From 2b3da80a17409f354462ae75fe64f3595c18d470 Mon Sep 17 00:00:00 2001
From: andreas hilti <andreas.hilti@bluewin.ch>
Date: Thu, 17 Aug 2023 22:45:52 +0200
Subject: [PATCH] Fix the xml serialization order

Properties needs to be in front of Components.

Signed-off-by: andreas hilti <andreas.hilti@bluewin.ch>
---
 src/CycloneDX.Core/Models/Component.cs        |  9 ++++--
 .../v1.4/valid-properties-components-1.4.xml  | 31 +++++++++++++++++++
 .../Xml/v1.4/SerializationTests.cs            |  1 +
 3 files changed, 38 insertions(+), 3 deletions(-)
 create mode 100644 tests/CycloneDX.Core.Tests/Resources/v1.4/valid-properties-components-1.4.xml

diff --git a/src/CycloneDX.Core/Models/Component.cs b/src/CycloneDX.Core/Models/Component.cs
index 8fa0edba..e087147b 100644
--- a/src/CycloneDX.Core/Models/Component.cs
+++ b/src/CycloneDX.Core/Models/Component.cs
@@ -178,15 +178,18 @@ public bool NonNullableModified
         public List<ExternalReference> ExternalReferences { get; set; }
         public bool ShouldSerializeExternalReferences() { return ExternalReferences?.Count > 0; }
 
-        [XmlArray("components")]
-        [ProtoMember(21)]
-        public List<Component> Components { get; set; }
+        //In the xml format, Properties is in front of Components.
+        //XML serialization uses the member order unless explicitly specified differently.
 
         [XmlArray("properties")]
         [XmlArrayItem("property")]
         [ProtoMember(22)]
         public List<Property> Properties { get; set; }
         public bool ShouldSerializeProperties() { return Properties?.Count > 0; }
+
+        [XmlArray("components")]
+        [ProtoMember(21)]
+        public List<Component> Components { get; set; }
         
         [XmlElement("evidence")]
         [ProtoMember(23)]
diff --git a/tests/CycloneDX.Core.Tests/Resources/v1.4/valid-properties-components-1.4.xml b/tests/CycloneDX.Core.Tests/Resources/v1.4/valid-properties-components-1.4.xml
new file mode 100644
index 00000000..ea0926e4
--- /dev/null
+++ b/tests/CycloneDX.Core.Tests/Resources/v1.4/valid-properties-components-1.4.xml
@@ -0,0 +1,31 @@
+<?xml version="1.0"?>
+<bom serialNumber="urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79" version="1" xmlns="http://cyclonedx.org/schema/bom/1.4">
+    <metadata>
+        <properties>
+            <property name="Foo">Bar</property>
+            <property name="Foo">You</property>
+            <property name="Foo">Two</property>
+            <property name="Bar">Foo</property>
+        </properties>
+    </metadata>
+    <components>
+        <component type="library">
+            <name>acme-library</name>
+            <version>1.0.0</version>
+            <properties>
+                <property name="Foo">Bar</property>
+                <property name="Bar">Foo</property>
+            </properties>
+            <components>
+                <component type="library">
+                    <name>acme-sub-library</name>
+                    <version>1.0.0</version>
+                    <properties>
+                        <property name="Foo">Bar</property>
+                        <property name="Bar">Foo</property>
+                    </properties>
+                </component>
+            </components>
+        </component>
+    </components>
+</bom>
diff --git a/tests/CycloneDX.Core.Tests/Xml/v1.4/SerializationTests.cs b/tests/CycloneDX.Core.Tests/Xml/v1.4/SerializationTests.cs
index c34d8c69..b245e1fc 100644
--- a/tests/CycloneDX.Core.Tests/Xml/v1.4/SerializationTests.cs
+++ b/tests/CycloneDX.Core.Tests/Xml/v1.4/SerializationTests.cs
@@ -54,6 +54,7 @@ public class SerializationTests
         [InlineData("valid-minimal-viable-1.4.xml")]
         [InlineData("valid-patch-1.4.xml")]
         [InlineData("valid-properties-1.4.xml")]
+        [InlineData("valid-properties-components-1.4.xml")]
         // [InlineData("valid-random-attributes-1.4.xml")]
         [InlineData("valid-release-notes-1.4.xml")]
         [InlineData("valid-service-1.4.xml")]