CycloneDX / CycloneDX/cyclonedx-core-java
Empty metadata --> tool tag causes parsing exception
- Dominant language
- Java
- Stars
- 120
- Forks
- 90
- Avg merge
- 12h 43m
- Merged PRs (30d)
- 18
Description
Hello, I have a question regarding an exception I get when parsing a 1.3 CycloneDX SBOM.
According to the specification, the `` tag in the `` section is an `array`, which does not specify a constraint to it's size: https://cyclonedx.org/docs/1.3/json/#metadata_tools
However, when I try to parse an SBOM like this using your library:
```xml
```
I get this exception:
```
com.fasterxml.jackson.databind.JsonMappingException: Cannot coerce empty String ("") to `org.cyclonedx.model.Tool` value (but could if coercion was enabled using `CoercionConfig`)
at [Source: UNKNOWN; byte offset: #UNKNOWN] (through reference chain: org.cyclonedx.model.Bom["metadata"])
```
The SBOM is generated using a tool, but it does not fill out this property.
I was wondering whether this behavior is intended or whether this is a difference to the specification that I did not understand.
Thank you for your time.
Contributor guide
Assessment
This issue has not been assessed yet.