oss/syft
2
0
Fork 0
mirror of https://github.com/anchore/syft.git synced 2025-11-17 08:23:15 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix: identify cyclone-json without $schema (#2303)

Browse Source 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
This commit is contained in:
Keith Zantow 2023-11-08 11:54:22 -05:00 committed by GitHub
parent 9b98785aab
commit d91c2dd842
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
4 changed files with 74 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
syft/format/cyclonedxjson/decoder.go
View File

@ -4,7 +4,6 @@ import (
"encoding/json"
"fmt"
"io"
"strings"
"github.com/CycloneDX/cyclonedx-go"
@ -75,7 +74,7 @@ func (d decoder) Identify(reader io.ReadSeeker) (sbom.FormatID, string) {
return "", ""
}
id, version := getFormatInfo(doc.JSONSchema, doc.BOMFormat, doc.SpecVersion)
id, version := getFormatInfo(doc.BOMFormat, doc.SpecVersion)
if version == "" || id != ID {
// not a cyclonedx json document that we support
return "", ""
@ -84,18 +83,13 @@ func (d decoder) Identify(reader io.ReadSeeker) (sbom.FormatID, string) {
return id, version
}
func getFormatInfo(schemaURI, bomFormat string, specVersion any) (sbom.FormatID, string) {
if !strings.Contains(schemaURI, "cyclonedx.org/schema/bom") {
// not a cyclonedx json document
return "", ""
}
func getFormatInfo(bomFormat string, specVersion any) (sbom.FormatID, string) {
if bomFormat != "CycloneDX" {
// not a cyclonedx json document
return "", ""
}
// by this point this looks to be valid cyclonedx json, but we need to know the version
// by this point, it looks to be cyclonedx json, but we need to know the version
var (
version string

15
syft/format/cyclonedxjson/decoder_test.go
View File

@ -103,6 +103,21 @@ func TestDecoder_Identify(t *testing.T) {
})
}
cases = append(cases, []testCase{
{
name: "no-schema-1.4",
file: "test-fixtures/identify/micronaut-1.4.json",
id: ID,
version: "1.4",
},
{
name: "no-schema-1.5",
file: "test-fixtures/identify/micronaut-1.5.json",
id: ID,
version: "1.5",
},
}...)
for _, test := range cases {
t.Run(test.name, func(t *testing.T) {
reader, err := os.Open(test.file)

28
syft/format/cyclonedxjson/test-fixtures/identify/micronaut-1.4.json Normal file
View File

@ -0,0 +1,28 @@
{
"bomFormat": "CycloneDX",
"specVersion": "1.4",
"version": 1,
"components": [
{
"type": "library",
"group": "io.netty",
"name": "netty-codec-http2",
"version": "4.1.73.Final",
"properties": [
{
"name": "syft:cpe23",
"value": "cpe:2.3:a:codec:codec:4.1.73.Final:*:*:*:*:*:*:*"
},
{
"name": "syft:cpe23",
"value": "cpe:2.3:a:codec:netty-codec-http2:4.1.73.Final:*:*:*:*:*:*:*"
},
{
"name": "syft:cpe23",
"value": "cpe:2.3:a:codec:netty_codec_http2:4.1.73.Final:*:*:*:*:*:*:*"
}
]
}
],
"serialNumber": "urn:uuid:43538af4-f715-3d85-9629-336fdd3790ad"
}

28
syft/format/cyclonedxjson/test-fixtures/identify/micronaut-1.5.json Normal file
View File

@ -0,0 +1,28 @@
{
"bomFormat": "CycloneDX",
"specVersion": "1.5",
"version": 1,
"components": [
{
"type": "library",
"group": "io.netty",
"name": "netty-codec-http2",
"version": "4.1.73.Final",
"properties": [
{
"name": "syft:cpe23",
"value": "cpe:2.3:a:codec:codec:4.1.73.Final:*:*:*:*:*:*:*"
},
{
"name": "syft:cpe23",
"value": "cpe:2.3:a:codec:netty-codec-http2:4.1.73.Final:*:*:*:*:*:*:*"
},
{
"name": "syft:cpe23",
"value": "cpe:2.3:a:codec:netty_codec_http2:4.1.73.Final:*:*:*:*:*:*:*"
}
]
}
],
"serialNumber": "urn:uuid:f4-f715-3d85-9629-336fdd3790ad"
}