feat: add maven component analysis path argument

src/analysis.js

@@ -60,13 +60,13 @@ async function requestStack(provider, manifest, url, html = false, opts = {}) {
 /**
  * Send a component analysis request and get the report as 'application/json'.
  * @param {import('./provider').Provider} provider - the provided data for constructing the request
- * @param {string} data - the content of the manifest
+ * @param {string} data - the content or the path of the manifest
  * @param {string} url - the backend url to send the request to
  * @param {{}} [opts={}] - optional various options to pass along the application
  * @returns {Promise<import('../generated/backend/AnalysisReport').AnalysisReport>}
  */
-async function requestComponent(provider, data, url, opts = {}) {
-	let provided = provider.provideComponent(data, opts) // throws error if content providing failed
+async function requestComponent(provider, data, url, opts = {}, path = '') {
+	let provided = provider.provideComponent(data, opts,path) // throws error if content providing failed
 	opts[rhdaOperationTypeHeader.toUpperCase().replaceAll("-","_")] = "component-analysis"
 	if (process.env["EXHORT_DEBUG"] === "true") {
 		console.log("Starting time of sending component analysis request to exhort server= " + new Date())
@@ -119,7 +119,13 @@ async function validateToken(url, opts = {}) {
 	return resp.status
 }
 
-
+/**
+ *
+ * @param {string} headerName - the header name to populate in request
+ * @param headers
+ * @param {{}} [opts={}] - optional various options to pass along the application
+ * @private
+ */
 function setRhdaHeader(headerName,headers,opts) {
 	let rhdaHeaderValue = getCustom(headerName.toUpperCase().replaceAll("-", "_"), null, opts);
 	if (rhdaHeaderValue) {

src/cli.js

@@ -13,7 +13,7 @@ const component = {
 		{
 			desc: 'manifest name and type',
 			type: 'string',
-			choices: ['pom.xml']
+			choices: ['pom.xml','package.json', 'go.mo', 'requirements.txt']
 		}
 	).positional(
 		'manifest-content',

src/index.js

@@ -92,10 +92,10 @@ async function stackAnalysis(manifest, html = false, opts = {}) {
  * @returns {Promise<AnalysisReport>}
  * @throws {Error} if no matching provider, failed to get create content, or backend request failed
  */
-async function componentAnalysis(manifestType, data, opts = {}) {
+async function componentAnalysis(manifestType, data, opts = {}, path = '') {
 	url = selectExhortBackend(opts)
 	let provider = match(manifestType, availableProviders) // throws error if no matching provider
-	return await analysis.requestComponent(provider, data, url, opts) // throws error request sending failed
+	return await analysis.requestComponent(provider, data, url, opts,path) // throws error request sending failed
 }
 
