diff --git a/syft/pkg/cataloger/java/parse_pom_xml.go b/syft/pkg/cataloger/java/parse_pom_xml.go index befe0537d..5fe1f34d1 100644 --- a/syft/pkg/cataloger/java/parse_pom_xml.go +++ b/syft/pkg/cataloger/java/parse_pom_xml.go @@ -236,7 +236,11 @@ func resolveProperty(pom gopom.Project, property *string, propertyName string) s seenBeforePropertyNames := map[string]struct{}{ propertyName: {}, } - return recursiveResolveProperty(pom, propertyCase, seenBeforePropertyNames) + result := recursiveResolveProperty(pom, propertyCase, seenBeforePropertyNames) + if propertyMatcher.MatchString(result) { + return "" // dereferencing variable failed; fall back to empty string + } + return result } //nolint:gocognit diff --git a/syft/pkg/cataloger/java/parse_pom_xml_test.go b/syft/pkg/cataloger/java/parse_pom_xml_test.go index 450f33fcd..66ebb5216 100644 --- a/syft/pkg/cataloger/java/parse_pom_xml_test.go +++ b/syft/pkg/cataloger/java/parse_pom_xml_test.go @@ -502,7 +502,7 @@ func Test_resolveProperty(t *testing.T) { pom: gopom.Project{ Parent: nil, }, - expected: "${project.parent.groupId}", + expected: "", }, { name: "nil string pointer halts search", @@ -512,7 +512,7 @@ func Test_resolveProperty(t *testing.T) { GroupID: nil, }, }, - expected: "${project.parent.groupId}", + expected: "", }, { name: "double dereference", @@ -537,7 +537,7 @@ func Test_resolveProperty(t *testing.T) { Version: stringPointer("1.2.3"), }, }, - expected: "${springboot.version}", + expected: "", }, { name: "resolution halts even if it resolves to a variable", @@ -552,7 +552,7 @@ func Test_resolveProperty(t *testing.T) { }, }, }, - expected: "${undefined.version}", + expected: "", }, { name: "resolution halts even if cyclic", @@ -564,7 +564,7 @@ func Test_resolveProperty(t *testing.T) { }, }, }, - expected: "${springboot.version}", + expected: "", }, { name: "resolution halts even if cyclic more steps", @@ -578,21 +578,24 @@ func Test_resolveProperty(t *testing.T) { }, }, }, - expected: "${cyclic.version}", + expected: "", }, { name: "resolution halts even if cyclic involving parent", property: "${cyclic.version}", pom: gopom.Project{ + Parent: &gopom.Parent{ + Version: stringPointer("${cyclic.version}"), + }, Properties: &gopom.Properties{ Entries: map[string]string{ - "other.version": "${cyclic.version}", + "other.version": "${parent.version}", "springboot.version": "${other.version}", "cyclic.version": "${springboot.version}", }, }, }, - expected: "${cyclic.version}", + expected: "", }, }