Skip to content

Commit a228078

Browse files
bloodhoundGitbloodhoundGit
committed
feat(nuget): add dependency check for inside group tags
 1. update code to look for dependencies in a group as well 2. update nuget test data with dependency data Signed-off-by: Abedin Poonawala <abedinp@securestack.com>
1 parent a05670b commit a228078

6 files changed

Lines changed: 363 additions & 270 deletions

‎src/packagedcode/nuget.py‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,29 @@ def get_dependencies(nuspec):
2727
dependencies = []
2828
try:
2929
if "dependencies" in nuspec:
30+
if "group" in nuspec["dependencies"]:
31+
for group in nuspec["dependencies"]["group"]:
32+
if "dependency" in group:
33+
for dependency in group["dependency"]:
34+
#dependencies.append(dependency)
35+
dpurl = models.PackageURL(
36+
type='nuget',
37+
namespace=None,
38+
name=dependency.get("@id"),
39+
version=dependency.get("@version"),
40+
qualifiers=None
41+
)
42+
dep_pack = models.DependentPackage(
43+
purl=str(dpurl),
44+
extracted_requirement=dependency.get("@version"),
45+
scope="dependency",
46+
is_runtime=False,
47+
is_optional=False,
48+
is_resolved=True,
49+
)
50+
51+
dependencies.append(dep_pack)
52+
3053
if "dependency" in nuspec.get("dependencies"):
3154
if "@id" and "@version" in nuspec.get("dependencies").get("dependency"):
3255
dpurl = models.PackageURL(

