scanoss 0.32.0 → 0.33.0

package/build/main/sdk/Dependencies/LocalDependency/parsers/python/PyProjectToml.js

@@ -3,42 +3,95 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const rProjectTableContent = new RegExp(/\[project\]\s*\n(.*(?:\n(?!^\s*\[).*)*)/g);
 const rDependenciesSection = new RegExp(/dependencies\s*=\s*\[((?:[^\]]|\](?!\n))+)\]/);
 const purlPrefix = "pkg:pypi/";
-const pyProjectToml = async (fileContent, filePath) => {
-    const result = { file: filePath, purls: [] };
-    const projectTableMatch = fileContent.match(rProjectTableContent);
-    if (!projectTableMatch)
-        return result;
-    const depKeyValueMatch = projectTableMatch[0].match(rDependenciesSection);
-    if (!depKeyValueMatch)
-        return result;
-    const depValue = depKeyValueMatch[1].toString();
-    /* At this point, depKeyValue contains the values for dependencies. Example:
-    *
-    *     "requests",
-    *     # this should be ignored
-    *     'importlib-metadata; python_version<"3.8"',  #This line as well
-    */
-    /* The following code will place each dependency in an array (ignoring comments #) */
-    const deps = depValue
-        .replace(",", "\n") //Convert inline dependencies to new line dependencies
-        .split(/\n/) //Generate an array by splitting new lines. Each line contains an independent dependency
-        .map(d => d.replace(/(,|"|'|\s|(#.*))/g, "")) // Remove extra spaces, quotes, comments and commas
-        .filter(d => d.length !== 0); //Filters those lines that are empty
-    deps.forEach(d => {
-        d = d.replace(/\;.*/g, ""); //Removes environment markers https://packaging.python.org/en/latest/specifications/dependency-specifiers/#environment-markers
-        d = d.replace(/\[.*\]/, ""); //Removes extras https://packaging.python.org/en/latest/specifications/dependency-specifiers/#extras
-        const requirementMatch = d.match(/(?:<|<=|!=|==|>=|>|~=|===).*/);
-        const requirement = requirementMatch ? requirementMatch[0] : null;
-        let purl = d;
-        if (requirement)
-            purl = d.replace(requirement, "").trim();
-        purl = purlPrefix + purl;
-        result.purls.push({
+/**
+ * Parses Poetry-style key-value dependencies from a TOML section body.
+ * Handles simple string values (name = "^1.0") and inline tables (name = {version = "^1.0"}).
+ */
+const parsePoetryDeps = (sectionContent) => {
+    const results = [];
+    const lines = sectionContent.split('\n');
+    for (const line of lines) {
+        const trimmed = line.trim();
+        if (!trimmed || trimmed.startsWith('#'))
+            continue;
+        const kvMatch = trimmed.match(/^([\w][\w.-]*)\s*=\s*(.*)/);
+        if (!kvMatch)
+            continue;
+        const name = kvMatch[1];
