Function parsePom

opensca/sca/java/mvn.go:305–438

parsePom 解析单个pom 返回该pom的依赖图

(ctx context.Context, pom *Pom, getpom getPomFunc)

// parsePom 解析单个pom 返回该pom的依赖图
func parsePom(ctx context.Context, pom *Pom, getpom getPomFunc) *model.DepGraph {

	// 补全nil值
	if pom.Properties == nil {
		pom.Properties = PomProperties{}
	}

	pom.Update(&pom.PomDependency)

	// 继承pom
	inheritPom(pom, getpom)

	// 记录在根pom的dependencyManagement中非import组件信息
	rootPomManagement := map[string]*PomDependency{}
	for _, dep := range pom.DependencyManagement {
		if dep.Scope != "import" {
			rootPomManagement[dep.Index2()] = dep
		}
	}

	root := &model.DepGraph{Vendor: pom.GroupId, Name: pom.ArtifactId, Version: pom.Version, Path: pom.File.Relpath()}
	root.Expand = pom

	// 解析子依赖构建依赖关系
	depIndex2Set := map[string]bool{}
	root.ForEachNode(func(p, n *model.DepGraph) bool {

		select {
		case <-ctx.Done():
			return false
		default:
		}

		if n.Expand == nil {
			return true
		}

		np := n.Expand.(*Pom)

		for _, lic := range np.Licenses {
			n.AppendLicense(lic)
		}

		// 记录在当前pom的dependencyManagement中非import组件信息
		depManagement := map[string]*PomDependency{}
		for _, dep := range np.DependencyManagement {
			if dep.Scope != "import" {
				depManagement[dep.Index2()] = dep
			}
		}

		for _, dep := range np.Dependencies {

			// 丢弃provided或optional=true的组件
			if dep.Scope == "provided" || dep.Optional {
				continue
			}
			// 丢弃scope为test的间接依赖