Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[BUG] Remote URLs and packages without versions raise an exception #193

Closed
mostafa opened this issue Mar 17, 2022 · 5 comments
Closed

[BUG] Remote URLs and packages without versions raise an exception #193

mostafa opened this issue Mar 17, 2022 · 5 comments
Assignees
Labels
bug Something isn't working

Comments

@mostafa
Copy link

mostafa commented Mar 17, 2022

I tried to run cyclonedx-bom on a requirements file (a test fixture and also a private repository of mine) and found that when the version is empty, the library raises an error. The error was introduced after I replaced the requirements parser in CycloneDX/cyclonedx-python#327, and the affected line is:

if self.component_version_optional() and bom_json[base_key][i]['version'] == "":

According to the specification, the version field is not required/enforced.

$ cyclonedx-bom -r -i tests/fixtures/requirements-local-and-remote-packages.txt --format json
Traceback (most recent call last):
  File "/somewhere/.pyenv/versions/3.9.6/bin/cyclonedx-bom", line 8, in <module>
    sys.exit(main())
  File "/somewhere/.pyenv/versions/3.9.6/lib/python3.9/site-packages/cyclonedx_py/client.py", line 260, in main
    CycloneDxCmd(args).execute()
  File "/somewhere/.pyenv/versions/3.9.6/lib/python3.9/site-packages/cyclonedx_py/client.py", line 122, in execute
    output.output_to_file(filename=output_filename, allow_overwrite=self._arguments.output_file_overwrite)
  File "/somewhere/.pyenv/versions/3.9.6/lib/python3.9/site-packages/cyclonedx/output/__init__.py", line 102, in output_to_file
    f_out.write(self.output_as_string().encode('utf-8'))
  File "/somewhere/.pyenv/versions/3.9.6/lib/python3.9/site-packages/cyclonedx/output/json.py", line 117, in output_as_string
    self.generate()
  File "/somewhere/.pyenv/versions/3.9.6/lib/python3.9/site-packages/cyclonedx/output/json.py", line 67, in generate
    bom_json = json.loads(self._specialise_output_for_schema_version(bom_json=bom_json))
  File "/somewhere/.pyenv/versions/3.9.6/lib/python3.9/site-packages/cyclonedx/output/json.py", line 96, in _specialise_output_for_schema_version
    bom_json = self._recurse_specialise_component(bom_json=bom_json)
  File "/somewhere/.pyenv/versions/3.9.6/lib/python3.9/site-packages/cyclonedx/output/json.py", line 147, in _recurse_specialise_component
    if self.component_version_optional() and bom_json[base_key][i]['version'] == "":
KeyError: 'version'

@madpah @jkowalleck WDYT?

@madpah
Copy link
Collaborator

madpah commented Mar 17, 2022

Hey @mostafa - thanks for the report.

Version is now optional according to CycloneDX 1.4 - and looks like this has exposed a bug in the library.

Will get a fix raised :-)

@madpah madpah self-assigned this Mar 17, 2022
@madpah madpah added the bug Something isn't working label Mar 17, 2022
@madpah
Copy link
Collaborator

madpah commented Apr 5, 2022

@mostafa - will leave this open for a bit to allow you to validate the fix that has been released.

@madpah
Copy link
Collaborator

madpah commented Apr 20, 2022

@mostafa - have you had chance to validate this fix yet?

@mostafa
Copy link
Author

mostafa commented Apr 21, 2022

@madpah Works like a charm! 👌 I think you can close the issue.

@madpah
Copy link
Collaborator

madpah commented Apr 21, 2022

Awesome - thanks for confirming @mostafa.

@madpah madpah closed this as completed Apr 21, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

2 participants