Skip to content

Commit 57d4b8e

Browse files
kzantowkzantow
authored
fix: panic if JSON relationship array contains null (#239)
Signed-off-by: Keith Zantow <kzantow@gmail.com>
1 parent 606f188 commit 57d4b8e

File tree

6 files changed

+166
-0
lines changed

6 files changed

+166
-0
lines changed

‎spdx/v2/v2_2/document.go

+8
Original file line numberDiff line numberDiff line change
@@ -120,6 +120,14 @@ func (d *Document) UnmarshalJSON(b []byte) error {
120120
return fmt.Sprintf("%v-%v->%v", common.RenderDocElementID(refA), rel, common.RenderDocElementID(refB))
121121
}
122122

123+
// remove null relationships
124+
for i := 0; i < len(d.Relationships); i++ {
125+
if d.Relationships[i] == nil {
126+
d.Relationships = append(d.Relationships[0:i], d.Relationships[i+1:]...)
127+
i--
128+
}
129+
}
130+
123131
// index current list of relationships to ensure no duplication
124132
for _, r := range d.Relationships {
125133
relationshipExists[serializeRel(r)] = true

‎spdx/v2/v2_2/json/json_test.go

+19
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,25 @@ func TestLoad(t *testing.T) {
4040
}
4141
}
4242

43+
func Test_nullRelationships(t *testing.T) {
44+
file, err := os.Open("testdata/spdx-null-relationships.json")
45+
if err != nil {
46+
panic(fmt.Errorf("error opening File: %s", err))
47+
}
48+
49+
var got spdx.Document
50+
err = json.ReadInto(file, &got)
51+
if err != nil {
52+
t.Errorf("json.parser.Load() error = %v", err)
53+
return
54+
}
55+
56+
require.Len(t, got.Relationships, 2)
57+
for _, r := range got.Relationships {
58+
require.NotNil(t, r)
59+
}
60+
}
61+
4362
func Test_Write(t *testing.T) {
4463
want := example.Copy()
4564

‎spdx/v2/v2_2/json/testdata/spdx-null-relationships.json

+56
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"files": [ {
3+
"fileName": "./Microsoft.CSharp.dll",
4+
"SPDXID": "SPDXRef-File--Microsoft.CSharp.dll-E226415EEA8ABBBA041A635582440F75E873395C",
5+
"checksums": [
6+
{
7+
"algorithm": "SHA256",
8+
"checksumValue": "696b0b0d6ac06e620efd58db6f5f2e15fa2c9b91ddf8774ab8768c958d593254"
9+
},
10+
{
11+
"algorithm": "SHA1",
12+
"checksumValue": "e226415eea8abbba041a635582440f75e873395c"
13+
}
14+
],
15+
"licenseConcluded": "NOASSERTION",
16+
"licenseInfoInFile": [
17+
"NOASSERTION"
18+
],
19+
"copyrightText": "NOASSERTION"
20+
}],
21+
"packages": [
22+
{
23+
"name": "read-pkg",
24+
"SPDXID": "SPDXRef-Package-read-pkg-1.1.0-30839A4052AC42B4E1CAB4B52EBC7DE7B94BB36D",
25+
"versionInfo": "1.1.0"
26+
},
27+
{
28+
"name": "read-pkg",
29+
"SPDXID": "SPDXRef-Package-read-pkg-1.1.0-30839A4052AC42B4E1CAB4B52EBC7DE7B94BB36D",
30+
"versionInfo": "1.1.0"
31+
}
32+
],
33+
"relationships": [
34+
null,
35+
{
36+
37+
},
38+
null,
39+
{
40+
41+
},
42+
null
43+
],
44+
"spdxVersion": "SPDX-2.2",
45+
"dataLicense": "CC0-1.0",
46+
"SPDXID": "SPDXRef-DOCUMENT",
47+
"name": "Coordinated Packages 229170",
48+
"documentNamespace": "https://sbom.microsoft/1:2QSF7qZlbE-F7QrUJlEo7g:pHp_nUFvDUijZ4LrJ4RhoQ/696:229170/F8kPc6dwY0WXD1Rkc2z6cg",
49+
"creationInfo": {
50+
"created": "2021-12-08T21:06:16Z",
51+
"creators": [
52+
"Organization: Microsoft",
53+
"Tool: Microsoft.SBOMTool-2.0.88"
54+
]
55+
}
56+
}

