feat!: remove spdx expression validation (#1382)

jkowalleck · web-flow · commit d6acb60aec1b · 2026-02-20T15:20:02.000+01:00
### Description  * Constructor of `Contrib.License.Factories.LicenseFactory` got an injectable argument `spdxExpressionValidate` for validating SPDX Expressions * Dependency `spdx-expression-parse` became a suggested (optional peer-dependency) library Used as an injectable in `Contrib.License.Factories.LicenseFactory.constructor`. Resolves or fixes issue:  ### AI Tool Disclosure - [x] My contribution does not include any AI-generated content - [ ] My contribution includes AI-generated content, as disclosed below: - AI Tools: `[e.g. GitHub CoPilot, ChatGPT, JetBrains Junie etc.]` - LLMs and versions: `[e.g. GPT-4.1, Claude Haiku 4.5, Gemini 2.5 Pro etc.]` - Prompts: `[Summarize the key prompts or instructions given to the AI tools]` ### Affirmation - [x] My code follows the [CONTRIBUTING.md](https://github.com/CycloneDX/cyclonedx-javascript-library/blob/main/CONTRIBUTING.md) guidelines --------- Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
diff --git a/HISTORY.md b/HISTORY.md
@@ -59,8 +59,12 @@ All notable changes to this project will be documented in this file.
   * Symbol `Contrib.FromNodePackageJson.Factories.PackageUrlFactory` ([#1348] via [#1378])
 * Changed
   * `Component.purl` is a `string` now, was `PackaheUrl` ([#1348] via [#1379])
+  * Constructor of `Contrib.License.Factories.LicenseFactory` got an injectable argument `spdxExpressionValidate` for validating SPDXExpressions ([#1348] via [#1382])  
+    Suggested implementation is `spdx-expression-parse`.
 * Dependencies
   * No longer depend on `packageurl-js@^2.0.1` ([#1348] via [#1378])
+  * Dependency `spdx-expression-parse` became a suggested (optional peer-dependency) library ([#1348] via [#1382])  
+    Used as an injectable in `Contrib.License.Factories.LicenseFactory.constructor`.
 * Build
   * Use _webpack_ `5.105.2` now, was `v5.103.0` (via [#1360], [#1374])
 * Chore
@@ -75,6 +79,7 @@ All notable changes to this project will be documented in this file.
 [#1378]: https://github.com/CycloneDX/cyclonedx-javascript-library/pull/1378
 [#1379]: https://github.com/CycloneDX/cyclonedx-javascript-library/pull/1379
 [#1380]: https://github.com/CycloneDX/cyclonedx-javascript-library/pull/1380
+[#1382]: https://github.com/CycloneDX/cyclonedx-javascript-library/pull/1382
 
 ## 9.4.1 -- 2025-12-04
 
diff --git a/examples/node/javascript/example.cjs b/examples/node/javascript/example.cjs
@@ -25,7 +25,10 @@ const CDX = require('@cyclonedx/cyclonedx-library')
 //    const { Bom, Component } = require('@cyclonedx/cyclonedx-library/Models')
 //    const { ComponentType } = require('@cyclonedx/cyclonedx-library/Enums')
 
-const lFac = new CDX.Contrib.License.Factories.LicenseFactory()
+const spdxExpressionParser = require('spdx-expression-parse')
+
+
+const lFac = new CDX.Contrib.License.Factories.LicenseFactory(spdxExpressionParser)
 
 const bom = new CDX.Models.Bom()
 bom.metadata.component = new CDX.Models.Component(
diff --git a/examples/node/javascript/example.mjs b/examples/node/javascript/example.mjs
@@ -25,7 +25,10 @@ import * as CDX from '@cyclonedx/cyclonedx-library'
 //    import { Bom, Component } from '@cyclonedx/cyclonedx-library/Models'
 //    import { ComponentType } from '@cyclonedx/cyclonedx-library/Enums'
 
-const lFac = new CDX.Contrib.License.Factories.LicenseFactory()
+import spdxExpressionParser from 'spdx-expression-parse'
+
+
+const lFac = new CDX.Contrib.License.Factories.LicenseFactory(spdxExpressionParser)
 
 const bom = new CDX.Models.Bom()
 bom.metadata.component = new CDX.Models.Component(
diff --git a/examples/node/javascript/package.json b/examples/node/javascript/package.json
@@ -8,6 +8,7 @@
   },
   "dependencies": {
     "@cyclonedx/cyclonedx-library": "file:../../..",
+    "spdx-expression-parse": "^3.0.1||^4",
     "xmlbuilder2": "^3.0.2||^4.0.0"
   },
   "optionalDependencies": {
diff --git a/examples/node/typescript/example.cjs/package.json b/examples/node/typescript/example.cjs/package.json
@@ -8,6 +8,7 @@
   },
   "dependencies": {
     "@cyclonedx/cyclonedx-library": "file:../../../..",
+    "spdx-expression-parse": "^3.0.1||^4",
     "xmlbuilder2": "^3.0.2||^4.0.0"
   },
   "optionalDependencies": {
@@ -18,6 +19,7 @@
   },
   "devDependencies": {
     "@types/node": "*",
+    "@types/spdx-expression-parse": "^3",
     "typescript": "^3.8 || ^4 || ^5"
   },
   "scripts": {
diff --git a/examples/node/typescript/example.cjs/src/example.ts b/examples/node/typescript/example.cjs/src/example.ts
@@ -25,7 +25,10 @@ import * as CDX from '@cyclonedx/cyclonedx-library'
 //    import { Bom, Component } from '@cyclonedx/cyclonedx-library/Models'
 //    import { ComponentType } from '@cyclonedx/cyclonedx-library/Enums'
 
