Fix: Detect and avoid infinite recursion during second upload of SBOM with nested duplicate

[syalioune]

Description

When a SBOM contains component with nested duplicate (componentA contains itself as a children), the second SBOM upload causes an infinite recursion.

Addressed Issue

See #1905 for details

Additional Details

N/A

Checklist

• I have read and understand the contributing guidelines
• This PR fixes a defect, and I have provided tests to verify that the fix is effective
• [ ] This PR implements an enhancement, and I have provided tests to verify that it works as intended
• [ ] This PR introduces changes to the database model, and I have added corresponding update logic
• [ ] This PR introduces new or alters existing behavior, and I have updated the documentation accordingly

[valentijnscholten]

It sounds like a nice find, but I was curious to see the cause of the problem. And I don't understand how it could cause an infinite recursion. When convert is called on the child cdx component, it should stop processing there because the child doesn't have any children so cycloneDxComponent.getComponents() for the child component would be null or empty?
(Probably not, but I'm not seeing it :-))

I am also wondering what will happen, with the fix in place, if there is ComponentA having ComponentB as child which has ComponentA as child. So the "recursive" dependency is one level deeper.

[syalioune]

It sounds like a nice find, but I was curious to see the cause of the problem. And I don't understand how it could cause an infinite recursion. When convert is called on the child cdx component, it should stop processing there because the child doesn't have any children so cycloneDxComponent.getComponents() for the child component would be null or empty?
(Probably not, but I'm not seeing it :-))

Please check my comment here #1905 (comment), the scenario is described. Important thing is that the recursion problem is not on the ModelConverter.convert method but on BomUploadProcessingTask.processComponent.

I am also wondering what will happen, with the fix in place, if there is ComponentA having ComponentB as child which has ComponentA as child. So the "recursive" dependency is one level deeper.

In that case we're doomed 😄 . More seriously, the fix should be updated to maintain ancestors component identities instead of just the nearest parent identity.

[valentijnscholten]

Just use Neo4J ;-)

[nscuro]

This PR is superseded by #3357.

Still, thanks a lot @syalioune for proposing a fix!