{{ site.version }}
diff --git a/docs/_posts/2025-10-07-v4.13.5.md b/docs/_posts/2025-10-07-v4.13.5.md
new file mode 100644
index 000000000..ba0054749
--- /dev/null
+++ b/docs/_posts/2025-10-07-v4.13.5.md
@@ -0,0 +1,97 @@
+---
+title: v4.13.5
+type: patch
+---
+
+**Important Notice:**
+
+Sonatype has started to enforce an authentication requirement for OSS Index.
+
+The [OSS Index analyzer] has historically been enabled by default for Dependency-Track,
+and configuration of credentials for authentication was not strictly necessary.
+
+This has now changed, and users who wish to continue using OSS Index will
+need to register for a free account, and configure credentials in the analyzer's settings.
+
+Please refer to [Sonatype's announcement] for further details.
+
+In the midterm, we'll be looking into enabling OSV per default
+to compensate for this change.
+
+**Fixes:**
+
+* Fix CPE matching not being fully case-insensitive - [apiserver/#5299]
+* Improve detection whether version of a github PURL is a commit SHA or release tag - [apiserver/#5350]
+* Make OSS Index credentials required - [apiserver/#5351]
+* Fix occasional NullPointerException when mirroring the NVD via REST API - [apiserver/#5352]
+* Fix `/api/v1/tag/policy/{uuid}` endpoint returning more tags than are assigned to a policy - [apiserver/#5353]
+* Fix possible failure of NVD mirroring due to corrupted timestamp files - [apiserver/#5354]
+* Fix BOM validation failing due to unrecognized new SPDX license IDs - [apiserver/#5355]
+* Fix new SPDX license IDs not being recognized - [apiserver/#5356]
+* Fix high CPU utilization when watchdog logger is configured - [apiserver/#5357]
+* Fix NullPointerException in GithubMetaAnalyzer when analyzing GitHub Actions - [apiserver/#5359]
+* Fix connection reset during OSV mirroring - [apiserver/#5360]
+* Fix compatibility of custom NuGet repositories with JFrog Artifactory - [apiserver/#5381]
+* Fix custom NuGet repositories not working with Sonatype Nexus - [apiserver/#5381]
+* Fix possible disclosure of private NuGet repository credentials to api.nuget.org - [apiserver/#5381] / [GHSA-83g2-vgqh-mgxc]
+
+For a complete list of changes, refer to the respective GitHub milestones:
+
+* [API server milestone 4.13.5](https://github.com/DependencyTrack/dependency-track/milestone/59?closed=1)
+* [Frontend milestone 4.13.5](https://github.com/DependencyTrack/frontend/milestone/44?closed=1)
+
+We thank all organizations and individuals who contributed to this release, from logging issues to taking part in discussions on GitHub & Slack to testing of fixes.
+
+Special thanks to everyone who contributed code to implement enhancements and fix defects:
+
+[@colinfyfe], [@framayo], [@jonbally], [@snieguu], [@stohrendorf]
+
+###### dependency-track-apiserver.jar
+
+| Algorithm | Checksum |
+|:----------|:---------|
+| SHA-1 | f38abe7b93f7cb88f3bba4c78c30a9ce7dc45c0d |
+| SHA-256 | bf55097e63b46ed16042024636b855f676ba67e6e5824e7da80f3cec863a3f77 |
+
+###### dependency-track-bundled.jar
+
+| Algorithm | Checksum |
+|:----------|:---------|
+| SHA-1 | 5aea8e0662f8aa4d9e53b52c14367c5345602e34 |
+| SHA-256 | 4a373de4d5aca924fb533ebfc7e1eb4fb5a249d81c948bd367a52fa53125a610 |
+
+###### frontend-dist.zip
+
+| Algorithm | Checksum |
+|:----------|:-----------------------------------------------------------------|
+| SHA-1 | e441f28a656b710766a9fd85360872bc9330d14c |
+| SHA-256 | fb67bf767e2142b72dbd226b984a1faee9e491d108ccfd29860a49e0b5b15a12 |
+
+###### Software Bill of Materials (SBOM)
+
+* API Server: [bom.json](https://github.com/DependencyTrack/dependency-track/releases/download/4.13.5/bom.json)
+* Frontend: [bom.json](https://github.com/DependencyTrack/frontend/releases/download/4.13.5/bom.json)
+
+[apiserver/#5299]: https://github.com/DependencyTrack/dependency-track/pull/5299
+[apiserver/#5350]: https://github.com/DependencyTrack/dependency-track/pull/5350
+[apiserver/#5351]: https://github.com/DependencyTrack/dependency-track/pull/5351
+[apiserver/#5352]: https://github.com/DependencyTrack/dependency-track/pull/5352
+[apiserver/#5353]: https://github.com/DependencyTrack/dependency-track/pull/5353
+[apiserver/#5354]: https://github.com/DependencyTrack/dependency-track/pull/5354
+[apiserver/#5355]: https://github.com/DependencyTrack/dependency-track/pull/5355
+[apiserver/#5356]: https://github.com/DependencyTrack/dependency-track/pull/5356
+[apiserver/#5357]: https://github.com/DependencyTrack/dependency-track/pull/5357
+[apiserver/#5359]: https://github.com/DependencyTrack/dependency-track/pull/5359
+[apiserver/#5360]: https://github.com/DependencyTrack/dependency-track/pull/5360
+[apiserver/#5381]: https://github.com/DependencyTrack/dependency-track/pull/5381
+
+[GHSA-83g2-vgqh-mgxc]: https://github.com/DependencyTrack/dependency-track/security/advisories/GHSA-83g2-vgqh-mgxc
+
+[OSS Index analyzer]: {{ site.baseurl }}{% link _docs/datasources/ossindex.md %}
+[Sonatype's announcement]: https://ossindex.sonatype.org/doc/auth-required
+
+[@colinfyfe]: https://github.com/colinfyfe
+[@framayo]: https://github.com/framayo
+[@jonbally]: https://github.com/jonbally
+[@snieguu]: https://github.com/snieguu
+[@stohrendorf]: https://github.com/stohrendorf
diff --git a/pom.xml b/pom.xml
index e1792c949..279112dec 100644
--- a/pom.xml
+++ b/pom.xml
@@ -85,25 +85,25 @@
21
- 4.13.4
+ 4.13.5
${project.parent.version}
4.3.0
0.1.2
- 11.1.0
+ 12.0.0
1.25.3
1.25.3
1.25.3
3.0.0
1.28.0
1.14.0
- 0.144.1
+ 0.145.2
1.0.1
11.0.0
3.1.1
- 2.1.6
+ 2.1.7
20250517
- 4.1.1
- 5.11.4
+ 5.0.0
+ 6.0.0
8.11.4
3.9.11
5.15.0
@@ -129,7 +129,7 @@
42.7.8
false
- 12.1.1
+ 12.1.2
3.11.4
src/main/webapp/**
@@ -581,7 +581,7 @@
io.github.ascopes
