scanoss 0.32.0 → 0.33.0

package/build/module/sdk/Dependencies/LocalDependency/parsers/python/PyProjectToml.js

@@ -1,42 +1,95 @@
 const rProjectTableContent = new RegExp(/\[project\]\s*\n(.*(?:\n(?!^\s*\[).*)*)/g);
 const rDependenciesSection = new RegExp(/dependencies\s*=\s*\[((?:[^\]]|\](?!\n))+)\]/);
 const purlPrefix = "pkg:pypi/";
-const pyProjectToml = async (fileContent, filePath) => {
-    const result = { file: filePath, purls: [] };
-    const projectTableMatch = fileContent.match(rProjectTableContent);
-    if (!projectTableMatch)
-        return result;
-    const depKeyValueMatch = projectTableMatch[0].match(rDependenciesSection);
-    if (!depKeyValueMatch)
-        return result;
-    const depValue = depKeyValueMatch[1].toString();
-    /* At this point, depKeyValue contains the values for dependencies. Example:
-    *
-    *     "requests",
-    *     # this should be ignored
-    *     'importlib-metadata; python_version<"3.8"',  #This line as well
-    */
-    /* The following code will place each dependency in an array (ignoring comments #) */
-    const deps = depValue
-        .replace(",", "\n") //Convert inline dependencies to new line dependencies
-        .split(/\n/) //Generate an array by splitting new lines. Each line contains an independent dependency
-        .map(d => d.replace(/(,|"|'|\s|(#.*))/g, "")) // Remove extra spaces, quotes, comments and commas
-        .filter(d => d.length !== 0); //Filters those lines that are empty
-    deps.forEach(d => {
-        d = d.replace(/\;.*/g, ""); //Removes environment markers https://packaging.python.org/en/latest/specifications/dependency-specifiers/#environment-markers
-        d = d.replace(/\[.*\]/, ""); //Removes extras https://packaging.python.org/en/latest/specifications/dependency-specifiers/#extras
-        const requirementMatch = d.match(/(?:<|<=|!=|==|>=|>|~=|===).*/);
-        const requirement = requirementMatch ? requirementMatch[0] : null;
-        let purl = d;
-        if (requirement)
-            purl = d.replace(requirement, "").trim();
-        purl = purlPrefix + purl;
-        result.purls.push({
+/**
+ * Parses Poetry-style key-value dependencies from a TOML section body.
+ * Handles simple string values (name = "^1.0") and inline tables (name = {version = "^1.0"}).
+ */
+const parsePoetryDeps = (sectionContent) => {
+    const results = [];
+    const lines = sectionContent.split('\n');
+    for (const line of lines) {
+        const trimmed = line.trim();
+        if (!trimmed || trimmed.startsWith('#'))
+            continue;
+        const kvMatch = trimmed.match(/^([\w][\w.-]*)\s*=\s*(.*)/);
+        if (!kvMatch)
+            continue;
+        const name = kvMatch[1];
+        const value = kvMatch[2].trim();
