CycloneDX依赖引用审查
审查本地CycloneDX 1.6的bom-ref声明与依赖边，显示重复、悬空引用、外部URN和无歧义依赖环。
- 1添加输入
- 2调整设置
- 3获取结果
工具输入和文件在当前浏览器处理，不会上传。
开始之前
在将构建生成的SBOM交给其他系统前，检查跨记录引用问题。保留完整原文，定位普通JSON语法检查无法解释的重复声明和连接错误。
如何使用
- 打开或粘贴由构建导出的CycloneDX 1.6 SBOM。
- 检查重复声明路径、未解析边和SCC，并确认是否显式定义根组件。
- 下载完整引用报告和original.json，修正生成器后重跑。
支持范围与限制
一个UTF-8 JSON文件或粘贴内容最多5 MiB；最多10,000个bom-ref声明、50,000条dependsOn边、200,000个JSON值，深度64。选择文件优先。下载合计最多10 MiB；完整报告可能先达到输出预算，届时整体拒绝；预览前200行。
仅支持CycloneDX JSON 1.6，检查基本组件/服务/依赖形状，不认证完整官方模式。识别嵌套组件/服务及metadata.component；遍历原文全部bom-ref声明并保留JSON指针。其他对象不能充当组件/服务图目标；1.4/1.5拒绝。
重复bom-ref会显示所有原始路径，相应边排除，不覆盖已有对象。重复dependency ref行明确报告，排除这些来源行的全部边；同一行重复目标保留为duplicate_edge。缺失本地引用、错误目标类型及未解析外部urn:cdx分别标明。
SCC/自环仅使用无歧义内部组件/服务依赖边。可达性要求metadata.component中显式且唯一的bom-ref，不按首个组件猜根。original.json保留原始JSON字节、精确数字和图分析范围外字段。provides、compositions、formulation、vulnerabilities只保留，不分析；不联网解析、扫描漏洞或判断合规。
报告超过20,000字符时，结果文本与复制动作使用紧凑预览。完整report.json、CSV和HTML请下载。 表格长单元格超过2000字符时仅显示前2000加省略号；完整下载不截断。
操作示例
示例输入
{
"bomFormat": "CycloneDX",
"specVersion": "1.6",
"version": 1,
"metadata": {
"component": {
"type": "application",
"name": "app",
"bom-ref": "app"
}
},
"components": [
{
"type": "library",
"name": "A",
"bom-ref": "A"
},
{
"type": "library",
"name": "B",
"bom-ref": "B"
}
],
"dependencies": [
{
"ref": "app",
"dependsOn": [
"A"
]
},
{
"ref": "A",
"dependsOn": [
"B"
]
},
{
"ref": "B",
"dependsOn": [
"A",
"missing",
"urn:cdx:11111111-1111-4111-8111-111111111111/1#remote"
]
}
]
}示例参数
{"secondary":"","params":{"spreadsheetSafe":true}}示例输出
{"format":"CycloneDX JSON 1.6 dependency audit","summary":{"declarations":3,"duplicateRefs":0,"dependencyDeclarations":3,"duplicateDependencyRefs":0,"edges":5,"resolvedEdges":3,"unresolvedEdges":2,"cycles":1,"rootStatus":"resolved","reachable":3,"unreachable":0},"definitions":[{"ref":"app","path":"/metadata/component/bom-ref","kind":"component","name":"app"},{"ref":"A","path":"/components/0/bom-ref","kind":"component","name":"A"},{"ref":"B","path":"/components/1/bom-ref","kind":"component","name":"B"}],"duplicates":[],"dependencyDeclarations":[{"ref":"app","path":"/dependencies/0/ref","status":"resolved","providesPreservedOutsideScope":false},{"ref":"A","path":"/dependencies/1/ref","status":"resolved","providesPreservedOutsideScope":false},{"ref":"B","path":"/dependencies/2/ref","status":"resolved","providesPreservedOutsideScope":false}],"duplicateDependencyRefs":[],"edges":[{"from":"app","to":"A","path":"/dependencies/0/dependsOn/0","status":"resolved"},{"from":"A","to":"B","path":"/dependencies/1/dependsOn/0","status":"resolved"},{"from":"B","to":"A","path":"/dependencies/2/dependsOn/0","status":"resolved"},{"from":"B","to":"missing","path":"/dependencies/2/dependsOn/1","status":"dangling_local"},{"from":"B","to":"urn:cdx:11111111-1111-4111-8111-111111111111/1#remote","path":"/dependencies/2/dependsOn/2","status":"external_urn_unresolved"}],"cycles":[["A","B"]],"reachability":{"rootRef":"app","rootStatus":"resolved","reachable":["A","B","app"],"unreachable":[]},"preservedOutsideScope":["provides","compositions","formulation","vulnerabilities","other non-dependency relationships"]}出现问题时
使用支持的1.6导出。让每个声明有唯一bom-ref，在生成器中修复目标引用及重复依赖行；需要可达性时提供明确根组件。外部BOM链接另行处理。完整报告超过10 MiB时减少输入，修正后重跑。
常见问题
通过JSON Schema仍可能有重复引用吗？
可能。跨记录唯一性与依赖连接需要语义检查；本报告补充生产者的模式校验。
依赖环都代表非法或安全问题吗？
不代表。SCC仅展示声明的依赖环，不判断它是否合法、可被利用或符合规范。
为什么没有根可达性结果？
需要唯一的metadata.component bom-ref；没有显式根时不会根据数组次序猜测。