Skip to content

Commit 658b323

Browse files
JNC4JNC4
authored
fix: handle legacy licenses array in sbom output (npm#9010)
Fixes npm#8892 Older packages on the registry use the deprecated `licenses` array (`"licenses": [{"type": "MIT", ...}]`) instead of the singular `license` string. `npm sbom` only checked for `license`, so these packages all showed up as `NOASSERTION`. This checks for the `licenses` array as a fallback in both the SPDX and CycloneDX codepaths. When there are multiple entries they're joined with ` OR `. Also noticed the CycloneDX expression branch was referencing `node.package.license` directly instead of the already-computed variable, which would break for these legacy packages. Fixed that too.
1 parent cf88236 commit 658b323

6 files changed

Lines changed: 395 additions & 8 deletions

File tree

‎lib/utils/sbom-cyclonedx.js‎

Lines changed: 13 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -84,15 +84,20 @@ const toCyclonedxItem = (node, { packageType }) => {
8484
node.package = toNormalize.content
8585
}
8686

87-
let parsedLicense
88-
try {
89-
let license = node.package?.license
90-
if (license) {
91-
if (typeof license === 'object') {
92-
license = license.type
93-
}
87+
let license = node.package?.license
88+
if (license) {
89+
if (typeof license === 'object') {
90+
license = license.type
9491
}
92+
} else if (Array.isArray(node.package?.licenses)) {
93+
license = node.package.licenses
94+
.map(l => (typeof l === 'object' ? l.type : l))
95+
.filter(Boolean)
96+
.join(' OR ')
97+
}
9598

99+
let parsedLicense
100+
try {
96101
parsedLicense = parseLicense(license)
97102
} catch {
98103
parsedLicense = null
@@ -158,7 +163,7 @@ const toCyclonedxItem = (node, { packageType }) => {
158163
component.licenses = [{ license: { id: parsedLicense.license } }]
159164
// If license is a conjunction, use the expression field
160165
} else if (parsedLicense?.conjunction) {
161-
component.licenses = [{ expression: node.package.license }]
166+
component.licenses = [{ expression: license }]
162167
}
163168

164169
return component

‎lib/utils/sbom-spdx.js‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -110,6 +110,11 @@ const toSpdxItem = (node, { packageType }) => {
110110
if (typeof license === 'object') {
111111
license = license.type
112112
}
113+
} else if (Array.isArray(node.package?.licenses)) {
114+
license = node.package.licenses
115+
.map(l => (typeof l === 'object' ? l.type : l))
116+
.filter(Boolean)
117+
.join(' OR ')
113118
}
114119

115120
const pkg = {

‎tap-snapshots/test/lib/utils/sbom-cyclonedx.js.test.cjs‎

Lines changed: 148 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -833,6 +833,154 @@ exports[`test/lib/utils/sbom-cyclonedx.js TAP single node - with issue tracker >
833833
}
834834
`
835835

