Modify CPE vendor candidate generation approach (#484)

* consider additional vendor candidates for ruby, python, rpm, npm, and java Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * add java pom.xml processing Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * allow for downstream transform control in cpe generation processing Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * migrate CPE generation logic to dedicated package Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * split java manifest groupID extraction into two tiers Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * extract groupID from pom parent project during CPE generation Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * update java groupID processing tests to cover multi-tier approach Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * fix constructor names for cpe.fieldCandidate Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * rename helper function to startsWithTopLevelDomain Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * add nil changes for java manifest sections Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * update comment to reflect parsing maven files Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * split out java description parsing Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * split out pom parent processing Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * simplify vendorsFromGroupIDs and associated tests Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * simplify test type for vendorsFromGroupIDs Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * copy candidate varidations to new instances Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * rename CPE generation string util functions Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * add an explanation around fieldCandidate Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * simplify type for the cpe.fieldCandidateSet Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * make CPE filter function names more readable Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * update groupIDsFromJavaManifest to use a guard clause Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * extract groupID extraction from artifactID fields into a separate function Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * bump goreleaser version to combat failure Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
2026-10-30 14:02:26 +01:00 · 2021-09-03 14:21:25 -04:00
parent 0799fd9d46
commit abbba3fc19
37 changed files with 3208 additions and 1763 deletions
@@ -0,0 +1,60 @@
+package java
+
+import (
+	"encoding/xml"
+	"fmt"
+	"io"
+	"strings"
+
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/vifraa/gopom"
+	"golang.org/x/net/html/charset"
+)
+
+const pomXMLGlob = "*pom.xml"
+
+func parsePomXML(path string, reader io.Reader) (*pkg.PomProject, error) {
+	var project gopom.Project
+
+	decoder := xml.NewDecoder(reader)
+	// prevent against warnings for "xml: encoding "iso-8859-1" declared but Decoder.CharsetReader is nil"
+	decoder.CharsetReader = charset.NewReaderLabel
+
+	if err := decoder.Decode(&project); err != nil {
+		return nil, fmt.Errorf("unable to unmarshal pom.xml: %w", err)
+	}
+
+	return &pkg.PomProject{
+		Path:        path,
+		Parent:      pomParent(project.Parent),
+		GroupID:     project.GroupID,
+		ArtifactID:  project.ArtifactID,
+		Version:     project.Version,
+		Name:        project.Name,
+		Description: cleanDescription(project.Description),
+		URL:         project.URL,
+	}, nil
+}
+
+func pomParent(parent gopom.Parent) (result *pkg.PomParent) {
+	if parent.ArtifactID != "" || parent.GroupID != "" || parent.Version != "" {
+		result = &pkg.PomParent{
+			GroupID:    parent.GroupID,
+			ArtifactID: parent.ArtifactID,
+			Version:    parent.Version,
+		}
+	}
+	return result
+}
+
+func cleanDescription(original string) (cleaned string) {
+	descriptionLines := strings.Split(original, "\n")
+	for _, line := range descriptionLines {
+		line = strings.TrimSpace(line)
+		if len(line) == 0 {
+			continue
+		}
+		cleaned += line + " "
+	}
+	return strings.TrimSpace(cleaned)
+}