[WIP] CycloneDX v2.0 Specification

[stevespringett]

Important

WORK IN PROGRESS
see Milestone for progress: https://github.com/CycloneDX/specification/milestone/2

---

BREAKING Changes

• Drop schema for XML.
  To be explained further.
• Drop schema for Protocol Buffers
  Reasoning: Downstream spec users may build ontop of JSON schema.
  To be explained further.

... TBC ...

Added

... TBD ...

Chaned

... TBD ...

Removed

... TBD ...

Misc

... TBD ...

---

• fixes CycloneDX 2.0 #631

General fix: constrain user-provided paths to an approved root, after normalization, and reject inputs outside that root. For this script, the least disruptive fix is to define a trusted base directory (current working directory), resolve both modelsDirectory and rootSchemaPath against it, then verify both resolved paths are inside that base before any filesystem access.

Best concrete change in tools/src/main/js/bundler/bundle-schemas.js:

• In bundleSchemas(...), after resolving paths, add containment checks using path.relative.
• Reject absolute user inputs early (optional but helpful) and reject any resolved path that escapes the base (.. prefix or absolute relative result).
• Keep behavior otherwise unchanged (same arguments, same outputs), but fail fast with a clear error on unsafe paths.

No new dependencies are needed; use existing path module only.

Use a safe-root confinement check for CLI-provided paths before filesystem operations.
Best approach here: resolve a trusted base directory (the current working directory), resolve both user inputs relative to it, and reject paths that escape that base. This preserves existing behavior for normal relative inputs while blocking traversal/out-of-scope absolute paths.

In tools/src/main/js/bundler/bundle-schemas.js:

1. Add a helper isPathWithinBase(baseDir, targetPath) near utility functions.
2. In bundleSchemas, resolve safeBaseDir = path.resolve(process.cwd()).
3. Resolve both modelsDirectory and rootSchemaPath against safeBaseDir.
4. Validate both resolved paths are within safeBaseDir; throw an error if not.
5. Keep existing fs.access checks and downstream behavior unchanged.

No extra package is required; Node path is already imported.

The best fix is to validate and constrain user-provided paths to an expected safe root before using them in filesystem operations. Here, keep existing functionality but require both modelsDirectory and rootSchemaPath to remain inside the current working directory tree (project context), after canonicalization.

In tools/src/main/js/bundler/bundle-schemas.js:

1. Add a helper that:
   • resolves the candidate path against a trusted base (process.cwd()),
   • canonicalizes with fs.realpath (to handle symlinks),
   • verifies the result is under the trusted base using path.relative checks.
2. In bundleSchemas, replace direct path.resolve(...) assignments with calls to this helper for both inputs.
3. Keep existing behavior otherwise (still checks existence, still generates outputs in root schema dir).

This addresses the flagged sink at line 207 because absoluteModelsDir is no longer uncontrolled; it is normalized and containment-checked.

To fix this safely without changing intended functionality, validate and constrain all file reads to a canonical trusted base directory derived from the provided modelsDirectory, and verify each resolved file path stays within that base before reading.

Best approach in this file:

1. Canonicalize modelsDirectory once using fs.realpath(...) after existence check.
2. For every file from readdir, resolve and canonicalize the file path (path.resolve + fs.realpath).
3. Enforce containment: ensure canonical file path is inside canonical models directory using path.relative(...) checks.
4. Skip or reject entries that escape the directory (including symlink traversal).
5. Use the validated canonical path in fs.readFile.

This keeps behavior the same for valid schema directories, but blocks path traversal/symlink escape scenarios and satisfies the CodeQL concern.

To fix this without changing intended functionality, validate and constrain both CLI-supplied paths (modelsDirectory, rootSchemaPath) to a known safe root (the current working directory is a practical default for this script). Use path.resolve to normalize, then enforce that resolved targets are within the resolved safe root using path.relative (safer than naive startsWith, especially across platforms). Reject paths that resolve outside the safe root or to different drive roots (Windows).

In tools/src/main/js/bundler/bundle-schemas.js:

1. Add a helper isPathInside(parent, child) near utility functions.
2. In bundleSchemas, define safeRoot = path.resolve(process.cwd()).
3. Resolve user inputs relative to safeRoot and validate both with isPathInside.
4. Throw an error before any filesystem access if validation fails.

No new dependencies are required.

The safest fix without changing intended functionality is to constrain file writes to a trusted base directory, and reject any resolved output path outside that base.
In this file, a practical trusted base is the provided modelsDirectory (already an input and expected project scope). We should:

1. Resolve and canonicalize (fs.realpath) modelsDirectory early.
2. Resolve candidate output paths from rootSchemaDir.
3. Canonicalize the output directory and verify it is inside the canonical models directory using a robust prefix check (relative + absolute/path traversal checks).
4. Fail fast with an error if outside boundary.
5. Use the validated output paths for writeFile/stat.

Changes are confined to tools/src/main/js/bundler/bundle-schemas.js inside bundleSchemas near lines 182–201 and do not require external dependencies.

To fix this without changing intended functionality, validate that both user-provided paths resolve under an expected safe base directory (for this script, the current working directory is a practical default), and only then proceed. This keeps legitimate usage (paths inside repo/workspace) while blocking traversal/absolute-path abuse that targets unrelated filesystem locations.

In tools/src/main/js/bundler/bundle-schemas.js, inside bundleSchemas right after resolving paths (absoluteModelsDir, absoluteRootPath), add canonicalization (fs.realpath) and enforce containment with path.relative(...) checks. Then use the canonical paths for subsequent operations (dirname/basename, access, outputs). This addresses CodeQL’s taint-to-sink path by introducing explicit validation before bundledPath/minifiedPath are built and written.

To fix this without changing core functionality, validate that the computed output paths remain inside an approved root directory before writing. The most robust approach here is:

• Resolve and normalize a trusted root (use absoluteModelsDir since it is already validated and represents the schema workspace).
• Build candidate output paths as before.
• Canonicalize with path.resolve.
• Enforce containment using path.relative checks (relative !== '', not absolute, and no .. prefix).
• Throw an error if either output path escapes the safe root.

Apply this in tools/src/main/js/bundler/bundle-schemas.js inside bundleSchemas, immediately after generating bundledPath/minifiedPath (around lines 200–202) and before any writes. No new dependency is needed; path is already imported.

To fix this safely without changing intended functionality, constrain all file operations to a trusted root (the provided modelsDirectory) and reject rootSchemaPath values outside that root after canonicalization.

Best approach in this file:

1. Canonicalize both inputs with fs.realpath(...) after existence checks.
2. Verify:
   • canonical root schema path is inside canonical models directory
   • canonical root schema directory is inside canonical models directory
3. Build output paths from the canonical root schema directory.
4. Optionally normalize output paths with path.resolve(...) and re-check containment before write/stat for defense in depth.

Concretely, update bundleSchemas in tools/src/main/js/bundler/bundle-schemas.js around lines 182–201 to use realpath and containment checks (path.relative(...)-based check), and fail fast with a clear error if violated.