-const lFac = new CDX.Contrib.License.Factories.LicenseFactory()
+import * as spdxExpressionParser from 'spdx-expression-parse'
+
+
+const lFac = new CDX.Contrib.License.Factories.LicenseFactory(spdxExpressionParser)
 
 const bom = new CDX.Models.Bom()
 bom.metadata.component = new CDX.Models.Component(
diff --git a/examples/node/typescript/example.mjs/package.json b/examples/node/typescript/example.mjs/package.json
@@ -8,6 +8,7 @@
   },
   "dependencies": {
     "@cyclonedx/cyclonedx-library": "file:../../../..",
+    "spdx-expression-parse": "^3.0.1||^4",
     "xmlbuilder2": "^3.0.2||^4.0.0"
   },
   "optionalDependencies": {
@@ -18,6 +19,7 @@
   },
   "devDependencies": {
     "@types/node": "*",
+    "@types/spdx-expression-parse": "^3",
     "typescript": "^4 || ^5"
   },
   "scripts": {
diff --git a/examples/node/typescript/example.mjs/src/example.ts b/examples/node/typescript/example.mjs/src/example.ts
@@ -25,7 +25,10 @@ import * as CDX from '@cyclonedx/cyclonedx-library'
 //    import { Bom, Component } from '@cyclonedx/cyclonedx-library/Models'
 //    import { ComponentType } from '@cyclonedx/cyclonedx-library/Enums'
 
-const lFac = new CDX.Contrib.License.Factories.LicenseFactory()
+import spdxExpressionParser from 'spdx-expression-parse'
+
+
+const lFac = new CDX.Contrib.License.Factories.LicenseFactory(spdxExpressionParser)
 
 const bom = new CDX.Models.Bom()
 bom.metadata.component = new CDX.Models.Component(
diff --git a/examples/web/parcel/package.json b/examples/web/parcel/package.json
@@ -4,7 +4,8 @@
   "license": "Apache-2.0",
   "source": "src/index.html",
   "dependencies": {
-    "@cyclonedx/cyclonedx-library": "file:../../.."
+    "@cyclonedx/cyclonedx-library": "file:../../..",
+    "spdx-expression-parse": "^3.0.1||^4"
   },
   "devDependencies": {
     "parcel": "^2"
diff --git a/examples/web/parcel/src/app.js b/examples/web/parcel/src/app.js
@@ -22,7 +22,10 @@ Copyright (c) OWASP Foundation. All Rights Reserved.
 const CDX = require('@cyclonedx/cyclonedx-library')
 // full Library is available as `CDX`, now
 
-const lFac = new CDX.Contrib.License.Factories.LicenseFactory()
+const spdxExpressionParser = require('spdx-expression-parse')
+
+
+const lFac = new CDX.Contrib.License.Factories.LicenseFactory(spdxExpressionParser)
 
 const bom = new CDX.Models.Bom()
 bom.metadata.component = new CDX.Models.Component(
diff --git a/examples/web/webpack/package.json b/examples/web/webpack/package.json
@@ -3,7 +3,8 @@
   "name": "@cyclonedx/cyclonedx-library-examples-web-webpack",
   "license": "Apache-2.0",
   "dependencies": {
-    "@cyclonedx/cyclonedx-library": "file:../../.."
+    "@cyclonedx/cyclonedx-library": "file:../../..",
+    "spdx-expression-parse": "^3.0.1||^4"
   },
   "devDependencies": {
     "webpack": "^5",
diff --git a/examples/web/webpack/src/index.js b/examples/web/webpack/src/index.js
@@ -22,7 +22,10 @@ Copyright (c) OWASP Foundation. All Rights Reserved.
 const CDX = require('@cyclonedx/cyclonedx-library')
 // full Library is available as `CDX`, now
 
