Merge branch 'main' of github.com:DmitriyLewen/go-dep-parser into fea…

…t/line-numbers-pom
aquasecurity · Jan 23, 2024 · 8a7bdf2 · 8a7bdf2
2 parents 21a2c76 + c95688d
commit 8a7bdf2
Show file tree

Hide file tree

Showing 6 changed files with 101 additions and 6 deletions.
diff --git a/go.mod b/go.mod
@@ -15,7 +15,7 @@ require (
 	go.uber.org/zap v1.26.0
 	golang.org/x/exp v0.0.0-20220407100705-7b9b53b0aca4
 	golang.org/x/mod v0.14.0
-	golang.org/x/net v0.19.0
+	golang.org/x/net v0.20.0
 	golang.org/x/text v0.14.0
 	golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2
 	gopkg.in/yaml.v3 v3.0.1

diff --git a/go.sum b/go.sum
@@ -46,8 +46,8 @@ golang.org/x/exp v0.0.0-20220407100705-7b9b53b0aca4 h1:K3x+yU+fbot38x5bQbU2QqUAV
 golang.org/x/exp v0.0.0-20220407100705-7b9b53b0aca4/go.mod h1:lgLbSvA5ygNOMpwM/9anMpWVlVJ7Z+cHWq/eFuinpGE=
 golang.org/x/mod v0.14.0 h1:dGoOF9QVLYng8IHTm7BAyWqCqSheQ5pYWGhzW00YJr0=
 golang.org/x/mod v0.14.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
-golang.org/x/net v0.19.0 h1:zTwKpTd2XuCqf8huc7Fo2iSy+4RHPd10s4KzeTnVr1c=
-golang.org/x/net v0.19.0/go.mod h1:CfAk/cbD4CthTvqiEl8NpboMuiuOYsAr/7NOjZJtv1U=
+golang.org/x/net v0.20.0 h1:aCL9BSgETF1k+blQaYUBx9hJ9LOGP3gAVemcZlf1Kpo=
+golang.org/x/net v0.20.0/go.mod h1:z8BVo6PvndSri0LbOE3hAn0apkU+1YvI6E70E9jsnvY=
 golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=

diff --git a/pkg/java/pom/parse_test.go b/pkg/java/pom/parse_test.go
@@ -767,6 +767,51 @@ func TestPom_Parse(t *testing.T) {
 				},
 			},
 		},
+		{
+			name:      "exclusions in child",
+			inputFile: filepath.Join("testdata", "exclusions-in-child", "pom.xml"),
+			local:     true,
+			want: []types.Library{
+				{
+					ID:      "com.example:example:1.0.0",
+					Name:    "com.example:example",
+					Version: "1.0.0",
+				},
+				{
+					ID:       "org.example:example-api:1.7.30",
+					Name:     "org.example:example-api",
+					Version:  "1.7.30",
+					Indirect: true,
+					License:  "The Apache Software License, Version 2.0",
+				},
+				{
+					ID:       "org.example:example-dependency:1.2.3",
+					Name:     "org.example:example-dependency",
+					Version:  "1.2.3",
+					Indirect: true,
+				},
+				{
+					ID:      "org.example:example-exclusions:4.0.0",
+					Name:    "org.example:example-exclusions",
+					Version: "4.0.0",
+				},
+			},
+			wantDeps: []types.Dependency{
+				{
+					ID: "com.example:example:1.0.0",
+					DependsOn: []string{
+						"org.example:example-exclusions:4.0.0",
+					},
+				},
+				{
+					ID: "org.example:example-exclusions:4.0.0",
+					DependsOn: []string{
+						"org.example:example-api:1.7.30",
+						"org.example:example-dependency:1.2.3",
+					},
+				},
+			},
+		},
 		{
 			name:      "exclusions with wildcards",
 			inputFile: filepath.Join("testdata", "wildcard-exclusions", "pom.xml"),

diff --git a/pkg/java/pom/pom.go b/pkg/java/pom/pom.go
@@ -4,6 +4,7 @@ import (
 	"encoding/xml"
 	"fmt"
 	"io"
+	"maps"
 	"reflect"
 	"strings"
 
@@ -257,9 +258,13 @@ func (d pomDependency) Resolve(props map[string]string, depManagement, rootDepMa
 
 // ToArtifact converts dependency to artifact.
 // It should be called after calling Resolve() so that variables can be evaluated.
-func (d pomDependency) ToArtifact(exclusions map[string]struct{}) artifact {
-	if exclusions == nil {
-		exclusions = map[string]struct{}{}
+func (d pomDependency) ToArtifact(ex map[string]struct{}) artifact {
+	// To avoid shadow adding exclusions to top pom's,
+	// we need to initialize a new map for each new artifact
+	// See `exclusions in child` test for more information
+	exclusions := map[string]struct{}{}
+	if ex != nil {
+		exclusions = maps.Clone(ex)
 	}
 	for _, e := range d.Exclusions.Exclusion {
 		exclusions[fmt.Sprintf("%s:%s", e.GroupID, e.ArtifactID)] = struct{}{}

diff --git a/pkg/java/pom/testdata/exclusions-in-child/pom.xml b/pkg/java/pom/testdata/exclusions-in-child/pom.xml
@@ -0,0 +1,17 @@
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+
+    <groupId>com.example</groupId>
+    <artifactId>example</artifactId>
+    <version>1.0.0</version>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.example</groupId>
+            <artifactId>example-exclusions</artifactId>
+            <version>4.0.0</version>
+        </dependency>
+    </dependencies>
+
+</project>
diff --git a/...pom/testdata/repository/org/example/example-exclusions/4.0.0/example-exclusions-4.0.0.pom b/...pom/testdata/repository/org/example/example-exclusions/4.0.0/example-exclusions-4.0.0.pom
@@ -0,0 +1,28 @@
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+
+    <groupId>org.example</groupId>
+    <artifactId>example-exclusions</artifactId>
+    <version>4.0.0</version>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.example</groupId>
+            <artifactId>example-dependency</artifactId>
+            <version>1.2.3</version>
+            <exclusions>
+                <exclusion>
+                    <groupId>org.example</groupId>
+                    <artifactId>example-api</artifactId>
+                </exclusion>
+            </exclusions>
+        </dependency>
+        <dependency>
+            <groupId>org.example</groupId>
+            <artifactId>example-api</artifactId>
+            <version>1.7.30</version>
+        </dependency>
+    </dependencies>
+
+</project>