Modify CPE vendor candidate generation approach (#484)

* consider additional vendor candidates for ruby, python, rpm, npm, and java Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * add java pom.xml processing Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * allow for downstream transform control in cpe generation processing Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * migrate CPE generation logic to dedicated package Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * split java manifest groupID extraction into two tiers Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * extract groupID from pom parent project during CPE generation Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * update java groupID processing tests to cover multi-tier approach Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * fix constructor names for cpe.fieldCandidate Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * rename helper function to startsWithTopLevelDomain Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * add nil changes for java manifest sections Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * update comment to reflect parsing maven files Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * split out java description parsing Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * split out pom parent processing Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * simplify vendorsFromGroupIDs and associated tests Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * simplify test type for vendorsFromGroupIDs Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * copy candidate varidations to new instances Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * rename CPE generation string util functions Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * add an explanation around fieldCandidate Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * simplify type for the cpe.fieldCandidateSet Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * make CPE filter function names more readable Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * update groupIDsFromJavaManifest to use a guard clause Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * extract groupID extraction from artifactID fields into a separate function Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * bump goreleaser version to combat failure Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
2026-10-31 06:26:30 +01:00 · 2021-09-03 14:21:25 -04:00
parent 0799fd9d46
commit abbba3fc19
37 changed files with 3208 additions and 1763 deletions
@@ -0,0 +1,130 @@
+package java
+
+import (
+	"bufio"
+	"fmt"
+	"io"
+	"strconv"
+	"strings"
+
+	"github.com/anchore/syft/internal/log"
+
+	"github.com/anchore/syft/syft/pkg"
+)
+
+const manifestGlob = "/META-INF/MANIFEST.MF"
+
+// nolint:funlen
+// parseJavaManifest takes MANIFEST.MF file content and returns sections of parsed key/value pairs.
+// For more information: https://docs.oracle.com/en/java/javase/11/docs/specs/jar/jar.html#jar-manifest
+func parseJavaManifest(path string, reader io.Reader) (*pkg.JavaManifest, error) {
+	var manifest pkg.JavaManifest
+	sections := []map[string]string{
+		make(map[string]string),
+	}
+	currentSection := 0
+	scanner := bufio.NewScanner(reader)
+	var lastKey string
+	for scanner.Scan() {
+		line := scanner.Text()
+
+		// empty lines denote section separators
+		if strings.TrimSpace(line) == "" {
+			currentSection++
+			// we don't want to allocate a new section map that wont necessarily be used, do that once there is
+			// a non-empty line to process
+
+			// do not process line continuations after this
+			lastKey = ""
+			continue
+		} else if currentSection >= len(sections) {
+			sections = append(sections, make(map[string]string))
+		}
+
+		if line[0] == ' ' {
+			// this is a continuation
+			if lastKey == "" {
+				return nil, fmt.Errorf("found continuation with no previous key (%s)", line)
+			}
+			sections[currentSection][lastKey] += strings.TrimSpace(line)
+		} else {
+			// this is a new key-value pair
+			idx := strings.Index(line, ":")
+			if idx == -1 {
+				return nil, fmt.Errorf("unable to split java manifest key-value pairs: %q", line)
+			}
+
+			key := strings.TrimSpace(line[0:idx])
+			value := strings.TrimSpace(line[idx+1:])
+			sections[currentSection][key] = value
+
+			// keep track of key for potential future continuations
+			lastKey = key
+		}
+	}
+
+	if err := scanner.Err(); err != nil {
+		return nil, fmt.Errorf("unable to read java manifest: %w", err)
+	}
+
+	if len(sections) > 0 {
+		manifest.Main = sections[0]
+		if len(sections) > 1 {
+			manifest.NamedSections = make(map[string]map[string]string)
+			for i, s := range sections[1:] {
+				name, ok := s["Name"]
+				if !ok {
+					// per the manifest spec (https://docs.oracle.com/en/java/javase/11/docs/specs/jar/jar.html#jar-manifest)
+					// this should never happen. If it does we want to know about it, but not necessarily stop
+					// cataloging entirely... for this reason we only log.
+					log.Warnf("java manifest section found without a name: %s", path)
+					name = strconv.Itoa(i)
+				} else {
+					delete(s, "Name")
+				}
+				manifest.NamedSections[name] = s
+			}
+		}
+	}
+
+	return &manifest, nil
+}
+
+func selectName(manifest *pkg.JavaManifest, filenameObj archiveFilename) string {
+	var name string
+	switch {
+	case filenameObj.name != "":
+		name = filenameObj.name
+	case manifest.Main["Name"] != "":
+		// Manifest original spec...
+		name = manifest.Main["Name"]
+	case manifest.Main["Bundle-Name"] != "":
+		// BND tooling...
+		name = manifest.Main["Bundle-Name"]
+	case manifest.Main["Short-Name"] != "":
+		// Jenkins...
+		name = manifest.Main["Short-Name"]
+	case manifest.Main["Extension-Name"] != "":
+		// Jenkins...
+		name = manifest.Main["Extension-Name"]
+	case manifest.Main["Implementation-Title"] != "":
+		// last ditch effort...
+		name = manifest.Main["Implementation-Title"]
+	}
+	return name
+}
+
+func selectVersion(manifest *pkg.JavaManifest, filenameObj archiveFilename) string {
+	var version string
+	switch {
+	case filenameObj.version != "":
+		version = filenameObj.version
+	case manifest.Main["Implementation-Version"] != "":
+		version = manifest.Main["Implementation-Version"]
+	case manifest.Main["Specification-Version"] != "":
+		version = manifest.Main["Specification-Version"]
+	case manifest.Main["Plugin-Version"] != "":
+		version = manifest.Main["Plugin-Version"]
+	}
+	return version
+}