836+
exports[`test/lib/utils/sbom-cyclonedx.js TAP single node - with legacy licenses array (multiple) > must match snapshot 1`] = `
837+
{
838+
"$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
839+
"bomFormat": "CycloneDX",
840+
"specVersion": "1.5",
841+
"serialNumber": "urn:uuid:00000000-0000-0000-0000-000000000000",
842+
"version": 1,
843+
"metadata": {
844+
"timestamp": "2020-01-01T00:00:00.000Z",
845+
"lifecycles": [
846+
{
847+
"phase": "build"
848+
}
849+
],
850+
"tools": [
851+
{
852+
"vendor": "npm",
853+
"name": "cli",
854+
"version": "10.0.0 "
855+
}
856+
],
857+
"component": {
858+
"bom-ref": "root@1.0.0",
859+
"type": "library",
860+
"name": "root",
861+
"version": "1.0.0",
862+
"scope": "required",
863+
"author": "Author",
864+
"purl": "pkg:npm/root@1.0.0",
865+
"properties": [],
866+
"externalReferences": [],
867+
"licenses": [
868+
{
869+
"expression": "MIT OR Apache-2.0"
870+
}
871+
]
872+
}
873+
},
874+
"components": [],
875+
"dependencies": [
876+
{
877+
"ref": "root@1.0.0",
878+
"dependsOn": []
879+
}
880+
]
881+
}
882+
`
883+
884+
exports[`test/lib/utils/sbom-cyclonedx.js TAP single node - with legacy licenses array (single) > must match snapshot 1`] = `
885+
{
886+
"$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
887+
"bomFormat": "CycloneDX",
888+
"specVersion": "1.5",
889+
"serialNumber": "urn:uuid:00000000-0000-0000-0000-000000000000",
890+
"version": 1,
891+
"metadata": {
892+
"timestamp": "2020-01-01T00:00:00.000Z",
893+
"lifecycles": [
894+
{
895+
"phase": "build"
896+
}
897+
],
898+
"tools": [
899+
{
900+
"vendor": "npm",
901+
"name": "cli",
902+
"version": "10.0.0 "
903+
}
904+
],
905+
"component": {
906+
"bom-ref": "root@1.0.0",
907+
"type": "library",
908+
"name": "root",
909+
"version": "1.0.0",
910+
"scope": "required",
911+
"author": "Author",
912+
"purl": "pkg:npm/root@1.0.0",
913+
"properties": [],
914+
"externalReferences": [],
915+
"licenses": [
916+
{
917+
"license": {
918+
"id": "MIT"
919+
}
920+
}
921+
]
922+
}
923+
},
924+
"components": [],
925+
"dependencies": [
926+
{
927+
"ref": "root@1.0.0",
928+
"dependsOn": []
929+
}
930+
]
931+
}
932+
`
933+
934+
exports[`test/lib/utils/sbom-cyclonedx.js TAP single node - with legacy licenses array (string entries) > must match snapshot 1`] = `
935+
{
936+
"$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
937+
"bomFormat": "CycloneDX",
938+
"specVersion": "1.5",
939+
"serialNumber": "urn:uuid:00000000-0000-0000-0000-000000000000",
940+
"version": 1,
941+
"metadata": {
942+
"timestamp": "2020-01-01T00:00:00.000Z",
943+
"lifecycles": [
944+
{
945+
"phase": "build"
946+
}
947+
],
948+
"tools": [
949+
{
950+
"vendor": "npm",
951+
"name": "cli",
952+
"version": "10.0.0 "
953+
}
954+
],
955+
"component": {
956+
"bom-ref": "root@1.0.0",
957+
"type": "library",
958+
"name": "root",
959+
"version": "1.0.0",
960+
"scope": "required",
961+
"author": "Author",
962+
"purl": "pkg:npm/root@1.0.0",
963+
"properties": [],
964+
"externalReferences": [],
965+
"licenses": [
966+
{
967+
"license": {
968+
"id": "MIT"
969+
}
970+
}
971+
]
972+
}
973+
},
974+
"components": [],
975+
"dependencies": [
976+
{
977+
"ref": "root@1.0.0",
978+
"dependsOn": []
979+
}
980+
]
981+
}
982+
`
983+
836984
exports[`test/lib/utils/sbom-cyclonedx.js TAP single node - with license expression > must match snapshot 1`] = `
837985
{
838986
"$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",

‎tap-snapshots/test/lib/utils/sbom-spdx.js.test.cjs‎

Lines changed: 135 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -594,6 +594,141 @@ exports[`test/lib/utils/sbom-spdx.js TAP single node - with integrity > must mat
594594
}
595595
`
596596

