Only a single instance of a dependency component reported in the SBOM when there are multiple instances

[emcfins]

When scanning a complex project (iot-device-simulator for example), the SBOM doesn't include all instances of a dependency installed.

In the linked repo, fast-xml-parser exists in source/console, source/simulator, source/custom-resource, and source/microservices. However, when cdxgen scans it, that fast-xml-parser is only reported to be in source/console and source/simulator.

When doing some digging, it seems like this line will only return a component if the version doesn't already exist in the component map.

if (compMap[component.purl]) return;

If cdxgen is used to find all instances of a package installed for things such as vulnerability reporting, it will report only 2 instances of the dependency to be patched, instead of 4.

[prabhu]

@emcfins The approach we take in this case is to retain multiple SrcFile properties. Can you check if the SBOM has these properties?

[emcfins]

Thank you for the quick reply!
From the generated SBOM:

This is the entry for v4.2.5:

      "group": "",
      "name": "fast-xml-parser",
      "version": "4.2.5",
      "description": "Validate XML, Parse XML, Build XML without C/C++ based libraries",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "07dff08b31385a782a41fb453e675a318957a09949398c4640e6a70bbedfabd93cf99d2fe5d0d2561fb782512b74844e3fffecfe381bed9bb129f07c9d5ca8d2"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://opensource.org/licenses/MIT"
          }
        }
      ],
      "purl": "pkg:npm/[email protected]",
      "externalReferences": [
        {
          "type": "vcs",
          "url": "https://github.com/NaturalIntelligence/fast-xml-parser#readme"
        },
        {
          "type": "vcs",
          "url": "git+https://github.com/NaturalIntelligence/fast-xml-parser.git"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/[email protected]",
      "properties": [
        {
          "name": "SrcFile",
          "value": "<snip>/source/simulator/package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-4.2.5.tgz"
        }
      ]
    },

And this is the entry for 4.4.0

    {
      "group": "",
      "name": "fast-xml-parser",
      "version": "4.4.0",
      "description": "Validate XML, Parse XML, Build XML without C/C++ based libraries",
      "scope": "optional",
      "hashes": [
        {
          "alg": "SHA-512",
          "content": "90b6378c5970218c01343a237252ac3400b5dac7c3e8dc16ef8401d82a0d18fbed5718e58987a156e9c1dc7632362fa7e13b75740720c18be6285fd9d7c7e5aa"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://opensource.org/licenses/MIT"
          }
        }
      ],
      "purl": "pkg:npm/[email protected]",
      "externalReferences": [
        {
          "type": "vcs",
          "url": "https://github.com/NaturalIntelligence/fast-xml-parser#readme"
        },
        {
          "type": "vcs",
          "url": "git+https://github.com/NaturalIntelligence/fast-xml-parser.git"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/[email protected]",
      "properties": [
        {
          "name": "SrcFile",
          "value": "<snip>/source/console/package-lock.json"
        },
        {
          "name": "ResolvedUrl",
          "value": "https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-4.4.0.tgz"
        }
      ]
    },