolving paths:

1. Resolve and normalize:

   • absoluteModelsDir = path.resolve(modelsDirectory)
   • absoluteRootPath = path.resolve(rootSchemaPath)

2. Enforce absoluteRootPath is inside absoluteModelsDir using path.relative:

   • reject if relativePath is absolute or starts with ..

3. Build output paths and re-check containment for bundledPath and minifiedPath the same way before writing.

This change should be made in tools/src/main/js/bundler/bundle-schemas.js within bundleSchemas(...), near lines 182–201, adding a small helper function in the same file (above bundleSchemas) to avoid duplicate logic.

To fix this safely without changing intended functionality, validate that the computed output files remain within the same directory as the resolved root schema path before writing/stat-ing them. In general: resolve and normalize all relevant paths, then enforce a root boundary check using path.relative (or equivalent) to reject traversal/out-of-root targets.

Best fix in this file:

• In bundleSchemas (around lines 200–201 where bundledPath and minifiedPath are built), compute resolved output paths and verify both are contained in rootSchemaDir.
• Add a small helper function (near existing helpers) to check directory containment robustly:
  • const relative = path.relative(baseDir, candidatePath)
  • Reject if relative is empty? (empty is fine for same path), starts with .., or path.isAbsolute(relative).
• Throw an error if validation fails, before any file write/read on those paths.
• Keep existing behavior (outputs next to root schema) intact.

No new dependencies are needed.

[jkowalleck]

MIT? not Apache-2.0 with NOTICE file?