Skip to content

pyproject.toml should not automatically activate poetry scanner #6303

@andrewm-aero

Description

@andrewm-aero

Describe the bug
The scanner incorrectly activates the poetry analyzer in the presence of a pyproject.toml file, regardless of its contents. While poetry does indeed use this file, so do a number of other tools, including setuptools and pytest. The scanner should only interpret a pyproject.toml as being a poetry file if it includes a [tool.poetry] TOML section.

Version of dependency-check used
Docker image docker.io/owasp/dependency-check:9.0.4

Log file
Output excerpt follows

[WARN] An error occurred while analyzing '/tmp/dctempc399499e-0516-4ec5-92a8-f494256212a5/check11208990173254915996tmp/2/redacted/pyproject.toml' (Poetry Analyzer).
...
[ERROR] Python `pyproject.toml` found and there is not a `poetry.lock` or `requirements.txt` - analysis will be incomplete

To Reproduce
Example non-poetry pyproject.toml (setuptools)

[project]
name = "redacted"
version = "0.1.0"
description = ""
authors = [
    {name = "redacted", email = "redacted"},
]
license = {text = "Proprietary"}
readme = "README.md"

[project.optional-dependencies]
test = [
    "pytest",
]

Expected behavior
This file not to be treated as poetry, and for the poetry analyzer to not activate.

Additional context
See here for details on the [tool.poetry] toml section.

See here and here for information on an example of tools other than poetry using this file.

A possible fix would be here to first parse the TOML file, and check if result.getTables("tool.poetry") returns non-null, and to disregard otherwise.

I believe this to be the cause of jeremylong/DependencyCheck#5971

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions