feat(parser): ignore white space in pom.xml files (#7747)

Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
aquasecurity · Oct 17, 2024 · a7baa93 · a7baa93
1 parent 922949a
commit a7baa93
Show file tree

Hide file tree

Showing 3 changed files with 96 additions and 1 deletion.
diff --git a/pkg/dependency/parser/java/pom/artifact.go b/pkg/dependency/parser/java/pom/artifact.go
@@ -163,7 +163,7 @@ func evaluateVariable(s string, props map[string]string, seenProps []string) str
 		}
 		s = strings.ReplaceAll(s, m[0], newValue)
 	}
-	return s
+	return strings.TrimSpace(s)
 }
 
 func printLoopedPropertiesStack(env string, usedProps []string) {

diff --git a/pkg/dependency/parser/java/pom/parse_test.go b/pkg/dependency/parser/java/pom/parse_test.go
@@ -1974,6 +1974,70 @@ func TestPom_Parse(t *testing.T) {
 				},
 			},
 		},
+		//[INFO] com.example:root-pom-with-spaces:jar:1.0.0
+		//[INFO] \- org.example:example-nested:jar:3.3.3:compile
+		//[INFO]    \- org.example:example-dependency:jar:1.2.4:compile
+		//[INFO]       \- org.example:example-api:jar:2.0.0:compile
+		{
+			name:      "space at the start and/or end of the text nodes",
+			inputFile: filepath.Join("testdata", "with-spaces", "pom.xml"),
+			local:     true,
+			want: []ftypes.Package{
+				{
+					ID:           "com.example:root-pom-with-spaces:1.0.0",
+					Name:         "com.example:root-pom-with-spaces",
+					Version:      "1.0.0",
+					Relationship: ftypes.RelationshipRoot,
+				},
+				{
+					ID:           "org.example:example-nested:3.3.3",
+					Name:         "org.example:example-nested",
+					Version:      "3.3.3",
+					Relationship: ftypes.RelationshipDirect,
+					Locations: ftypes.Locations{
+						{
+							StartLine: 24,
+							EndLine:   28,
+						},
+					},
+				},
+				{
+					ID:           "org.example:example-api:2.0.0",
+					Name:         "org.example:example-api",
+					Version:      "2.0.0",
+					Licenses:     []string{"The Apache Software License, Version 2.0"},
+					Relationship: ftypes.RelationshipIndirect,
+				},
+				// dependency version is taken from `com.example:root-pom-with-spaces` from dependencyManagement
+				// not from `com.example:example-nested` from `com.example:example-nested`
+				{
+					ID:           "org.example:example-dependency:1.2.4",
+					Name:         "org.example:example-dependency",
+					Version:      "1.2.4",
+					Relationship: ftypes.RelationshipIndirect,
+				},
+			},
+			wantDeps: []ftypes.Dependency{
+				{
+					ID: "com.example:root-pom-with-spaces:1.0.0",
+					DependsOn: []string{
+						"org.example:example-nested:3.3.3",
+					},
+				},
+				{
+					ID: "org.example:example-dependency:1.2.4",
+					DependsOn: []string{
+						"org.example:example-api:2.0.0",
+					},
+				},
+				{
+					ID: "org.example:example-nested:3.3.3",
+					DependsOn: []string{
+						"org.example:example-dependency:1.2.4",
+					},
+				},
+			},
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {

diff --git a/pkg/dependency/parser/java/pom/testdata/with-spaces/pom.xml b/pkg/dependency/parser/java/pom/testdata/with-spaces/pom.xml
@@ -0,0 +1,31 @@
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <modelVersion> 4.0.0</modelVersion>
+
+    <groupId>com.example </groupId>
+    <artifactId> root-pom-with-spaces </artifactId>
+    <version> 1.0.0</version>
+
+    <properties>
+        <dependency.version > 1.2.4</dependency.version >
+    </properties>
+
+    <dependencyManagement>
+        <dependencies>
+            <dependency>
+                <groupId> org.example</groupId>
+                <artifactId>example-dependency </artifactId>
+                <version>${dependency.version} </version>
+            </dependency>
+        </dependencies>
+    </dependencyManagement>
+
+    <dependencies>
+        <dependency>
+            <groupId> org.example </groupId>
+            <artifactId>  example-nested   </artifactId>
+            <version>   3.3.3  </version>
+        </dependency>
+    </dependencies>
+
+</project>