forked from DependencyTrack/dependency-track
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Validate uploaded BOMs against CycloneDX schema
Closes DependencyTrack#3218 Signed-off-by: nscuro <[email protected]>
- Loading branch information
Showing
12 changed files
with
689 additions
and
3 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
200 changes: 200 additions & 0 deletions
200
src/main/java/org/dependencytrack/parser/cyclonedx/CycloneDxValidator.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,200 @@ | ||
| /* | ||
| * This file is part of Dependency-Track. | ||
| * | ||
| * Licensed under the Apache License, Version 2.0 (the "License"); | ||
| * you may not use this file except in compliance with the License. | ||
| * You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| * | ||
| * SPDX-License-Identifier: Apache-2.0 | ||
| * Copyright (c) Steve Springett. All Rights Reserved. | ||
| */ | ||
| package org.dependencytrack.parser.cyclonedx; | ||
|
|
||
| import alpine.common.logging.Logger; | ||
| import com.fasterxml.jackson.core.JsonParseException; | ||
| import com.fasterxml.jackson.core.JsonToken; | ||
| import com.fasterxml.jackson.databind.json.JsonMapper; | ||
| import org.codehaus.stax2.XMLInputFactory2; | ||
| import org.cyclonedx.CycloneDxSchema; | ||
| import org.cyclonedx.exception.ParseException; | ||
| import org.cyclonedx.parsers.JsonParser; | ||
| import org.cyclonedx.parsers.Parser; | ||
| import org.cyclonedx.parsers.XmlParser; | ||
|
|
||
| import javax.xml.stream.XMLInputFactory; | ||
| import javax.xml.stream.XMLStreamException; | ||
| import javax.xml.stream.XMLStreamReader; | ||
| import javax.xml.stream.events.XMLEvent; | ||
| import java.io.ByteArrayInputStream; | ||
| import java.io.IOException; | ||
| import java.util.ArrayList; | ||
| import java.util.List; | ||
| import java.util.Optional; | ||
|
|
||
| import static org.cyclonedx.CycloneDxSchema.NS_BOM_10; | ||
| import static org.cyclonedx.CycloneDxSchema.NS_BOM_11; | ||
| import static org.cyclonedx.CycloneDxSchema.NS_BOM_12; | ||
| import static org.cyclonedx.CycloneDxSchema.NS_BOM_13; | ||
| import static org.cyclonedx.CycloneDxSchema.NS_BOM_14; | ||
| import static org.cyclonedx.CycloneDxSchema.NS_BOM_15; | ||
| import static org.cyclonedx.CycloneDxSchema.Version.VERSION_10; | ||
| import static org.cyclonedx.CycloneDxSchema.Version.VERSION_11; | ||
| import static org.cyclonedx.CycloneDxSchema.Version.VERSION_12; | ||
| import static org.cyclonedx.CycloneDxSchema.Version.VERSION_13; | ||
| import static org.cyclonedx.CycloneDxSchema.Version.VERSION_14; | ||
| import static org.cyclonedx.CycloneDxSchema.Version.VERSION_15; | ||
|
|
||
| /** | ||
| * @since 4.11.0 | ||
| */ | ||
| public class CycloneDxValidator { | ||
|
|
||
| private static final Logger LOGGER = Logger.getLogger(CycloneDxValidator.class); | ||
|
|
||
| private final JsonMapper jsonMapper = new JsonMapper(); | ||
|
|
||
| public void validate(final byte[] bomBytes) { | ||
| final FormatAndVersion formatAndVersion = detectFormatAndSchemaVersion(bomBytes); | ||
|
|
||
| final Parser bomParser = switch (formatAndVersion.format()) { | ||
| case JSON -> new JsonParser(); | ||
| case XML -> new XmlParser(); | ||
| }; | ||
|
|
||
| final List<ParseException> validationErrors; | ||
| try { | ||
| validationErrors = bomParser.validate(bomBytes, formatAndVersion.version()); | ||
| } catch (IOException e) { | ||
| throw new RuntimeException("Failed to validate BOM", e); | ||
| } | ||
|
|
||
| if (!validationErrors.isEmpty()) { | ||
| throw new InvalidBomException("BOM is invalid", validationErrors.stream() | ||
| .map(ParseException::getMessage) | ||
| .toList()); | ||
| } | ||
| } | ||
|
|
||
| private FormatAndVersion detectFormatAndSchemaVersion(final byte[] bomBytes) { | ||
| try { | ||
| final CycloneDxSchema.Version version = detectSchemaVersionFromJson(bomBytes); | ||
| return new FormatAndVersion(Format.JSON, version); | ||
| } catch (JsonParseException e) { | ||
| if (LOGGER.isDebugEnabled()) { | ||
| LOGGER.debug("Failed to parse BOM as JSON", e); | ||
| } | ||
| } catch (IOException e) { | ||
| throw new RuntimeException(e); | ||
| } | ||
|
|
||
| try { | ||
| final CycloneDxSchema.Version version = detectSchemaVersionFromXml(bomBytes); | ||
| return new FormatAndVersion(Format.XML, version); | ||
| } catch (XMLStreamException e) { | ||
| if (LOGGER.isDebugEnabled()) { | ||
| LOGGER.debug("Failed to parse BOM as XML", e); | ||
| } | ||
| } | ||
|
|
||
| throw new InvalidBomException("BOM is neither valid JSON nor XML"); | ||
| } | ||
|
|
||
| private CycloneDxSchema.Version detectSchemaVersionFromJson(final byte[] bomBytes) throws IOException { | ||
| try (final com.fasterxml.jackson.core.JsonParser jsonParser = jsonMapper.createParser(bomBytes)) { | ||