protobuf-maven-plugin
- 3.9.1
+ 3.10.1
${lib.protobuf-java.version}
@@ -679,7 +679,7 @@
org.codehaus.mojo
exec-maven-plugin
- 3.6.0
+ 3.6.1
merge-services-bom
diff --git a/src/main/docker/Dockerfile.alpine b/src/main/docker/Dockerfile.alpine
index dc6c1e4c1..138acffe8 100644
--- a/src/main/docker/Dockerfile.alpine
+++ b/src/main/docker/Dockerfile.alpine
@@ -36,7 +36,7 @@ COPY ./target/${WAR_FILENAME} ./
RUN ./create-jre.sh -i "./${WAR_FILENAME}" -o ./jre
-FROM alpine:3.22@sha256:4bcff63911fcb4448bd4fdacec207030997caf25e9bea4045fa6c8c44de311d1
+FROM alpine:3.22@sha256:4b7ce07002c69e8f3d704a9c5d6fd3053be500b7f1c69fc0d80990c2ad8dd412
ARG COMMIT_SHA
ARG APP_VERSION
diff --git a/src/main/java/org/dependencytrack/tasks/repositories/AbstractMetaAnalyzer.java b/src/main/java/org/dependencytrack/tasks/repositories/AbstractMetaAnalyzer.java
index 71ab9fb99..353602681 100644
--- a/src/main/java/org/dependencytrack/tasks/repositories/AbstractMetaAnalyzer.java
+++ b/src/main/java/org/dependencytrack/tasks/repositories/AbstractMetaAnalyzer.java
@@ -85,10 +85,12 @@ public abstract class AbstractMetaAnalyzer implements IMetaAnalyzer {
}
protected void handleUnexpectedHttpResponse(final Logger logger, String url, final int statusCode,
- final String statusText, final Component component) {
+ final String statusText, final Component component) {
logger.debug("HTTP Status : " + statusCode + " " + statusText);
logger.debug(" - RepositoryType URL : " + url);
- logger.debug(" - Package URL : " + component.getPurl().canonicalize());
+ if(component != null && component.getPurl() != null) {
+ logger.debug(" - Package URL : " + component.getPurl().canonicalize());
+ }
Notification.dispatch(new Notification()
.scope(NotificationScope.SYSTEM)
.group(NotificationGroup.REPOSITORY)
@@ -100,7 +102,6 @@ public abstract class AbstractMetaAnalyzer implements IMetaAnalyzer {
protected void handleRequestException(final Logger logger, final Exception e) {
logger.error("Request failure for repository URL: " + baseUrl, e);
- e.printStackTrace();
Notification.dispatch(new Notification()
.scope(NotificationScope.SYSTEM)
.group(NotificationGroup.REPOSITORY)
diff --git a/src/main/java/org/dependencytrack/tasks/repositories/MetaModel.java b/src/main/java/org/dependencytrack/tasks/repositories/MetaModel.java
index e40a95381..dfb480681 100644
--- a/src/main/java/org/dependencytrack/tasks/repositories/MetaModel.java
+++ b/src/main/java/org/dependencytrack/tasks/repositories/MetaModel.java
@@ -51,4 +51,14 @@ public class MetaModel {
public void setPublishedTimestamp(final Date publishedTimestamp) {
this.publishedTimestamp = publishedTimestamp;
}
+
+
+ @Override
+ public String toString() {
+ return "MetaModel{" +
+ "component=" + component +
+ ", latestVersion='" + latestVersion + '\'' +
+ ", publishedTimestamp=" + publishedTimestamp +
+ '}';
+ }
}
diff --git a/src/main/java/org/dependencytrack/tasks/repositories/NugetMetaAnalyzer.java b/src/main/java/org/dependencytrack/tasks/repositories/NugetMetaAnalyzer.java
index 0fa9fa6af..20d9d73f0 100644
--- a/src/main/java/org/dependencytrack/tasks/repositories/NugetMetaAnalyzer.java
+++ b/src/main/java/org/dependencytrack/tasks/repositories/NugetMetaAnalyzer.java
@@ -19,6 +19,8 @@
package org.dependencytrack.tasks.repositories;
import alpine.common.logging.Logger;
+import com.github.benmanes.caffeine.cache.Cache;
+import com.github.benmanes.caffeine.cache.Caffeine;
import com.github.packageurl.PackageURL;
import org.apache.http.HttpStatus;
import org.apache.http.client.methods.CloseableHttpResponse;
@@ -31,50 +33,110 @@ import org.json.JSONArray;
import org.json.JSONObject;
import java.io.IOException;
-import java.text.DateFormat;
-import java.text.ParseException;
-import java.text.SimpleDateFormat;
+import java.time.Instant;
+import java.time.LocalDateTime;
+import java.time.ZoneOffset;
+import java.time.format.DateTimeFormatter;
+import java.time.format.DateTimeParseException;
+import java.time.temporal.TemporalAccessor;
+import java.util.ArrayList;
import java.util.Date;
+import java.util.List;
+import java.util.concurrent.TimeUnit;
/**
* An IMetaAnalyzer implementation that supports Nuget.
+ *
+ * Excludes pre-release and unlisted versions. Pre-release versions will be considered if no stable release exists.
+ * Unlisted versions are excluded because they have been deliberately hidden for a specific safety reason.
+ * To quote the Microsoft Nuget
+ * docs:
+ *
"Unlisting a package version hides it from search and from nuget.org package details page. This allows
+ * existing users of the package to continue using it but reduces new adoption since the package is not visible in
+ * search".
+ * For an example package, see
+ * Microsoft.Data.SqlClient/6.1.0
+ * which states:
+ * This package has been deprecated as it has critical bugs
and
+ * The owner has unlisted this package. This could mean that the package is deprecated, has security
+ * vulnerabilities or shouldn't be used anymore.
+ * Dependency Track won't prevent users from using an unlisted package, but it won't encourage it.
+ *
+ * We do not use the PackageBaseAddress resource to retrieve version information - it would be faster and simpler
+ * but, to quote Microsoft:
+ *
This list contains both listed and unlisted package versions.
+ * Artifactory doesn't provide the PackageBaseAddress resource,
+ * despite Microsoft stating it is required. JFrog
+ * state here it is not supported
+ * as at September 2025./a>.
+ *
+ * Artifactory also doesn't provide "published" data as of August 2025 so no dates will be included in the response from
+ * those feeds. Other third party feeds may also omit the published dates.