-const lFac = new CDX.Contrib.License.Factories.LicenseFactory()
+const spdxExpressionParser = require('spdx-expression-parse')
+
+
+const lFac = new CDX.Contrib.License.Factories.LicenseFactory(spdxExpressionParser)
 
 const bom = new CDX.Models.Bom()
 bom.metadata.component = new CDX.Models.Component(
diff --git a/package.json b/package.json
@@ -80,13 +80,13 @@
     "node": ">=20.18.0"
   },
   "dependencies": {
-    "spdx-expression-parse": "^3.0.1 || ^4"
   },
   "peerDependencies": {
     "ajv": "^8.12.0",
     "ajv-formats": "^3.0.1",
     "ajv-formats-draft2019": "^1.6.1",
     "libxmljs2": "^0.35||^0.37",
+    "spdx-expression-parse": "^3.0.1 || ^4",
     "xmlbuilder2": "^3.0.2||^4.0.0"
   },
   "peerDependenciesMeta": {
@@ -102,6 +102,9 @@
     "libxmljs2": {
       "optional": true
     },
+    "spdx-expression-parse": {
+      "optional": true
+    },
     "xmlbuilder2": {
       "optional": true
     }
@@ -124,6 +127,7 @@
     "ajv-formats-draft2019": "^1.6.1",
     "libxmljs2": "^0.35||^0.37",
     "xmlbuilder2": "^3.0.2||^4.0.0",
+    "spdx-expression-parse": "^3.0.1||^4",
     "@types/mocha": "^10",
     "@types/node": "ts5.7",
     "@types/spdx-expression-parse": "^3",
diff --git a/src/contrib/license/factories.ts b/src/contrib/license/factories.ts
@@ -19,9 +19,26 @@ Copyright (c) OWASP Foundation. All Rights Reserved.
 
 import type { DisjunctiveLicense, License } from '../../models/license'
 import { LicenseExpression, NamedLicense, SpdxLicense } from '../../models/license'
-import { fixupSpdxId, isValidSpdxLicenseExpression } from '../../spdx'
+import { fixupSpdxId } from '../../spdx'
+
+/**
+ * SPDXLicense Expression validation.
+ *
+ * We suggest one of the following 3rd-party libraries:
+ * - `spdx-expression-parse@^3.0.1||^4` - {@link https://www.npmjs.com/package/spdx-expression-parse}
+ *
+ * @throws {@link Error} when the argument is no valid SPDX License Expression
+ */
+type SpdxExpressionValidate = (data: string) => void
 
 export class LicenseFactory {
+
+  readonly #spdxExpressionValidate: SpdxExpressionValidate
+
+  constructor(spdxExpressionValidate: SpdxExpressionValidate) {
+    this.#spdxExpressionValidate = spdxExpressionValidate
+  }
+
   makeFromString (value: string): License {
     try {
       return this.makeSpdxLicense(value)
@@ -43,10 +60,12 @@ export class LicenseFactory {
    */
   makeExpression (value: string | any): LicenseExpression {
     const expression = String(value)
-    if (isValidSpdxLicenseExpression(expression)) {
-      return new LicenseExpression(expression)
+    try {
+      this.#spdxExpressionValidate(expression)
+    } catch (err) {
+      throw new RangeError('Invalid SPDX license expression', { cause: err })
     }
-    throw new RangeError('Invalid SPDX license expression')
+    return new LicenseExpression(expression)
   }
 
   makeDisjunctive (value: string): DisjunctiveLicense {
diff --git a/src/spdx.ts b/src/spdx.ts
@@ -17,8 +17,6 @@ SPDX-License-Identifier: Apache-2.0
 Copyright (c) OWASP Foundation. All Rights Reserved.
 */
 
-import spdxExpressionParse from 'spdx-expression-parse'
-
 /* @ts-expect-error: TS6059 -- this works as long as the file/path is available in dist-package. */
 import { enum as _spdxSpecEnum } from '../res/schema/spdx.SNAPSHOT.schema.json' with { type: 'json' }
 
@@ -48,15 +46,3 @@ export function fixupSpdxId (value: string | any): SpdxId | undefined {
     ? spdxLowerToActual[value.toLowerCase()]
     : undefined
 }
-
-export function isValidSpdxLicenseExpression (value: string | any): boolean {
-  if (typeof value !== 'string') {
-    return false
-  }
-  try {
-    spdxExpressionParse(value)
-  } catch (err) {
-    return false
-  }
-  return true
-}
diff --git a/tests/integration/Contrib.License.Factories.LicenseFactory.test.js b/tests/integration/Contrib.License.Factories.LicenseFactory.test.js
@@ -20,6 +20,7 @@ Copyright (c) OWASP Foundation. All Rights Reserved.
 const assert = require('node:assert')
 
 const { suite, test } = require('mocha')
+const spdxExpressionValidate = require('spdx-expression-parse')
 
 const {
   Contrib,
@@ -28,7 +29,9 @@ const {
 
 suite('integration: Contrib.License.Factories.LicenseFactory', () => {
   test('makeFromString() -> LicenseExpression', () => {
-    const sut = new Contrib.License.Factories.LicenseFactory()
+    const sut = new Contrib.License.Factories.LicenseFactory(
+      spdxExpressionValidate
+    )
     const expression = '(MIT OR Apache-2.0)'
 
     const license = sut.makeFromString(expression)
