fix(cyclonedx): add nil check to metadata.component (#2673)

aquasecurity · Aug 8, 2022 · de365c8 · de365c8
1 parent 50db7da
commit de365c8
Show file tree

Hide file tree

Showing 3 changed files with 23 additions and 1 deletion.
diff --git a/pkg/sbom/cyclonedx/testdata/happy/empty-metadata-component-bom.json b/pkg/sbom/cyclonedx/testdata/happy/empty-metadata-component-bom.json
@@ -0,0 +1,17 @@
+{
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.4",
+  "serialNumber": "urn:uuid:c986ba94-e37d-49c8-9e30-96daccd0415b",
+  "version": 1,
+  "metadata": {
+    "timestamp": "2022-05-28T10:20:03.79527Z",
+    "tools": [
+      {
+        "vendor": "aquasecurity",
+        "name": "trivy",
+        "version": "dev"
+      }
+    ]
+  },
+  "dependencies": []
+}
diff --git a/pkg/sbom/cyclonedx/unmarshal.go b/pkg/sbom/cyclonedx/unmarshal.go
@@ -186,7 +186,7 @@ func componentMap(metadata *cdx.Metadata, components *[]cdx.Component) map[strin
 	for _, component := range lo.FromPtr(components) {
 		cmap[component.BOMRef] = component
 	}
-	if metadata != nil {
+	if metadata != nil && metadata.Component != nil {
 		cmap[metadata.Component.BOMRef] = *metadata.Component
 	}
 	return cmap

diff --git a/pkg/sbom/cyclonedx/unmarshal_test.go b/pkg/sbom/cyclonedx/unmarshal_test.go
@@ -184,6 +184,11 @@ func TestUnmarshaler_Unmarshal(t *testing.T) {
 			inputFile: "testdata/happy/empty-bom.json",
 			want:      sbom.SBOM{},
 		},
+		{
+			name:      "happy path empty metadata component",
+			inputFile: "testdata/happy/empty-metadata-component-bom.json",
+			want:      sbom.SBOM{},
+		},
 		{
 			name:      "sad path invalid purl",
 			inputFile: "testdata/sad/invalid-purl.json",