Adds components.properties filtering in bom#373
Adds components.properties filtering in bom#373timmyteo wants to merge 4 commits intoowasp-dep-scan:masterfrom
Conversation
Signed-off-by: Tim Messing <141575989+timmyteo@users.noreply.github.com>
Signed-off-by: Tim Messing <141575989+timmyteo@users.noreply.github.com>
Signed-off-by: Tim Messing <141575989+timmyteo@users.noreply.github.com>
| json_dump(vdr_file, bom_data, error_msg=f"Unable to generate VDR file at {vdr_file}", log=LOG) | ||
|
|
||
|
|
||
| def remove_extra_properties(bom_data): |
There was a problem hiding this comment.
@timmyteo Could we refactor this to simplify?
exclude_properties = {"Namespaces", "ImportedModules"}
for i, component in enumerate(bom_data["components"]):
if properties := component.get("properties"):
bom_data["components"][i]["properties"] = [p for p in properties if p.get("name") not in exclude_properties]
return bom_data@prabhu Do we want to make the excluded or allowed properties an optional argument for this function?
There was a problem hiding this comment.
Optional argument sounds good. Support for regex or startswith since blint uses "internal:" prefix
Signed-off-by: Tim Messing <141575989+timmyteo@users.noreply.github.com>
|
@prabhu - I have added regular expression matching for exclusion and made the feature controlled by an optional argument to the command line. @cerrussell - Thanks for the simplified code! If you see a way of further simplifying the new logic added for the regular expression matching, please let me know. |
|
@timmyteo Thank you for the improvements. I am not convinced about a cli argument specifically for this. Perhaps, this could be part of some profile with some trimming happening by default. Let me include these changes in a new PR, since I am also planning to do some refactoring. |
|
This is implemented in a different manner now. |
Implements #362
Filters the desired components.properties objects by name. This implementation uses an exclude list instead of an allow list. Filtering is applied to the file
sbom-universal.vdr.jsonAttached are before and after bom files to demonstrate filtering in action on an example. In this example, the bom only had the property "ImportedModules"
after.json
before.json