Appending custom folders (like js libraries)

[durga-pasupuleti]

currently the tool is generating the awsome reports for dotnet. I am thinking for some projects there is a chance of having the lib or library folder under javascript.
Any suggestion or ideas to allow those folders to be included in the sbom?

[prabhu]

@durga-pasupuleti Thank you for the kind words. It should try and detect some js packages if invoked without specifying any type argument. However, the detection logic is quite basic and may not work well. Can you try without the -t argument and share your observation?

[durga-pasupuleti]

Tried generating without -t argument, but yeah it's still not loading them. I think cdxgen is not considering
<ItemGroup> <Content Include="ClientApp\build-config.js" /> <Content Include="ClientApp\karma.conf.js" /> <Content Include="ClientApp\protractor.conf.js" /> <Content Include="ClientApp\src\app\app.component.html" /> </ItemGroup>
from the csproj file.
But its able to add the jquery used by of these js files. I am not sure how it got added to sbom?

Logic could be anything which in the msbuild inclusion should be there in sbom. Not only dotnet projects as per the CycloneDX and the sbom guidelines.

[prabhu]

Yes. They can be definitely added as file components under metadata.component. I would say it's a nice to have feature though, since these are not required for compliance or security purposes.

[durga-pasupuleti]

I agree. But as per the security whatever software in our application should be listed. I hope even js should be included, in recent projects we have a structure to read everything. But earlier the old applications loaded js files from the directory and included in HTML.

[prabhu]

Would you like to come up with a PR? This line needs some tweaking.