+        const value = kvMatch[2].trim();
+        // Skip python version constraint
+        if (name.toLowerCase() === 'python')
+            continue;
+        let requirement = null;
+        if (value.startsWith('"') || value.startsWith("'")) {
+            // Simple string version: requests = "^2.28.0"
+            const ver = value.replace(/["']/g, '').trim();
+            if (ver && ver !== '*')
+                requirement = ver;
+        }
+        else if (value.startsWith('{')) {
+            // Inline table: click = {version = "^8.1.3", optional = true}
+            const versionMatch = value.match(/version\s*=\s*["']([^"']+)["']/);
+            if (versionMatch) {
+                const ver = versionMatch[1].trim();
+                if (ver && ver !== '*')
+                    requirement = ver;
+            }
+        }
+        const purl = purlPrefix + name;
+        results.push({
             purl,
             ...(requirement !== null && { requirement })
         });
-    });
+    }
+    return results;
+};
+const pyProjectToml = async (fileContent, filePath) => {
+    const result = { file: filePath, purls: [] };
+    // Try PEP 621 format first
+    const projectTableMatch = fileContent.match(rProjectTableContent);
+    if (projectTableMatch) {
+        const depKeyValueMatch = projectTableMatch[0].match(rDependenciesSection);
+        if (depKeyValueMatch) {
+            const depValue = depKeyValueMatch[1].toString();
+            /* At this point, depKeyValue contains the values for dependencies. Example:
+            *
+            *     "requests",
+            *     # this should be ignored
+            *     'importlib-metadata; python_version<"3.8"',  #This line as well
+            */
+            /* The following code will place each dependency in an array (ignoring comments #) */
+            const deps = depValue
+                .replace(",", "\n") //Convert inline dependencies to new line dependencies
+                .split(/\n/) //Generate an array by splitting new lines. Each line contains an independent dependency
+                .map(d => d.replace(/(,|"|'|\s|(#.*))/g, "")) // Remove extra spaces, quotes, comments and commas
+                .filter(d => d.length !== 0); //Filters those lines that are empty
+            deps.forEach(d => {
+                d = d.replace(/\;.*/g, ""); //Removes environment markers https://packaging.python.org/en/latest/specifications/dependency-specifiers/#environment-markers
+                d = d.replace(/\[.*\]/, ""); //Removes extras https://packaging.python.org/en/latest/specifications/dependency-specifiers/#extras
+                const requirementMatch = d.match(/(?:<|<=|!=|==|>=|>|~=|===).*/);
+                const requirement = requirementMatch ? requirementMatch[0] : null;
