.NET Framework - Incorrect version detection (AssemblyVersion instead of NuGet package version)

[Marlohn]

Description:
When scanning a .NET Framework 4.8 solution that uses packages.config, cdxgen reports the AssemblyVersion instead of the actual NuGet package version.

Example:

• Actual NuGet version: Newtonsoft.Json 13.0.3
• AssemblyVersion: 13.0.0.0 (constant for the whole 13.x line)
• BOM shows both, causing false positives in Dependency-Track. (Same issue also occurs with System.Text.Json)

Expected:

• cdxgen should report the NuGet package version from packages.config (or from the HintPath in the .csproj) when available, and not fall back to the AssemblyVersion if package version info exists.

Has anyone been through this and knows how to fix it?

[prabhu]

Could you share a sample project or attach some artefacts? Do you see any difference with '--deep' argument?

[setchy]

I've created an example demo.csproj to help demonstrate.

When running as cdxgen and cdxgen --deep, both resulting bom.json files are extracting the Assembly Metadata Version (from the include reference) and not the NuGet Package Version (from the hint path)

[prabhu]

This is added as a unit test now. Thank you!

[chadwjames]

I tested this issue locally and it was introduced with version 11.1.0. Version 11.0.10 doesn't have this issue. See attached bom files.
bom_11.0.10.json
bom_11.1.0.json

Example proj and package files:
CycloneRazorTest.csproj.txt
packages.config.txt

[prabhu]

@chadwjames Can you suggest some package names and versions that I should focus on for this sample?

Below is the new BOM from #2158

bom.json

[chadwjames]

Thank you. Specifically, the Microsoft.AspNet.Razor and RazorEngine packages were adding extra records to the BOM that contained the assembly versions of those components.

     "group": "",
      "name": "RazorEngine",
      "version": "3.10.0.0",
      "purl": "pkg:nuget/[email protected]",
      "type": "library",
      "bom-ref": "pkg:nuget/[email protected]",

[prabhu]

Thank you. Can you retest with master?

[chadwjames]

master works! Thanks for fixing this. See attached bom files for comparason.
command:
node bin/cdxgen.js -o .\bom_master.json --required-only --no-babel ..\CycloneRazorTest
bom_master.json
bom_11.5.0.json

[prabhu]

Thank you for the wonderful test cases! Working on a fix PR here.