bug: ensure only valid JSON files processed

Author: anthonyharrison

sbomdiff/cyclonedx_parser.py

@@ -23,23 +23,25 @@ def parse_cyclonedx_json(self, sbom_file):
         """parses CycloneDX JSON BOM file extracting package name, version and license"""
         data = json.load(open(sbom_file))
         packages = {}
-        for d in data["components"]:
-            if d["type"] in ["library", "application", "operating-system"]:
-                package = d["name"]
-                version = d["version"]
-                license = "NOT FOUND"
-                # Multiple ways of defining license data
-                if "licenses" in d and len(d["licenses"]) > 0:
-                    license_data = d["licenses"][0]
-                    if "license" in license_data:
-                        if "id" in license_data["license"]:
-                            license = license_data["license"]["id"]
-                        elif "name" in license_data["license"]:
-                            license = license_data["license"]["name"]
-                    elif "expression" in license_data:
-                        license = license_data["expression"]
-                if package not in packages:
-                    packages[package] = [version, license]
+        # Check that valid CycloneDX JSON file is being processed
+        if "components" in data:
+            for d in data["components"]:
+                if d["type"] in ["library", "application", "operating-system"]:
+                    package = d["name"]
+                    version = d["version"]
+                    license = "NOT FOUND"
+                    # Multiple ways of defining license data
+                    if "licenses" in d and len(d["licenses"]) > 0:
+                        license_data = d["licenses"][0]
+                        if "license" in license_data:
+                            if "id" in license_data["license"]:
+                                license = license_data["license"]["id"]
+                            elif "name" in license_data["license"]:
+                                license = license_data["license"]["name"]
+                        elif "expression" in license_data:
+                            license = license_data["expression"]
+                    if package not in packages:
+                        packages[package] = [version, license]
 
         return packages
 

sbomdiff/spdx_parser.py

@@ -55,15 +55,17 @@ def parse_spdx_json(self, sbom_file):
         """parses SPDX JSON BOM file extracting package name, version and license"""
         data = json.load(open(sbom_file))
         packages = {}
-        for d in data["packages"]:
-            package = d["name"]
-            try:
-                version = d["versionInfo"]
-                license = d["licenseConcluded"]
-                if package not in packages:
-                    packages[package] = [version, license]
-            except KeyError as e:
-                pass
+        # Check that valid SPDX JSON file is being processed
+        if "packages" in data:
+            for d in data["packages"]:
+                package = d["name"]
+                try:
+                    version = d["versionInfo"]
+                    license = d["licenseConcluded"]
+                    if package not in packages:
+                        packages[package] = [version, license]
+                except KeyError as e:
+                    pass
 
         return packages
 
@@ -128,15 +130,17 @@ def parse_spdx_yaml(self, sbom_file):
         data = yaml.safe_load(open(sbom_file))
 
         packages = {}
-        for d in data["packages"]:
-            package = d["name"]
-            try:
-                version = d["versionInfo"]
-                license = d["licenseConcluded"]
-                if package not in packages:
-                    packages[package] = [version, license]
-            except KeyError as e:
-                pass
+        # Check that valid SPDX YAML file is being processed
+        if "packages" in data:
+            for d in data["packages"]:
+                package = d["name"]
+                try:
+                    version = d["versionInfo"]
+                    license = d["licenseConcluded"]
+                    if package not in packages:
+                        packages[package] = [version, license]
+                except KeyError as e:
+                    pass
 
         return packages