CycloneDX / CycloneDX/cyclonedx-gradle-plugin

Error parsing POM skips dependency without logging of maven coordinates

Open
#112 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Java
Stars
240
Forks
103
Avg merge
1d 9h
Merged PRs (30d)
11

Description

Tested with version `1.4.1`.

Running `gradle cyclonedxBom -S` on a project that consumes a [dependency with a not well formed POM](https://mvnrepository.com/artifact/org.outerj.xreporter/xreporter-expression/1.2.1.1) file gives this output:

```
10:47:20 > Task :server:eksternregisterweb:cyclonedxBom
10:47:20 An error occurred attempting to read POM
10:47:20 org.codehaus.plexus.util.xml.pull.XmlPullParserException: Unrecognised tag: 'groupId' (position: START_TAG seen ...\n ... @24:14)
10:47:20 at org.apache.maven.model.io.xpp3.MavenXpp3Reader.checkUnknownElement(MavenXpp3Reader.java:178)
10:47:20 at org.apache.maven.model.io.xpp3.MavenXpp3Reader.parseModel(MavenXpp3Reader.java:2239)
10:47:20 at org.apache.maven.model.io.xpp3.MavenXpp3Reader.read(MavenXpp3Reader.java:3852)
10:47:20 at org.apache.maven.model.io.xpp3.MavenXpp3Reader.read(MavenXpp3Reader.java:595)
10:47:20 at org.apache.maven.model.io.xpp3.MavenXpp3Reader.read(MavenXpp3Reader.java:609)
10:47:20 at org.cyclonedx.gradle.MavenHelper.readPom(MavenHelper.java:298)
10:47:20 at org.cyclonedx.gradle.MavenHelper.readPom(MavenHelper.java:285)
10:47:20 at org.cyclonedx.gradle.CycloneDxTask.getResolvedMavenProject(CycloneDxTask.java:222)
10:47:20 at org.cyclonedx.gradle.CycloneDxTask.augmentComponentMetadata(CycloneDxTask.java:234)
10:47:20 at org.cyclonedx.gradle.CycloneDxTask.lambda$null$3(CycloneDxTask.java:167)
10:47:20 at java.base/java.lang.Iterable.forEach(Iterable.java:75)
10:47:20 at org.cyclonedx.gradle.CycloneDxTask.lambda$createBom$4(CycloneDxTask.java:156)
10:47:20 at java.base/java.util.stream.ReferencePipeline$7$1.accept(ReferencePipeline.java:271)
10:47:20 at java.base/java.util.stream.ReferencePipeline$2$1.accept(ReferencePipeline.java:177)
10:47:20 at java.base/java.util.Iterator.forEachRemaining(Iterator.java:133)
10:47:20 at java.base/java.util.Spliterators$IteratorSpliterator.forEachRemaining(Spliterators.java:1801)
10:47:20 at java.base/java.util.stream.ReferencePipeline$Head.forEach(ReferencePipeline.java:658)
10:47:20 at java.base/java.util.stream.ReferencePipeline$7$1.accept(ReferencePipeline.java:274)
10:47:20 at java.base/java.util.TreeMap$KeySpliterator.forEachRemaining(TreeMap.java:2739)
10:47:20 at java.base/java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:484)
10:47:20 at java.base/java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:474)
10:47:20 at java.base/java.util.stream.ReduceOps$ReduceOp.evaluateSequential(ReduceOps.java:913)
10:47:20 at java.base/java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:234)
10:47:20 at java.base/java.util.stream.ReferencePipeline.collect(ReferencePipeline.java:578)
10:47:20 at org.cyclonedx.gradle.CycloneDxTask.createBom(CycloneDxTask.java:174)
10:47:20 at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
10:47:20 at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
10:47:20 at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
10:47:20 at java.base/java.lang.reflect.Method.invoke(Method.java:566)
10:47:20 at org.gradle.internal.reflect.JavaMethod.invoke(JavaMethod.java:104)
10:47:20 at org.gradle.api.internal.project.taskfactory.StandardTaskAction.doExecute(StandardTaskAction.java:58)
10:47:20 at org.gradle.api.internal.project.taskfactory.StandardTaskAction.execute(StandardTaskAction.java:51)
10:47:20 at org.gradle.api.internal.project.taskfactory.StandardTaskAction.execute(StandardTaskAction.java:29)
