fix(sca): use resolved dep.name for registerCve to prevent registry key mismatch for no-pom JARs

For JARs without pom.properties, DependencyResolver.guessFallbackNoPom produces an
artifactId-only name (e.g. "junrar" instead of "com.github.junrar:junrar"). The transformer
was calling registerCve with entry.artifact() — the full groupId:artifactId from the DB —
creating a registry key that mismatched the key DependencyService would later report.

Result: the periodic action emitted two separate telemetry entries for the same physical JAR:
  - "junrar" with metadata:[] (source/hash present, CVE absent — Step 2 lookup missed)
  - "com.github.junrar:junrar" with CVE data but no source/hash (Step 3, knownDeps miss)

Fix: resolveArtifactDep() returns the matched Dependency object (not just the version string),
and processClass uses dep.name for registerCve and MethodCallbackSpec. This keeps the registry
key consistent with what DependencyService will report regardless of pom.properties presence.

Implementation:
- Add matchDep() returning Dependency (matchVersion delegates to it)
- Change classpathArtifactCache to cache Dependency (preserves resolved name)
- Add resolveArtifactDep() returning Dependency; resolveVersionForArtifact delegates to it
- Add findArtifactInClasspath() returning Dependency; findArtifactVersionInClasspath delegates to it

The smoke test's synthetic pom.properties masked this bug by making both routes agree on the
full groupId:artifactId name. No smoke test changes needed — the unit tests cover the fix:
- ScaReachabilityTransformerJava9Test: resolveArtifactDep returns artifactId-only name for no-pom
- ScaReachabilityPeriodicActionTest: CVE and source/hash merged into single entry for no-pom dep

Author: jandro996

dd-java-agent/appsec/src/main/java/com/datadog/appsec/sca/ScaReachabilityTransformer.java

@@ -66,13 +66,15 @@ public final class ScaReachabilityTransformer implements ClassFileTransformer {
   final ConcurrentHashMap<URI, List<Dependency>> jarCache = new ConcurrentHashMap<>();
 
   /**
-   * Cache: artifact name → classpath-resolved version. Used when the class's own JAR does not
-   * contain the vulnerable artifact (e.g., Spring Boot starters whose watched classes live in
-   * transitive dependency JARs). Only non-null results are cached; null means "not yet found" and
-   * will be retried on the next periodic retransform.
+   * Cache: artifact name → classpath-resolved {@link Dependency}. Stores the full dependency (name
+   * + version) so that the resolved {@code dep.name} — which may be an artifactId-only name like
+   * {@code "junrar"} for JARs without pom.properties — is propagated to {@code registerCve} and
+   * kept consistent with the name that {@link datadog.telemetry.dependency.DependencyService} will
+   * report. Only non-null results are cached; null means "not yet found" and will be retried on the
+   * next periodic retransform.
    */
   @VisibleForTesting
-  final ConcurrentHashMap<String, String> classpathArtifactCache = new ConcurrentHashMap<>();
+  final ConcurrentHashMap<String, Dependency> classpathArtifactCache = new ConcurrentHashMap<>();
 
   /**
    * Classes whose bytecode needs (re)transformation for method-level symbol injection:
@@ -170,15 +172,25 @@ private byte[] processClass(
     String dotClassName = null;
 
     for (ScaEntry entry : entries) {
-      // Resolve version: first check the class's own JAR, then fall back to a full classpath
-      // scan. The fallback handles cases where the vulnerable artifact is an aggregator/starter
-      // POM whose watched classes actually live in a transitive dependency JAR (e.g.,
-      // spring-boot-starter-web watches @Controller, but @Controller is in spring-context.jar).
-      String version = resolveVersionForArtifact(entry.artifact(), classJarDeps);
-      if (version == null) {
+      // Resolve the dependency for this artifact: first check the class's own JAR, then fall back
+      // to a full classpath scan. The fallback handles aggregator/starter POM artifacts whose
+      // watched classes actually live in a transitive dependency JAR (e.g., spring-boot-starter-web
+      // watches @Controller, but @Controller is in spring-context.jar).
+      //
+      // We use the resolved dep's name (not entry.artifact()) for registerCve and
+      // MethodCallbackSpec
+      // to ensure that the registry key matches the name that DependencyService will later report.
+      // For JARs without pom.properties, DependencyResolver.guessFallbackNoPom produces an
+      // artifactId-only name (e.g. "junrar" instead of "com.github.junrar:junrar"). Using
+      // entry.artifact() as the registry key would cause a mismatch with DependencyService's name,
+      // causing the CVE telemetry event to lose its source/hash or appear under the wrong name.
+      Dependency resolvedDep = resolveArtifactDep(entry.artifact(), classJarDeps);
+      if (resolvedDep == null) {
         hasUnresolvedMethodLevelSymbols = true;
         continue;
       }
+      String version = resolvedDep.version;
+      String depName = resolvedDep.name != null ? resolvedDep.name : entry.artifact();
 
