From 722df28ed152fd42f01d3603d320a7b8f60d3c2c Mon Sep 17 00:00:00 2001 From: Pujitha Paladugu Date: Mon, 26 Oct 2026 07:46:54 -0700 Subject: [PATCH] fix(java): skip comment lines in gradle.lockfile (#5372) Signed-off-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com> Co-authored-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com> --- syft/pkg/cataloger/java/parse_gradle_lockfile.go | 5 +++++ .../cataloger/java/parse_gradle_lockfile_test.go | 16 ++++++++++++++++ 2 files changed, 21 insertions(+) diff --git a/syft/pkg/cataloger/java/parse_gradle_lockfile.go b/syft/pkg/cataloger/java/parse_gradle_lockfile.go index 4e9e8c694..672664c87 100644 --- a/syft/pkg/cataloger/java/parse_gradle_lockfile.go +++ b/syft/pkg/cataloger/java/parse_gradle_lockfile.go @@ -35,6 +35,11 @@ func parseGradleLockfile(_ context.Context, _ file.Resolver, _ *generic.Environm // Trim leading and trailing whitespace from the line line = strings.TrimSpace(line) + // skip comment lines (e.g. the header gradle writes), which may contain ':' and '=' characters + if strings.HasPrefix(line, "#") { + continue + } + groupNameVersion := line groupNameVersion = strings.Split(groupNameVersion, "=")[0] parts := strings.Split(groupNameVersion, ":") diff --git a/syft/pkg/cataloger/java/parse_gradle_lockfile_test.go b/syft/pkg/cataloger/java/parse_gradle_lockfile_test.go index a9208a1b8..cb4ade998 100644 --- a/syft/pkg/cataloger/java/parse_gradle_lockfile_test.go +++ b/syft/pkg/cataloger/java/parse_gradle_lockfile_test.go @@ -87,3 +87,19 @@ func Test_parserGradleLockfile_lineTooLong(t *testing.T) { require.Len(t, pkgs, 1) assert.Equal(t, "before", pkgs[0].Name) } + +func Test_parserGradleLockfile_skipsComments(t *testing.T) { + contents := `# This is a Gradle generated file for dependency locking. +# To regenerate this file, run: ./gradlew :dependencies --write-locks + # indented: comment=too +com.squareup.okhttp3:okhttp:4.12.0=compileClasspath,runtimeClasspath +empty=annotationProcessor +` + reader := file.NewLocationReadCloser(file.NewLocation("gradle.lockfile"), io.NopCloser(strings.NewReader(contents))) + + pkgs, _, err := parseGradleLockfile(context.Background(), nil, nil, reader) + require.NoError(t, err) + require.Len(t, pkgs, 1) + assert.Equal(t, "okhttp", pkgs[0].Name) + assert.Equal(t, "4.12.0", pkgs[0].Version) +}