diff --git a/syft/pkg/cataloger/java/parse_pom_xml.go b/syft/pkg/cataloger/java/parse_pom_xml.go index b343c8f46d3..a10009f7d81 100644 --- a/syft/pkg/cataloger/java/parse_pom_xml.go +++ b/syft/pkg/cataloger/java/parse_pom_xml.go @@ -24,6 +24,10 @@ func parserPomXML(path string, content io.Reader) ([]*pkg.Package, []artifact.Re var pkgs []*pkg.Package for _, dep := range pom.Dependencies { + if strings.HasPrefix(dep.Version, "${") { + versionProperty := dep.Version[2 : len(dep.Version)-1] + dep.Version = pom.Properties.Entries[versionProperty] + } p := newPackageFromPom(dep) if p.Name == "" { continue diff --git a/syft/pkg/cataloger/java/parse_pom_xml_test.go b/syft/pkg/cataloger/java/parse_pom_xml_test.go index 8c25cad9d67..e7fdfe6f69d 100644 --- a/syft/pkg/cataloger/java/parse_pom_xml_test.go +++ b/syft/pkg/cataloger/java/parse_pom_xml_test.go @@ -57,6 +57,141 @@ func Test_parserPomXML(t *testing.T) { } } +func Test_parseCommonsTextPomXMLProject(t *testing.T) { + tests := []struct { + input string + expected []*pkg.Package + }{ + { + input: "test-fixtures/pom/commons-text.pom.xml", + expected: []*pkg.Package{ + { + Name: "commons-lang3", + Version: "3.12.0", + FoundBy: javaPomCataloger, + Language: pkg.Java, + Type: pkg.JavaPkg, + MetadataType: pkg.JavaMetadataType, + Metadata: pkg.JavaMetadata{ + PURL: "pkg:maven/org.apache.commons/commons-lang3@3.12.0", + }, + }, + { + Name: "junit-jupiter", + Version: "", + FoundBy: javaPomCataloger, + Language: pkg.Java, + Type: pkg.JavaPkg, + MetadataType: pkg.JavaMetadataType, + Metadata: pkg.JavaMetadata{ + PURL: "pkg:maven/org.junit.jupiter/junit-jupiter", + }, + }, + { + Name: "assertj-core", + Version: "3.23.1", + FoundBy: javaPomCataloger, + Language: pkg.Java, + Type: pkg.JavaPkg, + MetadataType: pkg.JavaMetadataType, + Metadata: pkg.JavaMetadata{ + PURL: "pkg:maven/org.assertj/assertj-core@3.23.1", + }, + }, + { + Name: "commons-io", + Version: "2.11.0", + FoundBy: javaPomCataloger, + Language: pkg.Java, + Type: pkg.JavaPkg, + MetadataType: pkg.JavaMetadataType, + Metadata: pkg.JavaMetadata{ + PURL: "pkg:maven/commons-io/commons-io@2.11.0", + }, + }, + { + Name: "mockito-inline", + Version: "4.8.0", + FoundBy: javaPomCataloger, + Language: pkg.Java, + Type: pkg.JavaPkg, + MetadataType: pkg.JavaMetadataType, + Metadata: pkg.JavaMetadata{ + PURL: "pkg:maven/org.mockito/mockito-inline@4.8.0", + }, + }, + { + Name: "js", + Version: "22.0.0.2", + FoundBy: javaPomCataloger, + Language: pkg.Java, + Type: pkg.JavaPkg, + MetadataType: pkg.JavaMetadataType, + Metadata: pkg.JavaMetadata{ + PURL: "pkg:maven/org.graalvm.js/js@22.0.0.2", + }, + }, + { + Name: "js-scriptengine", + Version: "22.0.0.2", + FoundBy: javaPomCataloger, + Language: pkg.Java, + Type: pkg.JavaPkg, + MetadataType: pkg.JavaMetadataType, + Metadata: pkg.JavaMetadata{ + PURL: "pkg:maven/org.graalvm.js/js-scriptengine@22.0.0.2", + }, + }, + { + Name: "commons-rng-simple", + Version: "1.4", + FoundBy: javaPomCataloger, + Language: pkg.Java, + Type: pkg.JavaPkg, + MetadataType: pkg.JavaMetadataType, + Metadata: pkg.JavaMetadata{ + PURL: "pkg:maven/org.apache.commons/commons-rng-simple@1.4", + }, + }, + { + Name: "jmh-core", + Version: "1.35", + FoundBy: javaPomCataloger, + Language: pkg.Java, + Type: pkg.JavaPkg, + MetadataType: pkg.JavaMetadataType, + Metadata: