Associate node package licenses from node_modules

syft/pkg/cataloger/common/generic_cataloger.go

@@ -6,10 +6,9 @@ package common
 import (
 	"fmt"
 
-	"github.com/anchore/syft/syft/artifact"
-
 	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/source"
 )
@@ -19,9 +18,12 @@ import (
 type GenericCataloger struct {
 	globParsers       map[string]ParserFn
 	pathParsers       map[string]ParserFn
+	postProcess       PostProcessFunc
 	upstreamCataloger string
 }
 
+type PostProcessFunc func(resolver source.FileResolver, location source.Location, p *pkg.Package)
+
 // NewGenericCataloger if provided path-to-parser-function and glob-to-parser-function lookups creates a GenericCataloger
 func NewGenericCataloger(pathParsers map[string]ParserFn, globParsers map[string]ParserFn, upstreamCataloger string) *GenericCataloger {
 	return &GenericCataloger{
@@ -31,6 +33,16 @@ func NewGenericCataloger(pathParsers map[string]ParserFn, globParsers map[string
 	}
 }
 
+// NewPostProcessingGenericCataloger if provided path-to-parser-function and glob-to-parser-function lookups creates a GenericCataloger
+func NewPostProcessingGenericCataloger(pathParsers map[string]ParserFn, globParsers map[string]ParserFn, upstreamCataloger string, postProcess PostProcessFunc) *GenericCataloger {
+	return &GenericCataloger{
+		globParsers:       globParsers,
+		pathParsers:       pathParsers,
+		postProcess:       postProcess,
+		upstreamCataloger: upstreamCataloger,
+	}
+}
+
 // Name returns a string that uniquely describes the upstream cataloger that this Generic Cataloger represents.
 func (c *GenericCataloger) Name() string {
 	return c.upstreamCataloger
@@ -69,6 +81,10 @@ func (c *GenericCataloger) Catalog(resolver source.FileResolver) ([]pkg.Package,
 				continue
 			}
 
+			if c.postProcess != nil {
+				c.postProcess(resolver, location, p)
+			}
+
 			packages = append(packages, *p)
 		}
 

syft/pkg/cataloger/javascript/cataloger.go

@@ -4,7 +4,15 @@ Package javascript provides a concrete Cataloger implementation for JavaScript e
 package javascript
 
 import (
+	"encoding/json"
+	"io"
+	"path"
+	"strings"
+
+	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/pkg/cataloger/common"
+	"github.com/anchore/syft/syft/source"
 )
 
 // NewJavascriptPackageCataloger returns a new JavaScript cataloger object based on detection of npm based packages.
@@ -23,5 +31,47 @@ func NewJavascriptLockCataloger() *common.GenericCataloger {
 		"**/yarn.lock":         parseYarnLock,
 	}
 
-	return common.NewGenericCataloger(nil, globParsers, "javascript-lock-cataloger")
+	return common.NewPostProcessingGenericCataloger(nil, globParsers, "javascript-lock-cataloger", addLicenses)
+}
+
+func addLicenses(resolver source.FileResolver, location source.Location, p *pkg.Package) {
+	dir := path.Dir(location.RealPath)
+	pkgPath := []string{dir, "node_modules"}
+	pkgPath = append(pkgPath, strings.Split(p.Name, "/")...)
+	pkgPath = append(pkgPath, "package.json")
+	pkgFile := path.Join(pkgPath...)
+	locations, err := resolver.FilesByPath(pkgFile)
+	if err != nil || len(locations) == 0 {
+		log.Debugf("no package.json found at: %s", pkgFile)
+		return
+	}
+
+	for _, location := range locations {
+		contentReader, err := resolver.FileContentsByLocation(location)
+		if err != nil {
+			log.Debugf("error getting file content reader for %s: %v", pkgFile, err)
+			return
+		}
+
+		contents, err := io.ReadAll(contentReader)
+		if err != nil {
+			log.Debugf("error reading file contents for %s: %v", pkgFile, err)
+			return
+		}
+
+		var pkgJSON packageJSON
+		err = json.Unmarshal(contents, &pkgJSON)
+		if err != nil {
+			log.Debugf("error parsing %s: %v", pkgFile, err)
+			return
+		}
+
+		licenses, err := pkgJSON.licensesFromJSON()
+		if err != nil {
+			log.Debugf("error getting licenses from %s: %v", pkgFile, err)
+			return
+		}
+
+		p.Licenses = licenses
+	}
 }