10:47:20 at org.gradle.api.internal.tasks.execution.ExecuteActionsTaskExecuter$2.run(ExecuteActionsTaskExecuter.java:494)
10:47:20 at org.gradle.internal.operations.DefaultBuildOperationRunner$1.execute(DefaultBuildOperationRunner.java:29)
10:47:20 at org.gradle.internal.operations.DefaultBuildOperationRunner$1.execute(DefaultBuildOperationRunner.java:26)
10:47:20 at org.gradle.internal.operations.DefaultBuildOperationRunner$3.execute(DefaultBuildOperationRunner.java:75)
10:47:20 at org.gradle.internal.operations.DefaultBuildOperationRunner$3.execute(DefaultBuildOperationRunner.java:68)
10:47:20 at org.gradle.internal.operations.DefaultBuildOperationRunner.execute(DefaultBuildOperationRunner.java:153)
10:47:20 at org.gradle.internal.operations.DefaultBuildOperationRunner.execute(DefaultBuildOperationRunner.java:68)
10:47:20 at org.gradle.internal.operations.DefaultBuildOperationRunner.run(DefaultBuildOperationRunner.java:56)
10:47:20 at org.gradle.internal.operations.DefaultBuildOperationExecutor.lambda$run$1(DefaultBuildOperationExecutor.java:71)
10:47:20 at org.gradle.internal.operations.UnmanagedBuildOperationWrapper.runWithUnmanagedSupport(UnmanagedBuildOperationWrapper.java:45)
10:47:20 at org.gradle.internal.operations.DefaultBuildOperationExecutor.run(DefaultBuildOperationExecutor.java:71)
10:47:20 at org.gradle.api.internal.tasks.execution.ExecuteActionsTaskExecuter.executeAction(ExecuteActionsTaskExecuter.java:479)
10:47:20 at org.gradle.api.internal.tasks.execution.ExecuteActionsTaskExecuter.executeActions(ExecuteActionsTaskExecuter.java:462)
10:47:20 at org.gradle.api.internal.tasks.execution.ExecuteActionsTaskExecuter.access$400(ExecuteActionsTaskExecuter.java:105)
10:47:20 at org.gradle.api.internal.tasks.execution.ExecuteActionsTaskExecuter$TaskExecution.executeWithPreviousOutputFiles(ExecuteActionsTaskExecuter.java:273)
10:47:20 at org.gradle.api.internal.tasks.execution.ExecuteActionsTaskExecuter$TaskExecution.execute(ExecuteActionsTaskExecuter.java:251)
10:47:20 at org.gradle.internal.execution.steps.ExecuteStep.lambda$executeOperation$1(ExecuteStep.java:66)
10:47:20 at java.base/java.util.Optional.orElseGet(Optional.java:369)
10:47:20 at org.gradle.internal.execution.steps.ExecuteStep.executeOperation(ExecuteStep.java:66)
10:47:20 at org.gradle.internal.execution.steps.ExecuteStep.access$000(ExecuteStep.java:34)
10:47:20 at org.gradle.internal.execution.steps.ExecuteStep$1.call(ExecuteStep.java:47)
10:47:20 at org.gradle.internal.execution.steps.ExecuteStep$1.call(ExecuteStep.java:44)
10:47:20 at org.gradle.internal.operations.DefaultBuildOperationRunner$CallableBuildOperationWorker.execute(DefaultBuildOperationRunner.java:200)
10:47:20 at org.gradle.internal.operations.DefaultBuildOperationRunner$CallableBuildOperationWorker.execute(DefaultBuildOperationRunner.java:195)
10:47:20 at org.gradle.internal.operations.DefaultBuildOperationRunner$3.execute(DefaultBuildOperationRunner.java:75)
10:47:20 at org.gradle.internal.operations.DefaultBuildOperationRunner$3.execute(DefaultBuildOperationRunner.java:68)
10:47:20 at org.gradle.internal.operations.DefaultBuildOperationRunner.execute(DefaultBuildOperationRunner.java:153)
10:47:20 at org.gradle.internal.operations.DefaultBuildOperationRunner.execute(DefaultBuildOperationRunner.java:68)
10:47:20 at org.gradle.internal.operations.DefaultBuildOperationRunner.call(DefaultBuildOperationRunner.java:62)
10:47:20 at org.gradle.internal.operations.DefaultBuildOperationExecutor.lambda$call$2(DefaultBuildOperationExecutor.java:76)
