@cdxgen/cdxgen 13.4.0 → 13.5.0

package/lib/ecosystems/parsers-jvm.js

@@ -20,17 +20,61 @@ import { applyPurl } from "../inventory/purl.js";
 import { parseScalaArtifact } from "../inventory/scalaCoords.js";
 import { xml2js } from "../parsers/xml.js";
 
+/** Bound on the `${...}` references one pom value may expand through. */
+const POM_PROPERTY_EXPANSION_LIMIT = 10;
+
+/**
+ * Expand the `${name}` references in a pom value. The value is returned only
+ * when every reference resolves, so a version is never half expanded.
+ *
+ * @param {string} value Raw pom value
+ * @param {Function} lookup Returns the value of a property name, or undefined
+ * @returns {string|undefined} Expanded value, or undefined
+ */
+function expandPomValue(value, lookup) {
+  let expanded = value;
+  for (
+    let i = 0;
+    i < POM_PROPERTY_EXPANSION_LIMIT && expanded?.includes("${");
+    i++
+  ) {
+    const start = expanded.indexOf("${");
+    const end = expanded.indexOf("}", start + 2);
+    if (end < 0) {
+      return undefined;
+    }
+    const replacement = lookup(expanded.slice(start + 2, end));
+    if (typeof replacement !== "string") {
+      return undefined;
+    }
+    expanded = `${expanded.slice(0, start)}${replacement}${expanded.slice(end + 1)}`;
+  }
+  return expanded?.includes("${") ? undefined : expanded;
+}
+
 /**
  * Parse pom file
  *
+ * Versions resolve from the pom's own properties and dependencyManagement.
+ * A caller that has read the pom's parents passes what they define in
+ * `inherited`, so versions the parents manage resolve too. Imported BOMs and
+ * parents outside the scanned directory are not read.
+ *
  * @param {string} pomFile pom file to parse
- * @returns {Object} Object containing pom properties, modules, and array of dependencies
+ * @param {Object} [inherited] Properties and managed versions from parent poms
+ * @param {Object} [inherited.properties] Property name to raw value
+ * @param {Object} [inherited.managedVersions] `groupId:artifactId` to version
+ * @returns {Object} Object containing pom properties, modules, the parent
+ *   reference, the user properties and managed versions this pom defines, and
+ *   array of dependencies
  */
-export function parsePom(pomFile) {
+export function parsePom(pomFile, inherited = {}) {
   const deps = [];
   let modules;
   let pomPurl;
   const properties = {};
+  const userProperties = {};
+  const managedVersions = {};
   let isQuarkus = false;
   const xmlData = readFileSync(pomFile, "utf-8");
   const project = xml2js(xmlData, {
@@ -63,25 +107,30 @@ export function parsePom(pomFile) {
     }
   }
   // Take the version from the parent if available
-  if (!properties.version && project.parent) {
+  if (!properties.version && project?.parent?.version?._) {
     properties.version = project.parent.version._;
   }
   // Take the groupId from the parent if available
-  if (!properties.groupId && project.parent) {
+  if (!properties.groupId && project?.parent?.groupId?._) {
     properties.groupId = project.parent.groupId._;
   }
+  let parent;
+  if (project?.parent) {
+    parent = {
+      groupId: project.parent.groupId?._,
+      artifactId: project.parent.artifactId?._,
+      version: project.parent.version?._,
+      // An empty <relativePath/> tells Maven not to look for the parent on
+      // disk; a missing one means ../pom.xml.
