Improve merge performance

src/CycloneDX.Core/Json/Serializer.Serialization.cs

@@ -89,5 +89,18 @@ internal static string Serialize(Models.Vulnerabilities.Vulnerability vulnerabil
             Contract.Requires(vulnerability != null);
             return JsonSerializer.Serialize(vulnerability, _options);
         }
+
+        internal static string Serialize(Models.Composition composition)
+        {
+            Contract.Requires(composition != null);
+            return JsonSerializer.Serialize(composition, _options);
+        }
+
+        internal static string Serialize(Models.ExternalReference externalReference)
+        {
+            Contract.Requires(externalReference != null);
+            return JsonSerializer.Serialize(externalReference, _options);
+        }
+
     }
 }

src/CycloneDX.Core/Models/Component.cs

@@ -218,6 +218,17 @@ public bool NonNullableModified
         [ProtoMember(26)]
         public Data Data { get; set; }
 
+        public override bool Equals(object obj)
+        {
+            var other = obj as Component;
+            if (other == null)
+            {
+                return false;
+            }
+
+            return Json.Serializer.Serialize(this) == Json.Serializer.Serialize(other);
+        }
+
         public bool Equals(Component obj)
         {
             return Json.Serializer.Serialize(this) == Json.Serializer.Serialize(obj);

src/CycloneDX.Core/Models/Composition.cs

@@ -25,7 +25,7 @@
 namespace CycloneDX.Models
 {
     [ProtoContract]
-    public class Composition : IXmlSerializable
+    public class Composition : IXmlSerializable, IEquatable<Composition>
     {
         [ProtoContract]
         public enum AggregateType
@@ -194,5 +194,26 @@ public void ReadXml(XmlReader reader)
                 writer.WriteEndElement();
             }
         }
+
+        public override bool Equals(object obj)
+        {
+            var other = obj as Composition;
+            if (other == null)
+            {
+                return false;
+            }
+
+            return Json.Serializer.Serialize(this) == Json.Serializer.Serialize(other);
+        }
+
+        public bool Equals(Composition obj)
+        {
+            return CycloneDX.Json.Serializer.Serialize(this) == CycloneDX.Json.Serializer.Serialize(obj);
+        }
+
+        public override int GetHashCode()
+        {
+            return CycloneDX.Json.Serializer.Serialize(this).GetHashCode();
+        }
     }
 }

src/CycloneDX.Core/Models/Dependency.cs

@@ -36,6 +36,17 @@ public class Dependency: IEquatable<Dependency>
         [ProtoMember(2)]
         public List<Dependency> Dependencies { get; set; }
 
+        public override bool Equals(object obj)
+        {
+            var other = obj as Dependency;
+            if (other == null)
+            {
+                return false;
+            }
+
+            return Json.Serializer.Serialize(this) == Json.Serializer.Serialize(other);
+        }
+
         public bool Equals(Dependency obj)
         {
             return CycloneDX.Json.Serializer.Serialize(this) == CycloneDX.Json.Serializer.Serialize(obj);

src/CycloneDX.Core/Models/ExternalReference.cs

@@ -15,16 +15,18 @@
 // SPDX-License-Identifier: Apache-2.0
 // Copyright (c) OWASP Foundation. All Rights Reserved.
 
+using System;
 using System.Collections.Generic;
 using System.Diagnostics.CodeAnalysis;
+using System.Text.Json.Serialization;
 using System.Xml.Serialization;
 using ProtoBuf;
 
 namespace CycloneDX.Models
 {
     [SuppressMessage("Microsoft.Naming", "CA1707:IdentifiersShouldNotContainUnderscores")]
     [ProtoContract]
-    public class ExternalReference
+    public class ExternalReference : IEquatable<ExternalReference>
     {
         [ProtoContract]
         public enum ExternalReferenceType
@@ -125,5 +127,26 @@ public enum ExternalReferenceType
         [ProtoMember(4)]
         public List<Hash> Hashes { get; set; }
         public bool ShouldSerializeHashes() { return Hashes?.Count > 0; }
+
+        public override bool Equals(object obj)
+        {
+            var other = obj as ExternalReference;
+            if (other == null)
+            {
+                return false;
+            }
+
+            return Json.Serializer.Serialize(this) == Json.Serializer.Serialize(other);
+        }
+
+        public bool Equals(ExternalReference obj)
+        {
+            return CycloneDX.Json.Serializer.Serialize(this) == CycloneDX.Json.Serializer.Serialize(obj);
+        }
+
+        public override int GetHashCode()
+        {
+            return CycloneDX.Json.Serializer.Serialize(this).GetHashCode();
+        }
     }
 }

src/CycloneDX.Core/Models/Service.cs

@@ -194,6 +194,17 @@ public ServiceDataChoices XmlData
 
         public bool ShouldSerializeProperties() => Properties?.Count > 0;
 