       if (!entry.isVersionVulnerable(version)) {
         continue;
@@ -191,16 +203,15 @@ private byte[] processClass(
         // Register the CVE now (at class load time) with reached=[] so the next heartbeat
         // signals the backend that SCA is monitoring this CVE. The callsite will be added
         // later when the method is actually called (via ScaReachabilityCallback).
-        ScaReachabilityDependencyRegistry.INSTANCE.registerCve(
-            entry.artifact(), version, entry.vulnId());
+        ScaReachabilityDependencyRegistry.INSTANCE.registerCve(depName, version, entry.vulnId());
         if (dotClassName == null) {
           dotClassName = Strings.getClassName(className);
         }
         methodCallbacks
             .computeIfAbsent(symbol.method(), k -> new ArrayList<>())
             .add(
                 new MethodCallbackSpec(
-                    entry.vulnId(), entry.artifact(), version, dotClassName, symbol.method()));
+                    entry.vulnId(), depName, version, dotClassName, symbol.method()));
       }
     }
 
@@ -314,8 +325,8 @@ public void performPendingRetransforms() {
     // callback.
     // Two paths in processClass() can trigger fresh JAR I/O under locks:
     //   1. resolveDependenciesFromCache() — safe only if jarCache is already populated.
-    //   2. resolveVersionForArtifact() → findArtifactVersionInClasspath() for aggregator artifacts
-    //      (e.g., spring-boot-starter-web) whose pom.properties is not in the class's own JAR.
+    //   2. resolveArtifactDep() → findArtifactInClasspath() for aggregator artifacts (e.g.,
+    //      spring-boot-starter-web) whose pom.properties is not in the class's own JAR.
     //      Without pre-warming classpathArtifactCache, this scans all java.class.path JARs via
     //      resolveDependencies() under JVM locks, reintroducing the snakeyaml deadlock.
     for (Class<?> c : toRetransform) {
@@ -359,50 +370,54 @@ public void performPendingRetransforms() {
   // ---------------------------------------------------------------------------
 
   /**
-   * Resolves the version of {@code artifactName} using a two-step strategy:
+   * Resolves the {@link Dependency} for {@code artifactName} (groupId:artifactId format), returning
+   * the matched dependency object — which may have an artifactId-only {@code name} for JARs without
+   * {@code pom.properties}. Returns {@code null} if the artifact cannot be found.
    *
-   * <ol>
-   *   <li>Check the dependencies resolved from the class's own JAR ({@code classJarDeps}). This
-   *       covers the common case where the class and its artifact live in the same JAR.
-   *   <li>If not found, fall back to a full classpath scan via {@link
-   *       #findArtifactVersionInClasspath}. This handles aggregator/starter POM artifacts (e.g.,
-   *       {@code spring-boot-starter-web}) whose watched classes live in transitive dependency JARs
-   *       rather than in the starter JAR itself. Results of successful scans are cached.
-   * </ol>
-   *
-   * @return the resolved version string, or {@code null} if the artifact cannot be found
+   * <p>Use this method (not {@link #resolveVersionForArtifact}) whenever the resolved dependency
+   * name needs to be propagated (e.g., for {@code registerCve} and {@code MethodCallbackSpec}), so
+   * that registry keys stay consistent with the names that {@link
+   * datadog.telemetry.dependency.DependencyService} will report.
    */
   @VisibleForTesting
-  String resolveVersionForArtifact(String artifactName, List<Dependency> classJarDeps) {
-    String version = matchVersion(artifactName, classJarDeps);
-    if (version != null) {
-      return version;
+  Dependency resolveArtifactDep(String artifactName, List<Dependency> classJarDeps) {
+    Dependency dep = matchDep(artifactName, classJarDeps);
+    if (dep != null) {
+      return dep;
     }
     // Classpath fallback: check cache first, then scan.
-    String cached = classpathArtifactCache.get(artifactName);
+    Dependency cached = classpathArtifactCache.get(artifactName);
     if (cached != null) {
       return cached;
     }
-    version = findArtifactVersionInClasspath(artifactName);
-    if (version != null) {
-      classpathArtifactCache.put(artifactName, version); // only cache hits; misses are retried
+    dep = findArtifactInClasspath(artifactName);
+    if (dep != null) {
+      classpathArtifactCache.put(artifactName, dep); // only cache hits; misses are retried
     }
-    return version;
+    return dep;
+  }
+
+  @VisibleForTesting
+  String resolveVersionForArtifact(String artifactName, List<Dependency> classJarDeps) {
+    Dependency dep = resolveArtifactDep(artifactName, classJarDeps);
+    return dep != null ? dep.version : null;
   }
 
