CycloneDX / CycloneDX/cyclonedx-core-java

Empty metadata --> tool tag causes parsing exception

Open
#784 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
120
Forks
90
Avg merge
12h 43m
Merged PRs (30d)
18

Description

Hello, I have a question regarding an exception I get when parsing a 1.3 CycloneDX SBOM.

According to the specification, the `` tag in the `` section is an `array`, which does not specify a constraint to it's size: https://cyclonedx.org/docs/1.3/json/#metadata_tools

However, when I try to parse an SBOM like this using your library:

```xml



```

I get this exception:

```
com.fasterxml.jackson.databind.JsonMappingException: Cannot coerce empty String ("") to `org.cyclonedx.model.Tool` value (but could if coercion was enabled using `CoercionConfig`)
at [Source: UNKNOWN; byte offset: #UNKNOWN] (through reference chain: org.cyclonedx.model.Bom["metadata"])
```

The SBOM is generated using a tool, but it does not fill out this property.
I was wondering whether this behavior is intended or whether this is a difference to the specification that I did not understand.

Thank you for your time.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.