Skip to content

Commit a279cdb

Browse files
cursoragentscript3r
cursoragent
and
script3r
committed
feat: Enhance algorithm detection and update fixtures
This commit improves the algorithm detection logic to consider multiple sources for parameter extraction. It also updates various fixtures with new UUIDs and algorithm definitions, including RSA, AES, ECDSA, and SHA-256, for better representation. Co-authored-by: script3r <[email protected]>
1 parent fa0ddb3 commit a279cdb

File tree

6 files changed

+335
-70
lines changed

6 files changed

+335
-70
lines changed

‎crates/cbom-generator/src/algorithm_detector.rs‎

Lines changed: 29 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -171,24 +171,37 @@ impl AlgorithmDetector {
171171
) -> Result<HashMap<String, serde_json::Value>> {
172172
let mut parameters = HashMap::new();
173173

174-
// Extract parameters from symbol
174+
// Try to extract parameters from multiple sources
175+
let sources = vec![&finding.symbol, &finding.snippet];
176+
175177
for param_pattern in &algorithm.parameter_patterns {
176-
if let Some(captures) = param_pattern.pattern.captures(&finding.symbol) {
177-
if let Some(value_match) = captures.get(1) {
178-
let value_str = value_match.as_str();
179-
180-
// Try to parse as number first, then as string
181-
let value = if let Ok(num) = value_str.parse::<u64>() {
182-
json!(num)
183-
} else {
184-
json!(value_str)
185-
};
186-
187-
parameters.insert(param_pattern.name.clone(), value);
178+
let mut found_value = false;
179+
180+
// Try each source (symbol, snippet) for parameter extraction
181+
for source in &sources {
182+
if let Some(captures) = param_pattern.pattern.captures(source) {
183+
if let Some(value_match) = captures.get(1) {
184+
let value_str = value_match.as_str();
185+
186+
// Try to parse as number first, then as string
187+
let value = if let Ok(num) = value_str.parse::<u64>() {
188+
json!(num)
189+
} else {
190+
json!(value_str)
191+
};
192+
193+
parameters.insert(param_pattern.name.clone(), value);
194+
found_value = true;
195+
break; // Found value, no need to check other sources
196+
}
197+
}
198+
}
199+
200+
// Use default value if pattern doesn't match any source
201+
if !found_value {
202+
if let Some(default) = &param_pattern.default_value {
203+
parameters.insert(param_pattern.name.clone(), default.clone());
188204
}
189-
} else if let Some(default) = &param_pattern.default_value {
190-
// Use default value if pattern doesn't match
191-
parameters.insert(param_pattern.name.clone(), default.clone());
192205
}
193206
}
194207

‎fixtures/c/openssl-mixed/mv-cbom.json‎

Lines changed: 25 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,14 @@
11
{
22
"bomFormat": "MV-CBOM",
33
"specVersion": "1.0",
4-
"serialNumber": "urn:uuid:f7699f6e-deb2-4df5-a35f-cdfc3e75fac2",
4+
"serialNumber": "urn:uuid:fc0dc0c3-dddc-4a08-9bb5-ec9e8c57513d",
55
"version": 1,
66
"metadata": {
77
"component": {
88
"name": "openssl-mixed",
99
"path": "/workspace/fixtures/c/openssl-mixed"
1010
},
11-
"timestamp": "2025-09-15T17:50:59.203450522Z",
11+
"timestamp": "2025-09-15T19:16:12.263741214Z",
1212
"tools": [
1313
{
1414
"name": "cipherscope",
@@ -19,7 +19,7 @@
1919
},
2020
"cryptoAssets": [
2121
{
22-
"bom-ref": "8ec4b990-c242-4dce-b287-f03f5ad7d944",
22+
"bom-ref": "5da73c7c-874f-4a4a-bdd5-b788a4fd9828",
2323
"assetType": "algorithm",
2424
"name": "RSA",
2525
"assetProperties": {
@@ -28,7 +28,25 @@
2828
}
2929
},
3030
{
31-
"bom-ref": "b0eeb295-734e-4802-84a1-c10c77b8c84d",
31+
"bom-ref": "949c682f-245a-48ac-929c-321883f113e5",
32+
"assetType": "algorithm",
33+
"name": "RSA",
34+
"assetProperties": {
35+
"primitive": "signature",
36+
"nistQuantumSecurityLevel": 0
37+
}
38+
},
39+
{
40+
"bom-ref": "21e6b5c1-a73c-4f06-9e65-2abb21dc7b8a",
41+
"assetType": "algorithm",
42+
"name": "RSA",
43+
"assetProperties": {
44+
"primitive": "signature",
45+
"nistQuantumSecurityLevel": 0
46+
}
47+
},
48+
{
49+
"bom-ref": "d9ad0e25-6a6a-4795-b6c6-6fe43df020d9",
3250
"assetType": "algorithm",
3351
"name": "ChaCha20Poly1305",
3452
"assetProperties": {
@@ -37,7 +55,7 @@
3755
}
3856
},
3957
{
40-
"bom-ref": "618e2556-e493-4d3d-b7a3-e541ccaf533e",
58+
"bom-ref": "d17963d8-afc3-4d9d-9639-40207e59cba2",
4159
"assetType": "algorithm",
4260
"name": "ChaCha20Poly1305",
4361
"assetProperties": {
@@ -48,9 +66,9 @@
4866
],
4967
"dependencies": [
5068
{
51-
"ref": "7b79d53e-9174-40a2-ab0e-90ce576f0eea",
69+
"ref": "9913e268-477a-44bd-b83c-e4507a13a864",
5270
"dependsOn": [
53-
"8ec4b990-c242-4dce-b287-f03f5ad7d944"
71+
"5da73c7c-874f-4a4a-bdd5-b788a4fd9828"
5472
],
5573
"dependencyType": "implements"
5674
}

