fix: skip pyproject.toml unless it contains before ensuring lockfiles

jeremylong · May 22, 2024 · ff963b4 · ff963b4
1 parent fccbd6f
commit ff963b4
Show file tree

Hide file tree

Showing 3 changed files with 28 additions and 6 deletions.
diff --git a/core/src/main/java/org/owasp/dependencycheck/analyzer/PoetryAnalyzer.java b/core/src/main/java/org/owasp/dependencycheck/analyzer/PoetryAnalyzer.java
@@ -147,18 +147,19 @@ protected void analyzeDependency(Dependency dependency, Engine engine) throws An
         //do not report on the build file itself
         engine.removeDependency(dependency);
 
+        final Toml result = new Toml().read(dependency.getActualFile());
         if (PYPROJECT_TOML.equals(dependency.getActualFile().getName())) {
+            if (result.getTable("tool.poetry") == null) {
+                LOGGER.debug("skipping {} as it does not contain `tool.poetry`", dependency.getDisplayFileName());
+                return;
+            }
+
             final File parentPath = dependency.getActualFile().getParentFile();
             ensureLock(parentPath);
             //exit as we can't analyze pyproject.toml - insufficient version information
             return;
         }
 
-        final Toml result = new Toml().read(dependency.getActualFile());
-        if (PYPROJECT_TOML.equals(dependency.getActualFile().getName()) && result.getTables("tool.poetry") == null) {
-            LOGGER.debug("skipping {} as it does not contain `tool.poetry`", dependency.getDisplayFileName());
-            return;
-        }
         final List<Toml> projectsLocks = result.getTables("package");
         if (projectsLocks == null) {
             return;

diff --git a/core/src/test/java/org/owasp/dependencycheck/analyzer/PoetryAnalyzerTest.java b/core/src/test/java/org/owasp/dependencycheck/analyzer/PoetryAnalyzerTest.java
@@ -73,9 +73,16 @@ public void testPoetryLock() throws AnalysisException {
         assertTrue("Expeced to find PyYAML", found);
     }
 
-    @Test(expected = AnalysisException.class)
+    @Test
     public void testPyprojectToml() throws AnalysisException {
         final Dependency result = new Dependency(BaseTest.getResourceAsFile(this, "python-myproject-toml/pyproject.toml"));
+        //returns with no error.
+        analyzer.analyze(result, engine);
+    }
+
+    @Test(expected = AnalysisException.class)
+    public void testPoetryToml() throws AnalysisException {
+        final Dependency result = new Dependency(BaseTest.getResourceAsFile(this, "python-poetry-toml/pyproject.toml"));
         //causes an exception.
         analyzer.analyze(result, engine);
     }

diff --git a/core/src/test/resources/python-poetry-toml/pyproject.toml b/core/src/test/resources/python-poetry-toml/pyproject.toml
@@ -0,0 +1,14 @@
+[tool.poetry]
+name = "test"
+version = "0.1.0"
+description = ""
+authors = ["Your Name <[email protected]>"]
+readme = "README.md"
+
+[tool.poetry.dependencies]
+python = "^3.7"
+
+
+[build-system]
+requires = ["poetry-core"]
+build-backend = "poetry.core.masonry.api"