From 397dd217ad696d2bddc3fe15b477edfb6f91b4cf Mon Sep 17 00:00:00 2001 From: nscuro Date: Wed, 25 Sep 2024 17:08:43 +0200 Subject: [PATCH] Fix CPE not being imported from CycloneDX `metadata.component` Fixes #4173 Signed-off-by: nscuro --- .../parser/cyclonedx/util/ModelConverter.java | 9 +++++---- .../dependencytrack/tasks/BomUploadProcessingTask.java | 1 + .../tasks/BomUploadProcessingTaskTest.java | 3 +++ src/test/resources/unit/bom-1.xml | 5 +++++ 4 files changed, 14 insertions(+), 4 deletions(-) diff --git a/src/main/java/org/dependencytrack/parser/cyclonedx/util/ModelConverter.java b/src/main/java/org/dependencytrack/parser/cyclonedx/util/ModelConverter.java index fcf75410b8..347b4c5fbd 100644 --- a/src/main/java/org/dependencytrack/parser/cyclonedx/util/ModelConverter.java +++ b/src/main/java/org/dependencytrack/parser/cyclonedx/util/ModelConverter.java @@ -23,6 +23,10 @@ import alpine.model.IConfigProperty.PropertyType; import com.github.packageurl.MalformedPackageURLException; import com.github.packageurl.PackageURL; +import jakarta.json.Json; +import jakarta.json.JsonArray; +import jakarta.json.JsonObject; +import jakarta.json.JsonValue; import org.apache.commons.collections4.MultiValuedMap; import org.apache.commons.collections4.multimap.HashSetValuedHashMap; import org.apache.commons.lang3.StringUtils; @@ -57,10 +61,6 @@ import org.dependencytrack.persistence.QueryManager; import org.dependencytrack.util.VulnerabilityUtil; -import jakarta.json.Json; -import jakarta.json.JsonArray; -import jakarta.json.JsonObject; -import jakarta.json.JsonValue; import java.io.StringReader; import java.util.ArrayList; import java.util.Arrays; @@ -124,6 +124,7 @@ public static Project convertToProject(final org.cyclonedx.model.Component cdxCo project.setName(trimToNull(cdxComponent.getName())); project.setVersion(trimToNull(cdxComponent.getVersion())); project.setDescription(trimToNull(cdxComponent.getDescription())); + project.setCpe(trimToNull(cdxComponent.getCpe())); project.setExternalReferences(convertExternalReferences(cdxComponent.getExternalReferences())); List contacts = new ArrayList<>(); diff --git a/src/main/java/org/dependencytrack/tasks/BomUploadProcessingTask.java b/src/main/java/org/dependencytrack/tasks/BomUploadProcessingTask.java index 210dc6d391..cc234968af 100644 --- a/src/main/java/org/dependencytrack/tasks/BomUploadProcessingTask.java +++ b/src/main/java/org/dependencytrack/tasks/BomUploadProcessingTask.java @@ -335,6 +335,7 @@ private Project processProject( // changed |= applyIfChanged(project, metadataComponent, Project::getVersion, project::setVersion); // changed |= applyIfChanged(project, metadataComponent, Project::getDescription, project::setDescription); hasChanged |= applyIfChanged(persistentProject, project, Project::getExternalReferences, persistentProject::setExternalReferences); + hasChanged |= applyIfChanged(persistentProject, project, Project::getCpe, persistentProject::setCpe); hasChanged |= applyIfChanged(persistentProject, project, Project::getPurl, persistentProject::setPurl); hasChanged |= applyIfChanged(persistentProject, project, Project::getSwidTagId, persistentProject::setSwidTagId); } diff --git a/src/test/java/org/dependencytrack/tasks/BomUploadProcessingTaskTest.java b/src/test/java/org/dependencytrack/tasks/BomUploadProcessingTaskTest.java index 6384609b6a..84a5c9daf7 100644 --- a/src/test/java/org/dependencytrack/tasks/BomUploadProcessingTaskTest.java +++ b/src/test/java/org/dependencytrack/tasks/BomUploadProcessingTaskTest.java @@ -167,6 +167,9 @@ public void informTest() throws Exception { qm.getPersistenceManager().refresh(project); assertThat(project.getClassifier()).isEqualTo(Classifier.APPLICATION); + assertThat(project.getCpe()).isEqualTo("cpe:2.3:a:acme:example:1.0.0:*:*:*:*:*:*:*"); + assertThat(project.getPurl()).asString().isEqualTo("pkg:maven/com.acme/example@1.0.0"); + assertThat(project.getSwidTagId()).isEqualTo("swidgen-242eb18a-503e-ca37-393b-cf156ef09691_9.1.1"); assertThat(project.getLastBomImport()).isNotNull(); assertThat(project.getExternalReferences()).isNotNull(); assertThat(project.getExternalReferences()).hasSize(4); diff --git a/src/test/resources/unit/bom-1.xml b/src/test/resources/unit/bom-1.xml index 3349fc1df3..1a91de2354 100644 --- a/src/test/resources/unit/bom-1.xml +++ b/src/test/resources/unit/bom-1.xml @@ -20,6 +20,11 @@ DependencyTrack Acme example + cpe:2.3:a:acme:example:1.0.0:*:*:*:*:*:*:* + pkg:maven/com.acme/example@1.0.0 + + PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiID8+CjxTb2Z0d2FyZUlkZW50aXR5IHhtbDpsYW5nPSJFTiIgbmFtZT0iQWNtZSBBcHBsaWNhdGlvbiIgdmVyc2lvbj0iOS4xLjEiIAogdmVyc2lvblNjaGVtZT0ibXVsdGlwYXJ0bnVtZXJpYyIgCiB0YWdJZD0ic3dpZGdlbi1iNTk1MWFjOS00MmMwLWYzODItM2YxZS1iYzdhMmE0NDk3Y2JfOS4xLjEiIAogeG1sbnM9Imh0dHA6Ly9zdGFuZGFyZHMuaXNvLm9yZy9pc28vMTk3NzAvLTIvMjAxNS9zY2hlbWEueHNkIj4gCiB4bWxuczp4c2k9Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvWE1MU2NoZW1hLWluc3RhbmNlIiAKIHhzaTpzY2hlbWFMb2NhdGlvbj0iaHR0cDovL3N0YW5kYXJkcy5pc28ub3JnL2lzby8xOTc3MC8tMi8yMDE1LWN1cnJlbnQvc2NoZW1hLnhzZCBzY2hlbWEueHNkIiA+CiAgPE1ldGEgZ2VuZXJhdG9yPSJTV0lEIFRhZyBPbmxpbmUgR2VuZXJhdG9yIHYwLjEiIC8+IAogIDxFbnRpdHkgbmFtZT0iQWNtZSwgSW5jLiIgcmVnaWQ9ImV4YW1wbGUuY29tIiByb2xlPSJ0YWdDcmVhdG9yIiAvPiAKPC9Tb2Z0d2FyZUlkZW50aXR5Pg== + https://acme.example