+                let purl = d;
+                if (requirement)
+                    purl = d.replace(requirement, "").trim();
+                purl = purlPrefix + purl;
+                result.purls.push({
+                    purl,
+                    ...(requirement !== null && { requirement })
+                });
+            });
+            return result;
+        }
+    }
+    // Fallback: Try Poetry format
+    // Matches [tool.poetry.dependencies], [tool.poetry.dev-dependencies], [tool.poetry.group.<name>.dependencies]
+    const rPoetryDepsSection = /\[tool\.poetry(?:\.group\.[\w-]+)?\.(?:dev-)?dependencies\]\s*\n([\s\S]*?)(?=\n\s*\[|$)/g;
+    const poetryMatches = fileContent.matchAll(rPoetryDepsSection);
+    for (const match of poetryMatches) {
+        const deps = parsePoetryDeps(match[1]);
+        result.purls.push(...deps);
+    }
     return result;
 };
 exports.default = pyProjectToml;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiUHlQcm9qZWN0VG9tbC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uLy4uLy4uLy4uLy4uL3NyYy9zZGsvRGVwZW5kZW5jaWVzL0xvY2FsRGVwZW5kZW5jeS9wYXJzZXJzL3B5dGhvbi9QeVByb2plY3RUb21sLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7O0FBRUEsTUFBTSxvQkFBb0IsR0FBRyxJQUFJLE1BQU0sQ0FBQywwQ0FBMEMsQ0FBQyxDQUFDO0FBQ3BGLE1BQU0sb0JBQW9CLEdBQUcsSUFBSSxNQUFNLENBQUUsOENBQThDLENBQUMsQ0FBQztBQUV6RixNQUFNLFVBQVUsR0FBRyxXQUFXLENBQUM7QUFFL0IsTUFBTSxhQUFhLEdBQUcsS0FBSyxFQUFFLFdBQW1CLEVBQUMsUUFBZ0IsRUFBNkIsRUFBRTtJQUM5RixNQUFNLE1BQU0sR0FBcUIsRUFBQyxJQUFJLEVBQUUsUUFBUSxFQUFFLEtBQUssRUFBRSxFQUFFLEVBQUMsQ0FBQztJQUU3RCxNQUFNLGlCQUFpQixHQUFHLFdBQVcsQ0FBQyxLQUFLLENBQUMsb0JBQW9CLENBQUMsQ0FBQztJQUNsRSxJQUFJLENBQUMsaUJBQWlCO1FBQUUsT0FBTyxNQUFNLENBQUM7SUFFdEMsTUFBTSxnQkFBZ0IsR0FBRyxpQkFBaUIsQ0FBQyxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsb0JBQW9CLENBQUMsQ0FBQztJQUMxRSxJQUFJLENBQUMsZ0JBQWdCO1FBQUUsT0FBTyxNQUFNLENBQUM7SUFFckMsTUFBTSxRQUFRLEdBQUcsZ0JBQWdCLENBQUMsQ0FBQyxDQUFDLENBQUMsUUFBUSxFQUFFLENBQUM7SUFFaEQ7Ozs7O01BS0U7SUFFRixxRkFBcUY7SUFFckYsTUFBTSxJQUFJLEdBQUksUUFBUTtTQUNuQixPQUFPLENBQUMsR0FBRyxFQUFFLElBQUksQ0FBQyxDQUFDLHNEQUFzRDtTQUN6RSxLQUFLLENBQUMsSUFBSSxDQUFDLENBQUksd0ZBQXdGO1NBQ3ZHLEdBQUcsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxPQUFPLENBQUMsbUJBQW1CLEVBQUUsRUFBRSxDQUFDLENBQUMsQ0FBQyxtREFBbUQ7U0FDaEcsTUFBTSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLE1BQU0sS0FBSyxDQUFDLENBQUUsQ0FBQSxDQUFFLG9DQUFvQztJQUdyRSxJQUFJLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxFQUFFO1FBQ2YsQ0FBQyxHQUFHLENBQUMsQ0FBQyxPQUFPLENBQUMsT0FBTyxFQUFFLEVBQUUsQ0FBQyxDQUFBLENBQUUsOEhBQThIO1FBQzFKLENBQUMsR0FBRyxDQUFDLENBQUMsT0FBTyxDQUFDLFFBQVEsRUFBRSxFQUFFLENBQUMsQ0FBQSxDQUFDLG9HQUFvRztRQUVoSSxNQUFNLGdCQUFnQixHQUFHLENBQUMsQ0FBQyxLQUFLLENBQUMsOEJBQThCLENBQUMsQ0FBQztRQUNqRSxNQUFNLFdBQVcsR0FBRyxnQkFBZ0IsQ0FBQyxDQUFDLENBQUMsZ0JBQWdCLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQTtRQUVqRSxJQUFJLElBQUksR0FBRyxDQUFDLENBQUM7UUFDYixJQUFJLFdBQVc7WUFBRSxJQUFJLEdBQUcsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxXQUFXLEVBQUUsRUFBRSxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUM7UUFFMUQsSUFBSSxHQUFHLFVBQVUsR0FBRyxJQUFJLENBQUM7UUFFekIsTUFBTSxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUM7WUFDaEIsSUFBSTtZQUNKLEdBQUcsQ0FBQyxXQUFXLEtBQUssSUFBSSxJQUFJLEVBQUUsV0FBVyxFQUFFLENBQUM7U0FDN0MsQ0FBQyxDQUFBO0lBQ0osQ0FBQyxDQUFDLENBQUE7SUFDRixPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUM7QUFFRixrQkFBZSxhQUFhLENBQUMifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiUHlQcm9qZWN0VG9tbC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uLy4uLy4uLy4uLy4uL3NyYy9zZGsvRGVwZW5kZW5jaWVzL0xvY2FsRGVwZW5kZW5jeS9wYXJzZXJzL3B5dGhvbi9QeVByb2plY3RUb21sLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7O0FBRUEsTUFBTSxvQkFBb0IsR0FBRyxJQUFJLE1BQU0sQ0FBQywwQ0FBMEMsQ0FBQyxDQUFDO0FBQ3BGLE1BQU0sb0JBQW9CLEdBQUcsSUFBSSxNQUFNLENBQUUsOENBQThDLENBQUMsQ0FBQztBQUV6RixNQUFNLFVBQVUsR0FBRyxXQUFXLENBQUM7QUFFL0I7OztHQUdHO0FBQ0gsTUFBTSxlQUFlLEdBQUcsQ0FBQyxjQUFzQixFQUE0QyxFQUFFO0lBQzNGLE1BQU0sT0FBTyxHQUE2QyxFQUFFLENBQUM7SUFDN0QsTUFBTSxLQUFLLEdBQUcsY0FBYyxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsQ0FBQztJQUV6QyxLQUFLLE1BQU0sSUFBSSxJQUFJLEtBQUssRUFBRSxDQUFDO1FBQ3pCLE1BQU0sT0FBTyxHQUFHLElBQUksQ0FBQyxJQUFJLEVBQUUsQ0FBQztRQUM1QixJQUFJLENBQUMsT0FBTyxJQUFJLE9BQU8sQ0FBQyxVQUFVLENBQUMsR0FBRyxDQUFDO1lBQUUsU0FBUztRQUVsRCxNQUFNLE9BQU8sR0FBRyxPQUFPLENBQUMsS0FBSyxDQUFDLDJCQUEyQixDQUFDLENBQUM7UUFDM0QsSUFBSSxDQUFDLE9BQU87WUFBRSxTQUFTO1FBRXZCLE1BQU0sSUFBSSxHQUFHLE9BQU8sQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUN4QixNQUFNLEtBQUssR0FBRyxPQUFPLENBQUMsQ0FBQyxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUM7UUFFaEMsaUNBQWlDO1FBQ2pDLElBQUksSUFBSSxDQUFDLFdBQVcsRUFBRSxLQUFLLFFBQVE7WUFBRSxTQUFTO1FBRTlDLElBQUksV0FBVyxHQUFrQixJQUFJLENBQUM7UUFFdEMsSUFBSSxLQUFLLENBQUMsVUFBVSxDQUFDLEdBQUcsQ0FBQyxJQUFJLEtBQUssQ0FBQyxVQUFVLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQztZQUNuRCw4Q0FBOEM7WUFDOUMsTUFBTSxHQUFHLEdBQUcsS0FBSyxDQUFDLE9BQU8sQ0FBQyxPQUFPLEVBQUUsRUFBRSxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUM7WUFDOUMsSUFBSSxHQUFHLElBQUksR0FBRyxLQUFLLEdBQUc7Z0JBQUUsV0FBVyxHQUFHLEdBQUcsQ0FBQztRQUM1QyxDQUFDO2FBQU0sSUFBSSxLQUFLLENBQUMsVUFBVSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUM7WUFDakMsOERBQThEO1lBQzlELE1BQU0sWUFBWSxHQUFHLEtBQUssQ0FBQyxLQUFLLENBQUMsZ0NBQWdDLENBQUMsQ0FBQztZQUNuRSxJQUFJLFlBQVksRUFBRSxDQUFDO2dCQUNqQixNQUFNLEdBQUcsR0FBRyxZQUFZLENBQUMsQ0FBQyxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUM7Z0JBQ25DLElBQUksR0FBRyxJQUFJLEdBQUcsS0FBSyxHQUFHO29CQUFFLFdBQVcsR0FBRyxHQUFHLENBQUM7WUFDNUMsQ0FBQztRQUNILENBQUM7UUFFRCxNQUFNLElBQUksR0FBRyxVQUFVLEdBQUcsSUFBSSxDQUFDO1FBQy9CLE9BQU8sQ0FBQyxJQUFJLENBQUM7WUFDWCxJQUFJO1lBQ0osR0FBRyxDQUFDLFdBQVcsS0FBSyxJQUFJLElBQUksRUFBRSxXQUFXLEVBQUUsQ0FBQztTQUM3QyxDQUFDLENBQUM7SUFDTCxDQUFDO0lBRUQsT0FBTyxPQUFPLENBQUM7QUFDakIsQ0FBQyxDQUFDO0FBRUYsTUFBTSxhQUFhLEdBQUcsS0FBSyxFQUFFLFdBQW1CLEVBQUMsUUFBZ0IsRUFBNkIsRUFBRTtJQUM5RixNQUFNLE1BQU0sR0FBcUIsRUFBQyxJQUFJLEVBQUUsUUFBUSxFQUFFLEtBQUssRUFBRSxFQUFFLEVBQUMsQ0FBQztJQUU3RCwyQkFBMkI7SUFDM0IsTUFBTSxpQkFBaUIsR0FBRyxXQUFXLENBQUMsS0FBSyxDQUFDLG9CQUFvQixDQUFDLENBQUM7SUFDbEUsSUFBSSxpQkFBaUIsRUFBRSxDQUFDO1FBQ3RCLE1BQU0sZ0JBQWdCLEdBQUcsaUJBQWlCLENBQUMsQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLG9CQUFvQixDQUFDLENBQUM7UUFDMUUsSUFBSSxnQkFBZ0IsRUFBRSxDQUFDO1lBQ3JCLE1BQU0sUUFBUSxHQUFHLGdCQUFnQixDQUFDLENBQUMsQ0FBQyxDQUFDLFFBQVEsRUFBRSxDQUFDO1lBRWhEOzs7OztjQUtFO1lBRUYscUZBQXFGO1lBRXJGLE1BQU0sSUFBSSxHQUFJLFFBQVE7aUJBQ25CLE9BQU8sQ0FBQyxHQUFHLEVBQUUsSUFBSSxDQUFDLENBQUMsc0RBQXNEO2lCQUN6RSxLQUFLLENBQUMsSUFBSSxDQUFDLENBQUksd0ZBQXdGO2lCQUN2RyxHQUFHLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsT0FBTyxDQUFDLG1CQUFtQixFQUFFLEVBQUUsQ0FBQyxDQUFDLENBQUMsbURBQW1EO2lCQUNoRyxNQUFNLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsTUFBTSxLQUFLLENBQUMsQ0FBRSxDQUFBLENBQUUsb0NBQW9DO1lBR3JFLElBQUksQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLEVBQUU7Z0JBQ2YsQ0FBQyxHQUFHLENBQUMsQ0FBQyxPQUFPLENBQUMsT0FBTyxFQUFFLEVBQUUsQ0FBQyxDQUFBLENBQUUsOEhBQThIO2dCQUMxSixDQUFDLEdBQUcsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxRQUFRLEVBQUUsRUFBRSxDQUFDLENBQUEsQ0FBQyxvR0FBb0c7Z0JBRWhJLE1BQU0sZ0JBQWdCLEdBQUcsQ0FBQyxDQUFDLEtBQUssQ0FBQyw4QkFBOEIsQ0FBQyxDQUFDO2dCQUNqRSxNQUFNLFdBQVcsR0FBRyxnQkFBZ0IsQ0FBQyxDQUFDLENBQUMsZ0JBQWdCLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQTtnQkFFakUsSUFBSSxJQUFJLEdBQUcsQ0FBQyxDQUFDO2dCQUNiLElBQUksV0FBVztvQkFBRSxJQUFJLEdBQUcsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxXQUFXLEVBQUUsRUFBRSxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUM7Z0JBRTFELElBQUksR0FBRyxVQUFVLEdBQUcsSUFBSSxDQUFDO2dCQUV6QixNQUFNLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQztvQkFDaEIsSUFBSTtvQkFDSixHQUFHLENBQUMsV0FBVyxLQUFLLElBQUksSUFBSSxFQUFFLFdBQVcsRUFBRSxDQUFDO2lCQUM3QyxDQUFDLENBQUE7WUFDSixDQUFDLENBQUMsQ0FBQTtZQUNGLE9BQU8sTUFBTSxDQUFDO1FBQ2hCLENBQUM7SUFDSCxDQUFDO0lBRUQsOEJBQThCO0lBQzlCLDhHQUE4RztJQUM5RyxNQUFNLGtCQUFrQixHQUFHLDBGQUEwRixDQUFDO0lBQ3RILE1BQU0sYUFBYSxHQUFHLFdBQVcsQ0FBQyxRQUFRLENBQUMsa0JBQWtCLENBQUMsQ0FBQztJQUMvRCxLQUFLLE1BQU0sS0FBSyxJQUFJLGFBQWEsRUFBRSxDQUFDO1FBQ2xDLE1BQU0sSUFBSSxHQUFHLGVBQWUsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUN2QyxNQUFNLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxHQUFHLElBQUksQ0FBQyxDQUFDO0lBQzdCLENBQUM7SUFFRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUM7QUFFRixrQkFBZSxhQUFhLENBQUMifQ==