VB6: component catalogue and implicit runtime for the SBOM - #36
Open
jthDEV wants to merge 2 commits into
Open
Conversation
… app Builds on the VB6 project scanner shipped in 1.10.0: - vb6_catalog.py: vendor, title, category, life-cycle notes and known advisories for well-known Microsoft ActiveX controls, ADO/DAO/MSXML libraries and Windows system DLLs; attached to lib:* dependencies - add MSVBVM60.DLL as implicit runtime dependency of Exe/OleDll/OleExe/ Control projects, switchable off with --vb6:excludeRuntime - contrib/devskim-vb6: DevSkim language definition for VB6 file types and 22 security rules with self-tests, producing SARIF - examples/vb6-legacy-insecure/OrderDesk: deliberately insecure VB6 sample that exercises the scanner catalogue and every DevSkim rule - CHANGELOG entries for 1.10.0 (missing) and Unreleased, README and docs Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| scan = VB6Scanner().scan(project)[0] | ||
|
|
||
| runtime = scan.dependencies[-1] | ||
| assert runtime.key == 'lib:dll:MSVBVM60' |
|
|
||
| runtime = scan.dependencies[-1] | ||
| assert runtime.key == 'lib:dll:MSVBVM60' | ||
| assert runtime.versions == ['6.0'] |
| runtime = scan.dependencies[-1] | ||
| assert runtime.key == 'lib:dll:MSVBVM60' | ||
| assert runtime.versions == ['6.0'] | ||
| assert runtime.description == 'Microsoft Visual Basic 6.0 Runtime' |
| assert runtime.key == 'lib:dll:MSVBVM60' | ||
| assert runtime.versions == ['6.0'] | ||
| assert runtime.description == 'Microsoft Visual Basic 6.0 Runtime' | ||
| assert runtime.meta['dependency_type'] == 'runtime' |
| assert runtime.versions == ['6.0'] | ||
| assert runtime.description == 'Microsoft Visual Basic 6.0 Runtime' | ||
| assert runtime.meta['dependency_type'] == 'runtime' | ||
| assert runtime.meta['implicit'] is True |
| assert 'CVE-2012-0158' in common_controls.meta['catalog']['advisories'] | ||
|
|
||
| user32 = by_key['lib:dll:user32'] | ||
| assert user32.meta['catalog']['category'] == 'windows-system' |
| assert user32.meta['catalog']['category'] == 'windows-system' | ||
|
|
||
| legacy_reports = by_key['lib:dll:LegacyReports'] | ||
| assert legacy_reports.description == '' |
|
|
||
| legacy_reports = by_key['lib:dll:LegacyReports'] | ||
| assert legacy_reports.description == '' | ||
| assert 'catalog' not in legacy_reports.meta |
|
|
||
|
|
||
| def test_vb6_options_expose_runtime_switch(): | ||
| assert 'excludeRuntime' in VB6Scanner.options() |
|
|
||
| def test_vb6_options_expose_runtime_switch(): | ||
| assert 'excludeRuntime' in VB6Scanner.options() | ||
| assert 'ignore' in VB6Scanner.options() |
…sast The DevSkim rule pack and the deliberately insecure demo application are static analysis, not software composition, and will live in their own tool (ts-sast) like the OBOM extraction lives in ts-obom. What stays here is metadata for the SBOM: the component catalogue and the implicit runtime. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
jthDEV
changed the title
jthDEV
marked this pull request as ready for review
September 6, 2026 13:08
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Builds on the VB6 project scanner from 1.10.0. Nothing here changes the scanner's parsing; it adds the metadata that other ecosystems get from their package registry and that VB6 has no registry for.
Why this PR is SCA only
The first version of this branch also carried a DevSkim rule pack and an insecure demo application. Following the same reasoning that moved OBOM out of ts-scan (not SCA, must not burden a pipeline that only wants an SBOM), those parts have been removed and will live in a separate tool,
ts-sast. ts-scan stays the SBOM scanner. What remains is purely about the quality of the bill of materials:What's in here
src/ts_scan/pm/vb6_catalog.py– catalogue of well-known VB6 libraries (Microsoft ActiveX controls, ADO/DAO/MSXML type libraries, Windows system DLLs), keyed by file name. Attaches vendor, title, category, life-cycle notes and known advisories (e.g. MSCOMCTL.OCX → CVE-2012-0158 / CVE-2012-1856, MSXML4 → support ended 2014) tolib:*dependencies viadescriptionandmeta.catalog. Without it the SBOM lists bare file names with a type library version; with it a reader sees what the component is and whether it is still supported. Identities (key, purl) are unchanged.MSVBVM60.DLL. It is added to Exe/OleExe/OleDll/Control projects (meta.dependency_type = runtime,implicit = true);--vb6:excludeRuntimeswitches it off.docs/sbom.mdget a short VB6 section and thevb6option prefix.Verification
pytest tests– 44 passed (existing VB6 tests adjusted for the runtime entry, 4 new tests for runtime, option and catalogue behaviour)pyright src/ts_scan/pm/vb6.py src/ts_scan/pm/vb6_catalog.py– cleanOpen for discussion
🤖 Generated with Claude Code