‎spdx/v2/v2_3/document.go

+8
Original file line numberDiff line numberDiff line change
@@ -119,6 +119,14 @@ func (d *Document) UnmarshalJSON(b []byte) error {
119119
return fmt.Sprintf("%v-%v->%v", common.RenderDocElementID(refA), rel, common.RenderDocElementID(refB))
120120
}
121121

122+
// remove null relationships
123+
for i := 0; i < len(d.Relationships); i++ {
124+
if d.Relationships[i] == nil {
125+
d.Relationships = append(d.Relationships[0:i], d.Relationships[i+1:]...)
126+
i--
127+
}
128+
}
129+
122130
// index current list of relationships to ensure no duplication
123131
for _, r := range d.Relationships {
124132
relationshipExists[serializeRel(r)] = true

‎spdx/v2/v2_3/json/json_test.go

+19
Original file line numberDiff line numberDiff line change
@@ -88,6 +88,25 @@ func Test_Write(t *testing.T) {
8888
}
8989
}
9090

91+
func Test_nullRelationships(t *testing.T) {
92+
file, err := os.Open("testdata/spdx-null-relationships.json")
93+
if err != nil {
94+
panic(fmt.Errorf("error opening File: %s", err))
95+
}
96+
97+
var got spdx.Document
98+
err = json.ReadInto(file, &got)
99+
if err != nil {
100+
t.Errorf("json.parser.Load() error = %v", err)
101+
return
102+
}
103+
104+
require.Len(t, got.Relationships, 2)
105+
for _, r := range got.Relationships {
106+
require.NotNil(t, r)
107+
}
108+
}
109+
91110
func Test_ShorthandFields(t *testing.T) {
92111
contents := `{
93112
"spdxVersion": "SPDX-2.3",

‎spdx/v2/v2_3/json/testdata/spdx-null-relationships.json

+56
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"files": [ {
3+
"fileName": "./Microsoft.CSharp.dll",
4+
"SPDXID": "SPDXRef-File--Microsoft.CSharp.dll-E226415EEA8ABBBA041A635582440F75E873395C",
5+
"checksums": [
6+
{
7+
"algorithm": "SHA256",
8+
"checksumValue": "696b0b0d6ac06e620efd58db6f5f2e15fa2c9b91ddf8774ab8768c958d593254"
9+
},
10+
{
11+
"algorithm": "SHA1",
12+
"checksumValue": "e226415eea8abbba041a635582440f75e873395c"
13+
}
14+
],
15+
"licenseConcluded": "NOASSERTION",
16+
"licenseInfoInFile": [
17+
"NOASSERTION"
18+
],
19+
"copyrightText": "NOASSERTION"
20+
}],
21+
"packages": [
22+
{
23+
"name": "read-pkg",
24+
"SPDXID": "SPDXRef-Package-read-pkg-1.1.0-30839A4052AC42B4E1CAB4B52EBC7DE7B94BB36D",
25+
"versionInfo": "1.1.0"
26+
},
27+
{
28+
"name": "read-pkg",
29+
"SPDXID": "SPDXRef-Package-read-pkg-1.1.0-30839A4052AC42B4E1CAB4B52EBC7DE7B94BB36D",
30+
"versionInfo": "1.1.0"
31+
}
32+
],
33+
"relationships": [
34+
null,
35+
{
36+
37+
},
38+
null,
39+
{
40+
41+
},
42+
null
43+
],
44+
"spdxVersion": "SPDX-2.3",
45+
"dataLicense": "CC0-1.0",
46+
"SPDXID": "SPDXRef-DOCUMENT",
47+
"name": "Coordinated Packages 229170",
48+
"documentNamespace": "https://sbom.microsoft/1:2QSF7qZlbE-F7QrUJlEo7g:pHp_nUFvDUijZ4LrJ4RhoQ/696:229170/F8kPc6dwY0WXD1Rkc2z6cg",
49+
"creationInfo": {
50+
"created": "2021-12-08T21:06:16Z",
51+
"creators": [
52+
"Organization: Microsoft",
53+
"Tool: Microsoft.SBOMTool-2.0.88"
54+
]
55+
}
56+
}

0 commit comments

Comments
 (0)