10:47:20 at org.gradle.internal.operations.UnmanagedBuildOperationWrapper.callWithUnmanagedSupport(UnmanagedBuildOperationWrapper.java:54)
10:47:20 at org.gradle.internal.operations.DefaultBuildOperationExecutor.call(DefaultBuildOperationExecutor.java:76)
10:47:20 at org.gradle.internal.execution.steps.ExecuteStep.execute(ExecuteStep.java:44)
10:47:20 at org.gradle.internal.execution.steps.ExecuteStep.execute(ExecuteStep.java:34)
10:47:20 at org.gradle.internal.execution.steps.RemovePreviousOutputsStep.execute(RemovePreviousOutputsStep.java:72)
10:47:20 at org.gradle.internal.execution.steps.RemovePreviousOutputsStep.execute(RemovePreviousOutputsStep.java:42)
10:47:20 at org.gradle.internal.execution.steps.ResolveInputChangesStep.execute(ResolveInputChangesStep.java:53)
10:47:20 at org.gradle.internal.execution.steps.ResolveInputChangesStep.execute(ResolveInputChangesStep.java:39)
10:47:20 at org.gradle.internal.execution.steps.CancelExecutionStep.execute(CancelExecutionStep.java:44)
10:47:20 at org.gradle.internal.execution.steps.TimeoutStep.executeWithoutTimeout(TimeoutStep.java:77)
10:47:20 at org.gradle.internal.execution.steps.TimeoutStep.execute(TimeoutStep.java:58)
10:47:20 at org.gradle.internal.execution.steps.CreateOutputsStep.execute(CreateOutputsStep.java:54)
10:47:20 at org.gradle.internal.execution.steps.CreateOutputsStep.execute(CreateOutputsStep.java:32)
10:47:20 at org.gradle.internal.execution.steps.CaptureStateAfterExecutionStep.execute(CaptureStateAfterExecutionStep.java:57)
10:47:20 at org.gradle.internal.execution.steps.CaptureStateAfterExecutionStep.execute(CaptureStateAfterExecutionStep.java:38)
10:47:20 at org.gradle.internal.execution.steps.BroadcastChangingOutputsStep.execute(BroadcastChangingOutputsStep.java:63)
10:47:20 at org.gradle.internal.execution.steps.BroadcastChangingOutputsStep.execute(BroadcastChangingOutputsStep.java:30)
10:47:20 at org.gradle.internal.execution.steps.BuildCacheStep.executeWithoutCache(BuildCacheStep.java:176)
10:47:20 at org.gradle.internal.execution.steps.BuildCacheStep.execute(BuildCacheStep.java:76)
10:47:20 at org.gradle.internal.execution.steps.BuildCacheStep.execute(BuildCacheStep.java:47)
10:47:20 at org.gradle.internal.execution.steps.StoreExecutionStateStep.execute(StoreExecutionStateStep.java:43)
10:47:20 at org.gradle.internal.execution.steps.StoreExecutionStateStep.execute(StoreExecutionStateStep.java:32)
10:47:20 at org.gradle.internal.execution.steps.RecordOutputsStep.execute(RecordOutputsStep.java:39)
10:47:20 at org.gradle.internal.execution.steps.RecordOutputsStep.execute(RecordOutputsStep.java:25)
10:47:20 at org.gradle.internal.execution.steps.SkipUpToDateStep.executeBecause(SkipUpToDateStep.java:102)
10:47:20 at org.gradle.internal.execution.steps.SkipUpToDateStep.lambda$execute$0(SkipUpToDateStep.java:95)
10:47:20 at java.base/java.util.Optional.map(Optional.java:265)
10:47:20 at org.gradle.internal.execution.steps.SkipUpToDateStep.execute(SkipUpToDateStep.java:55)
10:47:20 at org.gradle.internal.execution.steps.SkipUpToDateStep.execute(SkipUpToDateStep.java:39)
10:47:20 at org.gradle.internal.execution.steps.ResolveChangesStep.execute(ResolveChangesStep.java:83)
10:47:20 at org.gradle.internal.execution.steps.ResolveChangesStep.execute(ResolveChangesStep.java:44)
10:47:20 at org.gradle.internal.execution.steps.legacy.MarkSnapshottingInputsFinishedStep.execute(MarkSnapshottingInputsFinishedStep.java:37)
10:47:20 at org.gradle.internal.execution.steps.legacy.MarkSnapshottingInputsFinishedStep.execute(MarkSnapshottingInputsFinishedStep.java:27)
10:47:20 at org.gradle.internal.execution.steps.ResolveCachingStateStep.execute(ResolveCachingStateStep.java:96)
