Add new command to "diff" two BOM versions and produce JSON Patch output (RFC 6902) #33

mrutkows · 2023-05-25T20:08:27Z

No description provided.

Signed-off-by: Matt Rutkowski <mrutkows@us.ibm.com>

sonatype-lift · 2023-05-25T20:09:38Z

cmd/diff.go

+	}
+
+	// Another JSON string
+	bRevisedData, err := ioutil.ReadFile(deltaFilename)


G304: Potential file inclusion via variable

ℹ️ Expand to see all @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

sonatype-lift · 2023-05-25T20:09:39Z

cmd/diff.go

+	defer getLogger().Exit()
+
+	// Prepare your JSON string as `[]byte`, not `string`
+	bBaseData, err := ioutil.ReadFile(baseFilename)


G304: Potential file inclusion via variable

ℹ️ Expand to see all @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

sonatype-lift · 2023-05-25T20:09:41Z

cmd/diff.go

+		switch format {
+		case FORMAT_TEXT:
+			var aJson map[string]interface{}
+			json.Unmarshal(bBaseData, &aJson)


G104: Errors unhandled.

❗❗ 2 similar findings have been found in this PR

🔎 Expand here to view all instances of this finding

File Path Line Number

cmd/diff.go 122

cmd/diff.go 113

Visit the Lift Web Console to find more details in your report.

ℹ️ Expand to see all @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

Signed-off-by: Matt Rutkowski <mrutkows@us.ibm.com>

sonatype-lift · 2023-05-30T14:24:48Z

cmd/diff.go

+		}
+	}()
+
+	Diff(utils.GlobalFlags)


G104: Errors unhandled.

ℹ️ Expand to see all @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

Signed-off-by: Matt Rutkowski <mrutkows@us.ibm.com>

sonatype-lift · 2023-05-30T20:00:58Z

cmd/diff.go

+
+	"github.com/CycloneDX/sbom-utility/utils"
+	"github.com/spf13/cobra"
+	"github.com/yudai/gojsondiff"


ST1019: package "github.com/yudai/gojsondiff" is being imported more than once

ℹ️ Expand to see all @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

Signed-off-by: Matt Rutkowski <mrutkows@us.ibm.com>

sonatype-lift · 2023-05-31T20:24:32Z

cmd/diff.go

+
+		// TODO: Enable only for debug
+		deltas := d.Deltas()
+		debugDeltas(deltas, "")


G104: Errors unhandled.

❗❗ 3 similar findings have been found in this PR

🔎 Expand here to view all instances of this finding

File Path Line Number

cmd/diff.go 159

cmd/diff.go 152

cmd/diff.go 146

Visit the Lift Web Console to find more details in your report.

ℹ️ Expand to see all @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

Signed-off-by: Matt Rutkowski <mrutkows@us.ibm.com>

sonatype-lift · 2023-05-31T20:45:27Z

cmd/diff.go

+			//deltaJson[d.Position.String()], err = f.formatObject(d.Deltas)
+		case *diff.Array:
+			fmt.Printf("%s[Array]: %v, PostPosition(): %v (Position: %s), # Deltas: %v\n", indent, pointer, pointer.PostPosition(), pointer.Position, len(pointer.Deltas))
+			debugDeltas(pointer.Deltas, indent2)


G104: Errors unhandled.

❗❗ 2 similar findings have been found in this PR

🔎 Expand here to view all instances of this finding

File Path Line Number

cmd/diff.go 213

cmd/diff.go 168

Visit the Lift Web Console to find more details in your report.

ℹ️ Expand to see all @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

Signed-off-by: Matt Rutkowski <mrutkows@us.ibm.com>

sonatype-lift · 2023-06-09T16:28:22Z

cmd/diff.go

+	return
+}
+
+func debugDeltas(deltas []diff.Delta, indent string) (err error) {


U1000: func debugDeltas is unused

ℹ️ Expand to see all @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

Signed-off-by: Matt Rutkowski <mrutkows@us.ibm.com>

sonatype-lift · 2023-06-09T17:22:24Z

cmd/diff.go

+	}
+
+	getLogger().Infof("Reading file (--input-revision): `%s` ...", deltaFilename)
+	bRevisedData, errReadDelta := ioutil.ReadFile(deltaFilename)


G304: Potential file inclusion via variable

ℹ️ Expand to see all @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

sonatype-lift · 2023-06-09T17:22:26Z

cmd/diff.go

+
+	// JSON string as `[]byte`, not `string`
+	getLogger().Infof("Reading file (--input-file): `%s` ...", baseFilename)
+	bBaseData, errReadBase := ioutil.ReadFile(baseFilename)


G304: Potential file inclusion via variable

ℹ️ Expand to see all @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

Signed-off-by: Matt Rutkowski <mrutkows@us.ibm.com>

sonatype-lift · 2023-06-11T19:49:12Z

cmd/diff.go

+	}()
+
+	// JSON string as `[]byte`, not `string`
+	baseFilename = filepath.Clean(baseFilename)


GO-2023-1568: A path traversal vulnerability exists in filepath.Clean on Windows.