+        // Skip python version constraint
+        if (name.toLowerCase() === 'python')
+            continue;
+        let requirement = null;
+        if (value.startsWith('"') || value.startsWith("'")) {
+            // Simple string version: requests = "^2.28.0"
+            const ver = value.replace(/["']/g, '').trim();
+            if (ver && ver !== '*')
+                requirement = ver;
+        }
+        else if (value.startsWith('{')) {
+            // Inline table: click = {version = "^8.1.3", optional = true}
+            const versionMatch = value.match(/version\s*=\s*["']([^"']+)["']/);
+            if (versionMatch) {
+                const ver = versionMatch[1].trim();
+                if (ver && ver !== '*')
+                    requirement = ver;
+            }
+        }
+        const purl = purlPrefix + name;
+        results.push({
             purl,
             ...(requirement !== null && { requirement })
         });
-    });
+    }
+    return results;
+};
+const pyProjectToml = async (fileContent, filePath) => {
+    const result = { file: filePath, purls: [] };
+    // Try PEP 621 format first
+    const projectTableMatch = fileContent.match(rProjectTableContent);
+    if (projectTableMatch) {
+        const depKeyValueMatch = projectTableMatch[0].match(rDependenciesSection);
+        if (depKeyValueMatch) {
+            const depValue = depKeyValueMatch[1].toString();
+            /* At this point, depKeyValue contains the values for dependencies. Example:
+            *
+            *     "requests",
+            *     # this should be ignored
+            *     'importlib-metadata; python_version<"3.8"',  #This line as well
+            */
+            /* The following code will place each dependency in an array (ignoring comments #) */
+            const deps = depValue
+                .replace(",", "\n") //Convert inline dependencies to new line dependencies
+                .split(/\n/) //Generate an array by splitting new lines. Each line contains an independent dependency
+                .map(d => d.replace(/(,|"|'|\s|(#.*))/g, "")) // Remove extra spaces, quotes, comments and commas
+                .filter(d => d.length !== 0); //Filters those lines that are empty
+            deps.forEach(d => {
+                d = d.replace(/\;.*/g, ""); //Removes environment markers https://packaging.python.org/en/latest/specifications/dependency-specifiers/#environment-markers
+                d = d.replace(/\[.*\]/, ""); //Removes extras https://packaging.python.org/en/latest/specifications/dependency-specifiers/#extras
+                const requirementMatch = d.match(/(?:<|<=|!=|==|>=|>|~=|===).*/);
+                const requirement = requirementMatch ? requirementMatch[0] : null;
