Cyclonedx external reference URLs are not validated when encoding

[wagoodman]

What happened:
When analyzing docker.io/anchore/test_images:grype-quality-node-d89207b@sha256:f56164678054e5eb59ab838367373a49df723b324617b1ba6de775749d7f91d4 and outputing to cyclonedx I'm seeing values that are not valid URLs in the externalReferences section:

# cat node-87.1.cxd.json| jq '.components[].externalReferences'
...
[
  {
    "url": "jsdom/webidl-conversions",
    "type": "distribution"
  }
]
[
  {
    "url": "jsdom/whatwg-url",
    "type": "distribution"
  }
]
[
  {
    "url": "git://github.com/isaacs/node-which.git",
    "type": "distribution"
  }
]
[
  {
    "url": "git://github.com/isaacs/node-which.git",
    "type": "distribution"
  }
]
...

Which results in invalid cyclonedx relative to the validator:

cyclonedx validate --input-file ./node-87.1.cxd.json  --input-version v1_4

Validating JSON BOM...
Validation failed: Value does not match format "iri-reference"
#/properties/components/items/$ref/properties/externalReferences/items/$ref/properties/url/format
BOM is not valid.

What you expected to happen:

URLs encoded should be compliant relative to where they were parsed, so for node cataloging https://github.com/jsdom/webidl-conversions/blob/master/package.json#L15 will result in a repository value of jsdom/webidl-conversions. For node, this should be interpreted as github.com/jsdom/webidl-conversions, for other package types these assumptions might not be valid or have different assumptions that can be made about the URL.

Ultimately

syft/syft/formats/common/cyclonedxhelpers/external_references.go

Line 15 in cfebae2

func encodeExternalReferences(p pkg.Package) *[]cyclonedx.ExternalReference {

the cyclonedx external reference encoder will need to take this into consideration.

Environment:
Syft version v0.87.1

[hainenber]

hi, I'd like to work on this issue. Can you help assigning it to me? Thanks!

[hainenber]

@wagoodman so it turns out the extracted metadata comes from embedded /usr/local/packages/npm/node_modules directory in the image and hence I don't see anyway to extrapolate the module's repository URL.

IMO, we can try validating extracted metadata before encoding as external_references, which would make the validation going through. I've made a PR at #2091. Let me know if you have any concern for this approach. Thanks!