Skip to content

(fix)gradle: ignore (c) lines in the report (IDETECT-4760) #1602

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 6 commits into from
Nov 26, 2025
Merged

(fix)gradle: ignore (c) lines in the report (IDETECT-4760) #1602

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
10160de
(fix)gradle - ignore (c) lines in the report
bd-samratmuk Nov 18, 2025
fa91e78
use constant GRADLE_CONSTRAINT_SUFFIX
bd-samratmuk Nov 20, 2025
3f4afed
add functional test cases
bd-samratmuk Nov 20, 2025
145d22b
Release 11.1.0-SIGQA7-IDETECT-4760
Nov 21, 2025
876815a
Using the next snapshot post release 11.1.0-SIGQA8-IDETECT-4760-SNAPSHOT
Nov 21, 2025
9139c83
Merge branch 'master' into IDETECT-4760
bd-samratmuk Nov 24, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion ...ation/detectable/detectables/gradle/inspection/parse/GradleReportConfigurationParser.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,7 @@

public class GradleReportConfigurationParser {
private static final String UNRESOLVED_SUFFIX = "(n)";
private static final String GRADLE_CONSTRAINT_SUFFIX = "(c)";

private final GradleReportLineParser parser = new GradleReportLineParser();

Expand All @@ -21,7 +22,9 @@ public GradleConfiguration parse(String header, List<String> dependencyLines, Ma
configuration.setUnresolved(parseUnresolved(header));
List<GradleTreeNode> children = new ArrayList<>();
for (String line: dependencyLines) {
children.add(parser.parseLine(line, metadata));
if (!line.trim().endsWith(GRADLE_CONSTRAINT_SUFFIX)) {
children.add(parser.parseLine(line, metadata));
}
Copy link
Contributor

@shantyk shantyk Nov 19, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is it at all possible for a dependency constraint to not be elsewhere in the tree? Based on what Gradle says “(c) - A dependency constraint, not a dependency. The dependency affected by the constraint occurs elsewhere in the tree.“ it sounds like the answer is no but I wonder if we should add a fallback ...

Copy link
Contributor Author

@bd-samratmuk bd-samratmuk Nov 20, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This file is responsible for checking every line irrespective of the level hence it's added here as (c) can occur in any level.

}
configuration.setChildren(children);

Expand Down
14 changes: 14 additions & 0 deletions ...ntegration/detectable/detectables/gradle/functional/GradleReportParserFunctionalTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -114,4 +114,18 @@ void testUnresolvedConfigurations() {

System.out.println(new GsonBuilder().setPrettyPrinting().create().toJson(codeLocation.get()));
}

@Test
void testConstraintsAreFiltered() {
Optional<CodeLocation> codeLocation = buildCodeLocation("/gradle/constraints_dependencyGraph.txt", true);
Assertions.assertTrue(codeLocation.isPresent());
DependencyGraph graph = codeLocation.get().getDependencyGraph();

MavenGraphAssert graphAssert = new MavenGraphAssert(graph);
graphAssert.hasRootSize(1);
graphAssert.hasRootDependency("com.google.code.gson:gson:2.8.9");
graphAssert.hasNoDependency("org.apache.logging.log4j:log4j-api:2.17.1");
graphAssert.hasNoDependency("org.apache.commons:commons-collections4:4.4");
graphAssert.hasNoDependency("javax.servlet:javax.servlet-api:3.1.0");
}
}
17 changes: 17 additions & 0 deletions detectable/src/test/resources/detectables/functional/gradle/constraints_dependencyGraph.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
------------------------------------------------------------
Project :project
------------------------------------------------------------

archives - Configuration for archive artifacts. (n)
No dependencies

compile - Dependencies for source set 'main'. (n)
+--- org.apache.logging.log4j:log4j-api:2.17.1 (c)
+--- com.google.code.gson:gson:2.8.9
| \--- org.apache.httpcomponents:httpclient:4.5.13
| +--- commons-codec:commons-codec:1.11
| \--- javax.servlet:javax.servlet-api:3.1.0 (c)
\--- org.apache.commons:commons-collections4:4.4 (c)

(n) - Not resolved (configuration is not meant to be resolved)