Resolve merge conflict with upstream/main

Author: pradhyum6144

README.rst

@@ -57,9 +57,8 @@ for any legal advice.
 
 
 
-
-.. |ci-tests| image:: https://github.com/aboutcode-org/scancode.io/actions/workflows/ci.yml/badge.svg?branch=main
-    :target: https://github.com/aboutcode-org/scancode.io/actions/workflows/ci.yml
+.. |ci-tests| image:: https://github.com/aboutcode-org/scancode.io/actions/workflows/run-unit-tests.yml/badge.svg?branch=main
+    :target: https://github.com/aboutcode-org/scancode.io/actions/workflows/run-unit-tests.yml
     :alt: CI Tests Status
 
 .. |docs-rtd| image:: https://readthedocs.org/projects/scancodeio/badge/?version=latest

pyproject.toml

@@ -123,7 +123,7 @@ android_analysis = [
   "android_inspector==0.0.1"
 ]
 mining = [
-  "minecode_pipelines==0.0.1b8"
+  "minecode_pipelines==0.1.1"
 ]
 
 [project.urls]

scancodeio/static/main.css

@@ -391,6 +391,12 @@ progress.file-upload::before {
 #message-list th#column-severity {
   min-width: 110px;
 }
+th#column-vulnerability_id {
+  min-width: 220px;
+}
+th#column-summary {
+  width: 40%;
+}
 .menu.is-info .is-active {
   background-color: #3e8ed0;
 }

scanpipe/management/commands/check-compliance.py

@@ -104,23 +104,17 @@ def check_compliance(self, fail_level):
         return total_issues > 0
 
     def check_vulnerabilities(self):
-        packages = self.project.discoveredpackages.vulnerable_ordered()
-        dependencies = self.project.discovereddependencies.vulnerable_ordered()
-
-        vulnerable_records = list(packages) + list(dependencies)
-        count = len(vulnerable_records)
+        all_vulnerabilities = self.project.vulnerabilities
+        vulnerabilities_count = len(all_vulnerabilities)
 
         if self.verbosity > 0:
-            if count:
-                self.stderr.write(f"{count} vulnerable records found:")
-                for entry in vulnerable_records:
-                    self.stderr.write(str(entry))
-                    vulnerability_ids = [
-                        vulnerability.get("vulnerability_id")
-                        for vulnerability in entry.affected_by_vulnerabilities
-                    ]
-                    self.stderr.write(" > " + ", ".join(vulnerability_ids))
+            if vulnerabilities_count:
+                self.stderr.write(f"{vulnerabilities_count} vulnerabilities found:")
+                for vulnerability_id, vulnerability_data in all_vulnerabilities.items():
+                    self.stderr.write(str(vulnerability_id))
+                    for affected_obj in vulnerability_data.get("affects", []):
+                        self.stderr.write(f" > {affected_obj}")
             else:
                 self.stdout.write("No vulnerabilities found")
 
-        return count > 0
+        return vulnerabilities_count > 0

scanpipe/models.py

@@ -1495,6 +1495,11 @@ def vulnerable_dependency_count(self):
         """Return the number of vulnerable dependencies related to this project."""
         return self.vulnerable_dependencies.count()
 
+    @cached_property
+    def vulnerability_count(self):
+        """Return the number of vulnerabilities related to this project."""
+        return self.vulnerable_package_count + self.vulnerable_dependency_count
+
     @cached_property
     def dependency_count(self):
         """Return the number of dependencies related to this project."""

scanpipe/pipes/cyclonedx.py

@@ -30,6 +30,7 @@
 from cyclonedx.model import license as cdx_license_model
 from cyclonedx.model.bom import Bom
 from cyclonedx.schema import SchemaVersion
+from cyclonedx.schema.schema import BaseSchemaVersion
 from cyclonedx.validation import ValidationError
 from cyclonedx.validation.json import JsonStrictValidator
 from defusedxml import ElementTree as SafeElementTree
@@ -184,10 +185,12 @@ def cyclonedx_component_to_package_data(
     affected_by_vulnerabilities = []
     if affected_by := vulnerabilities.get(bom_ref):
         for cdx_vulnerability in affected_by:
+            cdx_vulnerability_json = cdx_vulnerability.as_json(view_=BaseSchemaVersion)
             affected_by_vulnerabilities.append(
                 {
                     "vulnerability_id": str(cdx_vulnerability.id),
                     "summary": cdx_vulnerability.description,
+                    "cdx_vulnerability_data": json.loads(cdx_vulnerability_json),
                 }
             )
 

scanpipe/pipes/d2d.py

@@ -165,31 +165,41 @@ def _map_jvm_to_class_resource(
     to_resource, from_resources, from_classes_index, jvm_lang: jvm.JvmLanguage
 ):
     for extension in jvm_lang.source_extensions:
-        normalized_path = jvm_lang.get_normalized_path(
+        # Perform basic conversion from .class to source file path
+        source_path = jvm_lang.get_source_path(
             path=to_resource.path, extension=extension
         )
+        # Perform basic mapping without normalization for scenarios listed in
+        # https://github.com/aboutcode-org/scancode.io/issues/1873
+        match = pathmap.find_paths(path=source_path, index=from_classes_index)
 
