sbom_detection.py

# Copyright (C) 2024 Intel Corporation
# SPDX-License-Identifier: GPL-3.0-or-later

import json
from typing import Optional

import defusedxml.ElementTree as ET

from cve_bin_tool.log import LOGGER
from cve_bin_tool.validator import validate_cyclonedx


def sbom_detection(file_path: str) -> Optional[str]:
    """
    Identifies SBOM type with content validation and extension checks.
    Returns 'spdx', 'cyclonedx', 'swid', or None if the SBOM type cannot be determined.

    Args:
        file_path (str): Path to the SBOM file.

    Returns:
        Optional[str]: The detected SBOM type or None if detection fails.
    """
    try:
        # Check for CycloneDX JSON format
        if file_path.lower().endswith(".json"):
            try:
                with open(file_path, encoding="utf-8") as f:
                    data = json.load(f)
                    # Check for CycloneDX-specific structure
                    if isinstance(data, dict):
                        if (
                            data.get("bomFormat") == "CycloneDX"
                            and "components" in data
                        ):
                            return "cyclonedx"
                        # Fallback: Check for required fields
                        if "specVersion" in data.get(
                            "bom", {}
                        ) and "version" in data.get("bom", {}):
                            LOGGER.warning(
                                f"Possible CycloneDX SBOM with non-standard structure: {file_path}"
                            )
                            return "cyclonedx"
            except (json.JSONDecodeError, UnicodeDecodeError) as e:
                LOGGER.debug(f"JSON parsing error for {file_path}: {str(e)}")
                pass  # Not JSON, continue with other checks

        # Check XML-based formats with namespace validation
        if file_path.endswith(".xml"):
            try:
                tree = ET.parse(file_path)
                root = tree.getroot()
                namespace = (
                    root.tag.split("}", 1)[0].strip("{") if "}" in root.tag else ""
                )

                # Check CycloneDX namespace
                if "cyclonedx.org" in namespace and validate_cyclonedx(file_path):
                    return "cyclonedx"
                # Check SWID by root tag and namespace
                elif root.tag.endswith("SoftwareIdentity") and "iso/19770" in namespace:
                    return "swid"
            except ET.ParseError as e:
                LOGGER.debug(f"XML parsing error for {file_path}: {str(e)}")
                return None

        # SPDX detection (case-insensitive and path check)
        if any(
            ext in file_path.lower()
            for ext in [".spdx", ".spdx.json", ".spdx.xml", ".spdx.yml", ".spdx.yaml"]
        ):
            return "spdx"

    except Exception as e:
        LOGGER.error(f"SBOM detection failed for {file_path}: {str(e)}")
    return None


def detect_sbom_type_from_content(file_path: str) -> Optional[str]:
    """
    Detects SBOM type by analyzing file content without relying on file extensions.
    This is a fallback method if the primary detection fails.

    Args:
        file_path (str): Path to the SBOM file.

    Returns:
        Optional[str]: The detected SBOM type or None if detection fails.
    """
    try:
        with open(file_path, "rb") as f:
            content = f.read(1024)  # Read first 1KB for analysis

        # Check for JSON content
        if content.startswith(b"{"):
            try:
                with open(file_path, encoding="utf-8") as f:
                    data = json.load(f)
                    if isinstance(data, dict) and data.get("bomFormat") == "CycloneDX":
                        return "cyclonedx"
                    elif "SPDXID" in data or "spdxVersion" in data:
                        return "spdx"
            except json.JSONDecodeError:
                pass

        # Check for XML content
        if content.startswith(b"<?xml"):
            try:
                tree = ET.parse(file_path)
                root = tree.getroot()
                namespace = (
                    root.tag.split("}", 1)[0].strip("{") if "}" in root.tag else ""
                )

                if "cyclonedx.org" in namespace:
                    return "cyclonedx"
                elif "iso/19770" in namespace:
                    return "swid"
                elif "spdx.org" in namespace:
                    return "spdx"
            except ET.ParseError:
                pass

    except Exception as e:
        LOGGER.debug(f"Content-based SBOM detection failed for {file_path}: {str(e)}")
    return None


def detect_sbom(file_path: str) -> Optional[str]:
    """
    Detects SBOM type using both file extension and content-based methods.
    This is the main function to be used for SBOM detection.

    Args:
        file_path (str): Path to the SBOM file.

    Returns:
        Optional[str]: The detected SBOM type or None if detection fails.
    """
    # First, try detection based on file extension and content
    sbom_type = sbom_detection(file_path)
    if sbom_type:
        return sbom_type

    # If primary detection fails, try content-based detection as a fallback
    return detect_sbom_type_from_content(file_path)