Invalid Purl in node applications

[phoenix-aditya]

Hey,

While scanning an application using cdxgen i found this error stating invalid purl
Can someone provide more context as to what the problem might be here?

/usr/local/lib/node_modules/@cyclonedx/cdxgen/node_modules/packageurl-js/src/package-url.js:43
        throw new Error('Invalid purl: "' + key + '" is a required field.');
              ^
Error: Invalid purl: "name" is a required field.
    at /usr/local/lib/node_modules/@cyclonedx/cdxgen/node_modules/packageurl-js/src/package-url.js:43:15
    at Array.forEach (<anonymous>)
    at new PackageURL (/usr/local/lib/node_modules/@cyclonedx/cdxgen/node_modules/packageurl-js/src/package-url.js:41:27)
    at parseGradleDep (file:///usr/local/lib/node_modules/@cyclonedx/cdxgen/utils.js:1485:13)
    at createJavaBom (file:///usr/local/lib/node_modules/@cyclonedx/cdxgen/index.js:1502:30)
    at createMultiXBom (file:///usr/local/lib/node_modules/@cyclonedx/cdxgen/index.js:42[53](https://gitlab.com/arcesium/internal/infosec/dependency-scan-jobs/-/jobs/5139201386#L53):21)
    at async createBom (file:///usr/local/lib/node_modules/@cyclonedx/cdxgen/index.js:5190:16)
    at async file:///usr/local/lib/node_modules/@cyclonedx/cdxgen/bin/cdxgen.js:2[56](https://gitlab.com/arcesium/internal/infosec/dependency-scan-jobs/-/jobs/5139201386#L56):22
Node.js v18.16.1

[prabhu]

@phoenix-aditya, this looks like an error from java gradle. Can you invoke with -t js?

[phoenix-aditya]

The project is built using gradle by invoking this It might prevent scanning of the backend of the project wouldnt it?

I would prefer cdxgen scans all the packages in the project including Java and Js. Would that be possible in this case?

[prabhu]

Could you share the output for gradle dependencies command? You can set the environment variable CDXGEN_DEBUG_MODE=debug and run the same gradle command. Is this with the latest cdxgen?

[phoenix-aditya]

I am using v9.8.0
I apologise i wont be able to share the output of gradle dependencies due to internal packages being present in it

[prabhu]

Try 9.8.3. We fixed a bug like this in 9.8.1

[phoenix-aditya]

Oh, My Bad
Will do so.
Thanks for the help

[prabhu]

Please confirm if the new version fixes the issue. If not, we can improve this logic further.