Set license name instead of ID when using custom license

Co-authored-by: Ross Murphy <RossMurphy@ibm.com> Signed-off-by: nscuro <nscuro@protonmail.com>
DependencyTrack · Jul 8, 2024 · 50e0acb · 50e0acb
1 parent c7f5dd0
commit 50e0acb
Show file tree

Hide file tree

Showing 2 changed files with 80 additions and 1 deletion.
diff --git a/src/main/java/org/dependencytrack/parser/cyclonedx/util/ModelConverter.java b/src/main/java/org/dependencytrack/parser/cyclonedx/util/ModelConverter.java
@@ -754,7 +754,11 @@ public static org.cyclonedx.model.Component convert(final QueryManager qm, final
  final LicenseChoice licenses = new LicenseChoice();
  if (component.getResolvedLicense() != null) {
  final org.cyclonedx.model.License license = new org.cyclonedx.model.License();
- license.setId(component.getResolvedLicense().getLicenseId());
+ if (!component.getResolvedLicense().isCustomLicense()) {
+ license.setId(component.getResolvedLicense().getLicenseId());
+ } else {
+ license.setName(component.getResolvedLicense().getName());
+ }
  license.setUrl(component.getLicenseUrl());
  licenses.addLicense(license);
  cycloneComponent.setLicenses(licenses);

diff --git a/src/test/java/org/dependencytrack/resources/v1/BomResourceTest.java b/src/test/java/org/dependencytrack/resources/v1/BomResourceTest.java
@@ -312,6 +312,81 @@ public void exportProjectAsCycloneDxInventoryTest() {
  assertThat(componentWithVulnAndAnalysis.getDirectDependencies()).isNotNull();
  }
 
+ @Test
+ public void exportProjectAsCycloneDxLicenseTest() {
+ Project project = qm.createProject("Acme Example", null, "1.0", null, null, null, true, false);
+ Component c = new Component();
+ c.setProject(project);
+ c.setName("sample-component");
+ c.setVersion("1.0");
+ org.dependencytrack.model.License license = new org.dependencytrack.model.License();
+ license.setId(1234);
+ license.setName("CustomName");
+ license.setCustomLicense(true);
+ c.setResolvedLicense(license);
+ c.setDirectDependencies("[]");
+ Component component = qm.createComponent(c, false);
+ qm.persist(project);
+ Response response = jersey.target(V1_BOM + "/cyclonedx/project/" + project.getUuid()).request()
+ .header(X_API_KEY, apiKey)
+ .get(Response.class);
+
+ final String jsonResponse = getPlainTextBody(response);
+ assertThatNoException().isThrownBy(() -> CycloneDxValidator.getInstance().validate(jsonResponse.getBytes()));
+ assertThatJson(jsonResponse)
+ .withMatcher("component", equalTo(component.getUuid().toString()))
+ .withMatcher("projectUuid", equalTo(project.getUuid().toString()))
+ .isEqualTo(json("""
+ {
+ "bomFormat": "CycloneDX",
+ "specVersion": "1.5",
+ "serialNumber": "${json-unit.ignore}",
+ "version": 1,
+ "metadata": {
+ "timestamp": "${json-unit.any-string}",
+ "tools": [
+ {
+ "vendor": "OWASP",
+ "name": "Dependency-Track",
+ "version": "${json-unit.any-string}"
+ }
+ ],
+ "component": {
+ "type": "library",
+ "bom-ref": "${json-unit.matches:projectUuid}",
+ "name": "Acme Example",
+ "version": "1.0"
+ }
+ },
+ "components": [
+ {
+ "type": "library",
+ "bom-ref": "${json-unit.matches:component}",
+ "name": "sample-component",
+ "version": "1.0",
+ "licenses": [
+ {
+ "license": {
+ "name": "CustomName"
+ }
+ }
+ ]
+ }
+ ],
+ "dependencies": [
+ {
+ "ref": "${json-unit.matches:projectUuid}",
+ "dependsOn": []
+ },
+ {
+ "ref": "${json-unit.matches:component}",
+ "dependsOn": []
+ }
+ ]
+ }
+ """));
+ }
+
  @Test
  public void exportProjectAsCycloneDxInventoryWithVulnerabilitiesTest() {
  var vulnerability = new Vulnerability();