apisec-code-bolt 0.1.6__tar.gz → 0.1.7__tar.gz

{apisec_code_bolt-0.1.6 → apisec_code_bolt-0.1.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: apisec-code-bolt
-Version: 0.1.6
+Version: 0.1.7
 Summary: Static analysis probe for extracting architectural metadata from codebases
 Project-URL: Homepage, https://apisec.ai
 Project-URL: Documentation, https://docs.apisec.ai/code-bolt

{apisec_code_bolt-0.1.6 → apisec_code_bolt-0.1.7}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "apisec-code-bolt"
-version = "0.1.6"
+version = "0.1.7"
 description = "Static analysis probe for extracting architectural metadata from codebases"
 readme = "README.md"
 license = {text = "Proprietary"}

{apisec_code_bolt-0.1.6 → apisec_code_bolt-0.1.7}/src/apisec_code_bolt/analysis/dependency_extractor.py

@@ -882,87 +882,129 @@ class DependencyExtractor:
         """Resolve versions pinned by parent/imported BOMs by walking the POM
         ancestry (parents + ``<scope>import</scope>``) on Maven Central.
 
-        Accumulates ``<properties>`` (nearest wins) and ``<dependencyManagement>``
-        pins across the chain, then dereferences ``${...}`` refs. Bounded depth +
-        cycle guard; any fetch/parse miss simply contributes nothing. Returns
-        ``{groupId:artifactId -> version}``.
+        Maven properties are **POM-scoped, not global**: two BOMs can define the
+        same property name with different values (e.g. spring-boot-dependencies
+        carries a Jackson-2 version while ``tools.jackson:jackson-bom`` carries a
+        Jackson-3 one). So each BOM's ``<dependencyManagement>`` pins are resolved
+        against THAT BOM's own scope (its ``<properties>`` + its parent chain,
+        child overriding parent) — never a shared soup — and imported BOMs are
+        resolved recursively in their own scope. First-seen pin wins (nearest to
+        the app). An imported-BOM coordinate whose version is itself a ``${...}``
+        ref is dereferenced before fetching. Bounded depth + cycle guards; any
+        fetch/parse miss contributes nothing. ``seed_props`` is intentionally
+        unused — seed coordinates arrive already version-resolved from the app pom.
+        Returns ``{groupId:artifactId -> version}``.
         """
         import xml.etree.ElementTree as ET
 