597+
exports[`test/lib/utils/sbom-spdx.js TAP single node - with legacy licenses array (multiple) > must match snapshot 1`] = `
598+
{
599+
"spdxVersion": "SPDX-2.3",
600+
"dataLicense": "CC0-1.0",
601+
"SPDXID": "SPDXRef-DOCUMENT",
602+
"name": "root@1.0.0",
603+
"documentNamespace": "docns",
604+
"creationInfo": {
605+
"created": "2020-01-01T00:00:00.000Z",
606+
"creators": [
607+
"Tool: npm/cli-10.0.0 "
608+
]
609+
},
610+
"documentDescribes": [
611+
"SPDXRef-Package-root-1.0.0"
612+
],
613+
"packages": [
614+
{
615+
"name": "root",
616+
"SPDXID": "SPDXRef-Package-root-1.0.0",
617+
"versionInfo": "1.0.0",
618+
"packageFileName": "",
619+
"downloadLocation": "NOASSERTION",
620+
"filesAnalyzed": false,
621+
"homepage": "NOASSERTION",
622+
"licenseDeclared": "MIT OR Apache-2.0",
623+
"externalRefs": [
624+
{
625+
"referenceCategory": "PACKAGE-MANAGER",
626+
"referenceType": "purl",
627+
"referenceLocator": "pkg:npm/root@1.0.0"
628+
}
629+
]
630+
}
631+
],
632+
"relationships": [
633+
{
634+
"spdxElementId": "SPDXRef-DOCUMENT",
635+
"relatedSpdxElement": "SPDXRef-Package-root-1.0.0",
636+
"relationshipType": "DESCRIBES"
637+
}
638+
]
639+
}
640+
`
641+
642+
exports[`test/lib/utils/sbom-spdx.js TAP single node - with legacy licenses array (single) > must match snapshot 1`] = `
643+
{
644+
"spdxVersion": "SPDX-2.3",
645+
"dataLicense": "CC0-1.0",
646+
"SPDXID": "SPDXRef-DOCUMENT",
647+
"name": "root@1.0.0",
648+
"documentNamespace": "docns",
649+
"creationInfo": {
650+
"created": "2020-01-01T00:00:00.000Z",
651+
"creators": [
652+
"Tool: npm/cli-10.0.0 "
653+
]
654+
},
655+
"documentDescribes": [
656+
"SPDXRef-Package-root-1.0.0"
657+
],
658+
"packages": [
659+
{
660+
"name": "root",
661+
"SPDXID": "SPDXRef-Package-root-1.0.0",
662+
"versionInfo": "1.0.0",
663+
"packageFileName": "",
664+
"downloadLocation": "NOASSERTION",
665+
"filesAnalyzed": false,
666+
"homepage": "NOASSERTION",
667+
"licenseDeclared": "MIT",
668+
"externalRefs": [
669+
{
670+
"referenceCategory": "PACKAGE-MANAGER",
671+
"referenceType": "purl",
672+
"referenceLocator": "pkg:npm/root@1.0.0"
673+
}
674+
]
675+
}
676+
],
677+
"relationships": [
678+
{
679+
"spdxElementId": "SPDXRef-DOCUMENT",
680+
"relatedSpdxElement": "SPDXRef-Package-root-1.0.0",
681+
"relationshipType": "DESCRIBES"
682+
}
683+
]
684+
}
685+
`
686+
687+
exports[`test/lib/utils/sbom-spdx.js TAP single node - with legacy licenses array (string entries) > must match snapshot 1`] = `
688+
{
689+
"spdxVersion": "SPDX-2.3",
690+
"dataLicense": "CC0-1.0",
691+
"SPDXID": "SPDXRef-DOCUMENT",
692+
"name": "root@1.0.0",
693+
"documentNamespace": "docns",
694+
"creationInfo": {
695+
"created": "2020-01-01T00:00:00.000Z",
696+
"creators": [
697+
"Tool: npm/cli-10.0.0 "
698+
]
699+
},
700+
"documentDescribes": [
701+
"SPDXRef-Package-root-1.0.0"
702+
],
703+
"packages": [
704+
{
705+
"name": "root",
706+
"SPDXID": "SPDXRef-Package-root-1.0.0",
707+
"versionInfo": "1.0.0",
708+
"packageFileName": "",
709+
"downloadLocation": "NOASSERTION",
710+
"filesAnalyzed": false,
711+
"homepage": "NOASSERTION",
712+
"licenseDeclared": "MIT",
713+
"externalRefs": [
714+
{
715+
"referenceCategory": "PACKAGE-MANAGER",
716+
"referenceType": "purl",
717+
"referenceLocator": "pkg:npm/root@1.0.0"
718+
}
719+
]
720+
}
721+
],
722+
"relationships": [
723+
{
724+
"spdxElementId": "SPDXRef-DOCUMENT",
725+
"relatedSpdxElement": "SPDXRef-Package-root-1.0.0",
726+
"relationshipType": "DESCRIBES"
727+
}
728+
]
729+
}
730+
`
731+
597732
exports[`test/lib/utils/sbom-spdx.js TAP single node - with license expression > must match snapshot 1`] = `
598733
{
599734
"spdxVersion": "SPDX-2.3",

‎test/lib/utils/sbom-cyclonedx.js‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -181,6 +181,53 @@ t.test('single node - with single license', t => {
181181
t.end()
182182
})
183183

184+
t.test('single node - with legacy licenses array (single)', t => {
185+
const pkg = {
186+
...rootPkg,
187+
licenses: [
188+
{
189+
type: 'MIT',
190+
url: 'http://opensource.org/licenses/mit-license.php',
191+
},
192+
],
193+
}
194+
const node = { ...root, package: pkg }
195+
const res = cyclonedxOutput({ npm, nodes: [node] })
196+
t.matchSnapshot(JSON.stringify(res))
197+
t.end()
198+
})
199+
200+
t.test('single node - with legacy licenses array (multiple)', t => {
201+
const pkg = {
202+
...rootPkg,
203+
licenses: [
204+
{
205+
type: 'MIT',
206+
url: 'http://opensource.org/licenses/mit-license.php',
207+
},
208+
{
209+
type: 'Apache-2.0',
210+
url: 'http://opensource.org/licenses/apache2.0.php',
211+
},
212+
],
213+
}
214+
const node = { ...root, package: pkg }
215+
const res = cyclonedxOutput({ npm, nodes: [node] })
216+
t.matchSnapshot(JSON.stringify(res))
217+
t.end()
218+
})
219+
220+
t.test('single node - with legacy licenses array (string entries)', t => {
221+
const pkg = {
222+
...rootPkg,
223+
licenses: ['MIT'],
224+
}
225+
const node = { ...root, package: pkg }
226+
const res = cyclonedxOutput({ npm, nodes: [node] })
227+
t.matchSnapshot(JSON.stringify(res))
228+
t.end()
229+
})
230+
184231
t.test('single node - with license expression', t => {
185232
const pkg = { ...rootPkg, license: '(MIT OR Apache-2.0)' }
186233
const node = { ...root, package: pkg }

0 commit comments

Comments
 (0)