From 5e7adefeabd5a89f4bdc83cadcfff1d11f563d1d Mon Sep 17 00:00:00 2001 From: Weston Steimel Date: Wed, 22 Nov 2023 12:55:21 +0000 Subject: [PATCH] fix(java): improve identification for org.eclipse.platform artifacts Signed-off-by: Weston Steimel --- .../cataloger/common/cpe/java_groupid_map.go | 1 + .../pkg/cataloger/java/parse_java_manifest.go | 26 ++++++++++++++----- 2 files changed, 20 insertions(+), 7 deletions(-) diff --git a/syft/pkg/cataloger/common/cpe/java_groupid_map.go b/syft/pkg/cataloger/common/cpe/java_groupid_map.go index b23a736eb949..d9134277d1b9 100644 --- a/syft/pkg/cataloger/common/cpe/java_groupid_map.go +++ b/syft/pkg/cataloger/common/cpe/java_groupid_map.go @@ -1199,4 +1199,5 @@ var DefaultArtifactIDToGroupID = map[string]string{ "spring-webflow": "org.springframework.webflow", "spring-ws": "org.springframework.ws", "spring-xml": "org.springframework.ws", + "org.eclipse.ant.core": "org.eclipse.platform", } diff --git a/syft/pkg/cataloger/java/parse_java_manifest.go b/syft/pkg/cataloger/java/parse_java_manifest.go index 14a3a363e383..50088111f9c2 100644 --- a/syft/pkg/cataloger/java/parse_java_manifest.go +++ b/syft/pkg/cataloger/java/parse_java_manifest.go @@ -153,6 +153,22 @@ func extractNameFromApacheMavenBundlePlugin(manifest *pkg.JavaManifest) string { return "" } +func extractNameFromArchiveFilename(a archiveFilename) string { + if strings.Contains(a.name, ".") { + // special case: this *might* be a group id + artifact id. By convention artifact ids do not have "." in them; + // however, there are some specific exceptions like with the artifacts under + // https://repo1.maven.org/maven2/org/eclipse/platform/ + if strings.HasPrefix(a.name, "org.eclipse.") { + return a.name + } + + fields := strings.Split(a.name, ".") + return fields[len(fields)-1] + } + + return a.name +} + func selectName(manifest *pkg.JavaManifest, filenameObj archiveFilename) string { name := extractNameFromApacheMavenBundlePlugin(manifest) if name != "" { @@ -160,13 +176,9 @@ func selectName(manifest *pkg.JavaManifest, filenameObj archiveFilename) string } // the filename tends to be the next-best reference for the package name - if filenameObj.name != "" { - if strings.Contains(filenameObj.name, ".") { - // special case: this *might* be a group id + artifact id. By convention artifact ids do not have "." in them. - fields := strings.Split(filenameObj.name, ".") - return fields[len(fields)-1] - } - return filenameObj.name + name = extractNameFromArchiveFilename(filenameObj) + if name != "" { + return name } // remaining fields in the manifest is a bit of a free-for-all depending on the build tooling used and package maintainer preferences