pkg.JavaMetadata{ + PURL: "pkg:maven/org.openjdk.jmh/jmh-core@1.35", + }, + }, + { + Name: "jmh-generator-annprocess", + Version: "1.35", + FoundBy: javaPomCataloger, + Language: pkg.Java, + Type: pkg.JavaPkg, + MetadataType: pkg.JavaMetadataType, + Metadata: pkg.JavaMetadata{ + PURL: "pkg:maven/org.openjdk.jmh/jmh-generator-annprocess@1.35", + }, + }, + }, + }, + } + + for _, test := range tests { + t.Run(test.input, func(t *testing.T) { + fixture, err := os.Open(test.input) + assert.NoError(t, err) + + actual, relationships, err := parserPomXML(fixture.Name(), fixture) + assert.NoError(t, err) + assert.Nil(t, relationships) + assert.Equal(t, test.expected, actual) + }) + } +} + func Test_parsePomXMLProject(t *testing.T) { tests := []struct { expected pkg.PomProject diff --git a/syft/pkg/cataloger/java/test-fixtures/pom/commons-text.pom.xml b/syft/pkg/cataloger/java/test-fixtures/pom/commons-text.pom.xml new file mode 100644 index 00000000000..6f54a6ed6b1 --- /dev/null +++ b/syft/pkg/cataloger/java/test-fixtures/pom/commons-text.pom.xml @@ -0,0 +1,575 @@ + + + + 4.0.0 + + org.apache.commons + commons-parent + 54 + + commons-text + 1.10.0 + Apache Commons Text + Apache Commons Text is a library focused on algorithms working on strings. + https://commons.apache.org/proper/commons-text + + + ISO-8859-1 + UTF-8 + 1.8 + 1.8 + + text + org.apache.commons.text + + 1.10.0 + (Java 8+) + + TEXT + 12318221 + + text + https://svn.apache.org/repos/infra/websites/production/commons/content/proper/commons-text + site-content + + 5.9.1 + 3.2.0 + 9.3 + + 4.7.2.0 + 4.7.2 + 3.19.0 + 6.49.0 + + 4.8.0 + 0.8.8 + + + 3.10.0 + 3.4.1 + + + 22.0.0.2 + 1.4 + + 0.16.0 + false + + 1.35 + 3.1.2 + + + 1.9 + RC1 + true + scm:svn:https://dist.apache.org/repos/dist/dev/commons/${commons.componentid} + Gary Gregory + 86fdc7e2a11262cb + + + + + org.apache.commons + commons-lang3 + 3.12.0 + + + + org.junit.jupiter + junit-jupiter + test + + + org.assertj + assertj-core + 3.23.1 + test + + + commons-io + commons-io + 2.11.0 + test + + + org.mockito + + mockito-inline + ${commons.mockito.version} + test + + + org.graalvm.js + js + ${graalvm.version} + test + + + org.graalvm.js + js-scriptengine + ${graalvm.version} + test + + + org.apache.commons + commons-rng-simple + ${commons.rng.version} + test + + + org.openjdk.jmh + jmh-core + ${jmh.version} + test + + + org.openjdk.jmh + jmh-generator-annprocess + ${jmh.version} + test + + + + + clean verify apache-rat:check japicmp:cmp checkstyle:check spotbugs:check javadoc:javadoc + + + + org.apache.rat + apache-rat-plugin + + + site-content/** + src/site/resources/download_lang.cgi + src/test/resources/org/apache/commons/text/stringEscapeUtilsTestData.txt + src/test/resources/org/apache/commons/text/lcs-perf-analysis-inputs.csv + src/site/resources/release-notes/RELEASE-NOTES-*.txt + + + + + maven-pmd-plugin + ${commons.pmd.version} + + ${maven.compiler.target} + + + + net.sourceforge.pmd + pmd-core + ${commons.pmd-impl.version} + + + net.sourceforge.pmd + pmd-java + ${commons.pmd-impl.version} + + + net.sourceforge.pmd + pmd-javascript + ${commons.pmd-impl.version} + + + net.sourceforge.pmd + pmd-jsp + ${commons.pmd-impl.version} + + + + + + + + maven-checkstyle-plugin + ${checkstyle.plugin.version} + + false + src/conf/checkstyle.xml + src/conf/checkstyle-header.txt + src/conf/checkstyle-suppressions.xml + src/conf/checkstyle-suppressions.xml + true + **/generated/**.java,**/jmh_generated/**.java + + + + com.puppycrawl.tools + checkstyle + ${checkstyle.version} + + + + + com.github.spotbugs + spotbugs-maven-plugin + ${commons.spotbugs.plugin.version} + + + com.github.spotbugs + spotbugs + ${commons.spotbugs.impl.version} + + + + src/conf/spotbugs-exclude-filter.xml + + + + maven-assembly-plugin + + + src/assembly/bin.xml + src/assembly/src.xml + + gnu + + + + org.apache.maven.plugins + maven-jar-plugin + + + + test-jar + + + + + + + ${commons.module.name} + + + + + + org.apache.maven.plugins + maven-scm-publish-plugin + + + javadocs + + + + + org.apache.maven.plugins + maven-javadoc-plugin + + ${maven.compiler.source} + + + + + + + + + maven-checkstyle-plugin + ${checkstyle.plugin.version} + + false + src/conf/checkstyle.xml + src/conf/checkstyle-header.txt + src/conf/checkstyle-suppressions.xml + src/conf/checkstyle-suppressions.xml + true + **/generated/**.java,**/jmh_generated/**.java + + + + + checkstyle + + + + + + + com.github.spotbugs + spotbugs-maven-plugin + ${commons.spotbugs.plugin.version} + + src/conf/spotbugs-exclude-filter.xml + + + + com.github.siom79.japicmp + japicmp-maven-plugin + + + maven-pmd-plugin + 3.19.0 + + ${maven.compiler.target} + + + + + pmd + cpd + + + + + + org.codehaus.mojo + taglist-maven-plugin + 3.0.0 + + + + + Needs Work + + + TODO + exact + + + FIXME + exact + + + XXX + exact + + + + + Noteable Markers + + + NOTE + exact + + + NOPMD + exact + + + NOSONAR + exact + + + + + + + + + + + 2014 + + + + kinow + Bruno P. Kinoshita + kinow@apache.org + + + britter + Benedikt Ritter + britter@apache.org + + + chtompki + Rob Tompkins + chtompki@apache.org + + + ggregory + Gary Gregory + ggregory at apache.org + https://www.garygregory.com + The Apache Software Foundation + https://www.apache.org/ + + PMC Member + + America/New_York + + https://people.apache.org/~ggregory/img/garydgregory80.png + + + + djones + Duncan Jones + djones@apache.org + + + + + + Don Jeba + donjeba@yahoo.com + + + Sampanna Kahu + + + Jarek Strzelecki + + + Lee Adcock + + + Amey Jadiye + ameyjadiye@gmail.com + + + Arun Vinud S S + + + Ioannis Sermetziadis + + + Jostein Tveit + + + Luciano Medallia + + + Jan Martin Keil + + + Nandor Kollar + + + Nick Wong + + + Ali Ghanbari + https://ali-ghanbari.github.io/ + + + + + scm:git:https://gitbox.apache.org/repos/asf/commons-text + scm:git:https://gitbox.apache.org/repos/asf/commons-text + https://gitbox.apache.org/repos/asf?p=commons-text.git + + + + jira + https://issues.apache.org/jira/browse/TEXT + + + + + apache.website + Apache Commons Site + scm:svn:https://svn.apache.org/repos/infra/websites/production/commons/content/proper/commons-text/ + + + + + + setup-checkout + + + site-content + + + + + + org.apache.maven.plugins + maven-antrun-plugin + + + prepare-checkout + + run + + pre-site + + + + + + + + + + + + + + + + + + + + + + + + java9+ + + [9,) + + + + true + + + + benchmark + + true + org.apache + + + + + org.codehaus.mojo + exec-maven-plugin + 3.1.0 + + + benchmark + test + + exec + + + test + java + + -classpath + + org.openjdk.jmh.Main + -rf + json + -rff + target/jmh-result.${benchmark}.json + ${benchmark} + + + + + + + + + + \ No newline at end of file