From f2caf4569532619b43d298f1d4b6b264bcf3208e Mon Sep 17 00:00:00 2001 From: Mikail <6186720+NyanKiyoshi@users.noreply.github.com> Date: Thu, 29 Aug 2024 17:05:43 +0200 Subject: [PATCH] fix: properly decode SPDX license expressions in CycloneDX format (#3175) Signed-off-by: Mikail Kocak --- syft/format/internal/cyclonedxutil/helpers/licenses.go | 9 +++------ .../internal/cyclonedxutil/helpers/licenses_test.go | 4 ++-- 2 files changed, 5 insertions(+), 8 deletions(-) diff --git a/syft/format/internal/cyclonedxutil/helpers/licenses.go b/syft/format/internal/cyclonedxutil/helpers/licenses.go index a092d3abdf3..24c5d6ffb79 100644 --- a/syft/format/internal/cyclonedxutil/helpers/licenses.go +++ b/syft/format/internal/cyclonedxutil/helpers/licenses.go @@ -54,17 +54,14 @@ func decodeLicenses(c *cyclonedx.Component) []pkg.License { } for _, l := range *c.Licenses { - if l.License == nil { - continue - } // these fields are mutually exclusive in the spec switch { - case l.License.ID != "": + case l.License != nil && l.License.ID != "": licenses = append(licenses, pkg.NewLicenseFromURLs(l.License.ID, l.License.URL)) - case l.License.Name != "": + case l.License != nil && l.License.Name != "": licenses = append(licenses, pkg.NewLicenseFromURLs(l.License.Name, l.License.URL)) case l.Expression != "": - licenses = append(licenses, pkg.NewLicenseFromURLs(l.Expression, l.License.URL)) + licenses = append(licenses, pkg.NewLicense(l.Expression)) default: } } diff --git a/syft/format/internal/cyclonedxutil/helpers/licenses_test.go b/syft/format/internal/cyclonedxutil/helpers/licenses_test.go index e2532f607d4..373a0937758 100644 --- a/syft/format/internal/cyclonedxutil/helpers/licenses_test.go +++ b/syft/format/internal/cyclonedxutil/helpers/licenses_test.go @@ -254,7 +254,8 @@ func TestDecodeLicenses(t *testing.T) { input: &cyclonedx.Component{ Licenses: &cyclonedx.Licenses{ { - License: &cyclonedx.License{}, + // CycloneDX specification doesn't allow to provide License if Expression is provided + License: nil, Expression: "MIT AND GPL-3.0-only WITH Classpath-exception-2.0", }, }, @@ -264,7 +265,6 @@ func TestDecodeLicenses(t *testing.T) { Value: "MIT AND GPL-3.0-only WITH Classpath-exception-2.0", SPDXExpression: "MIT AND GPL-3.0-only WITH Classpath-exception-2.0", Type: license.Declared, - URLs: []string{}, }, }, },