From 5a7c200911663ebe5fbd0d5140c6c29234235f29 Mon Sep 17 00:00:00 2001 From: James Neate Date: Tue, 11 Jul 2023 18:56:36 +0100 Subject: [PATCH] fix: allow valid cyclonedx input with no components (#1873) fix: allow valid cyclonedx input with no components --------- Signed-off-by: James Neate Signed-off-by: Christopher Phillips Co-authored-by: Christopher Phillips --- syft/formats/common/cyclonedxhelpers/decoder.go | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/syft/formats/common/cyclonedxhelpers/decoder.go b/syft/formats/common/cyclonedxhelpers/decoder.go index cb4c9974e28..ecfb9baf91f 100644 --- a/syft/formats/common/cyclonedxhelpers/decoder.go +++ b/syft/formats/common/cyclonedxhelpers/decoder.go @@ -3,6 +3,7 @@ package cyclonedxhelpers import ( "fmt" "io" + "strings" "github.com/CycloneDX/cyclonedx-go" @@ -15,6 +16,8 @@ import ( "github.com/anchore/syft/syft/source" ) +const cycloneDXXmlSchema = "http://cyclonedx.org/schema/bom" + func GetValidator(format cyclonedx.BOMFileFormat) sbom.Validator { return func(reader io.Reader) error { bom := &cyclonedx.BOM{} @@ -22,8 +25,9 @@ func GetValidator(format cyclonedx.BOMFileFormat) sbom.Validator { if err != nil { return err } - // random JSON does not necessarily cause an error (e.g. SPDX) - if (cyclonedx.BOM{} == *bom || bom.Components == nil) { + + xmlWithoutNS := format == cyclonedx.BOMFileFormatXML && !strings.Contains(bom.XMLNS, cycloneDXXmlSchema) + if (cyclonedx.BOM{} == *bom || bom.Components == nil || xmlWithoutNS) { return fmt.Errorf("not a valid CycloneDX document") } return nil