10:47:20 at org.gradle.internal.execution.steps.ResolveCachingStateStep.execute(ResolveCachingStateStep.java:52)
10:47:20 at org.gradle.internal.execution.steps.CaptureStateBeforeExecutionStep.execute(CaptureStateBeforeExecutionStep.java:83)
10:47:20 at org.gradle.internal.execution.steps.CaptureStateBeforeExecutionStep.execute(CaptureStateBeforeExecutionStep.java:54)
10:47:20 at org.gradle.internal.execution.steps.ValidateStep.execute(ValidateStep.java:74)
10:47:20 at org.gradle.internal.execution.steps.SkipEmptyWorkStep.lambda$execute$2(SkipEmptyWorkStep.java:88)
10:47:20 at java.base/java.util.Optional.orElseGet(Optional.java:369)
10:47:20 at org.gradle.internal.execution.steps.SkipEmptyWorkStep.execute(SkipEmptyWorkStep.java:88)
10:47:20 at org.gradle.internal.execution.steps.SkipEmptyWorkStep.execute(SkipEmptyWorkStep.java:34)
10:47:20 at org.gradle.internal.execution.steps.legacy.MarkSnapshottingInputsStartedStep.execute(MarkSnapshottingInputsStartedStep.java:38)
10:47:20 at org.gradle.internal.execution.steps.LoadExecutionStateStep.execute(LoadExecutionStateStep.java:46)
10:47:20 at org.gradle.internal.execution.steps.LoadExecutionStateStep.execute(LoadExecutionStateStep.java:34)
10:47:20 at org.gradle.internal.execution.steps.AssignWorkspaceStep.lambda$execute$0(AssignWorkspaceStep.java:43)
10:47:20 at org.gradle.api.internal.tasks.execution.ExecuteActionsTaskExecuter$TaskExecution$3.withWorkspace(ExecuteActionsTaskExecuter.java:286)
10:47:20 at org.gradle.internal.execution.steps.AssignWorkspaceStep.execute(AssignWorkspaceStep.java:43)
10:47:20 at org.gradle.internal.execution.steps.AssignWorkspaceStep.execute(AssignWorkspaceStep.java:33)
10:47:20 at org.gradle.internal.execution.steps.IdentityCacheStep.execute(IdentityCacheStep.java:40)
10:47:20 at org.gradle.internal.execution.steps.IdentityCacheStep.execute(IdentityCacheStep.java:30)
10:47:20 at org.gradle.internal.execution.steps.IdentifyStep.execute(IdentifyStep.java:54)
10:47:20 at org.gradle.internal.execution.steps.IdentifyStep.execute(IdentifyStep.java:40)
10:47:20 at org.gradle.internal.execution.impl.DefaultExecutionEngine.rebuild(DefaultExecutionEngine.java:46)
10:47:20 at org.gradle.api.internal.tasks.execution.ExecuteActionsTaskExecuter.lambda$executeIfValid$0(ExecuteActionsTaskExecuter.java:182)
10:47:20 at java.base/java.util.Optional.map(Optional.java:265)
10:47:20 at org.gradle.api.internal.tasks.execution.ExecuteActionsTaskExecuter.executeIfValid(ExecuteActionsTaskExecuter.java:182)
10:47:20 at org.gradle.api.internal.tasks.execution.ExecuteActionsTaskExecuter.execute(ExecuteActionsTaskExecuter.java:173)
10:47:20 at org.gradle.api.internal.tasks.execution.CleanupStaleOutputsExecuter.execute(CleanupStaleOutputsExecuter.java:109)
10:47:20 at org.gradle.api.internal.tasks.execution.FinalizePropertiesTaskExecuter.execute(FinalizePropertiesTaskExecuter.java:46)
10:47:20 at org.gradle.api.internal.tasks.execution.ResolveTaskExecutionModeExecuter.execute(ResolveTaskExecutionModeExecuter.java:62)
10:47:20 at org.gradle.api.internal.tasks.execution.SkipTaskWithNoActionsExecuter.execute(SkipTaskWithNoActionsExecuter.java:57)
10:47:20 at org.gradle.api.internal.tasks.execution.SkipOnlyIfTaskExecuter.execute(SkipOnlyIfTaskExecuter.java:56)
10:47:20 at org.gradle.api.internal.tasks.execution.CatchExceptionTaskExecuter.execute(CatchExceptionTaskExecuter.java:36)
10:47:20 at org.gradle.api.internal.tasks.execution.EventFiringTaskExecuter$1.executeTask(EventFiringTaskExecuter.java:77)
10:47:20 at org.gradle.api.internal.tasks.execution.EventFiringTaskExecuter$1.call(EventFiringTaskExecuter.java:55)