+      relativePath:
+        project.parent.relativePath === undefined
+          ? "../pom.xml"
+          : project.parent.relativePath?._ || "",
+    };
+  }
   if (project?.scm?.url?._) {
     properties.scm = project.scm.url._;
   }
-  if (properties.groupId || properties.artifactId) {
-    pomPurl = build({
-      type: "maven",
-      namespace: properties.groupId || "" || null,
-      name: properties.artifactId,
-      version: properties.version || null,
-      qualifiers: { type: properties.packaging || "jar" } || null,
-    });
-  }
   const moduleEntries = [];
   if (project?.modules?.module) {
     moduleEntries.push(project.modules.module);
@@ -100,11 +149,80 @@ export function parsePom(pomFile) {
   if (project?.properties) {
     for (const aprop of Object.keys(project.properties)) {
       properties[aprop] = project.properties[aprop]?._;
+      userProperties[aprop] = project.properties[aprop]?._;
       if (!isQuarkus && aprop.startsWith("quarkus.platform")) {
         isQuarkus = true;
       }
     }
   }
+  const inheritedProperties = inherited?.properties || {};
+  const lookupProperty = (name) => {
+    switch (name) {
+      case "project.version":
+      case "pom.version":
+      case "version":
+        return properties.version;
+      case "project.groupId":
+      case "pom.groupId":
+      case "groupId":
+        return properties.groupId;
+      case "project.artifactId":
+      case "pom.artifactId":
+      case "artifactId":
+        return properties.artifactId;
+      case "project.parent.version":
+        return parent?.version;
+      case "project.parent.groupId":
+        return parent?.groupId;
+      default:
+        return Object.hasOwn(userProperties, name)
+          ? userProperties[name]
+          : inheritedProperties[name];
+    }
+  };
+  // A property can refer to another, so each lookup expands its value too.
+  const expand = (value) =>
+    expandPomValue(value, (name) => {
+      const raw = lookupProperty(name);
+      return raw?.includes("${")
+        ? expandPomValue(raw, (inner) =>
+            inner === name ? undefined : lookupProperty(inner),
+          )
+        : raw;
+    });
+  let managedEntries = project?.dependencyManagement?.dependencies?.dependency;
+  if (managedEntries && !Array.isArray(managedEntries)) {
+    managedEntries = [managedEntries];
+  }
+  for (const amanaged of managedEntries || []) {
+    // An imported BOM manages versions this pom cannot see without fetching it
+    if (amanaged?.scope?._ === "import" || !amanaged?.version?._) {
+      continue;
+    }
+    const group = expand(amanaged.groupId?._);
+    const name = expand(amanaged.artifactId?._);
+    const version = expand(amanaged.version._);
+    if (group && name && version) {
+      managedVersions[`${group}:${name}`] = version;
+    }
+  }
+  const inheritedManagedVersions = inherited?.managedVersions || {};
+  // CI friendly versions such as ${revision} resolve from the properties
+  for (const coordinate of ["groupId", "version"]) {
+    if (properties[coordinate]?.includes("${")) {
+      properties[coordinate] =
+        expand(properties[coordinate]) || properties[coordinate];
+    }
+  }
+  if (properties.groupId || properties.artifactId) {
+    pomPurl = build({
+      type: "maven",
+      namespace: properties.groupId || "" || null,
+      name: properties.artifactId,
+      version: properties.version || null,
+      qualifiers: { type: properties.packaging || "jar" } || null,
+    });
+  }
   // Check the plugins for quarkus
   if (!isQuarkus && project?.build?.plugins?.plugin) {
     if (Array.isArray(project.build.plugins.plugin)) {
@@ -138,7 +256,18 @@ export function parsePom(pomFile) {
         versionStr = version._;
       }
       if (versionStr?.includes("$")) {
-        versionStr = properties[versionStr?.replace(/[${}]/g, "")];
+        versionStr = expand(versionStr);
+      }
+      let groupStr = adep.groupId ? adep.groupId._ : "";
+      if (groupStr?.includes("${")) {
+        groupStr = expand(groupStr) || groupStr;
+      }
+      const nameStr = adep.artifactId ? adep.artifactId._ : "";
+      if (!versionStr && !version?._) {
+        const managedKey = `${groupStr}:${nameStr}`;
+        versionStr = Object.hasOwn(managedVersions, managedKey)
+          ? managedVersions[managedKey]
+          : inheritedManagedVersions[managedKey];
       }
       const scope = adep.scope?._;
       const type = adep.type?._ || "jar";
@@ -156,8 +285,8 @@ export function parsePom(pomFile) {
       }
       if (includeMavenTestScope || scope !== "test") {
         deps.push({
-          group: adep.groupId ? adep.groupId._ : "",
-          name: adep.artifactId ? adep.artifactId._ : "",
+          group: groupStr,
+          name: nameStr,
           version: versionStr,
           qualifiers,
           scope: mapMavenScope(scope, optional === "true"),
@@ -179,7 +308,120 @@ export function parsePom(pomFile) {
       }
     }
   }
-  return { isQuarkus, pomPurl, modules, properties, dependencies: deps };
+  return {
+    isQuarkus,
+    pomPurl,
+    modules,
+    parent,
+    properties,
+    userProperties,
+    managedVersions,
+    dependencies: deps,
+  };
+}
+
+/** Bound on the chain of parent poms read from disk. */
+const LOCAL_PARENT_DEPTH_LIMIT = 10;
+
+/**
+ * The pom file a `<parent>` reference points at on disk, when it lies inside
+ * the scanned directory and declares the coordinates the reference names.