+                let purl = d;
+                if (requirement)
+                    purl = d.replace(requirement, "").trim();
+                purl = purlPrefix + purl;
+                result.purls.push({
+                    purl,
+                    ...(requirement !== null && { requirement })
+                });
+            });
+            return result;
+        }
+    }
+    // Fallback: Try Poetry format
+    // Matches [tool.poetry.dependencies], [tool.poetry.dev-dependencies], [tool.poetry.group.<name>.dependencies]
+    const rPoetryDepsSection = /\[tool\.poetry(?:\.group\.[\w-]+)?\.(?:dev-)?dependencies\]\s*\n([\s\S]*?)(?=\n\s*\[|$)/g;
+    const poetryMatches = fileContent.matchAll(rPoetryDepsSection);
+    for (const match of poetryMatches) {
+        const deps = parsePoetryDeps(match[1]);
+        result.purls.push(...deps);
+    }
     return result;
 };
 export default pyProjectToml;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiUHlQcm9qZWN0VG9tbC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uLy4uLy4uLy4uLy4uL3NyYy9zZGsvRGVwZW5kZW5jaWVzL0xvY2FsRGVwZW5kZW5jeS9wYXJzZXJzL3B5dGhvbi9QeVByb2plY3RUb21sLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUVBLE1BQU0sb0JBQW9CLEdBQUcsSUFBSSxNQUFNLENBQUMsMENBQTBDLENBQUMsQ0FBQztBQUNwRixNQUFNLG9CQUFvQixHQUFHLElBQUksTUFBTSxDQUFFLDhDQUE4QyxDQUFDLENBQUM7QUFFekYsTUFBTSxVQUFVLEdBQUcsV0FBVyxDQUFDO0FBRS9CLE1BQU0sYUFBYSxHQUFHLEtBQUssRUFBRSxXQUFtQixFQUFDLFFBQWdCLEVBQTZCLEVBQUU7SUFDOUYsTUFBTSxNQUFNLEdBQXFCLEVBQUMsSUFBSSxFQUFFLFFBQVEsRUFBRSxLQUFLLEVBQUUsRUFBRSxFQUFDLENBQUM7SUFFN0QsTUFBTSxpQkFBaUIsR0FBRyxXQUFXLENBQUMsS0FBSyxDQUFDLG9CQUFvQixDQUFDLENBQUM7SUFDbEUsSUFBSSxDQUFDLGlCQUFpQjtRQUFFLE9BQU8sTUFBTSxDQUFDO0lBRXRDLE1BQU0sZ0JBQWdCLEdBQUcsaUJBQWlCLENBQUMsQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLG9CQUFvQixDQUFDLENBQUM7SUFDMUUsSUFBSSxDQUFDLGdCQUFnQjtRQUFFLE9BQU8sTUFBTSxDQUFDO0lBRXJDLE1BQU0sUUFBUSxHQUFHLGdCQUFnQixDQUFDLENBQUMsQ0FBQyxDQUFDLFFBQVEsRUFBRSxDQUFDO0lBRWhEOzs7OztNQUtFO0lBRUYscUZBQXFGO0lBRXJGLE1BQU0sSUFBSSxHQUFJLFFBQVE7U0FDbkIsT0FBTyxDQUFDLEdBQUcsRUFBRSxJQUFJLENBQUMsQ0FBQyxzREFBc0Q7U0FDekUsS0FBSyxDQUFDLElBQUksQ0FBQyxDQUFJLHdGQUF3RjtTQUN2RyxHQUFHLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsT0FBTyxDQUFDLG1CQUFtQixFQUFFLEVBQUUsQ0FBQyxDQUFDLENBQUMsbURBQW1EO1NBQ2hHLE1BQU0sQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxNQUFNLEtBQUssQ0FBQyxDQUFFLENBQUEsQ0FBRSxvQ0FBb0M7SUFHckUsSUFBSSxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsRUFBRTtRQUNmLENBQUMsR0FBRyxDQUFDLENBQUMsT0FBTyxDQUFDLE9BQU8sRUFBRSxFQUFFLENBQUMsQ0FBQSxDQUFFLDhIQUE4SDtRQUMxSixDQUFDLEdBQUcsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxRQUFRLEVBQUUsRUFBRSxDQUFDLENBQUEsQ0FBQyxvR0FBb0c7UUFFaEksTUFBTSxnQkFBZ0IsR0FBRyxDQUFDLENBQUMsS0FBSyxDQUFDLDhCQUE4QixDQUFDLENBQUM7UUFDakUsTUFBTSxXQUFXLEdBQUcsZ0JBQWdCLENBQUMsQ0FBQyxDQUFDLGdCQUFnQixDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUE7UUFFakUsSUFBSSxJQUFJLEdBQUcsQ0FBQyxDQUFDO1FBQ2IsSUFBSSxXQUFXO1lBQUUsSUFBSSxHQUFHLENBQUMsQ0FBQyxPQUFPLENBQUMsV0FBVyxFQUFFLEVBQUUsQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDO1FBRTFELElBQUksR0FBRyxVQUFVLEdBQUcsSUFBSSxDQUFDO1FBRXpCLE1BQU0sQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDO1lBQ2hCLElBQUk7WUFDSixHQUFHLENBQUMsV0FBVyxLQUFLLElBQUksSUFBSSxFQUFFLFdBQVcsRUFBRSxDQUFDO1NBQzdDLENBQUMsQ0FBQTtJQUNKLENBQUMsQ0FBQyxDQUFBO0lBQ0YsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyxDQUFDO0FBRUYsZUFBZSxhQUFhLENBQUMifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiUHlQcm9qZWN0VG9tbC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uLy4uLy4uLy4uLy4uL3NyYy9zZGsvRGVwZW5kZW5jaWVzL0xvY2FsRGVwZW5kZW5jeS9wYXJzZXJzL3B5dGhvbi9QeVByb2plY3RUb21sLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUVBLE1BQU0sb0JBQW9CLEdBQUcsSUFBSSxNQUFNLENBQUMsMENBQTBDLENBQUMsQ0FBQztBQUNwRixNQUFNLG9CQUFvQixHQUFHLElBQUksTUFBTSxDQUFFLDhDQUE4QyxDQUFDLENBQUM7QUFFekYsTUFBTSxVQUFVLEdBQUcsV0FBVyxDQUFDO0FBRS9COzs7R0FHRztBQUNILE1BQU0sZUFBZSxHQUFHLENBQUMsY0FBc0IsRUFBNEMsRUFBRTtJQUMzRixNQUFNLE9BQU8sR0FBNkMsRUFBRSxDQUFDO0lBQzdELE1BQU0sS0FBSyxHQUFHLGNBQWMsQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLENBQUM7SUFFekMsS0FBSyxNQUFNLElBQUksSUFBSSxLQUFLLEVBQUUsQ0FBQztRQUN6QixNQUFNLE9BQU8sR0FBRyxJQUFJLENBQUMsSUFBSSxFQUFFLENBQUM7UUFDNUIsSUFBSSxDQUFDLE9BQU8sSUFBSSxPQUFPLENBQUMsVUFBVSxDQUFDLEdBQUcsQ0FBQztZQUFFLFNBQVM7UUFFbEQsTUFBTSxPQUFPLEdBQUcsT0FBTyxDQUFDLEtBQUssQ0FBQywyQkFBMkIsQ0FBQyxDQUFDO1FBQzNELElBQUksQ0FBQyxPQUFPO1lBQUUsU0FBUztRQUV2QixNQUFNLElBQUksR0FBRyxPQUFPLENBQUMsQ0FBQyxDQUFDLENBQUM7UUFDeEIsTUFBTSxLQUFLLEdBQUcsT0FBTyxDQUFDLENBQUMsQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDO1FBRWhDLGlDQUFpQztRQUNqQyxJQUFJLElBQUksQ0FBQyxXQUFXLEVBQUUsS0FBSyxRQUFRO1lBQUUsU0FBUztRQUU5QyxJQUFJLFdBQVcsR0FBa0IsSUFBSSxDQUFDO1FBRXRDLElBQUksS0FBSyxDQUFDLFVBQVUsQ0FBQyxHQUFHLENBQUMsSUFBSSxLQUFLLENBQUMsVUFBVSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUM7WUFDbkQsOENBQThDO1lBQzlDLE1BQU0sR0FBRyxHQUFHLEtBQUssQ0FBQyxPQUFPLENBQUMsT0FBTyxFQUFFLEVBQUUsQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDO1lBQzlDLElBQUksR0FBRyxJQUFJLEdBQUcsS0FBSyxHQUFHO2dCQUFFLFdBQVcsR0FBRyxHQUFHLENBQUM7UUFDNUMsQ0FBQzthQUFNLElBQUksS0FBSyxDQUFDLFVBQVUsQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDO1lBQ2pDLDhEQUE4RDtZQUM5RCxNQUFNLFlBQVksR0FBRyxLQUFLLENBQUMsS0FBSyxDQUFDLGdDQUFnQyxDQUFDLENBQUM7WUFDbkUsSUFBSSxZQUFZLEVBQUUsQ0FBQztnQkFDakIsTUFBTSxHQUFHLEdBQUcsWUFBWSxDQUFDLENBQUMsQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDO2dCQUNuQyxJQUFJLEdBQUcsSUFBSSxHQUFHLEtBQUssR0FBRztvQkFBRSxXQUFXLEdBQUcsR0FBRyxDQUFDO1lBQzVDLENBQUM7UUFDSCxDQUFDO1FBRUQsTUFBTSxJQUFJLEdBQUcsVUFBVSxHQUFHLElBQUksQ0FBQztRQUMvQixPQUFPLENBQUMsSUFBSSxDQUFDO1lBQ1gsSUFBSTtZQUNKLEdBQUcsQ0FBQyxXQUFXLEtBQUssSUFBSSxJQUFJLEVBQUUsV0FBVyxFQUFFLENBQUM7U0FDN0MsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUVELE9BQU8sT0FBTyxDQUFDO0FBQ2pCLENBQUMsQ0FBQztBQUVGLE1BQU0sYUFBYSxHQUFHLEtBQUssRUFBRSxXQUFtQixFQUFDLFFBQWdCLEVBQTZCLEVBQUU7SUFDOUYsTUFBTSxNQUFNLEdBQXFCLEVBQUMsSUFBSSxFQUFFLFFBQVEsRUFBRSxLQUFLLEVBQUUsRUFBRSxFQUFDLENBQUM7SUFFN0QsMkJBQTJCO0lBQzNCLE1BQU0saUJBQWlCLEdBQUcsV0FBVyxDQUFDLEtBQUssQ0FBQyxvQkFBb0IsQ0FBQyxDQUFDO0lBQ2xFLElBQUksaUJBQWlCLEVBQUUsQ0FBQztRQUN0QixNQUFNLGdCQUFnQixHQUFHLGlCQUFpQixDQUFDLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxvQkFBb0IsQ0FBQyxDQUFDO1FBQzFFLElBQUksZ0JBQWdCLEVBQUUsQ0FBQztZQUNyQixNQUFNLFFBQVEsR0FBRyxnQkFBZ0IsQ0FBQyxDQUFDLENBQUMsQ0FBQyxRQUFRLEVBQUUsQ0FBQztZQUVoRDs7Ozs7Y0FLRTtZQUVGLHFGQUFxRjtZQUVyRixNQUFNLElBQUksR0FBSSxRQUFRO2lCQUNuQixPQUFPLENBQUMsR0FBRyxFQUFFLElBQUksQ0FBQyxDQUFDLHNEQUFzRDtpQkFDekUsS0FBSyxDQUFDLElBQUksQ0FBQyxDQUFJLHdGQUF3RjtpQkFDdkcsR0FBRyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxtQkFBbUIsRUFBRSxFQUFFLENBQUMsQ0FBQyxDQUFDLG1EQUFtRDtpQkFDaEcsTUFBTSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLE1BQU0sS0FBSyxDQUFDLENBQUUsQ0FBQSxDQUFFLG9DQUFvQztZQUdyRSxJQUFJLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxFQUFFO2dCQUNmLENBQUMsR0FBRyxDQUFDLENBQUMsT0FBTyxDQUFDLE9BQU8sRUFBRSxFQUFFLENBQUMsQ0FBQSxDQUFFLDhIQUE4SDtnQkFDMUosQ0FBQyxHQUFHLENBQUMsQ0FBQyxPQUFPLENBQUMsUUFBUSxFQUFFLEVBQUUsQ0FBQyxDQUFBLENBQUMsb0dBQW9HO2dCQUVoSSxNQUFNLGdCQUFnQixHQUFHLENBQUMsQ0FBQyxLQUFLLENBQUMsOEJBQThCLENBQUMsQ0FBQztnQkFDakUsTUFBTSxXQUFXLEdBQUcsZ0JBQWdCLENBQUMsQ0FBQyxDQUFDLGdCQUFnQixDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUE7Z0JBRWpFLElBQUksSUFBSSxHQUFHLENBQUMsQ0FBQztnQkFDYixJQUFJLFdBQVc7b0JBQUUsSUFBSSxHQUFHLENBQUMsQ0FBQyxPQUFPLENBQUMsV0FBVyxFQUFFLEVBQUUsQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDO2dCQUUxRCxJQUFJLEdBQUcsVUFBVSxHQUFHLElBQUksQ0FBQztnQkFFekIsTUFBTSxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUM7b0JBQ2hCLElBQUk7b0JBQ0osR0FBRyxDQUFDLFdBQVcsS0FBSyxJQUFJLElBQUksRUFBRSxXQUFXLEVBQUUsQ0FBQztpQkFDN0MsQ0FBQyxDQUFBO1lBQ0osQ0FBQyxDQUFDLENBQUE7WUFDRixPQUFPLE1BQU0sQ0FBQztRQUNoQixDQUFDO0lBQ0gsQ0FBQztJQUVELDhCQUE4QjtJQUM5Qiw4R0FBOEc7SUFDOUcsTUFBTSxrQkFBa0IsR0FBRywwRkFBMEYsQ0FBQztJQUN0SCxNQUFNLGFBQWEsR0FBRyxXQUFXLENBQUMsUUFBUSxDQUFDLGtCQUFrQixDQUFDLENBQUM7SUFDL0QsS0FBSyxNQUFNLEtBQUssSUFBSSxhQUFhLEVBQUUsQ0FBQztRQUNsQyxNQUFNLElBQUksR0FBRyxlQUFlLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7UUFDdkMsTUFBTSxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsR0FBRyxJQUFJLENBQUMsQ0FBQztJQUM3QixDQUFDO0lBRUQsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyxDQUFDO0FBRUYsZUFBZSxhQUFhLENBQUMifQ==