*
* @author Steve Springett
* @since 3.4.0
*/
public class NugetMetaAnalyzer extends AbstractMetaAnalyzer {
- public static final DateFormat[] SUPPORTED_DATE_FORMATS = new DateFormat[]{
- new SimpleDateFormat("yyyy-MM-dd'T'HH:mm:ss.SSSXXX"),
- new SimpleDateFormat("yyyy-MM-dd'T'HH:mm:ss'Z'"),
- new SimpleDateFormat("yyyy-MM-dd'T'HH:mm:ss")
- };
private static final Logger LOGGER = Logger.getLogger(NugetMetaAnalyzer.class);
- private static final String DEFAULT_BASE_URL = "https://api.nuget.org";
- private static final String INDEX_URL = "/v3/index.json";
+ private static final String DEFAULT_BASE_URL = "https://api.nuget.org/v3/index.json";
+ private static final String NUGET_KEY_UPPER = "upper";
+ private static final String NUGET_KEY_ITEMS = "items";
- private static final String DEFAULT_VERSION_QUERY_ENDPOINT = "/v3-flatcontainer/%s/index.json";
-
- private static final String DEFAULT_REGISTRATION_ENDPOINT = "/v3/registration5-gz-semver2/%s/%s.json";
+ private static final Cache REPO_REGISTRATION_URL_CACHE = Caffeine.newBuilder()
+ .maximumSize(100)
+ .expireAfterWrite(15, TimeUnit.MINUTES)
+ .build();
- private String versionQueryUrl;
+ private String serviceIndexUrl;
+ private String registrationsBaseUrl = "";
- private String registrationUrl;
NugetMetaAnalyzer() {
this.baseUrl = DEFAULT_BASE_URL;
-
- // Set defaults that work with NuGet.org just in case the index endpoint is not available
- this.versionQueryUrl = baseUrl + DEFAULT_VERSION_QUERY_ENDPOINT;
- this.registrationUrl = baseUrl + DEFAULT_REGISTRATION_ENDPOINT;
}
+
+ /**
+ * Sets the repository base URL which will then be used to retrieve and parse the service index. If the user has
+ * specified a repo URL ending with index.json, it should be considered "fully qualified" and used as is to maximise
+ * compatability with non-nuget.org repos such as Artifactory. If not, preserve the previous Dependency Track
+ * behaviour of appending the nuget.org index to the supplied URL.
+ * @param baseUrl the base URL to the repository
+ */
@Override
public void setRepositoryBaseUrl(String baseUrl) {
super.setRepositoryBaseUrl(baseUrl);
- initializeEndpoints();
+ if (baseUrl.toLowerCase().endsWith("index.json")) {
+ this.serviceIndexUrl = baseUrl;
+ } else {
+ this.serviceIndexUrl = stripTrailingSlash(baseUrl) + "/v3/index.json";
+ }
+
+ this.setRegistrationsBaseUrl(REPO_REGISTRATION_URL_CACHE.get(this.serviceIndexUrl, key -> findRegistrationsBaseUrl()));
+ }
+
+ /**
+ * Sets the RegistrationsBaseUrl to be used to retrieve package metadata. This is primarily intended
+ * for testing as setRepositoryBaseUrl should find and set the best URL automatically. Call this method AFTER
+ * setRepositoryBaseUrl to ensure your value is not overridden.
+ *
+ * @param registrationsBaseUrlStem Registrations URL to be set
+ */
+ public void setRegistrationsBaseUrl(String registrationsBaseUrlStem) {
+ if(registrationsBaseUrlStem == null || registrationsBaseUrlStem.isBlank()) {
+ return;
+ }
+ this.registrationsBaseUrl = stripTrailingSlash(registrationsBaseUrlStem) + "/%s/%s.json";
+ }
+
+ private static String stripTrailingSlash(String input) {
+ if (input == null || input.isBlank()) {
+ return input;
+ }
+ return input.endsWith("/") ? input.substring(0, input.length() - 1) : input;
}
/**
@@ -95,117 +157,313 @@ public class NugetMetaAnalyzer extends AbstractMetaAnalyzer {
* {@inheritDoc}
*/
public MetaModel analyze(final Component component) {
+
+ if(component == null) {
+ throw new IllegalArgumentException("Component cannot be null");
+ }
+
final MetaModel meta = new MetaModel(component);
if (component.getPurl() != null) {
- if (performVersionCheck(meta, component)) {
- performLastPublishedCheck(meta, component);
- }
+ LOGGER.debug("Analyzing component: " + component.getPurl().getName() + " (Internal: " + component.isInternal() + ")");
+ performVersionCheck(meta, component);
}
+ LOGGER.debug("Results: " + meta);
return meta;
}
- private boolean performVersionCheck(final MetaModel meta, final Component component) {
- final String url = String.format(versionQueryUrl, urlEncode(component.getPurl().getName().toLowerCase()));
- try (final CloseableHttpResponse response = processHttpRequest(url)) {
- if (response.getStatusLine().getStatusCode() == HttpStatus.SC_OK) {
- if (response.getEntity() != null) {
- String responseString = EntityUtils.toString(response.getEntity());
- var jsonObject = new JSONObject(responseString);
- final JSONArray versions = jsonObject.getJSONArray("versions");
+ /**
+ * Attempts to find the latest version of the supplied component and return its published date, if one exists.
+ * Ignores pre-release and unlisted versions.
+ * @param meta {@link MetaModel} to be updated with detected version information
+ * @param component {@link Component} to be looked up in the NuGet repo
+ */
+ private void performVersionCheck(final MetaModel meta, final Component component) {
- String latest = findLatestVersion(filterPreReleaseVersions(versions));
- if (latest == null) {
- latest = findLatestVersion(versions);
- }
- meta.setLatestVersion(latest);
- }
- return true;
- } else {
- handleUnexpectedHttpResponse(LOGGER, url, response.getStatusLine().getStatusCode(), response.getStatusLine().getReasonPhrase(), component);
+ if (registrationsBaseUrl == null || registrationsBaseUrl.isBlank()) {
+ LOGGER.debug("Registration URL not defined for repo " + this.serviceIndexUrl + " - skipping version check");
+ return;
+ }
+
+ LOGGER.debug("Performing version check for: " + component.getPurl().getName() + " using " + registrationsBaseUrl);
+
+ try {
+ final var packageRegistrationRoot = fetchPackageRegistrationIndex(registrationsBaseUrl, component);
+
+ if(packageRegistrationRoot == null) {
+ return;
}
+
+ // Search for a release version first...
+ AbridgedNugetCatalogEntry abridgedNugetCatalogEntry = findLatestViaRegistrations(packageRegistrationRoot, false);
+
+ // ... then try again if none found, looking for the latest pre-release version
+ if (abridgedNugetCatalogEntry == null) {
+ abridgedNugetCatalogEntry = findLatestViaRegistrations(packageRegistrationRoot, true);
+ }
+
+ if (abridgedNugetCatalogEntry != null) {
+ meta.setLatestVersion(abridgedNugetCatalogEntry.getVersion());
+ meta.setPublishedTimestamp(abridgedNugetCatalogEntry.getPublishedTimestamp());
+ }
+
} catch (IOException e) {
handleRequestException(LOGGER, e);
} catch (Exception ex) {
throw new MetaAnalyzerException(ex);
}
- return false;
}
- private String findLatestVersion(JSONArray versions) {
+ /**
+ * Retrieves the package registration index for the specified component
+ * (e.g. https://api.nuget.org/v3/registration5-gz-semver2/microsoft.data.sqlclient/index.json) and converts to JSON
+ * @param registrationsBaseUrl Registration base URL to look up package info
+ * @param component Component for which retrieve package registration data should be retrieved
+ * @return JSONObject containing package data if found or null if data not found
+ * @throws IOException if HTTP request errors
+ */
+ private JSONObject fetchPackageRegistrationIndex(final String registrationsBaseUrl, final Component component) throws IOException {
+ final String idLower = urlEncode(component.getPurl().getName().toLowerCase());
+ final String indexUrl = String.format(registrationsBaseUrl, idLower, "index");
- if (versions.isEmpty()) {
+ try (final CloseableHttpResponse resp = processHttpRequest(indexUrl)) {
+ if (resp.getStatusLine().getStatusCode() != HttpStatus.SC_OK || resp.getEntity() == null) {
+ handleUnexpectedHttpResponse(LOGGER, indexUrl, resp.getStatusLine().getStatusCode(), resp.getStatusLine().getReasonPhrase(), component);
+ return null;
+ }
+ return new JSONObject(EntityUtils.toString(resp.getEntity()));
+ }
+ }
+
+ /**
+ * Parses the NuGet Registrations to find latest version information. Handles both inline items and paged items.
