Error: Cannot create a string longer than 0x1fffffe8 characters

[durga-pasupuleti]

Command>> cdxgen --deep

node:buffer:599
slice: (buf, start, end) => buf.utf8Slice(start, end),
^

Error: Cannot create a string longer than 0x1fffffe8 characters
at Object.slice (node:buffer:599:37)
at Buffer.toString (node:buffer:818:14)
at readFileSync (node:fs:512:41)
at addEvidenceForDotnet (file:///C:/Users/.../AppData/Roaming/npm/node_modules/@cyclonedx/cdxgen/utils.js:10021:33)
at createCsharpBom (file:///C:/Users/.../AppData/Roaming/npm/node_modules/@cyclonedx/cdxgen/index.js:4645:17)
at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
at async createMultiXBom (file:///C:/Users/.../AppData/Roaming/npm/node_modules/@cyclonedx/cdxgen/index.js:5014:15)
at async createBom (file:///C:/Users/.../AppData/Roaming/npm/node_modules/@cyclonedx/cdxgen/index.js:5832:16)
at async file:///C:/Users/..node_modules/@cyclonedx/cdxgen/bin/cdxgen.js:444:20 {
code: 'ERR_STRING_TOO_LONG'
}

Node.js v18.12.1

[prabhu]

@dplabsindia Could you try with node 20 which is min version required. If you still face this error, we might require a way to reproduce this bug with public repos. Or you can share the slices file generated by the dosai command via discord.

[durga-pasupuleti]

Ok, i have a situation where the bom is generatimg with all the components and dependencies array is empty on sbom.
but in reality we have the dependencies.

How the dependencies will get add?

[prabhu]

@dplabsindia for dotnet run the restore command to ensure project.assets.json file is generated before invoking cdxgen. The command might be different for .Net framework and other windows apps.

[durga-pasupuleti]

Thanks, @prabhu. The project is on .NET 4.8 and it doesn't have the project.assets.json file. However, when generating the SBOM using CycloneDX for .NET, it includes the dependencies. Is there any workaround in cdxgen? I prefer to use cdxgen as it generates all the dependencies, and my other projects include both .NET and Angular.

[prabhu]

Any ideas if cyclonedx for .net executes any commands to achieve this? As a node.js tool, cdxgen cannot use any API so needs external commands. Have you tried building the app and executing cdxgen?

[prabhu]

I think cyclonedx-dotnet is making use of the nuget api to identify dependencies. I will keep these issues and look for a sponsor, since improving dotnet support is a significant effort, which needs to be paid for somehow.

[durga-pasupuleti]

thanks @prabhu , but if there is a change for the !pkgList.length over csProjFiles then it will load all the dependencies irresepctive of SDK.
I hope this change will work for any .net project with some changes.

[prabhu]

Could you test and share a PR?

[durga-pasupuleti]

@prabhu pushed a branch to support dotnet project. test against dotnet framwork 4.7. Please review and let me know.

[prabhu]

@durga-pasupuleti did you get a chance to test with the latest version?

[durga-pasupuleti]

@prabhu working good for the dependency tree. And looking for introducing a new variable for the metadata component. So that the cyclonedx format will be fulfilled. I think it could be easy as we already have the command line variables.