Repository navigation
[BUG] unexpected NoPropertiesProvidedException when deserializing empty OrganizationalEntity #764
Description
After upgrading to cyclonedx-gradle-plugin 2.0.0 I noticed that it also adds an empty (and deprecated) manufacture object in the BOM metadata section that cyclonedx-python-lib is unable to parse:
Traceback (most recent call last):
File "//main.py", line 11, in main
bom = Bom.from_json(data=bom_data)
File "/usr/local/lib/python3.13/site-packages/serializable/__init__.py", line 375, in from_json
_data[k] = prop_info.concrete_type.from_json(data=v)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^
File "/usr/local/lib/python3.13/site-packages/serializable/__init__.py", line 375, in from_json
_data[k] = prop_info.concrete_type.from_json(data=v)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^
File "/usr/local/lib/python3.13/site-packages/serializable/__init__.py", line 391, in from_json
return cls(**_data)
File "/usr/local/lib/python3.13/site-packages/cyclonedx/model/contact.py", line 300, in __init__
raise NoPropertiesProvidedException(
'One of name, urls or contacts must be supplied for an OrganizationalEntity - none supplied.'
)
cyclonedx.exception.model.NoPropertiesProvidedException: One of name, urls or contacts must be supplied for an OrganizationalEntity - none supplied.manufacture and manufacturer don't require any object attribute per CDX spec. An { } object is not "optional" OrganizationalEntity, so deserialization fails here:
cyclonedx-python-lib/cyclonedx/model/contact.py
Lines 299 to 302 in b8cbb59
Note that the deserialization issue can happen with any use of manufacture or manufacturer, regardless if in metadata or within a Component.
I'm not entirely sure where to best fix this, otherwise I'd open a PR myself 😊
Reproduction repo: https://github.com/Churro/cdx-manufacturer-bug
SBOM to deserialize:
{
"bomFormat" : "CycloneDX",
"specVersion" : "1.6",
"version" : 1,
"metadata" : {
"timestamp" : "2025-01-25T19:11:26Z",
"tools" : {
"components" : [
{
"type" : "application",
"author" : "CycloneDX",
"name" : "cyclonedx-gradle-plugin",
"version" : "2.0.0"
}
],
"services" : [ ]
},
"component" : {
"type" : "application",
"bom-ref" : "pkg:maven/foo/[email protected]",
"name" : "foo-bar",
"version" : "1.2.3",
"purl" : "pkg:maven/foo/[email protected]",
"modified" : false
},
"manufacture" : { },
"licenses" : [ ]
},
"components" : [
{
"type" : "library",
"name": "some-lib",
"manufacturer" : { }
}
],
"dependencies" : [ ]
}Parsing code:
import json
import traceback
from cyclonedx.model.bom import Bom
def main() -> None:
try:
with open("repr.json", "r") as f:
bom_data = json.load(f)
bom = Bom.from_json(data=bom_data)
print(bom)
except BaseException as e:
print(traceback.format_exc())
if __name__ == "__main__":
main()
Activity
jkowalleck commentedon Jan 28, 2025
tested, report verified.
I'll suggest to treat this as a defect/bug.
a possible bug fix would be: Allow "empty"
OrganizationalEntity.solution:
OrganizationalEntityno longer throwsNoPropertiesProvidedException.Feel free to pullrequest a solution.
and please add your test data and test case similar to
cyclonedx-python-lib/tests/test_deserialize_json.py
Lines 91 to 102 in b8cbb59
[-]NoPropertiesProvidedException for empty `manufacture` or `manufacturer` object[/-][+]unexpected `NoPropertiesProvidedException` when deserializing empty `OrganizationalEntity`[/+][-]unexpected `NoPropertiesProvidedException` when deserializing empty `OrganizationalEntity`[/-][+][BUG] unexpected `NoPropertiesProvidedException` when deserializing empty `OrganizationalEntity`[/+]feat: allow empty `OrganizationalEntity` object (CycloneDX#768)
jkowalleck commentedon Feb 4, 2025
this was released via https://github.com/CycloneDX/cyclonedx-python-lib/releases/tag/v8.6.0
NoPropertiesProvidedException#776