Add support for Nuget lockfiles #497
Open
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
tevoinea
reviewed
Apr 6, 2023
| foreach (var (name, value) in framework) | ||
| { | ||
| var component = new NuGetComponent(name, value.Resolved); | ||
| singleFileComponentRecorder.RegisterUsage(new DetectedComponent(component)); |
There was a problem hiding this comment.
Not sure if the team would want it included in this PR or not, but packages.lock.json supports reconstructing the whole component graph (see parentComponentId docs link) by using the dependencies property and also isExplicitlyReferencedDependency (same doc link) through the type property (is it Direct or Transitive).
Porges
commented
Apr 10, 2023
| @@ -105,6 +115,12 @@ private async Task ProcessFileAsync(ProcessRequest processRequest) | |||
| else if ("paket.lock".Equals(stream.Pattern, StringComparison.OrdinalIgnoreCase)) | |||
| { | |||
| this.ParsePaketLock(processRequest); | |||
| return; | |||
There was a problem hiding this comment.
Fixed what seems like a small bug here; it would always continue to the "nuget bytes" parsing and throw a null reference exception which is then caught.
melotic
added
version:minor
type:feature
melotic
reviewed
Apr 14, 2023
test/Microsoft.ComponentDetection.Detectors.Tests/Utilities/TestLogger.cs
Show resolved
Hide resolved
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
These have been supported since VS2017 but they are not yet parsed. The lockfile contains all transitive dependencies and does not require a build to be performed in order to be used.
I found that support for this was missing while investigating why our repo was not getting flagged for anything despite having transitive dependencies on packages with High- and Critical-level advisories. It turned out that Component Governance was not finding any dependencies at all, since the existing detectors require the project to be built first.
I've also added a simple test logger implementation when writing a test, since a mock logger is not very useful when tests fail.