[WIP] CycloneDX v2.0 Specification

[stevespringett]

Important

WORK IN PROGRESS
see Milestone for progress: https://github.com/CycloneDX/specification/milestone/2

---

BREAKING Changes

• Drop schema for XML.
  To be explained further.
• Drop schema for Protocol Buffers
  Reasoning: Downstream spec users may build ontop of JSON schema.
  To be explained further.

... TBC ...

Added

... TBD ...

Chaned

... TBD ...

Removed

... TBD ...

Misc

... TBD ...

---

• fixes CycloneDX 2.0 #631

General fix: validate user-controlled path inputs against a strict policy before using them in filesystem APIs. For this script, the least disruptive and most practical policy is: only allow paths that resolve under the current working directory (project workspace), and reject anything outside it.

Best fix in this file:

1. Add a helper that resolves a user input path against process.cwd(), then verifies the resolved path is inside that base directory (or equal to it).
2. Use that helper for both modelsDirectory and rootSchemaPath in the CLI block before calling bundleSchemas.
3. Keep bundleSchemas behavior unchanged; only sanitize/validate at the trust boundary (CLI parsing).
4. Reuse existing isInsideDir helper to avoid unnecessary new dependencies.

Edits are only in tools/src/main/js/bundler/bundle-schemas.js:

• Add resolveCliPathWithinCwd(...) helper after isInsideDir.
• In CLI section, resolve and validate both args, handle invalid input with a clear error + process.exit(1).
• Pass validated absolute paths to bundleSchemas.

The best fix is to validate and constrain rootSchemaPath to a safe root before using it in filesystem operations. In this file, the natural safe root is modelsDirectory (already resolved as absoluteModelsDir). Keep existing behavior as much as possible by:

1. Resolving both paths to absolute normalized paths.
2. Verifying absoluteRootPath is equal to or inside absoluteModelsDir.
3. Failing fast with a clear error if it is outside.

Concretely in tools/src/main/js/bundler/bundle-schemas.js:

• Add a helper that allows “inside-or-equal” directory checks (current isInsideDir rejects equality).
• In bundleSchemas, right after resolving absoluteModelsDir/absoluteRootPath and before fs.access, enforce that root schema is contained within models directory.
• Throw an error when invalid. This preserves core functionality (bundling schemas from provided model directory) while preventing path traversal / arbitrary file access via CLI input.

To fix this safely without changing core functionality, validate that both CLI-provided paths stay within an expected safe base directory (the current working directory is a practical default for this script). Keep normalization via path.resolve, then enforce containment with the existing isInsideDir helper (plus equality check to allow the base dir itself). Reject paths outside the safe root before any filesystem access.

Best concrete fix in this file:

• In bundleSchemas (around lines 196–202), after resolving absoluteModelsDir/absoluteRootPath, compute safeRootDir = path.resolve(process.cwd()).
• Check both resolved paths are either equal to safeRootDir or inside it.
• Throw an error if validation fails.
• This introduces no new dependencies/imports and uses existing helper logic.

To fix this without changing intended functionality, validate that both user-provided paths are inside an expected safe root (the current working directory), after normalization. Then, when constructing per-file paths from readdir, resolve and re-check each candidate path stays within the validated models directory before reading.

Best concrete fix in tools/src/main/js/bundler/bundle-schemas.js:

1. Add a helper that normalizes and validates a user path against a base directory (using path.resolve + isInsideDir / equality check).
2. In bundleSchemas, derive safeRootDir = path.resolve(process.cwd()).
3. Replace direct path.resolve(modelsDirectory/rootSchemaPath) with validated absolute paths from the helper.
4. In the schema loop, use path.resolve(absoluteModelsDir, file) and skip anything that escapes absoluteModelsDir (defense in depth).
5. Keep behavior otherwise unchanged.

No new dependencies are required.

Best fix: enforce a safe root directory boundary for both modelsDirectory and rootSchemaPath before any filesystem read/list operations. General approach: canonicalize candidate paths and root path, then verify candidate is inside root; reject otherwise.

In tools/src/main/js/bundler/bundle-schemas.js:

1. Add a helper that resolves symlinks/canonical paths via fs.realpath and checks containment with existing isInsideDir (plus equality allowance where appropriate).
2. In bundleSchemas, after resolving input paths and before fs.access/readFile/readdir, compute a trusted base (here: process.cwd()), canonicalize it, and validate:
   • absoluteModelsDir must be inside base dir.
   • absoluteRootPath must be inside base dir.
3. Throw an explicit error when validation fails.

This preserves existing functionality for normal project-relative usage while blocking traversal to unexpected filesystem locations.

To fix this without changing intended functionality, validate that rootSchemaPath is inside the provided modelsDirectory before deriving output paths and writing files. In general, when user input influences filesystem paths, resolve both paths to absolute canonical form and enforce a containment rule (safe root directory).

Best fix in this file:

• In bundleSchemas(...), after resolving/access checks and before using rootSchemaDir/bundledPath, add a guard:
  • Ensure absoluteRootPath is equal to absoluteModelsDir or is inside it (isInsideDir(absoluteRootPath, absoluteModelsDir)).
  • If not, throw an error.
• This reuses the existing isInsideDir helper and preserves existing behavior for valid invocations while preventing writes outside the models tree.

No new imports or dependencies are required.

To fix this safely without changing intended behavior, validate that both user-provided paths are constrained to an expected safe root (the current working directory), after canonicalization. Specifically:

• In bundleSchemas, compute safeRoot = await fs.realpath(process.cwd()).
• Canonicalize user inputs:
  • absoluteModelsDir = await fs.realpath(path.resolve(modelsDirectory))
  • absoluteRootPath = await fs.realpath(path.resolve(rootSchemaPath))
• Enforce containment with the existing isInsideDir helper (plus equality check):
  • allow when candidate === safeRoot || isInsideDir(candidate, safeRoot)
  • reject otherwise with an error.
• Keep existing functionality (same outputs relative to provided schema path) for valid in-repo paths.

This requires edits only in tools/src/main/js/bundler/bundle-schemas.js, inside bundleSchemas near lines 196–201.

The safest fix without changing intended functionality is to enforce that both the input root schema and generated output files remain inside the provided models directory after canonicalization. This keeps current behavior (write beside root schema) for valid inputs, while blocking dangerous paths.

In tools/src/main/js/bundler/bundle-schemas.js, inside bundleSchemas:

1. Canonicalize modelsDirectory and rootSchemaPath with fs.realpath(...) after path.resolve(...).
2. Validate absoluteRootPath is inside absoluteModelsDir (or equal to it if desired policy; here we require “inside” as existing helper does).
3. Build output paths as today, then canonicalize their parent dirs (fs.realpath(path.dirname(...))) and reconstruct canonical target paths.
4. Validate canonical output targets are inside canonical models dir before writing.
5. Throw explicit errors when checks fail.

No new dependency is required; existing path, fs.promises, and existing isInsideDir helper are sufficient.

The safest fix without changing intended functionality is to enforce that both input paths stay within an approved base directory (current working directory is a practical default), and to validate output paths as well before writing.

In tools/src/main/js/bundler/bundle-schemas.js:

• Add a helper to safely resolve a candidate path under a base directory and reject escapes.
• In bundleSchemas, resolve modelsDirectory and rootSchemaPath via that helper instead of raw path.resolve(...).
• After constructing bundledPath and minifiedPath, verify both remain inside the same safe base before any write/stat operations.
• Keep behavior intact for normal valid project-local usage; only reject traversal/outside-base paths with a clear error.

No new dependency is required; existing path utilities and the existing isInsideDir helper are sufficient.