Describe the bug
The scanner incorrectly activates the poetry analyzer in the presence of a pyproject.toml file, regardless of its contents. While poetry does indeed use this file, so do a number of other tools, including setuptools and pytest. The scanner should only interpret a pyproject.toml as being a poetry file if it includes a [tool.poetry] TOML section.
Version of dependency-check used
Docker image docker.io/owasp/dependency-check:9.0.4
Log file
Output excerpt follows
[WARN] An error occurred while analyzing '/tmp/dctempc399499e-0516-4ec5-92a8-f494256212a5/check11208990173254915996tmp/2/redacted/pyproject.toml' (Poetry Analyzer).
...
[ERROR] Python `pyproject.toml` found and there is not a `poetry.lock` or `requirements.txt` - analysis will be incomplete
To Reproduce
Example non-poetry pyproject.toml (setuptools)
[project]
name = "redacted"
version = "0.1.0"
description = ""
authors = [
{name = "redacted", email = "redacted"},
]
license = {text = "Proprietary"}
readme = "README.md"
[project.optional-dependencies]
test = [
"pytest",
]
Expected behavior
This file not to be treated as poetry, and for the poetry analyzer to not activate.
Additional context
See here for details on the [tool.poetry] toml section.
See here and here for information on an example of tools other than poetry using this file.
A possible fix would be here to first parse the TOML file, and check if result.getTables("tool.poetry") returns non-null, and to disregard otherwise.
I believe this to be the cause of jeremylong/DependencyCheck#5971
Describe the bug
The scanner incorrectly activates the poetry analyzer in the presence of a pyproject.toml file, regardless of its contents. While poetry does indeed use this file, so do a number of other tools, including setuptools and pytest. The scanner should only interpret a pyproject.toml as being a poetry file if it includes a
[tool.poetry]TOML section.Version of dependency-check used
Docker image docker.io/owasp/dependency-check:9.0.4
Log file
Output excerpt follows
To Reproduce
Example non-poetry pyproject.toml (setuptools)
Expected behavior
This file not to be treated as poetry, and for the poetry analyzer to not activate.
Additional context
See here for details on the
[tool.poetry]toml section.See here and here for information on an example of tools other than poetry using this file.
A possible fix would be here to first parse the TOML file, and check if
result.getTables("tool.poetry")returns non-null, and to disregard otherwise.I believe this to be the cause of jeremylong/DependencyCheck#5971