+ * Sorts pages in descending order by the upper version number - if a listed, final version can be found in that
+ * page, it will be returned or pages will be searched in descending order until a match is found.
+ * @param registrationData Registrations to be searched
+ * @return Version metadata if a suitable version found, or null if not
+ * @throws IOException if network error occurs
+ */
+ private AbridgedNugetCatalogEntry findLatestViaRegistrations(final JSONObject registrationData, final boolean includePreRelease) throws IOException {
+
+ final JSONArray pages = registrationData == null ? null : registrationData.optJSONArray(NUGET_KEY_ITEMS);
+
+ if (pages == null || pages.isEmpty()) {
return null;
}
- ComparableVersion latestVersion = new ComparableVersion(versions.getString(0));
-
- for (int i = 1; i < versions.length(); i++) {
- ComparableVersion version = new ComparableVersion(versions.getString(i));
- if (version.compareTo(latestVersion) > 0) {
- latestVersion = version;
+ // Build a list of pages sorted by descending "upper" property.
+ final List pageUpperBounds = new ArrayList<>();
+ for (int i = 0; i < pages.length(); i++) {
+ final JSONObject page = pages.optJSONObject(i);
+ if (page != null && page.has(NUGET_KEY_UPPER)) {
+ pageUpperBounds.add(page);
}
}
- return latestVersion.toString();
+ // Sort upper page bounds in descending order to get newest page first e.g, [ "6.1.0", "5.1.0" ]
+ pageUpperBounds.sort((pageOne, pageTwo) -> {
+ final ComparableVersion pageOneUpper = new ComparableVersion(pageOne.optString(NUGET_KEY_UPPER, "0"));
+ final ComparableVersion pageTwoUpper = new ComparableVersion(pageTwo.optString(NUGET_KEY_UPPER, "0"));
+ return pageTwoUpper.compareTo(pageOneUpper); // descending
+ });
+
+ for (final JSONObject page : pageUpperBounds) {
+ try {
+ final JSONArray leaves = resolveLeaves(page);
+ final AbridgedNugetCatalogEntry bestOnPage = findHighestVersionFromLeaves(leaves, includePreRelease);
+ if (bestOnPage != null) {
+ return bestOnPage;
+ }
+ } catch (MetaAnalyzerException ex) {
+ // Reporting handled in resolveLeaves - return null to avoid returning incorrect version from any page
+ return null;
+ }
+ }
+
+ // No suitable version found
+ return null;
}
- private JSONArray filterPreReleaseVersions(JSONArray versions) {
- JSONArray filteredVersions = new JSONArray();
- for (int i = 0; i < versions.length(); i++) {
- if (!versions.getString(i).contains("-")) {
- filteredVersions.put(versions.getString(i));
- }
+ /**
+ * Parse the page JSON to find item leaves, retrieving data from the repo if needed. Returns null if neither
+ * inline items nor a fetchable @id exist/succeed.
+ * @param page Page to be parsed
+ * @return JSONArray containing leaf data if available, null if not
+ * @throws IOException if network error occurs
+ * @throws MetaAnalyzerException if the repo returns an unexpected result
+ */
+ private JSONArray resolveLeaves(final JSONObject page) throws IOException, MetaAnalyzerException {
+ if (page == null) {
+ return null;
}
- return filteredVersions;
- }
- private boolean performLastPublishedCheck(final MetaModel meta, final Component component) {
- final String url = String.format(registrationUrl, urlEncode(component.getPurl().getName().toLowerCase()), urlEncode(meta.getLatestVersion()));
- try (final CloseableHttpResponse response = processHttpRequest(url)) {
- if (response.getStatusLine().getStatusCode() == HttpStatus.SC_OK) {
- if (response.getEntity() != null) {
- String stringResponse = EntityUtils.toString(response.getEntity());
- if (!stringResponse.equalsIgnoreCase("") && !stringResponse.equalsIgnoreCase("{}")) {
- JSONObject jsonResponse = new JSONObject(stringResponse);
- final String updateTime = jsonResponse.optString("published", null);
- if (updateTime != null) {
- meta.setPublishedTimestamp(parseUpdateTime(updateTime));
- }
- return true;
- }
- }
+ final JSONArray inline = page.optJSONArray(NUGET_KEY_ITEMS);
+ if (inline != null && !inline.isEmpty()) {
+ LOGGER.trace("Processing inline catalog entries");
+ return inline;
+ }
+
+ final String pageUrl = page.optString("@id", null);
+ if (pageUrl == null || pageUrl.isBlank()) {
+ return null;
+ }
+
+ LOGGER.trace("Retrieving catalog entry page " + pageUrl);
+ try (final CloseableHttpResponse resp = processHttpRequest(pageUrl)) {
+ if (resp.getStatusLine().getStatusCode() == HttpStatus.SC_OK && resp.getEntity() != null) {
+ final var pageJson = new JSONObject(EntityUtils.toString(resp.getEntity()));
+ return pageJson.optJSONArray(NUGET_KEY_ITEMS);
} else {
- handleUnexpectedHttpResponse(LOGGER, url, response.getStatusLine().getStatusCode(), response.getStatusLine().getReasonPhrase(), component);
+ handleUnexpectedHttpResponse(LOGGER, pageUrl, resp.getStatusLine().getStatusCode(), resp.getStatusLine().getReasonPhrase(), null);
+ throw new MetaAnalyzerException("Could not retrieve catalog entry page when processing " + pageUrl);
}
- } catch (IOException e) {
- handleRequestException(LOGGER, e);
- } catch (Exception ex) {
- throw new MetaAnalyzerException(ex);
}
- return false;
}
- private void initializeEndpoints() {
- final String url = baseUrl + INDEX_URL;
- try {
- try (final CloseableHttpResponse response = processHttpRequest(url)) {
- if (response.getStatusLine().getStatusCode() == HttpStatus.SC_OK) {
- if(response.getEntity()!=null){
- String responseString = EntityUtils.toString(response.getEntity());
- JSONObject responseJson = new JSONObject(responseString);
- final JSONArray resources = responseJson.getJSONArray("resources");
- final JSONObject packageBaseResource = findResourceByType(resources, "PackageBaseAddress");
- final JSONObject registrationsBaseResource = findResourceByType(resources, "RegistrationsBaseUrl/Versioned");
- if (packageBaseResource != null && registrationsBaseResource != null) {
- versionQueryUrl = packageBaseResource.getString("@id") + "%s/index.json";
- registrationUrl = registrationsBaseResource.getString("@id") + "%s/%s.json";
- }
- }
- }
+ /**
+ * Scan the supplied leaves to extract the latest listed version. NuGet does not guarantee release order
+ * so scan the entire array although, anecdotally, the collection does generally appear to be in ascending order
+ * @param leaves Items to be scanned
+ * @param includePreRelease include pre-release versions in latest version lookup
+ * @return {@link AbridgedNugetCatalogEntry containing the latest version found in the leaves collection
+ */
+ private AbridgedNugetCatalogEntry findHighestVersionFromLeaves(final JSONArray leaves, final boolean includePreRelease) {
+
+ if (leaves == null || leaves.isEmpty()) {
+ return null;
+ }
+
+ AbridgedNugetCatalogEntry bestEntry = null;
+ ComparableVersion newestVersionFound = null;
+
+ for (int i = 0; i < leaves.length(); i++) {
+ final JSONObject leaf = leaves.optJSONObject(i);
+ AbridgedNugetCatalogEntry entry = null;
+
+ if (leaf.has("catalogEntry")) {
+ entry = parseCatalogEntry(leaf.optJSONObject("catalogEntry"));
+ }
+
+ if (entry == null || entry.getVersion() == null || (isPreRelease(entry.getVersion()) && !includePreRelease)) {
+ continue;
+ }
+
+ final ComparableVersion entryVersion = new ComparableVersion(entry.getVersion());
+ if (newestVersionFound == null || entryVersion.compareTo(newestVersionFound) > 0) {
+ newestVersionFound = entryVersion;
+ bestEntry = entry;
+ }
+ }
+
+ return bestEntry;
+ }
+
+ /**
+ * Parse a single catalog entry to extract the version and published information. Could be extended to include other
+ * fields (such as listed) if required. Returns null immediately if the entry is unlisted.