-        props: dict[str, str] = dict(seed_props)
-        raw_pins: dict[str, str] = {}
-        seen: set[str] = set()
-        worklist = list(seeds)
-        depth = 0
-        while worklist and depth < 8:
-            depth += 1
-            nxt: list[tuple[str, str, str]] = []
-            for g, a, v in worklist:
-                if not (g and a and v):
-                    continue
-                key = f"{g}:{a}:{v}"
-                if key in seen:
-                    continue
-                seen.add(key)
-                data = self._fetch_pom(g, a, v)
-                if not data:
-                    continue
-                try:
-                    el = ET.fromstring(data)
-                except ET.ParseError:
-                    continue
-                bns = el.tag[: el.tag.index("}") + 1] if el.tag.startswith("{") else ""
-
-                def bq(t: str, _ns: str = bns) -> str:
-                    return f"{_ns}{t}"
-
-                pe = el.find(bq("properties"))
-                if pe is not None:
-                    for c in pe:
-                        k = c.tag[len(bns):] if bns else c.tag
-                        if c.text and k not in props:  # nearest (child) wins
-                            props[k] = c.text.strip()
-                dm = el.find(bq("dependencyManagement"))
-                dmd = dm.find(bq("dependencies")) if dm is not None else None
-                if dmd is not None:
-                    for d in dmd.findall(bq("dependency")):
-                        dg = (d.findtext(bq("groupId")) or "").strip()
-                        da = (d.findtext(bq("artifactId")) or "").strip()
-                        dv = (d.findtext(bq("version")) or "").strip()
-                        scope = (d.findtext(bq("scope")) or "").strip().lower()
-                        if scope == "import" and dg and da and dv:
-                            nxt.append((dg, da, dv))
-                        elif dg and da and dv and f"{dg}:{da}" not in raw_pins:
-                            raw_pins[f"{dg}:{da}"] = dv
-                par = el.find(bq("parent"))
-                if par is not None:
-                    pg = (par.findtext(bq("groupId")) or "").strip()
-                    pa = (par.findtext(bq("artifactId")) or "").strip()
-                    pv = (par.findtext(bq("version")) or "").strip()
-                    if pg and pa and pv:
-                        nxt.append((pg, pa, pv))
-            worklist = nxt
-
-        def deref(val: str | None) -> str | None:
-            if val is None:
+        parsed: dict[str, tuple | None] = {}
+
+        def parse(g: str, a: str, v: str):
+            """(own_props, dm_pins, imports, parent) for a POM; cached; None if unfetchable."""
+            key = f"{g}:{a}:{v}"
+            if key in parsed:
+                return parsed[key]
+            parsed[key] = None  # guard re-entry / unfetchable
+            data = self._fetch_pom(g, a, v)
+            if not data:
                 return None
-            seen2: set[str] = set()
+            try:
+                el = ET.fromstring(data)
+            except ET.ParseError:
+                return None
+            ns = el.tag[: el.tag.index("}") + 1] if el.tag.startswith("{") else ""
+
+            def q(t: str) -> str:
+                return f"{ns}{t}"
+
+            own: dict[str, str] = {}
+            pe = el.find(q("properties"))
+            if pe is not None:
+                for c in pe:
+                    k = c.tag[len(ns):] if ns else c.tag
+                    if c.text:
+                        own[k] = c.text.strip()
+            own.setdefault("project.version", v)
+            own.setdefault("project.groupId", g)
+            dm_pins: list[tuple[str, str, str]] = []
+            imports: list[tuple[str, str, str]] = []
+            dm = el.find(q("dependencyManagement"))
+            dmd = dm.find(q("dependencies")) if dm is not None else None
+            if dmd is not None:
+                for d in dmd.findall(q("dependency")):
+                    dg = (d.findtext(q("groupId")) or "").strip()
+                    da = (d.findtext(q("artifactId")) or "").strip()
+                    dv = (d.findtext(q("version")) or "").strip()
+                    sc = (d.findtext(q("scope")) or "").strip().lower()
+                    if dg and da and dv:
+                        (imports if sc == "import" else dm_pins).append((dg, da, dv))
+            parent = None
+            par = el.find(q("parent"))
+            if par is not None:
+                pg = (par.findtext(q("groupId")) or "").strip()
+                pa = (par.findtext(q("artifactId")) or "").strip()
+                pv = (par.findtext(q("version")) or "").strip()
+                if pg and pa and pv:
+                    parent = (pg, pa, pv)
+            result = (own, dm_pins, imports, parent)
+            parsed[key] = result
+            return result
+
+        def interp(val: str, scope: dict[str, str]) -> str | None:
+            if not val:
+                return None
+            seen_p: set[str] = set()
             m = re.fullmatch(r"\$\{([^}]+)\}", val.strip())
-            while m and m.group(1) not in seen2:
-                seen2.add(m.group(1))
-                repl = props.get(m.group(1))
+            while m and m.group(1) not in seen_p:
+                seen_p.add(m.group(1))
+                repl = scope.get(m.group(1))
                 if repl is None:
                     return None
                 val = repl.strip()
                 m = re.fullmatch(r"\$\{([^}]+)\}", val)
-            return None if (val is None or "${" in val) else val
-
-        out: dict[str, str] = {}
-        for name, raw in raw_pins.items():
-            rv = deref(raw)
-            if rv:
-                out[name] = rv
-        return out
+            return None if (not val or "${" in val) else val
+
+        def scope_of(g: str, a: str, v: str, seen: frozenset, depth: int) -> dict[str, str]:
+            """A POM's effective property scope: parent chain, child overrides parent."""
+            key = f"{g}:{a}:{v}"
+            if depth > 10 or key in seen:
+                return {}
+            p = parse(g, a, v)
+            if p is None:
+                return {}
+            own, _dm, _imp, parent = p
+            merged = dict(scope_of(*parent, seen | {key}, depth + 1)) if parent else {}
+            merged.update(own)  # own overrides inherited
+            return merged
+
+        pins: dict[str, str] = {}
+        resolved: set[str] = set()
+
+        def resolve_bom(g: str, a: str, v: str, depth: int) -> None:
+            key = f"{g}:{a}:{v}"
+            if depth > 10 or key in resolved:
+                return
+            resolved.add(key)
+            p = parse(g, a, v)
+            if p is None:
+                return
+            _own, dm_pins, imports, parent = p
+            scope = scope_of(g, a, v, frozenset(), 0)  # resolve in THIS bom's own scope
+            for dg, da, dv in dm_pins:
+                rv = interp(dv, scope)
+                if rv:
+                    pins.setdefault(f"{dg}:{da}", rv)  # nearest-to-app wins
+            for dg, da, dv in imports:
+                iv = interp(dv, scope)
+                if iv:
+                    resolve_bom(interp(dg, scope) or dg, interp(da, scope) or da, iv, depth + 1)
+            if parent:  # inherited dependencyManagement from the parent chain
+                resolve_bom(parent[0], parent[1], parent[2], depth + 1)
+
+        for g, a, v in seeds:
+            if g and a and v:
+                resolve_bom(g, a, v, 0)
+        return pins
 
