nx-eric-jarosch opened a new pull request, #3:
URL: https://github.com/apache/ant-antlibs-cyclonedx/pull/3
### Problem Description
When any of these (not an exhaustive list) dependencies are present, a
MalformedURLException can be observed.
```
organisation="commons-codec" module="commons-codec" revision="1.3"
organisation="commons-discovery" module="commons-discovery" revision="0.4"
organisation="commons-digester" module="commons-digester" revision="1.8"
organisation="commons-collections" module="commons-collections"
revision="3.2"
organisation="commons-io" module="commons-io" revision="1.1"
organisation="commons-logging" module="commons-logging" revision="1.1"
organisation="commons-lang" module="commons-lang" revision="2.3"
organisation="commons-pool" module="commons-pool" revision="1.3"
```
because their .pom includes, for example, this:
```
<licenses>
<license>
<name>The Apache Software License, Version 2.0</name>
<url>/LICENSE.txt</url>
</license>
</licenses>
```
<details>
<summary>full stack trace</summary>
```
java.net.MalformedURLException: no protocol: /LICENSE.txt
at
org.apache.tools.ant.types.resources.URLResource.newURL(URLResource.java:429)
at
org.apache.tools.ant.types.resources.URLResource.<init>(URLResource.java:86)
at
org.apache.ant.cyclonedx.IvyModuleComponentResolver.fillFromModuleDescriptor(IvyModuleComponentResolver.java:312)
at
org.apache.ant.cyclonedx.IvyModuleComponentResolver.toComponent(IvyModuleComponentResolver.java:267)
at
org.apache.ant.cyclonedx.IvyModuleComponentResolver.lambda$resolve$0(IvyModuleComponentResolver.java:192)
at
java.base/java.util.stream.ReferencePipeline$3$1.accept(ReferencePipeline.java:195)
at
java.base/java.util.ArrayList$ArrayListSpliterator.forEachRemaining(ArrayList.java:1654)
at
java.base/java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:484)
at
java.base/java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:474)
at
java.base/java.util.stream.ReduceOps$ReduceOp.evaluateSequential(ReduceOps.java:913)
at
java.base/java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:234)
at
java.base/java.util.stream.ReferencePipeline.collect(ReferencePipeline.java:578)
at
org.apache.ant.cyclonedx.IvyModuleComponentResolver.resolve(IvyModuleComponentResolver.java:193)
at org.apache.ant.cyclonedx.Component.resolve(Component.java:879)
at
org.apache.ant.cyclonedx.ComponentBomTask.lambda$createBom$0(ComponentBomTask.java:295)
at
org.apache.ant.cyclonedx.ComponentBomTask.visitAllComponents(ComponentBomTask.java:529)
at
org.apache.ant.cyclonedx.ComponentBomTask.visitAllComponentsWithExtra(ComponentBomTask.java:522)
at
org.apache.ant.cyclonedx.ComponentBomTask.visitAllComponents(ComponentBomTask.java:518)
at
org.apache.ant.cyclonedx.ComponentBomTask.createBom(ComponentBomTask.java:293)
at
org.apache.ant.cyclonedx.ComponentBomTask.execute(ComponentBomTask.java:276)
at org.apache.tools.ant.UnknownElement.execute(UnknownElement.java:299)
at jdk.internal.reflect.GeneratedMethodAccessor4.invoke(Unknown Source)
at
java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.base/java.lang.reflect.Method.invoke(Method.java:566)
at
org.apache.tools.ant.dispatch.DispatchUtils.execute(DispatchUtils.java:99)
at org.apache.tools.ant.Task.perform(Task.java:350)
at java.base/java.util.Vector.forEach(Vector.java:1387)
at org.apache.tools.ant.taskdefs.Sequential.execute(Sequential.java:67)
at org.apache.tools.ant.UnknownElement.execute(UnknownElement.java:299)
at jdk.internal.reflect.GeneratedMethodAccessor4.invoke(Unknown Source)
at
java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.base/java.lang.reflect.Method.invoke(Method.java:566)
at
org.apache.tools.ant.dispatch.DispatchUtils.execute(DispatchUtils.java:99)
at org.apache.tools.ant.Task.perform(Task.java:350)
at
org.apache.tools.ant.taskdefs.MacroInstance.execute(MacroInstance.java:391)
at org.apache.tools.ant.UnknownElement.execute(UnknownElement.java:299)
at jdk.internal.reflect.GeneratedMethodAccessor4.invoke(Unknown Source)
at
java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.base/java.lang.reflect.Method.invoke(Method.java:566)
at
org.apache.tools.ant.dispatch.DispatchUtils.execute(DispatchUtils.java:99)
at org.apache.tools.ant.Task.perform(Task.java:350)
at org.apache.tools.ant.Target.execute(Target.java:449)
at org.apache.tools.ant.Target.performTasks(Target.java:470)
at org.apache.tools.ant.Project.executeSortedTargets(Project.java:1401)
at org.apache.tools.ant.Project.executeTarget(Project.java:1374)
at
org.apache.tools.ant.helper.DefaultExecutor.executeTargets(DefaultExecutor.java:41)
at org.apache.tools.ant.Project.executeTargets(Project.java:1264)
at org.apache.tools.ant.Main.runBuild(Main.java:818)
at org.apache.tools.ant.Main.startAnt(Main.java:223)
at org.apache.tools.ant.Main.start(Main.java:190)
at org.apache.tools.ant.Main.main(Main.java:274)
at
java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at
java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at
java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.base/java.lang.reflect.Method.invoke(Method.java:566)
at com.intellij.rt.ant.execution.AntMain2.main(AntMain2.java:31)
Caused by: java.net.MalformedURLException: no protocol: /LICENSE.txt
at java.base/java.net.URL.<init>(URL.java:627)
at java.base/java.net.URL.<init>(URL.java:523)
at java.base/java.net.URL.<init>(URL.java:470)
at
org.apache.tools.ant.types.resources.URLResource.newURL(URLResource.java:427)
... 55 more
```
</details>
---
### Solution
When the license URL is not a valid URL, the CycloneDX field is left empty.
The resulting file then only contains a `license.id`.
As well as an externalReference: `{ "type": "license", "url": "/LICENSE.txt"
}` (this URL is apparently not parsed)
<details>
<summary>example component entry as seen after this PR</summary>
```
{
"type" : "library",
"bom-ref" : "pkg:maven/commons-io/[email protected]?type=jar",
"group" : "commons-io",
"name" : "commons-io",
"version" : "1.1",
"description" : "Commons-IO contains utility classes, stream
implementations, file filters, and endian classes.",
"hashes" : [ ... (omitted for brevity) ... ],
"licenses" : [
{
"license" : {
"id" : "Apache-2.0"
}
}
],
"purl" : "pkg:maven/commons-io/[email protected]?type=jar",
"externalReferences" : [
{
"type" : "website",
"url" : "http://jakarta.apache.org/commons/io/";
},
{
"type" : "license",
"url" : "/LICENSE.txt"
}
]
},
```
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