 async function validateToken(opts = {}) {

src/providers/java_maven.js

@@ -52,10 +52,10 @@ function provideStack(manifest, opts = {}) {
  * @param {{}} [opts={}] - optional various options to pass along the application
  * @returns {Provided}
  */
-function provideComponent(data, opts = {}) {
+function provideComponent(data, opts = {},path = '') {
 	return {
 		ecosystem,
-		content: getSbomForComponentAnalysis(data, opts),
+		content: getSbomForComponentAnalysis(data, opts,path),
 		contentType: 'application/vnd.cyclonedx+json'
 	}
 }
@@ -218,7 +218,7 @@ function createSbomStackAnalysis(manifest, opts = {}) {
  * @returns {[Dependency]} the Dot Graph content
  * @private
  */
-function getSbomForComponentAnalysis(data, opts = {}) {
+function getSbomForComponentAnalysis(data, opts = {}, manifestPath) {
 	// get custom maven path
 	let mvn = getCustomPath('mvn', opts)
 	// verify maven is accessible
@@ -228,34 +228,53 @@ function getSbomForComponentAnalysis(data, opts = {}) {
 		}
 	})
 	// create temp files for pom and effective pom
-	let tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'exhort_'))
-	let tmpEffectivePom = path.join(tmpDir, 'effective-pom.xml')
-	let tmpTargetPom = path.join(tmpDir, 'target-pom.xml')
-	// write target pom content to temp file
-	fs.writeFileSync(tmpTargetPom, data)
+	let tmpDir
+	let tmpEffectivePom
+	let targetPom
+
+	if (manifestPath.trim() === '') {
+		tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'exhort_'))
+		tmpEffectivePom = path.join(tmpDir, 'effective-pom.xml')
+		targetPom = path.join(tmpDir, 'target-pom.xml')
+		// write target pom content to temp file
+		fs.writeFileSync(targetPom, data)
+	}
+	else
+	{
+		tmpEffectivePom = path.join(path.dirname(manifestPath), 'effective-pom.xml')
+		targetPom = manifestPath
+	}
+
+
 	// create effective pom and save to temp file
-	execSync(`${mvn} -q help:effective-pom -Doutput=${tmpEffectivePom} -f ${tmpTargetPom}`, err => {
+	execSync(`${mvn} -q help:effective-pom -Doutput=${tmpEffectivePom} -f ${targetPom}`, err => {
 		if (err) {
 			throw new Error('failed creating maven effective pom')
 		}
 	})
 	// iterate over all dependencies in original pom and collect all ignored ones
-	let ignored = getDependencies(tmpTargetPom).filter(d => d.ignore)
+	let ignored = getDependencies(targetPom).filter(d => d.ignore)
 	// iterate over all dependencies and create a package for every non-ignored one
 	/** @type [Dependency] */
 	let dependencies = getDependencies(tmpEffectivePom)
 		.filter(d => !(dependencyIn(d, ignored)) && !(dependencyInExcludingVersion(d, ignored)))
 	let sbom = new Sbom();
-	let rootDependency = getRootFromPom(tmpTargetPom);
+	let rootDependency = getRootFromPom(targetPom);
 	let purlRoot = toPurl(rootDependency.groupId, rootDependency.artifactId, rootDependency.version)
 	sbom.addRoot(purlRoot)
 	let rootComponent = sbom.getRoot();
 	dependencies.forEach(dep => {
 		let currentPurl = toPurl(dep.groupId, dep.artifactId, dep.version)
 		sbom.addDependency(rootComponent, currentPurl)
 	})
-	// delete temp files and directory
-	fs.rmSync(tmpDir, {recursive: true, force: true})
+	if (manifestPath.trim() === '') {
+		// delete temp files and directory
+		fs.rmSync(tmpDir, {recursive: true, force: true})
+	}
+	else {
+		fs.rmSync(path.join(path.dirname(manifestPath), 'effective-pom.xml'))
+	}
+
 	// return dependencies list
 	return sbom.getAsJsonString()
 }
@@ -317,7 +336,22 @@ function getDependencies(manifest) {
 	// parse manifest pom.xml to json
 	let pomJson = parser.parse(buf.toString())
 	// iterate over all dependencies and chery pick dependencies with a exhortignore comment
-	pomJson['project']['dependencies']['dependency'].forEach(dep => {
+	let pomXml;
+	// project without modules
+	if(pomJson['project'])
+	{
+		if(pomJson['project']['dependencies'] !== undefined ) {
+			pomXml = pomJson['project']['dependencies']['dependency']
+		}
+		else
+			pomXml = []
+	}
+	// project with modules
+	else {
+		pomXml = pomJson['projects']['project'].filter(project => project.dependencies !== undefined).flatMap(project => project.dependencies.dependency)
+	}
+
+	pomXml.forEach(dep => {
 		let ignore = false
 		if (dep['#comment'] && dep['#comment'].includes('exhortignore')) { // #comment is an array or a string
 			ignore = true

test/providers/java_maven.test.js

@@ -118,3 +118,42 @@ suite('testing the java-maven data provider', () => {
 
 	})
 }).beforeAll(() => clock = sinon.useFakeTimers(new Date('2023-08-07T00:00:00.000Z'))).afterAll(()=> {clock.restore()});
+
+suite('testing the java-maven data provider with modules', () => {
+	[
+		"pom_with_one_module",
+		"pom_with_multiple_modules"
+
+	].forEach(testCase => {
+		let scenario = testCase.replaceAll('_', ' ')
+		test(`verify maven data provided for component analysis using path for scenario ${scenario}`, async () => {
+			// load the expected list for the scenario
+			let expectedSbom = fs.readFileSync(`test/providers/tst_manifests/maven/${testCase}/component_analysis_expected_sbom.json`,).toString().trim()
+			// read target manifest file
+			expectedSbom = JSON.stringify(JSON.parse(expectedSbom))
+			let effectivePomContent = fs.readFileSync(`test/providers/tst_manifests/maven/${testCase}/effectivePom.xml`,).toString()
+			let mockedExecFunction = function(command){
+				if(command.includes(":effective-pom")){
+					interceptAndOverwriteDataWithMock(command, effectivePomContent,"Doutput=");
+				}
+			}
+			javaMvnProviderRewire.__set__('execSync',mockedExecFunction)
+			// invoke sut component analysis for scenario manifest
+			let provideDataForComponent = await javaMvnProviderRewire.__get__("provideComponent")("",{},`test/providers/tst_manifests/maven/${testCase}/pom.xml`)
+			// verify returned data matches expectation
+			expect(provideDataForComponent).to.deep.equal({
+				ecosystem: 'maven',
+				contentType: 'application/vnd.cyclonedx+json',
+				content: expectedSbom
+			})
+			javaMvnProviderRewire.__ResetDependency__()
+			// expect(beautifiedOutput).to.deep.equal(expectedSbom)
+
+			// these test cases takes ~2500-2700 ms each pr >10000 in CI (for the first test-case)
+		}).timeout(process.env.GITHUB_ACTIONS ? 40000 : 10000)
+
+
+		// these test cases takes ~1400-2000 ms each pr >10000 in CI (for the first test-case)
+
+	})
+}).beforeAll(() => clock = sinon.useFakeTimers(new Date('2023-08-07T00:00:00.000Z'))).afterAll(()=> {clock.restore()});