-
-
Notifications
You must be signed in to change notification settings - Fork 54
Labels
bugSomething isn't workingSomething isn't workingquestionFurther information is requestedFurther information is requested
Description
It seems that deserialization silently loads broken bom data, omitting components due to deduplication.
For reproduction, refer to the sample testdata output as produced in CycloneDX/cyclonedx-cli#399:
{
"bomFormat": "CycloneDX",
"specVersion": "1.5",
"serialNumber": "urn:uuid:66fa5692-2e9d-45c5-830a-ec8ccaf7dcc9",
"version": 1,
"metadata": {
"component": {
"type": "application",
"bom-ref": "root",
"name": "test"
}
},
"components": [
{
"type": "operating-system",
"bom-ref": "test12",
"name": "alpine"
},
{
"type": "container",
"bom-ref": "test11",
"name": "alpine"
},
{
"type": "operating-system",
"bom-ref": "test22",
"name": "alpine"
},
{
"type": "container",
"bom-ref": "test21",
"name": "alpine"
}
],
"dependencies": [
{
"ref": "root",
"dependsOn": [
"test11",
"test21"
]
},
{
"ref": "test11",
"dependsOn": [
"test12"
]
},
{
"ref": "test21",
"dependsOn": [
"test22"
]
}
]
}
Deserialize and validate bom:
>>> with open('test/out.json', mode="r") as testfile:
... json_bom = load(testfile)
>>> len(json_bom['components'])
4
>>> len(json_bom['dependencies'])
3
>>> bom = Bom.from_json(json_bom)
>>> len(bom.components)
2
>>> len(bom.dependencies)
5
>>> bom.validate()
Traceback (most recent call last):
File "<stdin>", line 1, in <module>
File "lib\site-packages\cyclonedx\model\bom.py", line 666, in validate
raise UnknownComponentDependencyException(
cyclonedx.exception.model.UnknownComponentDependencyException: One or more Components have Dependency references to Components/Services that are not known in this BOM. They are: {<BomRef 'test22' id=2111773432208>, <BomRef 'test21' id=2111773432160>}
Because Bom.from_json()
doesn't throw an error, there's no telling what data is actually lost during deserialization.
jkowalleck
Metadata
Metadata
Assignees
Labels
bugSomething isn't workingSomething isn't workingquestionFurther information is requestedFurther information is requested