Skip to content

Commit 3e1304f

Browse files
ruromeroruromero
authored
fix: don't parse any value as number (#221)
Signed-off-by: Ruben Romero Montes <[email protected]>
1 parent b92838b commit 3e1304f

File tree

9 files changed

+102
-40
lines changed

9 files changed

+102
-40
lines changed

‎src/providers/java_maven.js‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -226,9 +226,7 @@ export default class Java_maven extends Base_java {
226226
let parser = new XMLParser({
227227
commentPropName: '#comment', // mark comments with #comment
228228
isArray: (_, jpath) => 'project.dependencies.dependency' === jpath,
229-
numberParseOptions: {
230-
skipLike: /[0-9]+[.]0/
231-
}
229+
parseTagValue: false
232230
})
233231
// read manifest pom.xml file into buffer
234232
let buf = fs.readFileSync(manifest)

‎test/providers/java_maven.test.js‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -137,3 +137,22 @@ suite('testing the java-maven data provider with modules', () => {
137137

138138
})
139139
}).beforeAll(() => clock = useFakeTimers(new Date('2023-08-07T00:00:00.000Z'))).afterAll(()=> {clock.restore()});
140+
141+
suite('testing the java-maven version parsing in getDependencies', () => {
142+
test('verify version parsing works correctly', async () => {
143+
const testCase = 'pom_deps_with_ignore_version_from_property';
144+
const javaMvnProvider = await createMockProvider(`test/providers/tst_manifests/maven/${testCase}`);
145+
146+
// Use provideComponent to test the version parsing through the public interface
147+
const result = javaMvnProvider.provideComponent(`test/providers/tst_manifests/maven/${testCase}/pom.xml`);
148+
const sbom = JSON.parse(result.content);
149+
150+
// Find the BouncyCastle dependency in the SBOM
151+
const bouncyCastleDependency = sbom.dependencies.find(dep =>
152+
dep.ref === 'pkg:maven/org.bouncycastle/[email protected]'
153+
);
154+
155+
expect(bouncyCastleDependency).to.exist;
156+
expect(bouncyCastleDependency.ref).to.equal('pkg:maven/org.bouncycastle/[email protected]');
157+
});
158+
}).beforeAll(() => clock = useFakeTimers(new Date('2023-08-07T00:00:00.000Z'))).afterAll(()=> {clock.restore()});

‎test/providers/tst_manifests/maven/pom_deps_with_ignore_version_from_property/component_analysis_expected_sbom.json‎

Lines changed: 20 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,26 @@
2121
"purl": "pkg:maven/pom-with-deps-and-ignore/[email protected]",
2222
"type": "application",
2323
"bom-ref": "pkg:maven/pom-with-deps-and-ignore/[email protected]"
24+
},
25+
{
26+
"group": "org.bouncycastle",
27+
"name": "bcprov-jdk18on",
28+
"version": "1.80",
29+
"purl": "pkg:maven/org.bouncycastle/[email protected]",
30+
"type": "library",
31+
"bom-ref": "pkg:maven/org.bouncycastle/[email protected]"
2432
}
2533
],
26-
"dependencies": []
34+
"dependencies": [
35+
{
36+
"ref": "pkg:maven/pom-with-deps-and-ignore/[email protected]",
37+
"dependsOn": [
38+
"pkg:maven/org.bouncycastle/[email protected]"
39+
]
40+
},
41+
{
42+
"ref": "pkg:maven/org.bouncycastle/[email protected]",
43+
"dependsOn": []
44+
}
45+
]
2746
}

‎test/providers/tst_manifests/maven/pom_deps_with_ignore_version_from_property/effective-pom.xml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,11 @@
2323
<version>1.2.17</version>
2424
<scope>compile</scope>
2525
</dependency>
26+
<dependency>
27+
<groupId>org.bouncycastle</groupId>
28+
<artifactId>bcprov-jdk18on</artifactId>
29+
<version>1.80</version>
30+
</dependency>
2631
</dependencies>
2732
<repositories>
2833
<repository>

‎test/providers/tst_manifests/maven/pom_deps_with_ignore_version_from_property/mvn_deptree.txt‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1 +1,3 @@
11
pom-with-deps-and-ignore:pom-with-dependency-not-ignored-for-tests:jar:0.0.1
2+
+- log4j:log4j:jar:1.2.17:compile
3+
\- org.bouncycastle:bcprov-jdk18on:jar:1.80:compile

‎test/providers/tst_manifests/maven/pom_deps_with_ignore_version_from_property/pom.xml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,11 @@
1717
<artifactId>log4j</artifactId>
1818
<version>${log4j.version}</version>
1919
</dependency>
20+
<dependency>
21+
<groupId>org.bouncycastle</groupId>
22+
<artifactId>bcprov-jdk18on</artifactId>
23+
<version>1.80</version>
24+
</dependency>
2025
</dependencies>
2126

2227
</project>

‎test/providers/tst_manifests/maven/pom_deps_with_ignore_version_from_property/stack_analysis_expected_sbom.json‎

