Merge branch 'main' into TC-3865

Author: a-oren

README.md

@@ -21,7 +21,7 @@ while you build your application.
 - Gradle Kotlin and Groovy (gradle)
 - Golang (go mod)
 - Rust (cargo)
-- Python (pip) ecosystems, and base images in Dockerfile.
+- Python (pip, pyproject.toml) ecosystems, and base images in Dockerfile.
 
 In future releases, Red Hat plans to support other package managers.
 
@@ -108,7 +108,7 @@ according to your preferences.
   dependencies for Rust projects.
   <br >If the path is not provided, your IDE's `PATH` environment will be used to locate the executable.
 
-- **Python** (`requirements.txt`) :
+- **Python** (`requirements.txt`, `pyproject.toml`) :
   <br >Set the full paths of the Python and the package installer for Python executables, which allows Exhort to locate
   and run the `pip3` commands to resolve dependencies for Python projects.
   <br >Python 2 executables `python` and `pip` can be used instead, if the `Use python 2.x` option is selected.
@@ -324,6 +324,21 @@ When modifying the grammar or lexer files, you need to regenerate the parser cla
   tokio = { version = "1.0", features = ["full"] } # trustify-da-ignore
   ```
 
+  If you want to ignore vulnerabilities for a dependency in a `pyproject.toml` file, you must add `trustify-da-ignore` as a comment
+  against the dependency in the manifest file.
+  For PEP 621 format:
+  ```toml
+  [project]
+  dependencies = [
+      "anyio==3.6.2",  # trustify-da-ignore
+  ]
+  ```
+  For Poetry format:
+  ```toml
+  [tool.poetry.dependencies]
+  anyio = "^3.6.2"  # trustify-da-ignore
+  ```
+
 - **Excluding developmental or test dependencies**
   <br >Red Hat Dependency Analytics does not analyze dependencies marked as `dev` or `test`, these dependencies are
   ignored.
@@ -371,6 +386,10 @@ When modifying the grammar or lexer files, you need to regenerate the parser cla
   You can create an alternative file to `requirements.txt`, for example, a `requirements-dev.txt` or
   a `requirements-test.txt` file where you can add the development or test dependencies there.
 
+  For `pyproject.toml`, dependencies from `[project.dependencies]` (PEP 621),
+  `[project.optional-dependencies]`, and `[tool.poetry.dependencies]` are analyzed.
+  Poetry group dependencies (`[tool.poetry.group.*.dependencies]`) are excluded.
+
 
 - **Excluding manifest files with patterns**
   <br >You can exclude specific manifest files from component analysis using configurable glob patterns. This feature allows you to avoid analyzing third-party dependencies, test files, or other manifests that are not relevant to your security analysis.

src/main/java/org/jboss/tools/intellij/componentanalysis/CAAnnotator.java

@@ -524,7 +524,7 @@ public static String getPackageManager(String file) {
             case "pom.xml" -> "maven";
             case "package.json" -> "npm";
             case "go.mod" -> "go";
-            case "requirements.txt" -> "python";
+            case "requirements.txt", "pyproject.toml" -> "python";
             case "build.gradle", "build.gradle.kts" -> "gradle";
             case "Cargo.toml" -> "cargo";
             default -> null;

src/main/java/org/jboss/tools/intellij/componentanalysis/SAIntentionAction.java

@@ -49,7 +49,8 @@ public boolean isAvailable(@NotNull Project project, Editor editor, PsiFile file
                 || "requirements.txt".equals(file.getName())
                 || "build.gradle".equals(file.getName())
                 || "build.gradle.kts".equals(file.getName())
-                || "Cargo.toml".equals(file.getName());
+                || "Cargo.toml".equals(file.getName())
+                || "pyproject.toml".equals(file.getName());
     }
 
     @Override

src/main/java/org/jboss/tools/intellij/componentanalysis/cargo/CargoCAAnnotator.java

@@ -70,6 +70,10 @@ protected String getInspectionShortName() {
 
     @Override
     protected Map<Dependency, List<PsiElement>> getDependencies(PsiFile file) {
+        if (!"Cargo.toml".equals(file.getName())) {
+            return Map.of();
+        }
+
         Map<Dependency, List<PsiElement>> resultMap = new HashMap<>();
 
         Set<String> commentIgnoredDeps = getIgnoredDependencies(file);
@@ -381,4 +385,4 @@ private void parseFlatDependencies(TomlTable table, Set<String> ignoredDeps, Map
             resultMap.computeIfAbsent(dp, k -> new LinkedList<>()).add(keyValue);
         }
     }
-}
+}