the process stop when running 'cdxgen' command

[tuhaolam]

INFO [2020-01-13 18:17:30,174] Scanning /app using scan plugins ['python']
INFO [2020-01-13 18:17:30,175] ⚡︎ Executing "cdxgen -o /app/reports/bom-report.xml /app"

when I run docker run --rm --tmpfs /tmp -v xxx:/app appthreat/sast-scan scan --src /app --type python --out_dir /app/reports, docker pull very fast, but the process stop at this scene for a very long time, and the network is ok.

[prabhu]

Any test repo you can share to reproduce this?

The cdxgen command would query pypi for all packages to build the metadata such as license etc. You can run this command directly to see what the issue is

npm install -g @appthreat/cdxgen
# From within the repo
cdxgen -o bom-report.xml .

[prabhu]

Also since cdxgen is not used yet for any analysis I will push out an update to disable cdxgen running by default. But nevertheless please invoke the command directly and let me know what the issue is.

[prabhu]

New version is live. Do you want to re-test?

[tuhaolam]

cdxgen -o bom-report.xml .

when I run the command as above with older version, it occurs to a error:

node: src/unix/core.c:187: uv_close: Assertion `0' failed.

when I re-rest using new version, it occurs to be stoped:

INFO [2020-01-15 07:12:27,903] Scanning /app using scan plugins ['python']
INFO [2020-01-15 07:12:27,903] ⚡︎ Executing "bandit -r -a vuln -ii -ll -o /app/reports/bandit-report.sarif -f sarif -x .git,.svn,.mvn,.idea,dist,bin,obj,backup,docs,tests,test,tmp,reports /app"
INFO [2020-01-15 07:12:30,290] ⚡︎ Executing "ossaudit -f /app/Pipfile -f /app/Pipfile.lock -f /app/xss_cleaner/requirements.txt --column cve --column name --column version --column cvss_score --column title --column description"

and I guess it maybe be network problem because I ran in the networking need to use proxy for accessing internet.

[prabhu]

There is some information here - nodejs/node#8096 . But I believe the issue could be in this library ForbesLindesay/sync-rpc#3 where it is not scaling well with timeout introduced by the proxy. I will rewrite cdxgen to make use of async await and get rid of the sync-request library. Will clone this issue in cdxgen.

[prabhu]

This is resolved now with the rewrite of cdxgen to use got