fix: close XMLStreamReader in JavaMavenProvider and make readLicenseFromManifest abstract

Author: soul2zimate

src/main/java/io/github/guacsec/trustifyda/Provider.java

@@ -73,16 +73,14 @@ protected Provider(Ecosystem.Type ecosystem, Path manifest) {
   public abstract Content provideComponent() throws IOException;
 
   /**
-   * Read the project license from the manifest file. Providers that support manifest-level license
-   * declarations (e.g., pom.xml {@code <licenses>}, package.json {@code license}, Cargo.toml {@code
-   * license}) should override this method.
+   * Read the project license from the manifest file. Each provider must decide how to extract the
+   * license from its manifest (e.g., pom.xml {@code <licenses>}, package.json {@code license},
+   * Cargo.toml {@code license}). Providers without a manifest-level license field should fall back
+   * to {@link LicenseUtils#readLicenseFile(Path)}.
    *
    * @return SPDX identifier or license name from the manifest, or null if not available
    */
-  public String readLicenseFromManifest() {
-    // Default: no manifest license field. Falls back to LICENSE file detection.
-    return LicenseUtils.readLicenseFile(manifest);
-  }
+  public abstract String readLicenseFromManifest();
 
   /**
    * If a package manager requires having a lock file it must exist in the provided path

src/main/java/io/github/guacsec/trustifyda/providers/CargoProvider.java

@@ -612,14 +612,15 @@ public CargoProvider(Path manifest) {
 
   @Override
   public String readLicenseFromManifest() {
-    return readLicenseFromToml(null);
+    String manifestLicense = readLicenseFromToml(null);
+    return LicenseUtils.getLicense(manifestLicense, manifest);
   }
 
   private String readLicenseFromToml(TomlParseResult existingResult) {
     try {
       TomlParseResult tomlResult = existingResult != null ? existingResult : Toml.parse(manifest);
       if (tomlResult.hasErrors()) {
-        return LicenseUtils.getLicense(null, manifest);
+        return null;
       }
       String license = tomlResult.getString("package.license");
       return LicenseUtils.getLicense(license, manifest);

src/main/java/io/github/guacsec/trustifyda/providers/GoModulesProvider.java

@@ -22,6 +22,7 @@
 import com.github.packageurl.PackageURL;
 import io.github.guacsec.trustifyda.Api;
 import io.github.guacsec.trustifyda.Provider;
+import io.github.guacsec.trustifyda.license.LicenseUtils;
 import io.github.guacsec.trustifyda.logging.LoggersFactory;
 import io.github.guacsec.trustifyda.sbom.Sbom;
 import io.github.guacsec.trustifyda.sbom.SbomFactory;
@@ -70,6 +71,11 @@ public GoModulesProvider(Path manifest) {
     this.mainModuleVersion = getDefaultMainModuleVersion();
   }
 
+  @Override
+  public String readLicenseFromManifest() {
+    return LicenseUtils.readLicenseFile(manifest);
+  }
+
   @Override
   public Content provideStack() throws IOException {
     // check for custom executable

src/main/java/io/github/guacsec/trustifyda/providers/GradleProvider.java

@@ -22,6 +22,7 @@
 import com.github.packageurl.PackageURL;
 import io.github.guacsec.trustifyda.Api;
 import io.github.guacsec.trustifyda.Provider;
+import io.github.guacsec.trustifyda.license.LicenseUtils;
 import io.github.guacsec.trustifyda.logging.LoggersFactory;
 import io.github.guacsec.trustifyda.sbom.Sbom;
 import io.github.guacsec.trustifyda.sbom.SbomFactory;
@@ -64,6 +65,11 @@ public GradleProvider(Path manifest) {
     super(Type.GRADLE, manifest);
   }
 
+  @Override
+  public String readLicenseFromManifest() {
+    return LicenseUtils.readLicenseFile(manifest);
+  }
+
   @Override
   public Content provideStack() throws IOException {
     Path tempFile = getDependencies(manifest);

src/main/java/io/github/guacsec/trustifyda/providers/JavaMavenProvider.java

@@ -84,28 +84,37 @@ private String readLicenseFromPom(Path pomPath) {
     XMLInputFactory factory = XMLInputFactory.newInstance();
     try (InputStream is = Files.newInputStream(pomPath)) {
       XMLStreamReader reader = factory.createXMLStreamReader(is);
-      boolean insideLicenses = false;
-      boolean insideLicense = false;
-      while (reader.hasNext()) {
-        int event = reader.next();
-        if (event == XMLStreamConstants.START_ELEMENT) {
-          String name = reader.getLocalName();
-          if ("licenses".equals(name)) {
-            insideLicenses = true;
-          } else if (insideLicenses && "license".equals(name)) {
-            insideLicense = true;
-          } else if (insideLicense && "name".equals(name)) {
-            String license = reader.getElementText();
-            if (license != null && !license.isBlank()) {
-              return license.trim();
+      try {
+        boolean insideLicenses = false;
+        boolean insideLicense = false;
+        while (reader.hasNext()) {
+          int event = reader.next();
+          if (event == XMLStreamConstants.START_ELEMENT) {
+            String name = reader.getLocalName();
+            if ("licenses".equals(name)) {
+              insideLicenses = true;
+            } else if (insideLicenses && "license".equals(name)) {
+              insideLicense = true;
+            } else if (insideLicense && "name".equals(name)) {
+              String license = reader.getElementText();
+              if (license != null && !license.isBlank()) {
+                return license.trim();
+              }
+            }
+          } else if (event == XMLStreamConstants.END_ELEMENT) {
+            String name = reader.getLocalName();
+            if ("license".equals(name)) {
+              insideLicense = false;
+            } else if ("licenses".equals(name)) {
+              break;
             }
           }
-        } else if (event == XMLStreamConstants.END_ELEMENT) {
-          String name = reader.getLocalName();
-          if ("license".equals(name)) {
-            insideLicense = false;
-          } else if ("licenses".equals(name)) {
-            break;
+        }
+      } finally {
+        if (!Objects.isNull(reader)) {
+          try {
+            reader.close();
+          } catch (XMLStreamException e) {
           }
         }
       }

src/main/java/io/github/guacsec/trustifyda/providers/PythonPipProvider.java

@@ -23,6 +23,7 @@
 import com.github.packageurl.PackageURL;
 import io.github.guacsec.trustifyda.Api;
 import io.github.guacsec.trustifyda.Provider;
+import io.github.guacsec.trustifyda.license.LicenseUtils;
 import io.github.guacsec.trustifyda.logging.LoggersFactory;
 import io.github.guacsec.trustifyda.sbom.Sbom;
 import io.github.guacsec.trustifyda.sbom.SbomFactory;
@@ -60,6 +61,11 @@ public PythonPipProvider(Path manifest) {
     super(Ecosystem.Type.PYTHON, manifest);
   }
 
+  @Override
+  public String readLicenseFromManifest() {
+    return LicenseUtils.readLicenseFile(manifest);
+  }
+
   @Override
   public Content provideStack() throws IOException {
     PythonControllerBase pythonController = getPythonController();