XmlParser - unable to parse XML SBOM with evidence entries

[rsvoboda]

XmlParser - unable to parse XML SBOM with evidence entries

Parsing fails with

[ERROR]   CycloneIT.test:15->parseSbomXml:21 » Parse com.fasterxml.jackson.databind.exc.MismatchedInputException:
  Cannot deserialize value of type `java.util.ArrayList<org.cyclonedx.model.component.evidence.Occurrence>`
  from Object value (token `JsonToken.START_OBJECT`)
  at [Source: UNKNOWN; byte offset: #UNKNOWN] (through reference chain: org.cyclonedx.model.Bom["metadata"]->
  org.cyclonedx.model.Component["evidence"]->org.cyclonedx.model.Evidence["occurrences"])

Reproducer:

• download code-with-quarkus-cyclonedx-xml.zip
• run mvn clean verify

Code is just:

    @Test
    void test() throws Exception {
        Bom bom = parseSbomXml(new File("."), "quarkus-run-cyclonedx.xml");
    }

    static Bom parseSbomXml(File testDir, String sbomFileName) throws Exception {
        File sbomFile = new File(testDir, "target/" + sbomFileName);
        assertTrue(sbomFile.exists());
        return new XmlParser().parse(sbomFile);
    }

SBOM XML is generated by Quarkus cyclonedx extension (https://quarkus.io/guides/cyclonedx/) during build phase. cc @aloubyansky

[espenotterstad]

Reproduced on master (527787d).

I think the trigger is narrower than the title suggests: it is not XML evidence parsing in general, but evidence under metadata.component.

The same <evidence> block parses fine under <components> and throws under <metadata><component>.

What looks to be the root cause of this is that MetadataDeserializer reads metadata into a generic JsonNode tree and then re-parses the component subtree through a TreeTraversingParser.

I would be happy to open my first PR on this, but I'd like to check whether @nscuro has a preferred direction. Make deserializeComponent parse from the original XML token stream instead of a tree, or keep the tree and add shape-tolerant handling to the affected field(s)?