microsoft / microsoft/component-detection
Add Support for ".pom" file parsing in Maven ecosystem
Open
Nobody has claimed this yet.
- #544 by @AbhinavAbhinav11 — closed without merging
detector:maven
status:requirements
- Dominant language
- C#
- Stars
- 553
- Forks
- 135
- Avg merge
- 20h 58m
- Merged PRs (30d)
- 6
Description
More context w.r.t above request:
- Recently we have observed that in AndroidBuildTools repo (which helps to download 3rd party packages for OMR from web and add to office-feed , so that OMR products can use them since OMR repo has offline-build) , packages defined in ‘maven’ ecosystem are not getting detected by ComponentGovernance tool, and on further debugging its observed that AndroidBuildTools repo uses “.pom” files for maven dependencies info & support only ‘pom.xml’ file for Maven ecosystem.
- To ensure Repos which uses ".pom" config file for maven ecosystem, raising this new request on 'parsing .pom file' so that we'll be security-compliant in these repos too.(eg:AndroidBuildTools)
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the Maven ecosystem parser that currently supports pom.xml, then compare how AndroidBuildTools uses .pom files. Done means Maven dependencies in .pom files are detected by ComponentGovernance, while existing pom.xml parsing continues to work.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp, xml
- Domain
- devtools, security
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100