| JsonToken currentToken = jsonParser.nextToken(); | ||
| if (currentToken != JsonToken.START_OBJECT) { | ||
| final String currentTokenAsString = Optional.ofNullable(currentToken) | ||
| .map(JsonToken::asString).orElse(null); | ||
| throw new JsonParseException(jsonParser, "Expected token %s, but got %s" | ||
| .formatted(JsonToken.START_OBJECT.asString(), currentTokenAsString)); | ||
| } | ||
|
|
||
| CycloneDxSchema.Version schemaVersion = null; | ||
| while (jsonParser.nextToken() != JsonToken.END_OBJECT) { | ||
| final String fieldName = jsonParser.getCurrentName(); | ||
| if ("specVersion".equals(fieldName)) { | ||
| if (jsonParser.nextToken() == JsonToken.VALUE_STRING) { | ||
| final String specVersion = jsonParser.getValueAsString(); | ||
| schemaVersion = switch (jsonParser.getValueAsString()) { | ||
| case "1.0", "1.1" -> | ||
| throw new InvalidBomException("JSON is not supported for specVersion %s".formatted(specVersion)); | ||
| case "1.2" -> VERSION_12; | ||
| case "1.3" -> VERSION_13; | ||
| case "1.4" -> VERSION_14; | ||
| case "1.5" -> VERSION_15; | ||
| default -> | ||
| throw new InvalidBomException("Unrecognized specVersion %s".formatted(specVersion)); | ||
| }; | ||
| } | ||
| } | ||
|
|
||
| if (schemaVersion != null) { | ||
| return schemaVersion; | ||
| } | ||
| } | ||
|
|
||
| throw new InvalidBomException("Unable to determine schema version from JSON"); | ||
| } | ||
| } | ||
|
|
||
| private CycloneDxSchema.Version detectSchemaVersionFromXml(final byte[] bomBytes) throws XMLStreamException { | ||
| final XMLInputFactory xmlInputFactory = XMLInputFactory2.newFactory(); | ||
| final var bomBytesStream = new ByteArrayInputStream(bomBytes); | ||
| final XMLStreamReader xmlStreamReader = xmlInputFactory.createXMLStreamReader(bomBytesStream); | ||
|
|
||
| CycloneDxSchema.Version schemaVersion = null; | ||
| while (xmlStreamReader.hasNext()) { | ||
| if (xmlStreamReader.next() == XMLEvent.START_ELEMENT) { | ||
| if (!"bom".equalsIgnoreCase(xmlStreamReader.getLocalName())) { | ||
| continue; | ||
| } | ||
|
|
||
| final var namespaceUrisSeen = new ArrayList<String>(); | ||
| for (int i = 0; i < xmlStreamReader.getNamespaceCount(); i++) { | ||
| final String namespaceUri = xmlStreamReader.getNamespaceURI(i); | ||
| namespaceUrisSeen.add(namespaceUri); | ||
|
|
||
| schemaVersion = switch (namespaceUri) { | ||
| case NS_BOM_10 -> VERSION_10; | ||
| case NS_BOM_11 -> VERSION_11; | ||
| case NS_BOM_12 -> VERSION_12; | ||
| case NS_BOM_13 -> VERSION_13; | ||
| case NS_BOM_14 -> VERSION_14; | ||
| case NS_BOM_15 -> VERSION_15; | ||
| default -> null; | ||
| }; | ||
| } | ||
|
|
||
| if (schemaVersion == null) { | ||
| throw new InvalidBomException("Unable to determine schema version from XML namespaces %s" | ||
| .formatted(namespaceUrisSeen)); | ||
| } | ||
|
|
||
| break; | ||
| } | ||
| } | ||
|
|
||
| if (schemaVersion == null) { | ||
| throw new InvalidBomException("Unable to determine schema version from XML"); | ||
| } | ||
|
|
||
| return schemaVersion; | ||
| } | ||
|
|
||
| private enum Format { | ||
| JSON, | ||
| XML | ||
| } | ||
|
|
||
| private record FormatAndVersion(Format format, CycloneDxSchema.Version version) { | ||
| } | ||
|
|
||
| } |
49 changes: 49 additions & 0 deletions
49
src/main/java/org/dependencytrack/parser/cyclonedx/InvalidBomException.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,49 @@ | ||
| /* | ||
| * This file is part of Dependency-Track. | ||
| * | ||
| * Licensed under the Apache License, Version 2.0 (the "License"); | ||
| * you may not use this file except in compliance with the License. | ||
| * You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| * | ||
| * SPDX-License-Identifier: Apache-2.0 | ||
| * Copyright (c) Steve Springett. All Rights Reserved. | ||
| */ | ||
| package org.dependencytrack.parser.cyclonedx; | ||
|
|
||
| import java.util.Collections; | ||
| import java.util.List; | ||
|
|
||
| public class InvalidBomException extends RuntimeException { | ||
|
|
||
| private final List<String> validationErrors; | ||
|
|
||
| InvalidBomException(final String message) { | ||
| this(message, (Throwable) null); | ||
| } | ||
|
|
||
| InvalidBomException(final String message, final Throwable cause) { | ||
| this(message, cause, Collections.emptyList()); | ||
| } | ||
|
|
||
| InvalidBomException(final String message, final List<String> validationErrors) { | ||
| this(message, null, validationErrors); | ||
| } | ||
|
|
||
| private InvalidBomException(final String message, final Throwable cause, final List<String> validationErrors) { | ||
| super(message, cause); | ||
| this.validationErrors = validationErrors; | ||
| } | ||
|
|
||
| public List<String> getValidationErrors() { | ||
| return validationErrors; | ||
| } | ||
|
|
||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.