‎tests/packagedcode/data/nuget/Castle.Core.nuspec.json.expected‎

Lines changed: 104 additions & 54 deletions
Original file line numberDiff line numberDiff line change
@@ -37,64 +37,114 @@
3737
"code_view_url": null,
3838
"vcs_url": "git+https://github.com/castleproject/Core",
3939
"copyright": "Copyright (c) 2004-2017 Castle Project - http://www.castleproject.org/",
40-
"declared_license_expression": "apache-2.0",
41-
"declared_license_expression_spdx": "Apache-2.0",
42-
"license_detections": [
43-
{
44-
"license_expression": "apache-2.0",
45-
"detection_log": [
46-
"not-combined"
47-
],
48-
"matches": [
49-
{
50-
"score": 100.0,
51-
"start_line": 1,
52-
"end_line": 1,
53-
"matched_length": 9,
54-
"match_coverage": 100.0,
55-
"matcher": "1-hash",
56-
"license_expression": "apache-2.0",
57-
"rule_identifier": "apache-2.0_20.RULE",
58-
"rule_url": "https://github.com/nexB/scancode-toolkit/tree/develop/src/licensedcode/data/rules/apache-2.0_20.RULE",
59-
"referenced_filenames": [],
60-
"is_license_text": false,
61-
"is_license_notice": false,
62-
"is_license_reference": true,
63-
"is_license_tag": false,
64-
"is_license_intro": false,
65-
"rule_length": 9,
66-
"rule_relevance": 100,
67-
"matched_text": "http://www.apache.org/licenses/LICENSE-2.0.html",
68-
"licenses": [
69-
{
70-
"key": "apache-2.0",
71-
"name": "Apache License 2.0",
72-
"short_name": "Apache 2.0",
73-
"category": "Permissive",
74-
"is_exception": false,
75-
"is_unknown": false,
76-
"owner": "Apache Software Foundation",
77-
"homepage_url": "http://www.apache.org/licenses/",
78-
"text_url": "http://www.apache.org/licenses/LICENSE-2.0",
79-
"reference_url": "https://scancode-licensedb.aboutcode.org/apache-2.0",
80-
"scancode_url": "https://github.com/nexB/scancode-toolkit/tree/develop/src/licensedcode/data/licenses/apache-2.0.LICENSE",
81-
"spdx_license_key": "Apache-2.0",
82-
"spdx_url": "https://spdx.org/licenses/Apache-2.0"
83-
}
84-
]
85-
}
86-
]
87-
}
88-
],
89-
"other_license_expression": null,
90-
"other_license_expression_spdx": null,
91-
"other_license_detections": [],
92-
"extracted_license_statement": "http://www.apache.org/licenses/LICENSE-2.0.html",
40+
"license_expression": "apache-2.0",
41+
"declared_license": "http://www.apache.org/licenses/LICENSE-2.0.html",
9342
"notice_text": null,
9443
"source_packages": [],
9544
"file_references": [],
9645
"extra_data": {},
97-
"dependencies": [],
46+
"dependencies": [
47+
{
48+
"purl": "pkg:nuget/NETStandard.Library@1.6.1",
49+
"extracted_requirement": "1.6.1",
50+
"scope": "dependency",
51+
"is_runtime": false,
52+
"is_optional": false,
53+
"is_resolved": true,
54+
"resolved_package": {},
55+
"extra_data": {}
56+
},
57+
{
58+
"purl": "pkg:nuget/System.Diagnostics.TraceSource@4.3.0",
59+
"extracted_requirement": "4.3.0",
60+
"scope": "dependency",
61+
"is_runtime": false,
62+
"is_optional": false,
63+
"is_resolved": true,
64+
"resolved_package": {},
65+
"extra_data": {}
66+
},
67+
{
68+
"purl": "pkg:nuget/System.Reflection.TypeExtensions@4.3.0",
69+
"extracted_requirement": "4.3.0",
70+
"scope": "dependency",
71+
"is_runtime": false,
72+
"is_optional": false,
73+
"is_resolved": true,
74+
"resolved_package": {},
75+
"extra_data": {}
76+
},
77+
{
78+
"purl": "pkg:nuget/System.Xml.XmlDocument@4.3.0",
79+
"extracted_requirement": "4.3.0",
80+
"scope": "dependency",
81+
"is_runtime": false,
82+
"is_optional": false,
83+
"is_resolved": true,
84+
"resolved_package": {},
85+
"extra_data": {}
86+
},
87+
{
88+
"purl": "pkg:nuget/System.Dynamic.Runtime@4.3.0",
89+
"extracted_requirement": "4.3.0",
90+
"scope": "dependency",
91+
"is_runtime": false,
92+
"is_optional": false,
93+
"is_resolved": true,
94+
"resolved_package": {},
95+
"extra_data": {}
96+
},
97+
{
98+
"purl": "pkg:nuget/System.Reflection@4.3.0",
99+
"extracted_requirement": "4.3.0",
100+
"scope": "dependency",
101+
"is_runtime": false,
102+
"is_optional": false,
103+
"is_resolved": true,
104+
"resolved_package": {},
105+
"extra_data": {}
106+
},
107+
{
108+
"purl": "pkg:nuget/System.Reflection.Emit@4.3.0",
109+
"extracted_requirement": "4.3.0",
110+
"scope": "dependency",
111+
"is_runtime": false,
112+
"is_optional": false,
113+
"is_resolved": true,
114+
"resolved_package": {},
115+
"extra_data": {}
116+
},
117+
{
118+
"purl": "pkg:nuget/System.Collections.Specialized@4.3.0",
119+
"extracted_requirement": "4.3.0",
120+
"scope": "dependency",
121+
"is_runtime": false,
122+
"is_optional": false,
123+
"is_resolved": true,
124+
"resolved_package": {},
125+
"extra_data": {}
126+
},
127+
{
128+
"purl": "pkg:nuget/System.ComponentModel@4.3.0",
129+
"extracted_requirement": "4.3.0",
130+
"scope": "dependency",
131+
"is_runtime": false,
132+
"is_optional": false,
133+
"is_resolved": true,
134+
"resolved_package": {},
135+
"extra_data": {}
136+
},
137+
{
138+
"purl": "pkg:nuget/System.ComponentModel.TypeConverter@4.3.0",
139+
"extracted_requirement": "4.3.0",
140+
"scope": "dependency",
141+
"is_runtime": false,
142+
"is_optional": false,
143+
"is_resolved": true,
144+
"resolved_package": {},
145+
"extra_data": {}
146+
}
147+
],
98148
"repository_homepage_url": "https://www.nuget.org/packages/Castle.Core/4.2.1",
99149
"repository_download_url": "https://www.nuget.org/api/v2/package/Castle.Core/4.2.1",
100150
"api_data_url": "https://api.nuget.org/v3/registration3/castle.core/4.2.1.json",

0 commit comments

Comments
 (0)