   /**
-   * Matches {@code artifactName} (groupId:artifactId format) against a list of dependencies.
+   * Matches {@code artifactName} (groupId:artifactId format) against a list of dependencies,
+   * returning the matched {@link Dependency} object (not just the version).
    *
    * <p>First tries an exact name match. If that fails, falls back to matching by artifact ID only.
    * The fallback handles JARs without {@code pom.properties}: {@code Dependency.guessFallbackNoPom}
    * can only extract the artifact ID from the filename (no group ID), producing names like {@code
-   * "junrar"} for {@code com.github.junrar:junrar}.
+   * "junrar"} for {@code com.github.junrar:junrar}. The returned dependency's {@code name} reflects
+   * what {@link datadog.telemetry.dependency.DependencyService} will report for that JAR.
    */
   @VisibleForTesting
-  static String matchVersion(String artifactName, List<Dependency> deps) {
+  static Dependency matchDep(String artifactName, List<Dependency> deps) {
     for (Dependency dep : deps) {
       if (artifactName.equals(dep.name)) {
-        return dep.version;
+        return dep;
       }
     }
     int colonIdx = artifactName.lastIndexOf(':');
@@ -415,14 +430,24 @@ static String matchVersion(String artifactName, List<Dependency> deps) {
           && !dep.name.contains(":")
           && artifactId.equals(dep.name)
           && dep.version != null) {
-        return dep.version;
+        return dep;
       }
     }
     return null;
   }
 
+  /**
+   * Matches {@code artifactName} against a list of dependencies, returning the resolved version
+   * string. Delegates to {@link #matchDep} — use that method when the full dependency object is
+   * needed.
+   */
   @VisibleForTesting
-  String findArtifactVersionInClasspath(String artifactName) {
+  static String matchVersion(String artifactName, List<Dependency> deps) {
+    Dependency dep = matchDep(artifactName, deps);
+    return dep != null ? dep.version : null;
+  }
+
+  private Dependency findArtifactInClasspath(String artifactName) {
     // Use URI (not URL) to avoid DNS lookups in equals/hashCode (DMI_COLLECTION_OF_URLS)
     Set<URI> scanned = new HashSet<>();
 
@@ -440,9 +465,9 @@ String findArtifactVersionInClasspath(String artifactName) {
       try {
         URI uri = new File(entry).toURI();
         if (scanned.add(uri)) {
-          String version = matchVersion(artifactName, resolveDependencies(uri.toURL()));
-          if (version != null) {
-            return version;
+          Dependency dep = matchDep(artifactName, resolveDependencies(uri.toURL()));
+          if (dep != null) {
+            return dep;
           }
         }
       } catch (Exception e) {
@@ -452,6 +477,12 @@ String findArtifactVersionInClasspath(String artifactName) {
     return null;
   }
 
+  @VisibleForTesting
+  String findArtifactVersionInClasspath(String artifactName) {
+    Dependency dep = findArtifactInClasspath(artifactName);
+    return dep != null ? dep.version : null;
+  }
+
   private List<Dependency> resolveDependenciesFromCache(URL url) {
     try {
       List<Dependency> cached = jarCache.get(url.toURI());

dd-java-agent/appsec/src/test/java/com/datadog/appsec/sca/ScaReachabilityTransformerJava9Test.java

@@ -238,6 +238,40 @@ void matchVersion_nullDepNameDoesNotThrow() {
             "com.example:foo", Collections.singletonList(nullName)));
   }
 
+  /**
+   * Regression test for the registry key mismatch bug (PR #11614).
+   *
+   * <p>For JARs without {@code pom.properties}, {@code DependencyResolver.guessFallbackNoPom}
+   * produces a dep with {@code name = "junrar"} (artifactId only, no groupId). {@code
+   * resolveArtifactDep} must return that dep object so that callers ({@code processClass}) can use
+   * {@code dep.name} — not {@code entry.artifact()} — when calling {@code registerCve} and building
+   * {@code MethodCallbackSpec}. Using {@code entry.artifact()} would create a registry key ({@code
+   * "com.github.junrar:junrar@7.5.5"}) that mismatches the key {@code DependencyService} will use
+   * ({@code "junrar@7.5.5"}), causing the CVE telemetry to lose source/hash or appear under the
+   * wrong name.
+   */
+  @Test
+  void resolveArtifactDep_noPomJar_returnsArtifactIdOnlyName() throws Exception {
+    ScaCveDatabase db = ScaCveDatabase.parse(new StringReader(JACKSON_JSON));
+    ScaReachabilityTransformer transformer = new ScaReachabilityTransformer(db, null);
+
+    // Simulate guessFallbackNoPom: dep.name is artifactId only (no groupId).
+    Dependency noPomDep =
+        new Dependency("jackson-databind", "2.9.0", "jackson-databind-2.9.0.jar", null);
+
+    Dependency resolved =
+        transformer.resolveArtifactDep(
+            "com.fasterxml.jackson.core:jackson-databind", Collections.singletonList(noPomDep));
+
+    assertNotNull(resolved, "should resolve via artifactId-only fallback");
+    assertEquals(
+        "jackson-databind",
+        resolved.name,
+        "resolved dep.name must be the artifactId-only name from the jar, "
+            + "not entry.artifact() — so registerCve uses the same key as DependencyService");
+    assertEquals("2.9.0", resolved.version);
+  }
+
   /**
    * Validates that {@code findArtifactVersionInClasspath} works correctly when the context
    * classloader is {@code null} — which is the actual runtime condition on agent threads, because

telemetry/src/test/java/datadog/telemetry/sca/ScaReachabilityPeriodicActionTest.java

@@ -569,4 +569,51 @@ void cveAndDepArriveSameHeartbeat_step2MergeStillWorks() {
     assertEquals("lib.jar", emitted.source, "Step 2 merge must preserve source");
     assertTrue(emitted.reachabilityMetadata.get(0).contains("GHSA-simultaneous"));
   }
+
+  /**
+   * Regression test for the registry key mismatch for JARs without pom.properties (PR #11614).
+   *
+   * <p>For JARs without {@code pom.properties}, {@code DependencyResolver.guessFallbackNoPom}
+   * produces an artifact-ID-only name (e.g. {@code "junrar"} instead of {@code
+   * "com.github.junrar:junrar"}). The transformer must register the CVE under the same name so that
+   * the registry key matches what {@code DependencyService} will report.
+   *
+   * <p>Without the fix, {@code registerCve} was called with {@code entry.artifact()} = {@code
+   * "com.github.junrar:junrar"}, while {@code DependencyService} reported {@code dep.name} = {@code
+   * "junrar"}. The result: two separate telemetry entries for the same physical JAR — one with
+   * {@code metadata:[]} (from Step 2, carrying source/hash but no CVE) and one with the CVE
+   * metadata (from Step 3, without source/hash).
+   *
+   * <p>With the fix, the transformer uses the resolved {@code dep.name} from {@code matchDep} (i.e.
+   * {@code "junrar"}) for {@code registerCve}, so the registry and {@code DependencyService} keys
+   * match. Step 2 merges them into a single emission with both the CVE metadata and source/hash.
+   */
+  @Test
+  void noPomJar_artifactIdOnlyName_cveAndSourceHashMergedIntoSingleEntry() {
+    // Simulates what ScaReachabilityTransformer.processClass() now does after the fix:
+    // registerCve with the artifactId-only name that DependencyService will also report.
+    ScaReachabilityDependencyRegistry.INSTANCE.registerCve("junrar", "7.5.5", "GHSA-hf5p-test");
+
+    // DependencyService returns the dep with the same artifactId-only name (guessFallbackNoPom).
+    Dependency incoming = new Dependency("junrar", "7.5.5", "junrar-7.5.5.jar", "CAFEBABE");
+    ScaReachabilityPeriodicAction merged = actionWithDeps(incoming);
+
+    merged.doIteration(telService);
+
+    // Must produce exactly ONE emission with BOTH the CVE metadata AND source/hash — not two
+    // separate entries (one with CVE but no source/hash, one with source/hash but no CVE).
+    ArgumentCaptor<Dependency> captor = ArgumentCaptor.forClass(Dependency.class);
+    verify(telService, times(1)).addDependency(captor.capture());
+    Dependency emitted = captor.getValue();
+    assertEquals(
+        "junrar", emitted.name, "name must be the artifactId-only name from DependencyService");
+    assertEquals("7.5.5", emitted.version);
+    assertEquals(
+        "junrar-7.5.5.jar", emitted.source, "source/hash from DependencyService must be preserved");
+    assertEquals("CAFEBABE", emitted.hash, "hash from DependencyService must be preserved");
+    assertFalse(
+        emitted.reachabilityMetadata.isEmpty(),
+        "CVE metadata must NOT be lost — a single merged entry must carry both CVE data and source/hash");
+    assertTrue(emitted.reachabilityMetadata.get(0).contains("GHSA-hf5p-test"));
+  }
 }