syft/pkg/cataloger/javascript/cataloger_test.go

@@ -0,0 +1,102 @@
+package javascript
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/source"
+)
+
+func Test_JavascriptCataloger(t *testing.T) {
+	expected := map[string]pkg.Package{
+		"@actions/core": {
+			Name:     "@actions/core",
+			Version:  "1.6.0",
+			Language: pkg.JavaScript,
+			Type:     pkg.NpmPkg,
+			Licenses: []string{"MIT"},
+		},
+		"wordwrap": {
+			Name:     "wordwrap",
+			Version:  "0.0.3",
+			Language: pkg.JavaScript,
+			Type:     pkg.NpmPkg,
+		},
+		"get-stdin": {
+			Name:     "get-stdin",
+			Version:  "5.0.1",
+			Language: pkg.JavaScript,
+			Type:     pkg.NpmPkg,
+		},
+		"minimist": {
+			Name:     "minimist",
+			Version:  "0.0.10",
+			Language: pkg.JavaScript,
+			Type:     pkg.NpmPkg,
+		},
+		"optimist": {
+			Name:     "optimist",
+			Version:  "0.6.1",
+			Language: pkg.JavaScript,
+			Type:     pkg.NpmPkg,
+		},
+		"string-width": {
+			Name:     "string-width",
+			Version:  "2.1.1",
+			Language: pkg.JavaScript,
+			Type:     pkg.NpmPkg,
+		},
+		"strip-ansi": {
+			Name:     "strip-ansi",
+			Version:  "4.0.0",
+			Language: pkg.JavaScript,
+			Type:     pkg.NpmPkg,
+		},
+		"strip-eof": {
+			Name:     "wordwrap",
+			Version:  "1.0.0",
+			Language: pkg.JavaScript,
+			Type:     pkg.NpmPkg,
+		},
+		"ansi-regex": {
+			Name:     "ansi-regex",
+			Version:  "3.0.0",
+			Language: pkg.JavaScript,
+			Type:     pkg.NpmPkg,
+		},
+		"is-fullwidth-code-point": {
+			Name:     "is-fullwidth-code-point",
+			Version:  "2.0.0",
+			Language: pkg.JavaScript,
+			Type:     pkg.NpmPkg,
+		},
+		"cowsay": {
+			Name:     "cowsay",
+			Version:  "1.4.0",
+			Language: pkg.JavaScript,
+			Type:     pkg.NpmPkg,
+			Licenses: []string{"MIT"},
+		},
+	}
+
+	s, err := source.NewFromDirectory("test-fixtures/pkg-lock")
+	require.NoError(t, err)
+
+	resolver, err := s.FileResolver(source.AllLayersScope)
+	require.NoError(t, err)
+
+	actual, _, err := NewJavascriptLockCataloger().Catalog(resolver)
+	if err != nil {
+		t.Fatalf("failed to parse package-lock.json: %+v", err)
+	}
+
+	var pkgs []*pkg.Package
+	for _, p := range actual {
+		p2 := p
+		pkgs = append(pkgs, &p2)
+	}
+
+	assertPkgsEqual(t, pkgs, expected)
+}

syft/pkg/cataloger/javascript/parse_package_lock_test.go

@@ -30,6 +30,12 @@ func assertPkgsEqual(t *testing.T, actual []*pkg.Package, expected map[string]pk
 
 func TestParsePackageLock(t *testing.T) {
 	expected := map[string]pkg.Package{
+		"@actions/core": {
+			Name:     "@actions/core",
+			Version:  "1.6.0",
+			Language: pkg.JavaScript,
+			Type:     pkg.NpmPkg,
+		},
 		"wordwrap": {
 			Name:     "wordwrap",
 			Version:  "0.0.3",