[WIP] CycloneDX v2.0 Specification

[stevespringett]

Important

WORK IN PROGRESS
see Milestone for progress: https://github.com/CycloneDX/specification/milestone/2

---

BREAKING Changes

• Drop schema for XML.
  To be explained further.
• Drop schema for Protocol Buffers
  Reasoning: Downstream spec users may build ontop of JSON schema.
  To be explained further.

... TBC ...

Added

... TBD ...

Chaned

... TBD ...

Removed

... TBD ...

Misc

... TBD ...

---

• fixes CycloneDX 2.0 #631

To fix this safely without changing intended functionality, validate that the provided rootSchemaPath is contained within the provided modulesDirectory (or within an expected safe root), after canonicalization. The most robust approach here is:

1. Resolve both input paths to absolute paths (path.resolve) — already done.
2. Canonicalize them with fs.realpath to collapse symlinks.
3. Enforce containment (root must be equal to or under modules directory) before any further filesystem use.
4. Fail fast with a clear error if validation fails.

This should be implemented in tools/src/main/js/bundler/bundle-schemas.js inside bundleSchemas, right after initial resolve/access and before using the root schema path further. Also slightly adjust isInsideDir so it treats the directory itself as “inside” (needed for robust boundary checks).

To fix this safely without changing intended behavior, validate and constrain all filesystem access to an allowed root directory after canonicalization (resolve symlinks), then ensure both:

1. modulesDirectory is under that safe root, and
2. every computed schemaPath is still inside the validated modules directory.

In tools/src/main/js/bundler/bundle-schemas.js, inside bundleSchemas:

• Canonicalize modulesDirectory and rootSchemaPath with fs.realpath(...) after fs.access(...).
• Derive a safe boundary directory (best fit here: current working directory via process.cwd() canonicalized).
• Reject paths not inside that boundary using existing isInsideDir(...) (extended to allow equality for directory checks).
• In the loop, canonicalize each schemaPath before reading and verify it is inside the canonical modules directory to prevent symlink escape.
  No new dependencies are needed.

To fix this safely without changing intended bundling behavior, validate that the resolved root schema path is inside an allowed base directory before using it. The best fit in this file is to constrain absoluteRootPath to the parent directory of absoluteModulesDir (which matches the shown CLI example layout: .../schema/<ver>/modules and .../schema/<ver>/root.schema.json).

What to change (tools/src/main/js/bundler/bundle-schemas.js):

1. In bundleSchemas, after computing absoluteModulesDir and absoluteRootPath, compute allowedRootBaseDir = path.dirname(absoluteModulesDir).
2. Use existing isInsideDir helper (plus equality check) to enforce:
   • absoluteRootPath === allowedRootBaseDir OR inside it.
3. Throw an error if validation fails, before any file access.
4. Keep all existing behavior otherwise unchanged.

No new dependency is required; existing path and helper function are sufficient.

To fix this without changing normal functionality, constrain all file writes to a trusted workspace root (here: modulesDirectory) and reject a rootSchemaPath that is outside that root.
Best approach in this file:

1. Compute canonical absolute paths for both modulesDirectory and rootSchemaPath using fs.realpath after existence checks (resolves symlinks too).
2. Enforce containment: ensure canonical root schema path is inside canonical modules directory (or equal to it if desired).
3. Build output paths from the canonical root schema directory and re-check the final output paths are inside canonical modules directory before writing.

This requires only edits in tools/src/main/js/bundler/bundle-schemas.js inside bundleSchemas, reusing existing isInsideDir helper and existing imports (fs, path).

To fix this without changing intended behavior, validate that:

1. rootSchemaPath is inside modulesDirectory (or at least within a defined safe root), and
2. generated output files (bundledPath, minifiedPath) are also inside that same safe root.

Best concrete fix in tools/src/main/js/bundler/bundle-schemas.js:

• Keep existing path.resolve.
• Add containment checks using the existing isInsideDir helper.
• Also allow equality for directory checks (because current helper returns false when paths are equal).
• Throw a clear error if any check fails before any file write/stat happens.

This preserves functionality for legitimate inputs while preventing traversal/out-of-scope writes.

Use a containment check to ensure all write targets remain under an approved base directory, and fail fast otherwise. The best minimal fix here is to enforce that rootSchemaPath is inside modulesDirectory (or at least that generated output paths are), then validate bundledPath and minifiedPath with the existing isInsideDir helper before any write.

In tools/src/main/js/bundler/bundle-schemas.js, inside bundleSchemas(...) after computing absolute paths and before generating/using output paths:

1. Ensure absoluteRootPath is under absoluteModulesDir (or equal if desired).
2. After creating bundledPath/minifiedPath, resolve them and verify they are inside absoluteModulesDir.
3. Throw an error if checks fail.

No new dependency is needed; reuse existing path and isInsideDir.

General fix: constrain user-controlled paths to a trusted base directory and reject any resolved path that escapes that base. Normalization alone is insufficient; enforce containment after resolve.

Best fix here without changing intended functionality too much:

• In bundleSchemas (around lines 196–205), derive a trusted base from modulesDirectory (already a required input), resolve rootSchemaPath relative to it, and reject if the resulting absolute path is not inside that base.
• Keep existing behavior for generating outputs next to root schema, but now guaranteed under trusted root.
• Use existing isInsideDir helper (already present) plus equality check for exact base match.
• No new dependencies needed.

Concretely in tools/src/main/js/bundler/bundle-schemas.js:

1. Replace current absoluteRootPath = path.resolve(rootSchemaPath) with:
   • absoluteModulesDir = path.resolve(modulesDirectory);
   • absoluteRootPath = path.resolve(absoluteModulesDir, rootSchemaPath);
   • containment check: absoluteRootPath === absoluteModulesDir || isInsideDir(absoluteRootPath, absoluteModulesDir)
   • throw on failure.
2. Leave downstream path construction unchanged.