Skip package-lock.json and yarn.lock in node_modules #431 (#485)

Signed-off-by: Keith Zantow <kzantow@gmail.com>

syft/pkg/cataloger/javascript/parse_package_json.go

@@ -206,3 +206,8 @@ func parsePackageJSON(_ string, reader io.Reader) ([]pkg.Package, error) {
 func (p PackageJSON) hasNameAndVersionValues() bool {
 	return p.Name != "" && p.Version != ""
 }
+
+func pathContainsNodeModulesDirectory(path string) bool {
+	isNodeModulesPath, _ := regexp.MatchString("[\\/]node_modules[\\/]", path)
+	return isNodeModulesPath
+}

syft/pkg/cataloger/javascript/parse_package_lock.go

@@ -27,9 +27,15 @@ type Dependency struct {
 	Requires  map[string]string
 }
 
-// parsePackageLock parses a package.lock and returns the discovered JavaScript packages.
-func parsePackageLock(_ string, reader io.Reader) ([]pkg.Package, error) {
-	packages := make([]pkg.Package, 0)
+// parsePackageLock parses a package-lock.json and returns the discovered JavaScript packages.
+func parsePackageLock(path string, reader io.Reader) ([]pkg.Package, error) {
+	// in the case we find package-lock.json files in the node_modules directories, skip those
+	// as the whole purpose of the lock file is for the specific dependencies of the root project
+	if pathContainsNodeModulesDirectory(path) {
+		return nil, nil
+	}
+
+	var packages []pkg.Package
 	dec := json.NewDecoder(reader)
 
 	for {

syft/pkg/cataloger/javascript/parse_yarn_lock.go

@@ -34,9 +34,14 @@ const (
 	noVersion = ""
 )
 
-func parseYarnLock(_ string, reader io.Reader) ([]pkg.Package, error) {
-	var packages []pkg.Package
+func parseYarnLock(path string, reader io.Reader) ([]pkg.Package, error) {
+	// in the case we find yarn.lock files in the node_modules directories, skip those
+	// as the whole purpose of the lock file is for the specific dependencies of the project
+	if pathContainsNodeModulesDirectory(path) {
+		return nil, nil
+	}
 
+	var packages []pkg.Package
 	scanner := bufio.NewScanner(reader)
 	parsedPackages := internal.NewStringSet()
 	currentPackage := noPackage