Skip to content

Incorrect successful parsing of invalid SPDX identifier fields #274

@awyeth

Description

@awyeth

SPDX identifiers require the SPDXRef- prefix and DocumentRef identifiers require the DocumentRef- prefix.

See spec details 6.3, 7.2, and 8.2

Currently, if the SPDXRef- prefix isn't present then the SBOM is parsed and the ID is accepted verbatim. Further, on being written out the SBOM will have the SPDXRef- prefix added.

Note, this also means that SPDXRef- is an accepted ID.

For example, the following SBOM:

{
  "SPDXID" : "SPDXRef-DOCUMENT",
  "spdxVersion" : "SPDX-2.3",
  "creationInfo" : {
    "created" : "2023-07-18T12:27:48Z",
    "creators" : [ "Person: Gary O'Neall", "Tool: spdx-maven-plugin" ],
    "licenseListVersion" : "3.21"
  },
  "name" : "tools-java",
  "dataLicense" : "CC0-1.0",
  "documentDescribes" : [ "SPDXRef-8" ],
  "documentNamespace" : "test",
  "packages" : [ {
    "SPDXID" : "7",
    "name" : "json-schema-validator"
  }],
  "relationships" : [ {
    "spdxElementId" : "7",
    "relationshipType" : "TEST_CASE_OF",
    "relatedSpdxElement" : "0"
  }]
}

is currently successfully parsed and when written has the following output:

{
  "spdxVersion":"SPDX-2.3",
  "dataLicense":"CC0-1.0",
  "SPDXID":"SPDXRef-DOCUMENT",
  "name":"tools-java",
  "documentNamespace":"test",
  "creationInfo":{
    "licenseListVersion":"3.21",
    "creators":["Person: Gary O'Neall","Tool: spdx-maven-plugin"],
    "created":"2023-07-18T12:27:48Z"
  },
  "packages":[{
    "name":"json-schema-validator",
    "SPDXID":"SPDXRef-7",
    "downloadLocation":"",
    "filesAnalyzed":true
  }],
  "relationships":[{
     "spdxElementId":"SPDXRef-7",
     "relatedSpdxElement":"SPDXRef-0",
     "relationshipType":"TEST_CASE_OF"
    },{
     "spdxElementId":"SPDXRef-DOCUMENT",
     "relatedSpdxElement":"SPDXRef-8",
     "relationshipType":"DESCRIBES"
  }]
}

#269 is the likely cause of this issue as it adjusted the parsing of IDs to be more tolerant of incorrectly formatted IDs.

Note, this came up as some of the sbom-conformance projects tests started failing as the input was parsed successfully (which was unexpected): google/sbom-conformance#70

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions