From b5c7d4ebe3d2d4eb18e325e96eb4ac9b77b0c967 Mon Sep 17 00:00:00 2001 From: Philipp Nanz Date: Wed, 31 Jul 2024 10:56:51 +0200 Subject: [PATCH] Fix validation error when XML BOM declares multiple namespaces Signed-off-by: Philipp Nanz --- .../parser/cyclonedx/CycloneDxValidator.java | 4 + .../resources/v1/BomResourceTest.java | 6 ++ src/test/resources/unit/bom-issue4008.xml | 99 +++++++++++++++++++ 3 files changed, 109 insertions(+) create mode 100644 src/test/resources/unit/bom-issue4008.xml diff --git a/src/main/java/org/dependencytrack/parser/cyclonedx/CycloneDxValidator.java b/src/main/java/org/dependencytrack/parser/cyclonedx/CycloneDxValidator.java index 991ebcb579..6da17ac789 100644 --- a/src/main/java/org/dependencytrack/parser/cyclonedx/CycloneDxValidator.java +++ b/src/main/java/org/dependencytrack/parser/cyclonedx/CycloneDxValidator.java @@ -195,6 +195,10 @@ private Version detectSchemaVersionFromXml(final byte[] bomBytes) throws XMLStre case NS_BOM_16 -> VERSION_16; default -> null; }; + + if (schemaVersion != null) { + break; + } } if (schemaVersion == null) { diff --git a/src/test/java/org/dependencytrack/resources/v1/BomResourceTest.java b/src/test/java/org/dependencytrack/resources/v1/BomResourceTest.java index fa48b76e6c..1cc5be81e1 100644 --- a/src/test/java/org/dependencytrack/resources/v1/BomResourceTest.java +++ b/src/test/java/org/dependencytrack/resources/v1/BomResourceTest.java @@ -1079,4 +1079,10 @@ public void uploadBomTooLargeViaPutTest() { """); } + @Test + public void validateCycloneDxBomWithMultipleNamespacesTest() throws Exception { + byte[] bom = resourceToByteArray("/unit/bom-issue4008.xml"); + assertThatNoException().isThrownBy(() -> CycloneDxValidator.getInstance().validate(bom)); + } + } diff --git a/src/test/resources/unit/bom-issue4008.xml b/src/test/resources/unit/bom-issue4008.xml new file mode 100644 index 0000000000..f4d2a5630b --- /dev/null +++ b/src/test/resources/unit/bom-issue4008.xml @@ -0,0 +1,99 @@ + + + + + + Author + author@example.com + 123-456-7890 + + + + + Foo Incorporated + https://foo.bar.com + + Foo Jr. + foojr@bar.com + 123-456-7890 + + + DependencyTrack + Acme example + + + https://acme.example + + + https://acme.example + + + https://acme.example + + + https://acme.example + + + + + Foo Incorporated + https://foo.bar.com + + Foo Sr. + foo@bar.com + 800-123-4567 + + + + Foo Incorporated + https://foo.bar.com + + Foo Jr. + foojr@bar.com + 123-456-7890 + + + + + + + Foo Incorporated + https://foo.bar.com + + Foo Jr. + foojr@bar.com + 123-456-7890 + + + Sometimes this field is long because it is composed of a list of authors...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... + Example Incorporated + com.example + xmlutil + 1.0.0 + A makebelieve XML utility library + + 2b67669c925048d1a5c7f124d9ba1d2a + 72ca79908c814022905e86f8bbecd9b829352139 + 1389877662864d2bb0488b4b1e417ce5647a1687084341178a203b243dfe90e7 + + + + Apache-2.0 + https://www.apache.org/licenses/LICENSE-2.0.txt + + + Copyright Example Inc. All rights reserved. + cpe:/a:example:xmlutil:1.0.0 + pkg:maven/com.example/xmlutil@1.0.0?packaging=jar + false + + foo + bar + baz + qux + qux + aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa + + + +