Description
It seems that deserialization silently loads broken bom data, omitting components due to deduplication.
For reproduction, refer to the sample testdata output as produced in CycloneDX/cyclonedx-cli#399:
{
"bomFormat": "CycloneDX",
"specVersion": "1.5",
"serialNumber": "urn:uuid:66fa5692-2e9d-45c5-830a-ec8ccaf7dcc9",
"version": 1,
"metadata": {
"component": {
"type": "application",
"bom-ref": "root",
"name": "test"
}
},
"components": [
{
"type": "operating-system",
"bom-ref": "test12",
"name": "alpine"
},
{
"type": "container",
"bom-ref": "test11",
"name": "alpine"
},
{
"type": "operating-system",
"bom-ref": "test22",
"name": "alpine"
},
{
"type": "container",
"bom-ref": "test21",
"name": "alpine"
}
],
"dependencies": [
{
"ref": "root",
"dependsOn": [
"test11",
"test21"
]
},
{
"ref": "test11",
"dependsOn": [
"test12"
]
},
{
"ref": "test21",
"dependsOn": [
"test22"
]
}
]
}
Deserialize and validate bom:
>>> with open('test/out.json', mode="r") as testfile:
... json_bom = load(testfile)
>>> len(json_bom['components'])
4
>>> len(json_bom['dependencies'])
3
>>> bom = Bom.from_json(json_bom)
>>> len(bom.components)
2
>>> len(bom.dependencies)
5
>>> bom.validate()
Traceback (most recent call last):
File "<stdin>", line 1, in <module>
File "lib\site-packages\cyclonedx\model\bom.py", line 666, in validate
raise UnknownComponentDependencyException(
cyclonedx.exception.model.UnknownComponentDependencyException: One or more Components have Dependency references to Components/Services that are not known in this BOM. They are: {<BomRef 'test22' id=2111773432208>, <BomRef 'test21' id=2111773432160>}
Because Bom.from_json()
doesn't throw an error, there's no telling what data is actually lost during deserialization.