NuGet (packages.lock.json) parser.

[Johannestegner]

This pull request includes a parser which parses lockfiles created by nuget/dotnet when using a lockfile.
NuGet does not force (or auto) create a lock file, so a *.csproj file parser might also be a good idea, as a fallback.

As a first stage, this should be good enough though.

[Johannestegner]

Reference: Issue with feature request can be found here aquasecurity/trivy#681

[simar7]

thanks for the PR @Johannestegner – I'll be taking a look at it and making comments as I go through it.

[Johannestegner]

Thank you for the review @simar7 ! Fixed the issues you mentioned, let me know if there is anything else you wish me to fix! :)

[simar7]

lgtm – @knqyf263 would you like to take a second look before we merge?

[Johannestegner]

Not sure yet, but depending on how the version should be handled in Trivy (aquasecurity/trivy#686 (comment)) I guess that this part should use a similar approach to convert the version.
This could of course be done later on, but might want to do it in a one off :)

[Johannestegner]

Actually, I guess this should not be used in the dependency parser, but rather when checking in Trivy or similar.
I will add a test case for legacy packages though, so that it's in the codebase.

[knqyf263]

Thanks for your contribution!

[Johannestegner]

Let me know if you want me to squash some (or all) commits :)

[knqyf263]

I'll squash all commits when merging this PR, so you don't have to care about it. We should keep the history in the PR.

[knqyf263]

I left one more comment, but it looks almost good! Thank you, again!

[Johannestegner]

I left one more comment, but it looks almost good! Thank you, again!

Good catch!

Updated the parser to use name + version again (tried with the code in an earlier note, but it didn't work out at all as I expected! hehe).
I removed the complex file/test and replaced it with a multi which contains targets for net4.0;netstandard2.0;netstandard1.0;net35;net2.0. Took me quite a while to find a package which required different dependencies!
Now I think it is working just as it should! :)

[knqyf263]

Thank you for adding multiple targets file! I've refactored a bit. It looks good to me now.