     # -- pom.xml (Maven / JVM) -------------------------------------------------
 

{apisec_code_bolt-0.1.6 → apisec_code_bolt-0.1.7}/tests/unit/test_dependency_parsing.py

@@ -523,6 +523,61 @@ class TestPomXml:
         by_name = {p.name: p for p in analyzer._parse_pom(pom)}
         assert by_name["com.h2database:h2"].version is None
 
+    def test_imported_bom_pins_resolve_in_own_scope(
+        self, analyzer: DependencyExtractor, tmp_path: Path, monkeypatch
+    ) -> None:
+        # Property scoping: an imported BOM's pins must resolve against THAT BOM's
+        # own properties, not a shared soup. Real case: spring-boot-dependencies
+        # carries a Jackson-2 `jackson.version` while tools.jackson:jackson-bom
+        # carries a Jackson-3 one; the Jackson-3 artifact must get 3.x, not the
+        # leaked 2.x. Regression guard for the null→wrong-version failure mode.
+        parent_pom = b"""<?xml version="1.0"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0">
+  <artifactId>starter-parent</artifactId>
+  <parent><groupId>org.example</groupId><artifactId>deps-bom</artifactId><version>1.0</version></parent>
+</project>"""
+        # deps-bom sets jackson.version=2.9 (Jackson-2 line) AND imports the v3 bom.
+        deps_bom = b"""<?xml version="1.0"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0">
+  <artifactId>deps-bom</artifactId>
+  <properties><jackson.version>2.9.0</jackson.version><j3.version>3.1.2</j3.version></properties>
+  <dependencyManagement><dependencies>
+    <dependency><groupId>tools.jackson</groupId><artifactId>jackson-bom</artifactId>
+      <version>${j3.version}</version><type>pom</type><scope>import</scope></dependency>
+  </dependencies></dependencyManagement>
+</project>"""
+        # jackson-bom (v3) sets its OWN jackson.version=3.1.2 and pins core with it.
+        j3_bom = b"""<?xml version="1.0"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0">
+  <artifactId>jackson-bom</artifactId>
+  <properties><jackson.version>3.1.2</jackson.version></properties>
+  <dependencyManagement><dependencies>
+    <dependency><groupId>tools.jackson.core</groupId><artifactId>jackson-databind</artifactId>
+      <version>${jackson.version}</version></dependency>
+  </dependencies></dependencyManagement>
+</project>"""
+
+        def fake_fetch(self, group, artifact, version):  # noqa: ANN001
+            return {"starter-parent": parent_pom, "deps-bom": deps_bom,
+                    "jackson-bom": j3_bom}.get(artifact)
+
+        monkeypatch.setattr(DependencyExtractor, "_fetch_pom", fake_fetch)
+        monkeypatch.setenv("APISEC_RESOLVE_MAVEN_BOMS", "1")
+        pom = tmp_path / "pom.xml"
+        pom.write_text(
+            """<?xml version="1.0"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0">
+  <parent><groupId>org.example</groupId><artifactId>starter-parent</artifactId><version>1.0</version></parent>
+  <dependencies>
+    <dependency><groupId>tools.jackson.core</groupId><artifactId>jackson-databind</artifactId></dependency>
+  </dependencies>
+</project>
+"""
+        )
+        by_name = {p.name: p for p in analyzer._parse_pom(pom)}
+        # v3 bom's own scope wins → 3.1.2, NOT the 2.9.0 that deps-bom set.
+        assert by_name["tools.jackson.core:jackson-databind"].version == "3.1.2"
+
     def test_version_range_not_pinned(self, analyzer: DependencyExtractor) -> None:
         # Maven range [1.0,2.0) is not an exact pin. (F-1)
         by_name = {p.name: p for p in analyzer._parse_pom(FIXTURES / "pom.xml")}