fix: support other versions of cyclonedx (#45)

Author: b31ngd3v

src/cve_bin_tool.py

@@ -3,6 +3,7 @@
 
 import glob
 import json
+import re
 import subprocess
 import tempfile
 from pathlib import Path
@@ -197,13 +198,17 @@ def sbom_finder(directory):
                         "bomFormat" in json_data
                         and "specVersion" in json_data
                         and json_data["bomFormat"] == "CycloneDX"
-                        and json_data["specVersion"] == "1.3"
                     ):
-                        sboms.append({"file": file, "type": "cyclonedx"})
+                        try:
+                            spec_version = float(json_data["specVersion"])
+                        except Exception:
+                            spec_version = 0
+                        if spec_version >= 1.3 and spec_version <= 1.5:
+                            sboms.append({"file": file, "type": "cyclonedx"})
             elif file.endswith(".xml"):
                 with open(file) as fd:
                     data = fd.read()
-                    if data.find("cyclonedx.org/schema/bom/1.3") != -1:
+                    if re.search(r"cyclonedx\.org\/schema\/bom\/1\.[3-5]", data):
                         sboms.append({"file": file, "type": "cyclonedx"})
                     elif (
                         data.find("standards.iso.org/iso/19770/-2/2015/schema.xsd")

test/sbom/cyclonedx_test.xml

@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<bom xmlns="http://cyclonedx.org/schema/bom/1.3"
+<bom xmlns="http://cyclonedx.org/schema/bom/1.4"
      serialNumber="urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79"
      version="1">
   <components>
@@ -24,4 +24,4 @@
       <version>2.11.1</version>
     </component>
   </components>
-</bom>
+</bom>

test/sbom/cyclonedx_test2.json

@@ -1,6 +1,6 @@
 {
   "bomFormat": "CycloneDX",
-  "specVersion": "1.3",
+  "specVersion": "1.5",
   "serialNumber": "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79",
   "version": 1,
   "components": [
@@ -46,4 +46,4 @@
       "description": "On board firmware"
     }
   ]
-}
+}