cdxgen not populating component and dependencies details for .net4.5 framework based web applications

[Ram2023GitHub]

Hello Everyone,
Iam using cdxgen for generating SBOM for my .net application which was built using dotnet4.5 framework.In my application i am using third party assemblies which are kept in third party folder under solution and then reference added for them in all projects.
bom.json file getting generated with blank dependencies and components and also getting this below error

Create reachables slice for C:\Windows\System32\generate. Please wait ...
Unable to generate reachables slice using atom. Check if this is a supported language.
Set the environment variable CDXGEN_DEBUG_MODE=debug to troubleshoot.
Create usages slice for C:\Windows\System32\generate. Please wait ...
Unable to generate usages slice using atom. Check if this is a supported language.
Set the environment variable CDXGEN_DEBUG_MODE=debug to troubleshoot.
Unable to identify component evidence for the input SBOM. Only java, javascript, python, and php projects are supported by evinse.
╔═══════════════════════════╤═════════════════════════════════════╤═══════════════════════════╤═════════════════╗
║ Group │ Name │ Version │ Scope ║
╚═══════════════════════════╧═════════════════════════════════════╧═══════════════════════════╧═════════════════╝
BOM includes 0 components and 0 dependencies

So here third party assemblies are not populated in component/dependencies.Its blank only.
Also tried to create one json file which will contain all third party assemblies along with version details and passing this file as parameter to
cdxgen CLI command.

Can anyone suggest further how can this issue will be fixed?

[prabhu]

@Ram2023GitHub could you share the full command used? Also can you try performing nuget restore or nuget build prior to invoking cdxgen?

[Ram2023GitHub]

No prabhu.Its private and can not be shared.

[Ram2023GitHub]

@prabhu getting below error if used -r and --deep both options and also when used only --deep option

C:\Windows\system32>set CDXGEN_DEBUG_MODE=debug && cdxgen -r --deep D:\CP -o D:\CP\myproject_bom2.json
FATAL ERROR: v8::ToLocalChecked Empty MaybeLocal
----- Native stack trace -----

1: 00007FF74680C94B node::SetCppgcReference+17979
2: 00007FF7467768A9 node::OnFatalError+265
3: 00007FF7471FDD93 v8::api_internal::ToLocalEmpty+83
4: 00007FF746769756 DSA_meth_get_flags+36054
5: 00007FF7471AAE8E v8::SharedValueConveyor::SharedValueConveyor+416270
6: 00007FF7471AAA8A v8::SharedValueConveyor::SharedValueConveyor+415242
7: 00007FF7471AAD4F v8::SharedValueConveyor::SharedValueConveyor+415951
8: 00007FF7471AABC0 v8::SharedValueConveyor::SharedValueConveyor+415552
9: 00007FF7472A61CE v8::PropertyDescriptor::writable+677742
10: 00007FF6C741C87E

----- JavaScript stack trace -----

1: readFileSync (node:fs:457:20)
2: addEvidenceForDotnet (file:///C:/Users/xxx.xxx/AppData/Roaming/npm/node_modules/@cyclonedx/cdxgen/utils.js:10135:33)
3: createCsharpBom (file:///C:/Users/xxx.xxx/AppData/Roaming/npm/node_modules/@cyclonedx/cdxgen/index.js:4769:17)
4: processTicksAndRejections (node:internal/process/task_queues:95:5)

[prabhu]

This particular readFileSync error is reported in another discussion. I think the latest node.js 22.1.0 works better in Windows environments.

[prabhu]

@Ram2023GitHub you can share the project privately with me on discord. We offer consulting services should your team needs this to be fixed as a priority and needs an NDA or a contract to share sensitive code privately.

[Ram2023GitHub]

We need to submit SBOM for our product to one of our client.
Iam not sure about sharing the project privately or any NDA right now.Need to check on this.

[Ram2023GitHub]

This particular readFileSync error is reported in another discussion. I think the latest node.js 22.1.0 works better in Windows environments.

@prabhu I tried with latest node.js 22.1.0 and getting same error.

C:\Windows\system32>set CDXGEN_DEBUG_MODE=debug && cdxgen -r --deep D:\CP\Service -o D:\CP\Service\myproject_bom1.json
Found 567 components by parsing the 27 csproj files. The resulting SBOM will be incomplete.
FATAL ERROR: v8::ToLocalChecked Empty MaybeLocal
----- Native stack trace -----

1: 00007FF6AEA3DA2B node::SetCppgcReference+15611
2: 00007FF6AE9AB129 node::OnFatalError+265
3: 00007FF6AF60E2DB v8::FunctionTemplate::RemovePrototype+299
4: 00007FF6AE99E608 DSA_meth_get_flags+34872
5: 00007FF64F60FB64

----- JavaScript stack trace -----

1: readFileSync (node:fs:448:20)
2: addEvidenceForDotnet (file:///C:/Users/xxx.xxx/AppData/Roaming/npm/node_modules/@cyclonedx/cdxgen/utils.js:10135:33)
3: createCsharpBom (file:///C:/Users/xxx.xxx/AppData/Roaming/npm/node_modules/@cyclonedx/cdxgen/index.js:4769:17)
4: createMultiXBom (file:///C:/Users/xxx.xxx/AppData/Roaming/npm/node_modules/@cyclonedx/cdxgen/index.js:5138:21)

[Ram2023GitHub]

Its almost 700 MB in size.Its size of entire directory which was used for generating SBOM using CDXGEN.
Individual assemblies/files are max 10 MB in size.

[prabhu]

oops. I think there might be some settings to increase the heap memory. Can you file a ticket here to skip large dll files?

https://github.com/owasp-dep-scan/dosai

[Ram2023GitHub]

Iam not sure for what i need to raise ticket.Iam not understanding it.Can you please elaborate in detail?

[prabhu]

When cdxgen is invoked with --deep it uses the dosai project to convert dll files into json. If dosai project skips large dll files, then we could generate an SBOM with some components.

In parallel, if there is a project to reproduce the issue we can come up with some fix to get it working in non-deep mode.

[Ram2023GitHub]

Its almost 700 MB in size.Its size of entire directory which was used for generating SBOM using CDXGEN.
Individual assemblies/files are max 10 MB in size.