On Windows, the filepath.Clean function could transform an invalid path such as "a/../c:/b" into the valid path "c:\b". This transformation of a relative (if invalid) path into an absolute path could enable a directory traversal attack.

After fix, the filepath.Clean function transforms this path into the relative (but still invalid) path ".\c:\b".

ℹ️ Expand to see all @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

Signed-off-by: Matt Rutkowski <mrutkows@us.ibm.com>

sonatype-lift · 2023-06-11T20:14:21Z

cmd/diff.go

+	}()
+
+	// JSON string as `[]byte`, not `string`
+	baseFilename, err = filepath.Abs(baseFilename)


GO-2023-1568: A path traversal vulnerability exists in filepath.Clean on Windows.

On Windows, the filepath.Clean function could transform an invalid path such as "a/../c:/b" into the valid path "c:\b". This transformation of a relative (if invalid) path into an absolute path could enable a directory traversal attack.

After fix, the filepath.Clean function transforms this path into the relative (but still invalid) path ".\c:\b".

ℹ️ Expand to see all @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

Signed-off-by: Matt Rutkowski <mrutkows@us.ibm.com>

sonatype-lift · 2023-06-12T06:17:23Z

cmd/diff.go

+
+	getLogger().Infof("Reading file (--input-file): `%s` ...", baseFilename)
+	// #nosec G304 (suppress warning)
+	bBaseData, errReadBase := ioutil.ReadFile(filepath.Clean(baseFilename))


GO-2023-1568: A path traversal vulnerability exists in filepath.Clean on Windows.

On Windows, the filepath.Clean function could transform an invalid path such as "a/../c:/b" into the valid path "c:\b". This transformation of a relative (if invalid) path into an absolute path could enable a directory traversal attack.

After fix, the filepath.Clean function transforms this path into the relative (but still invalid) path ".\c:\b".