+ * @param catalogEntry Catalog entry to be parsed
+ * @return {@link AbridgedNugetCatalogEntry} if version is valid, null if not
+ */
+ private AbridgedNugetCatalogEntry parseCatalogEntry(final JSONObject catalogEntry) {
+
+ // Listed is optional so assume package is listed unless explicitly hidden
+ boolean listed = catalogEntry.optBoolean("listed", true);
+
+ if(!listed) {
+ return null;
+ }
+
+ var version = catalogEntry.optString("version", null);
+ if (version == null || version.isBlank()) {
+ return null;
+ }
+
+ AbridgedNugetCatalogEntry entry = new AbridgedNugetCatalogEntry();
+ entry.setVersion(version);
+
+ var updateTime = catalogEntry.optString("published", null);
+ if (updateTime != null) {
+ entry.setPublishedTimestamp(parseUpdateTime(updateTime));
+ }
+
+ return entry;
+ }
+
+ /**
+ * NuGet considers a version string with any suffix after a hyphen to be pre-release according to
+ * the documentation. This method could be expanded if we need to cover other rules.
+ * @param version Version string to be tested
+ * @return True if version matches pre-release conventions, false otherwise
+ */
+ private boolean isPreRelease(final String version) {
+ return version.contains("-");
+ }
+
+ /**
+ * Connects to the NuGet repo, retrieves the service index and attempts to find the best RegistrationsBaseUrl
+ * @return RegistrationsBaseUrl if found, null otherwise
+ */
+ private String findRegistrationsBaseUrl() {
+
+ JSONObject responseJson = null;
+
+ try (final CloseableHttpResponse resp = processHttpRequest(this.serviceIndexUrl)) {
+ if (resp.getStatusLine().getStatusCode() == HttpStatus.SC_OK && resp.getEntity() != null) {
+ responseJson = new JSONObject(EntityUtils.toString(resp.getEntity()));
+ } else {
+ handleUnexpectedHttpResponse(LOGGER, this.serviceIndexUrl, resp.getStatusLine().getStatusCode(), resp.getStatusLine().getReasonPhrase(), null);
+ throw new MetaAnalyzerException("Could not initialize NugetMetaAnalyzer - unexpected response from NuGet service. Response code was " + resp.getStatusLine().getStatusCode() + ".");
}
} catch (IOException e) {
handleRequestException(LOGGER, e);
}
+
+ if (responseJson != null) {
+ final JSONArray resources = responseJson.optJSONArray("resources");
+ final String regBaseUrl = extractRegistrationBaseUrlFromJson(resources);
+ if (regBaseUrl != null) {
+ LOGGER.debug("RegistrationsBaseUrl selected: " + regBaseUrl);
+ return regBaseUrl;
+ }
+ }
+
+ LOGGER.debug("Could not find the RegistrationsBaseUrl at " + this.serviceIndexUrl);
+ return null;
+ }
+
+ /**
+ * Attempts to find the "best" RegistrationsBaseUrl from the NuGet service index preferring SemVer 2 with
+ * compression, SemVer 2 without compression then non-compressed, non-SemVer2.
+ * See MS
+ * spec states that ISO8601 should be used but that standard is flexible when it comes to timezone info.
+ *
+ * The ISO_INSTANT formatter handles time with timezone and milliseconds ("yyyy-MM-dd'T'HH:mm:ss.SSSXXX") and
+ * UTC-only ("yyyy-MM-dd'T'HH:mm:ss'Z'"). A fallback LocalDateTime parser handles cases without a timezone
+ * ("yyyy-MM-dd'T'HH:mm:ss").
+ * @param nugetDateTimeString Date time string in one of NuGet's permitted formats
+ * @return Date if input could be parsed, null if date could not be parsed
+ */
+ protected Date parseUpdateTime(String nugetDateTimeString) {
+ if (nugetDateTimeString == null) {
return null;
}
- // NuGet repositories may use differing date formats, so we try a few date formats that are commonly used until the right one is found.
