feat: add nodejs-binary package classifier (#1296)

syft/pkg/cataloger/javascript/cataloger.go

@@ -9,9 +9,11 @@ import (
 	"path"
 	"strings"
 
+	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/pkg/cataloger/common"
+	"github.com/anchore/syft/syft/pkg/cataloger/generic"
 	"github.com/anchore/syft/syft/source"
 )
 
@@ -35,6 +37,11 @@ func NewJavascriptLockCataloger() *common.GenericCataloger {
 	return common.NewGenericCataloger(nil, globParsers, "javascript-lock-cataloger", addLicenses)
 }
 
+func NewNodeBinaryCataloger() *generic.Cataloger {
+	return generic.NewCataloger("node-binary-cataloger").
+		WithParserByMimeTypes(parseNodeBinary, internal.ExecutableMIMETypeSet.List()...)
+}
+
 func addLicenses(resolver source.FileResolver, location source.Location, p *pkg.Package) error {
 	dir := path.Dir(location.RealPath)
 	pkgPath := []string{dir, "node_modules"}

syft/pkg/cataloger/javascript/parse_node_binary.go

@@ -0,0 +1,43 @@
+package javascript
+
+import (
+	"regexp"
+
+	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/syft/artifact"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/pkg/cataloger/generic"
+	"github.com/anchore/syft/syft/source"
+)
+
+var nodeClassifier = generic.Classifier{
+	Package: "node.js", // Note: this purposely matches the "node.js" string to aid nvd vuln matching
+	FilepathPatterns: []*regexp.Regexp{
+		// note: should we just parse all files resolved with executable mimetypes
+		// regexp that matches node binary
+		regexp.MustCompile(`(.*/|^)node$`),
+	},
+	EvidencePatterns: []*regexp.Regexp{
+		// regex that matches node.js/vx.y.z
+		regexp.MustCompile(`(?m)node\.js\/v(?P<version>[0-9]+\.[0-9]+\.[0-9]+)`),
+	},
+	CPEs: []pkg.CPE{
+		pkg.MustCPE("cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*"),
+	},
+}
+
+func parseNodeBinary(_ source.FileResolver, _ *generic.Environment, reader source.LocationReadCloser) ([]pkg.Package, []artifact.Relationship, error) {
+	p, _, err := nodeClassifier.Examine(reader)
+	if err != nil {
+		log.Trace("failed to find node.js package: %+v", err)
+		return nil, nil, nil // we can silently fail here to reduce warning noise
+	}
+
+	// TODO add node specific metadata to the packages to help with vulnerability matching
+	if p != nil {
+		p.Language = pkg.JavaScript
+		return []pkg.Package{*p}, nil, nil
+	}
+	p.SetID()
+	return nil, nil, nil
+}