+        public override bool Equals(object obj)
+        {
+            var other = obj as Service;
+            if (other == null)
+            {
+                return false;
+            }
+
+            return Json.Serializer.Serialize(this) == Json.Serializer.Serialize(other);
+        }
+
         public bool Equals(Service obj)
         {
             return CycloneDX.Json.Serializer.Serialize(this) == CycloneDX.Json.Serializer.Serialize(obj);

src/CycloneDX.Core/Models/Tool.cs

@@ -48,6 +48,17 @@ public class Tool: IEquatable<Tool>
         public List<ExternalReference> ExternalReferences { get; set; }
         public bool ShouldSerializeExternalReferences() { return ExternalReferences?.Count > 0; }
 
+        public override bool Equals(object obj)
+        {
+            var other = obj as Tool;
+            if (other == null)
+            {
+                return false;
+            }
+
+            return Json.Serializer.Serialize(this) == Json.Serializer.Serialize(other);
+        }
+
         public bool Equals(Tool obj)
         {
             return CycloneDX.Json.Serializer.Serialize(this) == CycloneDX.Json.Serializer.Serialize(obj);

src/CycloneDX.Core/Models/Vulnerabilities/Vulnerability.cs

@@ -143,7 +143,18 @@ public class Vulnerability: IEquatable<Vulnerability>
         [ProtoMember(18)]
         public List<Property> Properties { get; set; }
         public bool ShouldSerializeProperties() { return Properties?.Count > 0; }
-
+
+        public override bool Equals(object obj)
+        {
+            var other = obj as Vulnerability;
+            if (other == null)
+            {
+                return false;
+            }
+
+            return Json.Serializer.Serialize(this) == Json.Serializer.Serialize(other);
+        }
+
         public bool Equals(Vulnerability obj)
         {
             return CycloneDX.Json.Serializer.Serialize(this) == CycloneDX.Json.Serializer.Serialize(obj);

src/CycloneDX.Utils/Merge.cs

@@ -23,20 +23,44 @@
 
 namespace CycloneDX.Utils
 {
-    class ListMergeHelper<T>
+    class ListMergeHelper<T> where T : IEquatable<T>
     {
         public List<T> Merge(List<T> list1, List<T> list2)
         {
             if (list1 is null) return list2;
             if (list2 is null) return list1;
 
             var result = new List<T>(list1);
+            // We want to avoid the costly computation of the hashes if possible.
+            // Therefore, we use a nullable type.
+            var resultHashes = new List<int?>(list1.Count);
+            for (int i = 0; i < list1.Count; i++)
+            {
+                resultHashes.Add(null);
+            }
 
             foreach (var item in list2)
             {
-                if (!(result.Contains(item))) 
+                int hash = item.GetHashCode();
+                bool found = false;
+                for (int i = 0; i < result.Count; i++)
+                {
+                    var resultItem = result[i];
+                    if (resultHashes[i] == null)
+                    {
+                        resultHashes[i] = resultItem.GetHashCode();
+                    }
+                    int resultHash = resultHashes[i].Value;
+                    if (hash == resultHash && item.Equals(resultItem))
+                    {
+                        found = true;
+                        break;
+                    }
+                }
+                if (!found) 
                 {
                     result.Add(item);
+                    resultHashes.Add(hash);
                 }
             }
 

tests/CycloneDX.Utils.Tests/MergeTests.cs

@@ -105,6 +105,31 @@ public void FlatMergeComponentsTest()
             Snapshot.Match(result);
         }
 
+        [Fact]
+        public void FlatMergeDuplicatedComponentsTest()
+        {
+            var sboms = new List<Bom>();
+            for (int i = 0; i < 3; i++)
+            {
+                var bom = new Bom
+                {
+                    Components = new List<Component>
+                    {
+                        new Component
+                        {
+                            Name = "Component1",
+                            Version = "1"
+                        }
+                    }
+                };
+                sboms.Add(bom);
+            }
+            var result = CycloneDXUtils.FlatMerge(sboms);
+
+            Assert.Single(result.Components);
+        }
+
+
         [Fact]
         public void FlatMergeVulnerabilitiesTest()
         {