Lines changed: 45 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -1,27 +1,46 @@
11
{
2-
"bomFormat": "CycloneDX",
3-
"specVersion": "1.4",
4-
"version": 1,
5-
"metadata": {
6-
"timestamp": "2023-08-07T00:00:00.000Z",
7-
"component": {
8-
"group": "pom-with-deps-and-ignore",
9-
"name": "pom-with-dependency-not-ignored-for-tests",
10-
"version": "0.0.1",
11-
"purl": "pkg:maven/pom-with-deps-and-ignore/[email protected]",
12-
"type": "application",
13-
"bom-ref": "pkg:maven/pom-with-deps-and-ignore/[email protected]"
14-
}
15-
},
16-
"components": [
17-
{
18-
"group": "pom-with-deps-and-ignore",
19-
"name": "pom-with-dependency-not-ignored-for-tests",
20-
"version": "0.0.1",
21-
"purl": "pkg:maven/pom-with-deps-and-ignore/[email protected]",
22-
"type": "application",
23-
"bom-ref": "pkg:maven/pom-with-deps-and-ignore/[email protected]"
24-
}
25-
],
26-
"dependencies": []
27-
}
2+
"bomFormat": "CycloneDX",
3+
"specVersion": "1.4",
4+
"version": 1,
5+
"metadata": {
6+
"timestamp": "2023-08-07T00:00:00.000Z",
7+
"component": {
8+
"group": "pom-with-deps-and-ignore",
9+
"name": "pom-with-dependency-not-ignored-for-tests",
10+
"version": "0.0.1",
11+
"purl": "pkg:maven/pom-with-deps-and-ignore/[email protected]",
12+
"type": "application",
13+
"bom-ref": "pkg:maven/pom-with-deps-and-ignore/[email protected]"
14+
}
15+
},
16+
"components": [
17+
{
18+
"group": "pom-with-deps-and-ignore",
19+
"name": "pom-with-dependency-not-ignored-for-tests",
20+
"version": "0.0.1",
21+
"purl": "pkg:maven/pom-with-deps-and-ignore/[email protected]",
22+
"type": "application",
23+
"bom-ref": "pkg:maven/pom-with-deps-and-ignore/[email protected]"
24+
},
25+
{
26+
"group": "org.bouncycastle",
27+
"name": "bcprov-jdk18on",
28+
"version": "1.80",
29+
"purl": "pkg:maven/org.bouncycastle/[email protected]",
30+
"type": "library",
31+
"bom-ref": "pkg:maven/org.bouncycastle/[email protected]"
32+
}
33+
],
34+
"dependencies": [
35+
{
36+
"ref": "pkg:maven/pom-with-deps-and-ignore/[email protected]",
37+
"dependsOn": [
38+
"pkg:maven/org.bouncycastle/[email protected]"
39+
]
40+
},
41+
{
42+
"ref": "pkg:maven/org.bouncycastle/[email protected]",
43+
"dependsOn": []
44+
}
45+
]
46+
}

‎test/providers/tst_manifests/maven/pom_with_multiple_modules/component_analysis_expected_sbom.json‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -177,10 +177,10 @@
177177
{
178178
"group": "commons-configuration",
179179
"name": "commons-configuration",
180-
"version": "1.1",
181-
"purl": "pkg:maven/commons-configuration/commons-configuration@1.1",
180+
"version": "1.10",
181+
"purl": "pkg:maven/commons-configuration/commons-configuration@1.10",
182182
"type": "library",
183-
"bom-ref": "pkg:maven/commons-configuration/commons-configuration@1.1"
183+
"bom-ref": "pkg:maven/commons-configuration/commons-configuration@1.10"
184184
},
185185
{
186186
"group": "com.squareup.okhttp3",
@@ -222,7 +222,7 @@
222222
"pkg:maven/com.google.code.findbugs/[email protected]",
223223
"pkg:maven/com.github.spotbugs/[email protected]",
224224
"pkg:maven/javax.enterprise/[email protected]",
225-
"pkg:maven/commons-configuration/commons-configuration@1.1",
225+
"pkg:maven/commons-configuration/commons-configuration@1.10",
226226
"pkg:maven/com.squareup.okhttp3/[email protected]",
227227
"pkg:maven/org.projectlombok/[email protected]"
228228
]
@@ -304,7 +304,7 @@
304304
"dependsOn": []
305305
},
306306
{
307-
"ref": "pkg:maven/commons-configuration/commons-configuration@1.1",
307+
"ref": "pkg:maven/commons-configuration/commons-configuration@1.10",
308308
"dependsOn": []
309309
},
310310
{

‎test/providers/tst_manifests/maven/pom_with_multiple_modules/module4/pom.xml‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -45,11 +45,6 @@
4545
<artifactId>jackson-databind</artifactId>
4646
<version>2.16.0</version>
4747
</dependency>
48-
49-
50-
51-
52-
5348
</dependencies>
5449

5550
</project>

0 commit comments

Comments
 (0)