10:47:20 at org.gradle.api.internal.tasks.execution.EventFiringTaskExecuter$1.call(EventFiringTaskExecuter.java:52)
10:47:20 at org.gradle.internal.operations.DefaultBuildOperationRunner$CallableBuildOperationWorker.execute(DefaultBuildOperationRunner.java:200)
10:47:20 at org.gradle.internal.operations.DefaultBuildOperationRunner$CallableBuildOperationWorker.execute(DefaultBuildOperationRunner.java:195)
10:47:20 at org.gradle.internal.operations.DefaultBuildOperationRunner$3.execute(DefaultBuildOperationRunner.java:75)
10:47:20 at org.gradle.internal.operations.DefaultBuildOperationRunner$3.execute(DefaultBuildOperationRunner.java:68)
10:47:20 at org.gradle.internal.operations.DefaultBuildOperationRunner.execute(DefaultBuildOperationRunner.java:153)
10:47:20 at org.gradle.internal.operations.DefaultBuildOperationRunner.execute(DefaultBuildOperationRunner.java:68)
10:47:20 at org.gradle.internal.operations.DefaultBuildOperationRunner.call(DefaultBuildOperationRunner.java:62)
10:47:20 at org.gradle.internal.operations.DefaultBuildOperationExecutor.lambda$call$2(DefaultBuildOperationExecutor.java:76)
10:47:20 at org.gradle.internal.operations.UnmanagedBuildOperationWrapper.callWithUnmanagedSupport(UnmanagedBuildOperationWrapper.java:54)
10:47:20 at org.gradle.internal.operations.DefaultBuildOperationExecutor.call(DefaultBuildOperationExecutor.java:76)
10:47:20 at org.gradle.api.internal.tasks.execution.EventFiringTaskExecuter.execute(EventFiringTaskExecuter.java:52)
10:47:20 at org.gradle.execution.plan.LocalTaskNodeExecutor.execute(LocalTaskNodeExecutor.java:41)
10:47:20 at org.gradle.execution.taskgraph.DefaultTaskExecutionGraph$InvokeNodeExecutorsAction.execute(DefaultTaskExecutionGraph.java:411)
10:47:20 at org.gradle.execution.taskgraph.DefaultTaskExecutionGraph$InvokeNodeExecutorsAction.execute(DefaultTaskExecutionGraph.java:398)
10:47:20 at org.gradle.execution.taskgraph.DefaultTaskExecutionGraph$BuildOperationAwareExecutionAction.execute(DefaultTaskExecutionGraph.java:391)
10:47:20 at org.gradle.execution.taskgraph.DefaultTaskExecutionGraph$BuildOperationAwareExecutionAction.execute(DefaultTaskExecutionGraph.java:377)
10:47:20 at org.gradle.execution.plan.DefaultPlanExecutor$ExecutorWorker.lambda$run$0(DefaultPlanExecutor.java:127)
10:47:20 at org.gradle.execution.plan.DefaultPlanExecutor$ExecutorWorker.execute(DefaultPlanExecutor.java:191)
10:47:20 at org.gradle.execution.plan.DefaultPlanExecutor$ExecutorWorker.executeNextNode(DefaultPlanExecutor.java:182)
10:47:20 at org.gradle.execution.plan.DefaultPlanExecutor$ExecutorWorker.run(DefaultPlanExecutor.java:124)
10:47:20 at org.gradle.internal.concurrent.ExecutorPolicy$CatchAndRecordFailures.onExecute(ExecutorPolicy.java:64)
10:47:20 at org.gradle.internal.concurrent.ManagedExecutorImpl$1.run(ManagedExecutorImpl.java:48)
10:47:20 at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
10:47:20 at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
10:47:20 at org.gradle.internal.concurrent.ThreadFactoryImpl$ManagedThreadRunnable.run(ThreadFactoryImpl.java:56)
10:47:20 at java.base/java.lang.Thread.run(Thread.java:829)
```

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at MavenHelper.readPom around line 298 and trace its callers in CycloneDxTask, especially getResolvedMavenProject and augmentComponentMetadata. Reproduce the issue with the org.outerj.xreporter/xreporter-expression/1.2.1.1 dependency using gradle cyclonedxBom -S; done means skipped malformed POMs log their Maven coordinates.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
build-system
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.