- for (DateFormat dateFormat : SUPPORTED_DATE_FORMATS) {
+ try {
+ TemporalAccessor ta = DateTimeFormatter.ISO_INSTANT.parse(nugetDateTimeString);
+ return Date.from(Instant.from(ta));
+ } catch (DateTimeParseException e) {
try {
- return dateFormat.parse(updateTime);
- } catch (ParseException e) {
- LOGGER.warn("An error occurred while parsing upload time for a NuGet component - Repo returned: " + updateTime);
+ LocalDateTime localDateTime = LocalDateTime.parse(nugetDateTimeString);
+ return Date.from(localDateTime.atOffset(ZoneOffset.UTC).toInstant());
+ } catch (DateTimeParseException e2) {
+ return null;
}
}
-
- return null;
}
+
+ /**
+ * Internal class to collate useful version information from the larger NuGet catalog entry
+ */
+ private static class AbridgedNugetCatalogEntry {
+ private String version;
+ private Date publishedTimestamp;
+
+ private String getVersion() {
+ return version;
+ }
+
+ private void setVersion(String version) {
+ this.version = version;
+ }
+
+ private Date getPublishedTimestamp() {
+ return publishedTimestamp;
+ }
+
+ private void setPublishedTimestamp(Date publishedTimestamp) {
+ this.publishedTimestamp = publishedTimestamp;
+ }
+
+ @Override
+ public String toString() {
+ return "AbridgedNugetCatalogEntry{" +
+ "version='" + version + '\'' +
+ ", publishedTimestamp=" + publishedTimestamp +
+ '}';
+ }
+ }
+
}
diff --git a/src/test/java/org/dependencytrack/tasks/repositories/NugetMetaAnalyzerTest.java b/src/test/java/org/dependencytrack/tasks/repositories/NugetMetaAnalyzerTest.java
index 5d9598969..c2537b21f 100644
--- a/src/test/java/org/dependencytrack/tasks/repositories/NugetMetaAnalyzerTest.java
+++ b/src/test/java/org/dependencytrack/tasks/repositories/NugetMetaAnalyzerTest.java
@@ -22,148 +22,550 @@ import com.github.packageurl.PackageURL;
import org.apache.http.HttpHeaders;
import org.dependencytrack.model.Component;
import org.dependencytrack.model.RepositoryType;
-import org.junit.jupiter.api.AfterAll;
-import org.junit.jupiter.api.Assertions;
-import org.junit.jupiter.api.BeforeAll;
-import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.*;
import org.junit.jupiter.params.ParameterizedTest;
-import org.junit.jupiter.params.provider.Arguments;
-import org.junit.jupiter.params.provider.MethodSource;
+import org.junit.jupiter.params.provider.ValueSource;
import org.mockserver.client.MockServerClient;
import org.mockserver.integration.ClientAndServer;
-
-import java.util.stream.Stream;
+import org.mockserver.model.Header;
import java.nio.file.Files;
import java.nio.file.Paths;
-import java.text.DateFormat;
-import java.text.ParseException;
-import java.text.SimpleDateFormat;
+import java.util.ArrayList;
import java.util.Date;
+import java.util.List;
-import static org.dependencytrack.tasks.repositories.NugetMetaAnalyzer.SUPPORTED_DATE_FORMATS;
import static org.mockserver.model.HttpRequest.request;
import static org.mockserver.model.HttpResponse.response;
class NugetMetaAnalyzerTest {
+ public static final String LOCALHOST_REPO_INDEX = "http://localhost:1080/artifactory/api/nuget/v3/nuget-repo/index.json";
private static ClientAndServer mockServer;
@BeforeAll
- public static void beforeClass() {
+ static void beforeClass() throws Exception {
mockServer = ClientAndServer.startClientAndServer(1080);
- }
- @AfterAll
- public static void afterClass() {
- mockServer.stop();
- }
-
- // This test is to check if the analyzer is:
- // * excluding pre-release versions if a release version exists,
- // * including pre-release versions if no release version exists
- // The test is transient depending on the current version of the package
- // retrieved from the repository at the time of running.
- // For example, when it was created, the latest released version of:
- // * Microsoft.Extensions.DependencyInjection was 9.0.0-preview.1.24080.9
- // * OpenTelemetry.Instrumentation.SqlClient was 1.12.0-beta.2 (no release version exists)
- @ParameterizedTest
- @MethodSource("testAnalyzerData")
- void testAnalyzer(String purl, boolean isLatestVersionPreRelease) throws Exception {
- Component component = new Component();
- component.setPurl(new PackageURL(purl));
- NugetMetaAnalyzer analyzer = new NugetMetaAnalyzer();
-
- analyzer.setRepositoryBaseUrl("https://api.nuget.org");
- MetaModel metaModel = analyzer.analyze(component);
-
- Assertions.assertTrue(analyzer.isApplicable(component));
- Assertions.assertEquals(RepositoryType.NUGET, analyzer.supportedRepositoryType());
- Assertions.assertNotNull(metaModel.getLatestVersion());
- Assertions.assertNotNull(metaModel.getPublishedTimestamp());
- Assertions.assertEquals(isLatestVersionPreRelease, metaModel.getLatestVersion().contains("-"));
- }
-
- static Stream testAnalyzerData() {
- return Stream.of(
- Arguments.of("pkg:nuget/CycloneDX.Core@5.4.0", false),
- Arguments.of("pkg:nuget/Microsoft.Extensions.DependencyInjection@8.0.0", false),
- Arguments.of("pkg:nuget/Microsoft.Extensions.DependencyInjection@8.0.0-beta.21301.5", false),
- Arguments.of("pkg:nuget/OpenTelemetry.Instrumentation.SqlClient@1.12.0-beta.1", true)
+ setupMockServerClient(
+ "/artifactory/api/nuget/v3/nuget-repo/index.json",
+ "/unit/tasks/repositories/https---localhost-nuget-artifactory.v3-index.json",
+ null, "application/json", 200
);
}
- @Test
- void testAnalyzerWithPrivatePackageRepository() throws Exception {
- String mockIndexResponse = readResourceFileToString("/unit/tasks/repositories/https---localhost-1080-v3-index.json");
- new MockServerClient("localhost", mockServer.getPort())
- .when(
- request()
- .withMethod("GET")
- .withPath("/v3/index.json")
- )
- .respond(
- response()
- .withStatusCode(200)
- .withHeader(HttpHeaders.CONTENT_TYPE, "application/json")
- .withBody(mockIndexResponse)
- );
- String encodedBasicHeader = "Basic OnBhc3N3b3Jk";
-
- String mockVersionResponse = readResourceFileToString("/unit/tasks/repositories/https---localhost-1080-v3-flat2" +
- "-nunitprivate-index.json");
- new MockServerClient("localhost", mockServer.getPort())
- .when(
- request()
- .withMethod("GET")
- .withPath("/v3/flat2/nunitprivate/index.json")
- .withHeader("Authorization", encodedBasicHeader)
- )
- .respond(
- response()
- .withStatusCode(200)
- .withHeader(HttpHeaders.CONTENT_TYPE, "application/json")
- .withBody(mockVersionResponse)
- );
-
- String mockRegistrationResponse = readResourceFileToString("/unit/tasks/repositories/https---localhost-1080-v3" +
- "-registrations2-nunitprivate-502.json");
- new MockServerClient("localhost", mockServer.getPort())
- .when(
- request()
- .withMethod("GET")
- .withPath("/v3/registrations2-semver2/nunitprivate/5.0.2.json")
- .withHeader("Authorization", encodedBasicHeader)
- )
- .respond(
- response()
- .withStatusCode(200)
- .withHeader(HttpHeaders.CONTENT_TYPE, "application/json")
- .withBody(mockRegistrationResponse)
- );
- Component component = new Component();
- component.setPurl(new PackageURL("pkg:nuget/NUnitPrivate@5.0.1"));
- NugetMetaAnalyzer analyzer = new NugetMetaAnalyzer();
- analyzer.setRepositoryUsernameAndPassword(null, "password");
- analyzer.setRepositoryBaseUrl("http://localhost:1080");
- MetaModel metaModel = analyzer.analyze(component);
- Assertions.assertEquals("5.0.2", metaModel.getLatestVersion());
- Assertions.assertNotNull(metaModel.getPublishedTimestamp());
+ private static void setupMockServerClient(
+ String path,
+ String responseFile,
+ String encodedBasicHeader
+ ) throws Exception {
+ setupMockServerClient(path, responseFile, encodedBasicHeader, "application/json", 200);
}
- @Test
- void testPublishedDateTimeFormat() throws ParseException {
- Date dateParsed = null;
- for (DateFormat dateFormat : SUPPORTED_DATE_FORMATS) {
- try {
- dateParsed = dateFormat.parse("1900-01-01T00:00:00+00:00");
- } catch (ParseException e) {}
+ private static void setupMockServerClient(
+ String path,
+ String responseFile,
+ String encodedBasicHeader,
+ String contentType,
+ int statusCode
+ ) throws Exception {
+
+ List headers = new ArrayList<>();
+ if (encodedBasicHeader != null) {
+ headers.add(new Header("Authorization", encodedBasicHeader));
}
- DateFormat dateFormat = new SimpleDateFormat("yyyy-MM-dd'T'HH:mm:ss");
- Assertions.assertEquals(dateFormat.parse("1900-01-01T00:00:00+00:00"), dateParsed);
+
+ new MockServerClient("localhost", 1080)
+ .when(
+ request()
+ .withMethod("GET")
+ .withPath(path)
+ .withHeaders(headers)
+ )
+ .respond(
+ response()
+ .withStatusCode(statusCode)
+ .withHeader(HttpHeaders.CONTENT_TYPE, contentType)
+ .withBody(Files.readString(Paths.get(NugetMetaAnalyzerTest.class.getResource(responseFile).toURI())))
+ );
}
- private String readResourceFileToString(String fileName) throws Exception {
- return Files.readString(Paths.get(getClass().getResource(fileName).toURI()));
+ @AfterAll
+ static void afterClass() {
+ mockServer.stop();
}
+
+ /**
+ * Various tests to confirm error handling behaviour when, e.g. the repo or package cannot
+ * be found. The analyzer should still return a MetaModel in these cases with null version and
+ * published. The analyzer should NOT crash.