+ *
+ * @param {string} pomFile Child pom file
+ * @param {Object} parentRef Parent reference from parsePom
+ * @param {string} rootDir Scanned directory
+ * @returns {string|undefined} Parent pom file
+ */
+function locateLocalParentPom(pomFile, parentRef, rootDir) {
+  if (!parentRef?.relativePath || !rootDir) {
+    return undefined;
+  }
+  let candidate = resolve(dirname(pomFile), parentRef.relativePath);
+  if (!candidate.endsWith(".xml")) {
+    candidate = join(candidate, "pom.xml");
+  }
+  const rel = relative(resolve(rootDir), candidate);
+  if (!rel || rel.startsWith("..") || isAbsolute(rel)) {
+    return undefined;
+  }
+  if (!safeExistsSync(candidate)) {
+    return undefined;
+  }
+  try {
+    const { groupId, artifactId } = parsePom(candidate).properties || {};
+    if (
+      artifactId !== parentRef.artifactId ||
+      (parentRef.groupId && groupId !== parentRef.groupId)
+    ) {
+      return undefined;
+    }
+  } catch (_err) {
+    return undefined;
+  }
+  return candidate;
+}
+
+/**
+ * What a pom passes on to its children: its user properties and managed
+ * versions over those of its own local parents.
+ *
+ * @param {string} pomFile Pom file
+ * @param {string} rootDir Scanned directory
+ * @param {Map} cache Results by pom file
+ * @param {number} depth Current depth of the parent chain
+ * @returns {Object} Inherited properties and managed versions
+ */
+function localPomInheritance(pomFile, rootDir, cache, depth) {
+  if (cache.has(pomFile)) {
+    return cache.get(pomFile);
+  }
+  const empty = { properties: {}, managedVersions: {} };
+  // A parent chain that loops back reads as having no parent
+  cache.set(pomFile, empty);
+  let inherited = empty;
+  try {
+    const parentPom =
+      depth < LOCAL_PARENT_DEPTH_LIMIT
+        ? locateLocalParentPom(pomFile, parsePom(pomFile).parent, rootDir)
+        : undefined;
+    if (parentPom) {
+      inherited = localPomInheritance(parentPom, rootDir, cache, depth + 1);
+    }
+    const own = parsePom(pomFile, inherited);
+    const result = {
+      properties: { ...inherited.properties, ...own.userProperties },
+      managedVersions: { ...inherited.managedVersions, ...own.managedVersions },
+    };
+    cache.set(pomFile, result);
+    return result;
+  } catch (_err) {
+    return empty;
+  }
+}
+
+/**
+ * Parse a pom file together with the parent poms it names that are present
+ * inside the scanned directory, without running Maven. Properties and
+ * dependencyManagement versions from those parents resolve the versions the
+ * pom leaves to them. Parents outside the directory and imported BOMs are not
+ * read, so the versions they manage stay empty.
+ *
+ * @param {string} pomFile Pom file to parse
+ * @param {string} rootDir Scanned directory; parents outside it are ignored
+ * @param {Map} [cache] Reused across the poms of one scan
+ * @returns {Object} Same shape as parsePom
+ */
+export function parsePomWithLocalParents(pomFile, rootDir, cache = new Map()) {
+  const pomPath = resolve(pomFile);
+  const parentPom = locateLocalParentPom(
+    pomPath,
+    parsePom(pomPath).parent,
+    rootDir,
+  );
+  if (!parentPom) {
+    return parsePom(pomFile);
+  }
+  return parsePom(pomFile, localPomInheritance(parentPom, rootDir, cache, 1));
 }
 
 /** Bound on the reactor walk. A pom's module list is untrusted input, so the