‎fixtures/java/bazel-tink/mv-cbom.json‎

Lines changed: 117 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,14 @@
11
{
22
"bomFormat": "MV-CBOM",
33
"specVersion": "1.0",
4-
"serialNumber": "urn:uuid:88fe9b38-0f8f-4845-9de5-bfb5ff06140e",
4+
"serialNumber": "urn:uuid:e1eb7020-382a-490d-9c92-469752da89b5",
55
"version": 1,
66
"metadata": {
77
"component": {
8-
"name": "test-case-bazel-java",
9-
"path": "/workspace/test-cases/test-case-bazel-java"
8+
"name": "bazel-tink",
9+
"path": "/workspace/fixtures/java/bazel-tink"
1010
},
11-
"timestamp": "2025-09-15T17:22:54.702513263Z",
11+
"timestamp": "2025-09-15T19:16:12.241784417Z",
1212
"tools": [
1313
{
1414
"name": "cipherscope",
@@ -17,6 +17,118 @@
1717
}
1818
]
1919
},
20-
"cryptoAssets": [],
20+
"cryptoAssets": [
21+
{
22+
"bom-ref": "ba0df8fe-5e3b-492c-8f01-9f3358ef9297",
23+
"assetType": "algorithm",
24+
"name": "RSA",
25+
"assetProperties": {
26+
"primitive": "signature",
27+
"nistQuantumSecurityLevel": 0
28+
}
29+
},
30+
{
31+
"bom-ref": "21c2707d-320f-4d89-bd67-fbd8f95b3f77",
32+
"assetType": "algorithm",
33+
"name": "RSA",
34+
"assetProperties": {
35+
"primitive": "signature",
36+
"nistQuantumSecurityLevel": 0
37+
}
38+
},
39+
{
40+
"bom-ref": "06134af5-446d-4e36-afc2-88748f6c22f8",
41+
"assetType": "algorithm",
42+
"name": "RSA",
43+
"assetProperties": {
44+
"primitive": "signature",
45+
"nistQuantumSecurityLevel": 0
46+
}
47+
},
48+
{
49+
"bom-ref": "f6072edb-c2ba-4007-b969-69b13739c360",
50+
"assetType": "algorithm",
51+
"name": "RSA",
52+
"assetProperties": {
53+
"primitive": "signature",
54+
"nistQuantumSecurityLevel": 0
55+
}
56+
},
57+
{
58+
"bom-ref": "a5d23b59-8db1-4ee0-85e8-c2655dde0724",
59+
"assetType": "algorithm",
60+
"name": "AES-GCM",
61+
"assetProperties": {
62+
"primitive": "aead",
63+
"parameterSet": {
64+
"keySize": 256
65+
},
66+
"nistQuantumSecurityLevel": 3
67+
}
68+
},
69+
{
70+
"bom-ref": "dee29965-0905-40d1-a1b3-a58d8c27fb75",
71+
"assetType": "algorithm",
72+
"name": "AES-GCM",
73+
"assetProperties": {
74+
"primitive": "aead",
75+
"nistQuantumSecurityLevel": 3
76+
}
77+
},
78+
{
79+
"bom-ref": "6ad6b958-0279-43c3-9630-adc14e3aab1a",
80+
"assetType": "algorithm",
81+
"name": "AES-GCM",
82+
"assetProperties": {
83+
"primitive": "aead",
84+
"nistQuantumSecurityLevel": 3
85+
}
86+
},
87+
{
88+
"bom-ref": "f7131de9-57b5-4367-8ca9-b7eb4b85917c",
89+
"assetType": "algorithm",
90+
"name": "AES-GCM",
91+
"assetProperties": {
92+
"primitive": "aead",
93+
"nistQuantumSecurityLevel": 3
94+
}
95+
},
96+
{
97+
"bom-ref": "61fb5bc1-e119-468c-acb2-a0cd8e15a97b",
98+
"assetType": "algorithm",
99+
"name": "AES-GCM",
100+
"assetProperties": {
101+
"primitive": "aead",
102+
"nistQuantumSecurityLevel": 3
103+
}
104+
},
105+
{
106+
"bom-ref": "7efb9e25-c4be-4254-98e7-7a324225e1ff",
107+
"assetType": "algorithm",
108+
"name": "AES-GCM",
109+
"assetProperties": {
110+
"primitive": "aead",
111+
"nistQuantumSecurityLevel": 3
112+
}
113+
},
114+
{
115+
"bom-ref": "bd07c47d-9736-4c07-948f-75c05d4654d8",
116+
"assetType": "algorithm",
117+
"name": "AES-GCM",
118+
"assetProperties": {
119+
"primitive": "aead",
120+
"nistQuantumSecurityLevel": 3
121+
}
122+
},
123+
{
124+
"bom-ref": "de8c36ae-8680-49d0-9776-42f0c395d945",
125+
"assetType": "algorithm",
126+
"name": "AES-GCM",
127+
"assetProperties": {
128+
"primitive": "aead",
129+
"nistQuantumSecurityLevel": 3
130+
}
131+
}
132+
],
21133
"dependencies": []
22134
}

0 commit comments

Comments
 (0)