@cyclonedx/cdxgen 8.4.9 → 8.4.10

package/index.js

@@ -1167,14 +1167,23 @@ const createJavaBom = async (path, options) => {
         ["true", "1"].includes(multiProjectMode) ||
         (gradleFiles.length > 1 && !["false", "0"].includes(multiProjectMode))
       ) {
-        if (DEBUG_MODE) {
-          console.log("Executing", gradleCmd, "projects in", path);
+        let gradleProjectsArgs = ["projects", "-q", "--console", "plain"];
+        if (process.env.GRADLE_ARGS) {
+          const addArgs = process.env.GRADLE_ARGS.split(" ");
+          gradleProjectsArgs = gradleProjectsArgs.concat(addArgs);
         }
-        const result = spawnSync(
+        console.log(
+          "Executing",
           gradleCmd,
-          ["projects", "-q", "--console", "plain"],
-          { cwd: path, encoding: "utf-8", timeout: TIMEOUT_MS }
+          gradleProjectsArgs.join(" "),
+          "projects in",
+          path
         );
+        const result = spawnSync(gradleCmd, gradleProjectsArgs, {
+          cwd: path,
+          encoding: "utf-8",
+          timeout: TIMEOUT_MS
+        });
         if (result.status !== 0 || result.error) {
           if (result.stderr) {
             console.error(result.stdout, result.stderr);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cyclonedx/cdxgen",
-  "version": "8.4.9",
+  "version": "8.4.10",
   "description": "Creates CycloneDX Software Bill-of-Materials (SBOM) from source or container image",
   "homepage": "http://github.com/cyclonedx/cdxgen",
   "author": "Prabhu Subramanian <prabhu@appthreat.com>",

package/utils.js

@@ -1214,6 +1214,7 @@ const parseGradleDep = function (
     const deps = [rootProject];
     const dependenciesList = [];
     const keys_cache = {};
+    const deps_keys_cache = {};
     let last_level = 0;
     let last_purl = `pkg:maven/${rootProjectName}@${rootProjectVersion}?type=jar`;
     const first_purl = last_purl;
@@ -1246,9 +1247,11 @@ const parseGradleDep = function (
           !rline ||
           rline.trim() === "" ||
           rline.startsWith("+--- ") ||
-          rline.startsWith("--- ")
+          rline.startsWith("\\--- ")
         ) {
           last_level = 1;
+          last_purl = first_purl;
+          stack = [last_purl];
         }
       }
       while ((match = depRegex.exec(rline))) {
@@ -1265,43 +1268,43 @@ const parseGradleDep = function (
             null
           ).toString();
           purlString = decodeURIComponent(purlString);
-
-          // Filter duplicates
-          if (!keys_cache[purlString]) {
-            keys_cache[purlString] = true;
-            if (group !== "project") {
+          keys_cache[purlString + "_" + last_purl] = true;
+          if (group !== "project") {
+            // Filter duplicates
+            if (!deps_keys_cache[purlString]) {
+              deps_keys_cache[purlString] = true;
               deps.push({
                 group,
                 name: name,
                 version: version,
                 qualifiers: { type: "jar" }
               });
-              if (!level_trees[purlString]) {
-                level_trees[purlString] = [];
-              }
-              if (level == 0 || last_purl === "") {
-                stack.push(purlString);
-              } else if (level > last_level) {
-                const cnodes = level_trees[last_purl] || [];
-                cnodes.push(purlString);
-                level_trees[last_purl] = cnodes;
-                if (stack[stack.length - 1] !== purlString) {
-                  stack.push(purlString);
-                }
-              } else {
-                for (let i = level; i <= last_level; i++) {
-                  stack.pop();
-                }
-                const last_stack =
-                  stack.length > 0 ? stack[stack.length - 1] : first_purl;
-                const cnodes = level_trees[last_stack] || [];
-                cnodes.push(purlString);
-                level_trees[last_stack] = cnodes;
+            }
+            if (!level_trees[purlString]) {
+              level_trees[purlString] = [];
+            }
+            if (level == 0 || last_purl === "") {
+              stack.push(purlString);
+            } else if (level > last_level) {
+              const cnodes = level_trees[last_purl] || [];
+              cnodes.push(purlString);
+              level_trees[last_purl] = cnodes;
+              if (stack[stack.length - 1] !== purlString) {
                 stack.push(purlString);
               }
-              last_level = level;
-              last_purl = purlString;
+            } else {
+              for (let i = level; i <= last_level; i++) {
+                stack.pop();
+              }
+              const last_stack =
+                stack.length > 0 ? stack[stack.length - 1] : first_purl;
+              const cnodes = level_trees[last_stack] || [];
+              cnodes.push(purlString);
+              level_trees[last_stack] = cnodes;
+              stack.push(purlString);
             }
+            last_level = level;
+            last_purl = purlString;
           }
         }
       }

package/utils.test.js

@@ -953,6 +953,7 @@ test("parse .net cs proj", async () => {
 });
 
 test("get nget metadata", async () => {
+  jest.setTimeout(240000);
   const dep_list = await utils.getNugetMetadata([
     {
       group: "",