CycloneDX / CycloneDX/cyclonedx-node-yarn

[BUG] unexpected package version expression causes crash

Open
#133 1 comment 0 reactions 0 assignees View on GitHub
bug help wanted
Dominant language
JavaScript
Stars
26
Forks
11
Avg merge
17m
Merged PRs (30d)
1

Description

## Describe the bug

When attempting to generate the SBOM and a package.json contains for example `"version": "1.0-dev" `it now crashes in a function called `Object.fixVersionField`. This concerns me as I would not expect the SBOM generation to adjust version numbers and instead just take them verbatim.

## To Reproduce

`package.json`
```json
{
"name": "jretret",
"version": "1.0-dev",
"packageManager": "yarn@4.3.0",
"dependencies": {
"is-sorted": "^1.0.5"
}
}
```

## Expected behavior

no crashes

## Screenshots or output-paste

```shellSession
$ yarn dlx --quiet @cyclonedx/yarn-plugin-cyclonedx -vvv

YARN_PLUGINS='/tmp/xfs-8c459013/dlx-363278/.yarn/unplugged/@cyclonedx-yarn-plugin-cyclonedx-npm-1.0.0-rc.7-922b640b2d/node_modules/@cyclonedx/yarn-plugin-cyclonedx/yarn-plugin-cyclonedx.cjs' yarn cyclonedx -vvv

DEBUG | YARN_VERSION: [ 4, 3, 0 ]
DEBUG | options: {"specVersion":"1.5","outputFormat":"JSON","outputFile":"-","production":false,"mcType":"application","shortPURLs":false,"outputReproducible":false,"verbosity":4,"projectDir":"/tmp/jretret"}
INFO | gathering project & workspace ...
DEBUG | project: /tmp/jretret
DEBUG | workspace: /tmp/jretret
LOG | gathering BOM data ...
Internal Error: Invalid version: "1.0-dev"
at Object.fixVersionField (/tmp/xfs-8c459013/dlx-363278/.yarn/unplugged/@cyclonedx-yarn-plugin-cyclonedx-npm-1.0.0-rc.7-922b640b2d/node_modules/@cyclonedx/yarn-plugin-cyclonedx/yarn-plugin-cyclonedx.cjs:48:3853)
at /tmp/xfs-8c459013/dlx-363278/.yarn/unplugged/@cyclonedx-yarn-plugin-cyclonedx-npm-1.0.0-rc.7-922b640b2d/node_modules/@cyclonedx/yarn-plugin-cyclonedx/yarn-plugin-cyclonedx.cjs:48:10076
at Array.forEach ()
at Jx (/tmp/xfs-8c459013/dlx-363278/.yarn/unplugged/@cyclonedx-yarn-plugin-cyclonedx-npm-1.0.0-rc.7-922b640b2d/node_modules/@cyclonedx/yarn-plugin-cyclonedx/yarn-plugin-cyclonedx.cjs:48:10041)
at Xf.makeComponent (/tmp/xfs-8c459013/dlx-363278/.yarn/unplugged/@cyclonedx-yarn-plugin-cyclonedx-npm-1.0.0-rc.7-922b640b2d/node_modules/@cyclonedx/yarn-plugin-cyclonedx/yarn-plugin-cyclonedx.cjs:48:13143)
at Xf.makeComponentFromWorkspace (/tmp/xfs-8c459013/dlx-363278/.yarn/unplugged/@cyclonedx-yarn-plugin-cyclonedx-npm-1.0.0-rc.7-922b640b2d/node_modules/@cyclonedx/yarn-plugin-cyclonedx/yarn-plugin-cyclonedx.cjs:48:12462)
at Xf.buildFromWorkspace (/tmp/xfs-8c459013/dlx-363278/.yarn/unplugged/@cyclonedx-yarn-plugin-cyclonedx-npm-1.0.0-rc.7-922b640b2d/node_modules/@cyclonedx/yarn-plugin-cyclonedx/yarn-plugin-cyclonedx.cjs:48:11711)
at async Is.execute (/tmp/xfs-8c459013/dlx-363278/.yarn/unplugged/@cyclonedx-yarn-plugin-cyclonedx-npm-1.0.0-rc.7-922b640b2d/node_modules/@cyclonedx/yarn-plugin-cyclonedx/yarn-plugin-cyclonedx.cjs:55:989)
at async Is.validateAndExecute (.../.cache/node/corepack/v1/yarn/4.3.0/yarn.js:94:787)
at async ls.run (/home/flow/.cache/node/corepack/v1/yarn/4.3.0/yarn.js:98:3250)
```

## Environment

- _@cyclonedx/yarn-plugin-cyclonedx_ version: `v1.0.0-rc.7+git.33febfe`
- yarn version: n/a
- Node version: n/a
- OS: n/a

## Additional context

as i've learned, is an invalid version identifier according to npm/yarn standards (which appears to adhere to semver), and causes crashes everywhere.
So this is somehow expected.

But still, an option could be: in case a crash because of version happens, remove `version` and try again, and add back the version afterwards ...
Or find a way to ignore the version when running manifest normalization ...

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.