ℹ️ Expand to see all @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

Signed-off-by: Matt Rutkowski <mrutkows@us.ibm.com>

mrutkows added 3 commits May 24, 2023 16:54

initial pseudo-code for diff command

f009403

Signed-off-by: Matt Rutkowski <mrutkows@us.ibm.com>

Add new diff command

56bfffa

Signed-off-by: Matt Rutkowski <mrutkows@us.ibm.com>

first working diff functionality with testcase

53974ce

Signed-off-by: Matt Rutkowski <mrutkows@us.ibm.com>

mrutkows self-assigned this May 25, 2023

sonatype-lift bot reviewed May 25, 2023

View reviewed changes

mrutkows added 2 commits May 25, 2023 15:20

remove incorrect reference to a custom schema file in diff test

b4e010b

Signed-off-by: Matt Rutkowski <mrutkows@us.ibm.com>

Support output file and colorize flags for diff cmd

e9a97f7

Signed-off-by: Matt Rutkowski <mrutkows@us.ibm.com>

sonatype-lift bot reviewed May 30, 2023

View reviewed changes

mrutkows added 5 commits May 30, 2023 10:51

Fix command help strings to reflect new flags

20a0aa7

Signed-off-by: Matt Rutkowski <mrutkows@us.ibm.com>

Fix command help strings to reflect new flags

f3348d4

Signed-off-by: Matt Rutkowski <mrutkows@us.ibm.com>

Clean up diff command test file

daf70ed

Signed-off-by: Matt Rutkowski <mrutkows@us.ibm.com>

Adjust flag help text

d651b2a

Signed-off-by: Matt Rutkowski <mrutkows@us.ibm.com>

go mod tidy

f013316

Signed-off-by: Matt Rutkowski <mrutkows@us.ibm.com>

sonatype-lift bot reviewed May 30, 2023

View reviewed changes

mrutkows added 4 commits May 30, 2023 16:25

Use a single Fprint for all format types

c3c1a16

Signed-off-by: Matt Rutkowski <mrutkows@us.ibm.com>

Add new unit test case around diff array modification detection

46c75ae

Signed-off-by: Matt Rutkowski <mrutkows@us.ibm.com>

switch to using go-jsondiff package

aab42cc

Signed-off-by: Matt Rutkowski <mrutkows@us.ibm.com>

Add debug of comparison delta tree

61f8c72

Signed-off-by: Matt Rutkowski <mrutkows@us.ibm.com>

sonatype-lift bot reviewed May 31, 2023

View reviewed changes

Add debug of comparison delta tree

3ac326d

Signed-off-by: Matt Rutkowski <mrutkows@us.ibm.com>

sonatype-lift bot reviewed May 31, 2023

View reviewed changes

mrutkows added 2 commits June 2, 2023 20:58

Add more diff array delta tests

168dfd5

Signed-off-by: Matt Rutkowski <mrutkows@us.ibm.com>

Add experimental diff command support

51d4bed

Signed-off-by: Matt Rutkowski <mrutkows@us.ibm.com>

sonatype-lift bot reviewed Jun 9, 2023

View reviewed changes

mrutkows added 4 commits June 9, 2023 11:50

use the latest jsondiff version

6a35f34

Signed-off-by: Matt Rutkowski <mrutkows@us.ibm.com>

use the latest jsondiff version

7a6d4f5

Signed-off-by: Matt Rutkowski <mrutkows@us.ibm.com>

use the latest jsondiff version

588a851

Signed-off-by: Matt Rutkowski <mrutkows@us.ibm.com>

Fix Sonatype errors

58d2e2d

Signed-off-by: Matt Rutkowski <mrutkows@us.ibm.com>

sonatype-lift bot reviewed Jun 9, 2023

View reviewed changes

Fix Sonatype errors

858a853

Signed-off-by: Matt Rutkowski <mrutkows@us.ibm.com>

sonatype-lift bot reviewed Jun 11, 2023

View reviewed changes

Fix Sonatype errors

b2f882d

Signed-off-by: Matt Rutkowski <mrutkows@us.ibm.com>

sonatype-lift bot reviewed Jun 11, 2023

View reviewed changes

mrutkows added 4 commits June 11, 2023 15:45

Fix Sonatype errors

3b7ba78

Signed-off-by: Matt Rutkowski <mrutkows@us.ibm.com>

Fix Sonatype errors

c7d6ecc

Signed-off-by: Matt Rutkowski <mrutkows@us.ibm.com>

Fix Sonatype errors

e8743ef

Signed-off-by: Matt Rutkowski <mrutkows@us.ibm.com>

move debug code to test file

44abf5b

Signed-off-by: Matt Rutkowski <mrutkows@us.ibm.com>

sonatype-lift bot reviewed Jun 12, 2023

View reviewed changes

Fix Sonatype errors

74000aa

Signed-off-by: Matt Rutkowski <mrutkows@us.ibm.com>

mrutkows merged commit 0b1af15 into main Jun 12, 2023

mrutkows deleted the bom-diff branch June 12, 2023 06:40

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add new command to "diff" two BOM versions and produce JSON Patch output (RFC 6902) #33

Add new command to "diff" two BOM versions and produce JSON Patch output (RFC 6902) #33

mrutkows commented May 25, 2023

sonatype-lift bot May 25, 2023

sonatype-lift bot May 25, 2023

sonatype-lift bot May 25, 2023

sonatype-lift bot May 30, 2023

sonatype-lift bot May 30, 2023

sonatype-lift bot May 31, 2023

sonatype-lift bot May 31, 2023

sonatype-lift bot Jun 9, 2023

sonatype-lift bot Jun 9, 2023

sonatype-lift bot Jun 9, 2023

sonatype-lift bot Jun 11, 2023

sonatype-lift bot Jun 11, 2023

sonatype-lift bot Jun 12, 2023

Command	Usage
`@sonatype-lift ignore`	Leave out the above finding from this PR
`@sonatype-lift ignoreall`	Leave out all the existing findings from this PR
`@sonatype-lift exclude <file\|issue\|path\|tool>`	Exclude specified `file\|issue\|path\|tool` from Lift findings by updating your config.toml file

Add new command to "diff" two BOM versions and produce JSON Patch output (RFC 6902) #33

Add new command to "diff" two BOM versions and produce JSON Patch output (RFC 6902) #33

Conversation

mrutkows commented May 25, 2023

sonatype-lift bot May 25, 2023

Choose a reason for hiding this comment

sonatype-lift bot May 25, 2023

Choose a reason for hiding this comment

sonatype-lift bot May 25, 2023

Choose a reason for hiding this comment

sonatype-lift bot May 30, 2023

Choose a reason for hiding this comment

sonatype-lift bot May 30, 2023

Choose a reason for hiding this comment

sonatype-lift bot May 31, 2023

Choose a reason for hiding this comment

sonatype-lift bot May 31, 2023

Choose a reason for hiding this comment

sonatype-lift bot Jun 9, 2023

Choose a reason for hiding this comment

sonatype-lift bot Jun 9, 2023

Choose a reason for hiding this comment

sonatype-lift bot Jun 9, 2023

Choose a reason for hiding this comment

sonatype-lift bot Jun 11, 2023

Choose a reason for hiding this comment

sonatype-lift bot Jun 11, 2023

Choose a reason for hiding this comment

sonatype-lift bot Jun 12, 2023

Choose a reason for hiding this comment