-        match = pathmap.find_paths(path=normalized_path, index=from_classes_index)
-
-        if not match and jvm_lang.name == "scala":
-            package_path = str(Path(to_resource.path).parent)
-            potential_sources = from_resources.filter(
-                path__startswith=package_path.replace("to/", "from/"),
-                extension__in=jvm_lang.source_extensions,
+        if not match:
+            normalized_path = jvm_lang.get_normalized_path(
+                path=to_resource.path, extension=extension
             )
-            for from_resource in potential_sources:
-                from_source_root_parts = from_resource.path.strip("/").split("/")
-                from_source_root = "/".join(from_source_root_parts[:-1])
-                pipes.make_relation(
-                    from_resource=from_resource,
-                    to_resource=to_resource,
-                    map_type=jvm_lang.binary_map_type,
-                    extra_data={"from_source_root": f"{from_source_root}/"},
+            match = pathmap.find_paths(path=normalized_path, index=from_classes_index)
+
+            # Scala fallback for case classes and inner classes
+            # https://github.com/aboutcode-org/scancode.io/issues/1875
+            if not match and jvm_lang.name == "scala":
+                package_path = str(Path(to_resource.path).parent)
+                potential_sources = from_resources.filter(
+                    path__startswith=package_path.replace("to/", "from/"),
+                    extension__in=jvm_lang.source_extensions,
                 )
-            continue
+                for from_resource in potential_sources:
+                    from_source_root_parts = from_resource.path.strip("/").split("/")
+                    from_source_root = "/".join(from_source_root_parts[:-1])
+                    pipes.make_relation(
+                        from_resource=from_resource,
+                        to_resource=to_resource,
+                        map_type=jvm_lang.binary_map_type,
+                        extra_data={"from_source_root": f"{from_source_root}/"},
+                    )
+                continue
 
-        if not match:
-            continue
+            if not match:
+                continue
 
         for resource_id in match.resource_ids:
             from_resource = from_resources.get(id=resource_id)

scanpipe/pipes/jvm.py

@@ -140,12 +140,27 @@ def get_normalized_path(cls, path, extension):
         # https://github.com/aboutcode-org/scancode.io/issues/1994
         if class_name.endswith("_$logger.class"):
             class_name, _, _ = class_name.partition("_$logger.class")
-        elif "$" in class_name:  # inner class
+        elif "$" in class_name and not class_name.startswith("$"):  # inner class
             class_name, _, _ = class_name.partition("$")
         else:
             class_name, _, _ = class_name.partition(".")  # plain .class
         return str(path.parent / f"{class_name}{extension}")
 
+    @classmethod
+    def get_source_path(cls, path, extension):
+        """
+        Return a JVM file path for ``path`` .class file path string.
+        No normalization is performed.
+        """
+        if not path.endswith(cls.binary_extensions):
+            raise ValueError(
+                f"Only path ending with {cls.binary_extensions} are supported."
+            )
+        path = Path(path.strip("/"))
+        class_name = path.name
+        class_name, _, _ = class_name.partition(".")  # plain .class
+        return str(path.parent / f"{class_name}{extension}")
+
 
 def find_expression(lines, regex):
     """

scanpipe/pipes/ort.py

@@ -130,14 +130,28 @@ def get_ort_project_type(project):
         return "docker"
 
 
+def sanitize_id_part(value):
+    """
+    Sanitize an identifier part by replacing colons with underscores.
+    ORT uses colons as separators in the identifier string representation.
+    """
+    if value:
+        return value.replace(":", "_")
+    return value
+
+
 def to_ort_package_list_yml(project):
     """Convert a project object into a YAML string in the ORT package list format."""
     project_type = get_ort_project_type(project)
 
     dependencies = []
     for package in project.discoveredpackages.all():
+        type_ = sanitize_id_part(project_type or package.type)
+        name = sanitize_id_part(package.name)
+        version = sanitize_id_part(package.version)
+
         dependency = Dependency(
-            id=f"{project_type or package.type}::{package.name}:{package.version}",
+            id=f"{type_}::{name}:{version}",
             purl=package.purl,
             sourceArtifact=SourceArtifact(url=package.download_url),
             declaredLicenses=[package.get_declared_license_expression_spdx()],

scanpipe/pipes/pathmap.py

@@ -164,11 +164,12 @@ def get_reversed_path_segments(path):
     Return reversed segments list given a POSIX ``path`` string. We reverse
     based on path segments separated by a "/".
 
-    Note that the inputh ``path`` is assumed to be normalized, not relative and
+    Note that the input ``path`` is assumed to be normalized, not relative and
     not containing double slash.
 
-    For example::
-    >>> assert get_reversed_path_segments("a/b/c.js") == ["c.js", "b", "a"]
+    For example:
+    >>> get_reversed_path_segments("a/b/c.js")
+    ['c.js', 'b', 'a']
     """
     # [::-1] does the list reversing
     reversed_segments = path.strip("/").split("/")[::-1]
@@ -177,13 +178,14 @@ def get_reversed_path_segments(path):
 
 def convert_segments_to_path(segments):
     """
-    Return a path string is suitable for indexing or matching given a
+    Return a path string suitable for indexing or matching given a
     ``segments`` sequence of path segment strings.
     The resulting reversed path is prefixed and suffixed by a "/" irrespective
     of whether the original path is a file or directory and had such prefix or
     suffix.
 
-    For example::
-    >>> assert convert_segments_to_path(["c.js", "b", "a"]) == "/c.js/b/a/"
+    For example:
+    >>> convert_segments_to_path(["c.js", "b", "a"])
+    '/c.js/b/a/'
     """
     return "/" + "/".join(segments) + "/"