+ */
+ @Nested
+ class ErrorHandlingTests {
+
+ @Test
+ void testBaseUrlNotFoundBehaviourWhenSettingRepoUrl() {
+ Assertions.assertDoesNotThrow(() -> {
+ var analyzer = new NugetMetaAnalyzer();
+ analyzer.setRepositoryBaseUrl("http://no-such-api.this-host-does-not-exist-nuget-repo.invalid");
+ });
+ }
+
+ @Test
+ void testBaseUrlNotFoundBehaviourWhenCallingAnalyze() {
+ Assertions.assertDoesNotThrow(() -> {
+ var analyzer = new NugetMetaAnalyzer();
+ analyzer.setRepositoryBaseUrl("http://no-such-api.this-host-does-not-exist-nuget-repo.invalid");
+
+ Component component = new Component();
+ component.setPurl(new PackageURL("pkg:nuget/CycloneDX.Core@5.4.0"));
+ MetaModel metaModel = analyzer.analyze(component);
+
+ Assertions.assertTrue(analyzer.isApplicable(component));
+ assertMetaModelExistsButEmpty(analyzer, metaModel);
+ });
+ }
+
+ @Test
+ void testRepoValidButPackageNotFoundBehaviour() throws Exception {
+
+ setupMockServerClient(
+ "/artifactory/api/nuget/v3/nuget-repo/registration-semver2/testing.no.such.package/index.json",
+ "/unit/tasks/repositories/https---nuget.org.no-such-package.xml",
+ null,
+ "application/xml",
+ 404
+ );
+
+ Component component = new Component();
+ component.setPurl(new PackageURL("pkg:nuget/Testing.No.Such.Package@8.0.0"));
+
+ var analyzer = new NugetMetaAnalyzer();
+ analyzer.setRepositoryBaseUrl(LOCALHOST_REPO_INDEX);
+ MetaModel metaModel = analyzer.analyze(component);
+
+ assertMetaModelExistsButEmpty(analyzer, metaModel);
+ }
+
+ @Test
+ void testErrorBetweenPageRequestsReturnsNullData() throws Exception {
+
+ var analyzer = new NugetMetaAnalyzer();
+ analyzer.setRepositoryBaseUrl(LOCALHOST_REPO_INDEX);
+
+ var component = new Component();
+ component.setName("Microsoft.Data.SqlClient");
+ component.setPurl(new PackageURL("pkg:nuget/Microsoft.Data.SqlClient@5.1.0"));
+
+ mockServer.reset();
+
+ setupMockServerClient(
+ "/artifactory/api/nuget/v3/nuget-repo/index.json",
+ "/unit/tasks/repositories/https---localhost-nuget-artifactory.v3-index.json",
+ null, "application/json", 200
+ );
+
+ setupMockServerClient(
+ "/artifactory/api/nuget/v3/nuget-repo/registration-semver2/microsoft.data.sqlclient/index.json",
+ "/unit/tasks/repositories/https---localhost-nuget-artifactory.registration-semver2.mds.index.json",
+ null
+ );
+
+ // Page 2
+ new MockServerClient("localhost", 1080)
+ .when(
+ request()
+ .withMethod("GET")
+ .withPath("/artifactory/api/nuget/v3/nuget-repo/registration-semver2/microsoft.data.sqlclient/page/5.1.1/6.1.0.json")
+ )
+ .respond(
+ response()
+ .withStatusCode(401)
+ .withHeader(HttpHeaders.CONTENT_TYPE, "application/xml")
+ .withBody("TestErrorNot Authorised BlobNotFoundThe specified blob does not exist.
+ RequestId:21575f5c-3b02-45a4-81a6-5e09fd2099db
+ Time:2025-08-12T23:22:21.2000000Z
+ * Excludes pre-release and unlisted versions. Pre-release versions will be considered if no stable release exists. + * Unlisted versions are excluded because they have been deliberately hidden for a specific safety reason. + * To quote the Microsoft Nuget + * docs: + *
"Unlisting a package version hides it from search and from nuget.org package details page. This allows + * existing users of the package to continue using it but reduces new adoption since the package is not visible in + * search".+ * For an example package, see + * Microsoft.Data.SqlClient/6.1.0 + * which states: + *
This package has been deprecated as it has critical bugsand + *
The owner has unlisted this package. This could mean that the package is deprecated, has security + * vulnerabilities or shouldn't be used anymore.+ * Dependency Track won't prevent users from using an unlisted package, but it won't encourage it. + *
+ * We do not use the PackageBaseAddress resource to retrieve version information - it would be faster and simpler + * but, to quote Microsoft: + *
This list contains both listed and unlisted package versions.+ * Artifactory doesn't provide the PackageBaseAddress resource, + * despite Microsoft stating it is required. JFrog + * state here it is not supported + * as at September 2025./a>. + *
+ * Artifactory also doesn't provide "published" data as of August 2025 so no dates will be included in the response from
+ * those feeds. Other third party feeds may also omit the published dates.
*
* @author Steve Springett
* @since 3.4.0
*/
public class NugetMetaAnalyzer extends AbstractMetaAnalyzer {
- public static final DateFormat[] SUPPORTED_DATE_FORMATS = new DateFormat[]{
- new SimpleDateFormat("yyyy-MM-dd'T'HH:mm:ss.SSSXXX"),
- new SimpleDateFormat("yyyy-MM-dd'T'HH:mm:ss'Z'"),
- new SimpleDateFormat("yyyy-MM-dd'T'HH:mm:ss")
- };
private static final Logger LOGGER = Logger.getLogger(NugetMetaAnalyzer.class);
- private static final String DEFAULT_BASE_URL = "https://api.nuget.org";
- private static final String INDEX_URL = "/v3/index.json";
+ private static final String DEFAULT_BASE_URL = "https://api.nuget.org/v3/index.json";
+ private static final String NUGET_KEY_UPPER = "upper";
+ private static final String NUGET_KEY_ITEMS = "items";
- private static final String DEFAULT_VERSION_QUERY_ENDPOINT = "/v3-flatcontainer/%s/index.json";
-
- private static final String DEFAULT_REGISTRATION_ENDPOINT = "/v3/registration5-gz-semver2/%s/%s.json";
+ private static final Cache
+ * The ISO_INSTANT formatter handles time with timezone and milliseconds ("yyyy-MM-dd'T'HH:mm:ss.SSSXXX") and
+ * UTC-only ("yyyy-MM-dd'T'HH:mm:ss'Z'"). A fallback LocalDateTime parser handles cases without a timezone
+ * ("yyyy-MM-dd'T'HH:mm:ss").
+ * @param nugetDateTimeString Date time string in one of NuGet's permitted formats
+ * @return Date if input could be parsed, null if date could not be parsed
+ */
+ protected Date parseUpdateTime(String nugetDateTimeString) {
+ if (nugetDateTimeString == null) {
return null;
}
- // NuGet repositories may use differing date formats, so we try a few date formats that are commonly used until the right one is found.
- for (DateFormat dateFormat : SUPPORTED_DATE_FORMATS) {
+ try {
+ TemporalAccessor ta = DateTimeFormatter.ISO_INSTANT.parse(nugetDateTimeString);
+ return Date.from(Instant.from(ta));
+ } catch (DateTimeParseException e) {
try {
- return dateFormat.parse(updateTime);
- } catch (ParseException e) {
- LOGGER.warn("An error occurred while parsing upload time for a NuGet component - Repo returned: " + updateTime);
+ LocalDateTime localDateTime = LocalDateTime.parse(nugetDateTimeString);
+ return Date.from(localDateTime.atOffset(ZoneOffset.UTC).toInstant());
+ } catch (DateTimeParseException e2) {
+ return null;
}
}
-
- return null;
}
+
+ /**
+ * Internal class to collate useful version information from the larger NuGet catalog entry
+ */
+ private static class AbridgedNugetCatalogEntry {
+ private String version;
+ private Date publishedTimestamp;
+
+ private String getVersion() {
+ return version;
+ }
+
+ private void setVersion(String version) {
+ this.version = version;
+ }
+
+ private Date getPublishedTimestamp() {
+ return publishedTimestamp;
+ }
+
+ private void setPublishedTimestamp(Date publishedTimestamp) {
+ this.publishedTimestamp = publishedTimestamp;
+ }
+
+ @Override
+ public String toString() {
+ return "AbridgedNugetCatalogEntry{" +
+ "version='" + version + '\'' +
+ ", publishedTimestamp=" + publishedTimestamp +
+ '}';
+ }
+ }
+
}
diff --git a/src/test/java/org/dependencytrack/tasks/repositories/NugetMetaAnalyzerTest.java b/src/test/java/org/dependencytrack/tasks/repositories/NugetMetaAnalyzerTest.java
index 5d9598969..c2537b21f 100644
--- a/src/test/java/org/dependencytrack/tasks/repositories/NugetMetaAnalyzerTest.java
+++ b/src/test/java/org/dependencytrack/tasks/repositories/NugetMetaAnalyzerTest.java
@@ -22,148 +22,550 @@ import com.github.packageurl.PackageURL;
import org.apache.http.HttpHeaders;
import org.dependencytrack.model.Component;
import org.dependencytrack.model.RepositoryType;
-import org.junit.jupiter.api.AfterAll;
-import org.junit.jupiter.api.Assertions;
-import org.junit.jupiter.api.BeforeAll;
-import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.*;
import org.junit.jupiter.params.ParameterizedTest;
-import org.junit.jupiter.params.provider.Arguments;
-import org.junit.jupiter.params.provider.MethodSource;
+import org.junit.jupiter.params.provider.ValueSource;
import org.mockserver.client.MockServerClient;
import org.mockserver.integration.ClientAndServer;
-
-import java.util.stream.Stream;
+import org.mockserver.model.Header;
import java.nio.file.Files;
import java.nio.file.Paths;
-import java.text.DateFormat;
-import java.text.ParseException;
-import java.text.SimpleDateFormat;
+import java.util.ArrayList;
import java.util.Date;
+import java.util.List;
-import static org.dependencytrack.tasks.repositories.NugetMetaAnalyzer.SUPPORTED_DATE_FORMATS;
import static org.mockserver.model.HttpRequest.request;
import static org.mockserver.model.HttpResponse.response;
class NugetMetaAnalyzerTest {
+ public static final String LOCALHOST_REPO_INDEX = "http://localhost:1080/artifactory/api/nuget/v3/nuget-repo/index.json";
private static ClientAndServer mockServer;
@BeforeAll
- public static void beforeClass() {
+ static void beforeClass() throws Exception {
mockServer = ClientAndServer.startClientAndServer(1080);
- }
- @AfterAll
- public static void afterClass() {
- mockServer.stop();
- }
-
- // This test is to check if the analyzer is:
- // * excluding pre-release versions if a release version exists,
- // * including pre-release versions if no release version exists
- // The test is transient depending on the current version of the package
- // retrieved from the repository at the time of running.
- // For example, when it was created, the latest released version of:
- // * Microsoft.Extensions.DependencyInjection was 9.0.0-preview.1.24080.9
- // * OpenTelemetry.Instrumentation.SqlClient was 1.12.0-beta.2 (no release version exists)
- @ParameterizedTest
- @MethodSource("testAnalyzerData")
- void testAnalyzer(String purl, boolean isLatestVersionPreRelease) throws Exception {
- Component component = new Component();
- component.setPurl(new PackageURL(purl));
- NugetMetaAnalyzer analyzer = new NugetMetaAnalyzer();
-
- analyzer.setRepositoryBaseUrl("https://api.nuget.org");
- MetaModel metaModel = analyzer.analyze(component);
-
- Assertions.assertTrue(analyzer.isApplicable(component));
- Assertions.assertEquals(RepositoryType.NUGET, analyzer.supportedRepositoryType());
- Assertions.assertNotNull(metaModel.getLatestVersion());
- Assertions.assertNotNull(metaModel.getPublishedTimestamp());
- Assertions.assertEquals(isLatestVersionPreRelease, metaModel.getLatestVersion().contains("-"));
- }
-
- static StreamTestErrorBlobNotFound