NuGet (packages.lock.json) parser.

pkg/nuget/parse.go

@@ -0,0 +1,54 @@
+package nuget
+
+import (
+    "encoding/json"
+    "io"
+
+    "golang.org/x/xerrors"
+
+    "github.com/aquasecurity/go-dep-parser/pkg/types"
+)
+
+type LockFile struct {
+    Version int
+    Targets map[string]Dependencies `json:"dependencies"`
+}
+
+type Dependencies map[string]Dependency
+
+type Dependency struct {
+    Type     string
+    Resolved string
+}
+
+func Parse(r io.Reader) ([]types.Library, error) {
+    var lockFile LockFile
+    decoder := json.NewDecoder(r)
+
+    if err := decoder.Decode(&lockFile); err != nil {
+        return nil, xerrors.Errorf("failed to decode packages.lock.json: %w", err)
+    }
+
+    uniqueLibs := map[types.Library]struct{}{}
+    for _, targetContent := range lockFile.Targets {
+        for packageName, packageContent := range targetContent {
+            // If package type is "project", it is the actual project, and we skip it.
+            if packageContent.Type == "Project" {
+                continue
+            }
+
+            lib:= types.Library{
+                Name:    packageName,
+                Version: packageContent.Resolved,
+            }
+            uniqueLibs[lib] = struct{}{}
+        }
+    }
+
+    var libraries []types.Library
+    for lib := range uniqueLibs{
+        libraries = append(libraries, lib)
+    }
+
+    return libraries, nil
+}

pkg/nuget/parse_test.go

@@ -0,0 +1,79 @@
+package nuget
+
+import (
+	"os"
+	"path"
+	"sort"
+	"strings"
+	"testing"
+
+	"github.com/aquasecurity/go-dep-parser/pkg/types"
+	"github.com/kylelemons/godebug/pretty"
+)
+
+func TestParse(t *testing.T) {
+	vectors := []struct {
+		file      string // Test input file
+		libraries []types.Library
+	}{
+		{
+			file:      "testdata/packages_lock_simple.json",
+			libraries: NuGetSimple,
+		},
+		{
+			file:      "testdata/packages_lock_subdependencies.json",
+			libraries: NuGetSubDependencies,
+		},
+		{
+			file:      "testdata/packages_lock_multi.json",
+			libraries: NuGetMultiTarget,
+		},
+		{
+			file:      "testdata/packages_lock_legacy.json",
+			libraries: NuGetLegacy,
+		},
+	}
+
+	for _, v := range vectors {
+		t.Run(path.Base(v.file), func(t *testing.T) {
+			f, err := os.Open(v.file)
+			if err != nil {
+				t.Fatalf("Open() error: %v", err)
+			}
+			libList, err := Parse(f)
+			if err != nil {
+				t.Fatalf("Parse() error: %v", err)
+			}
+
+			sort.Slice(libList, func(i, j int) bool {
+				ret := strings.Compare(libList[i].Name, libList[j].Name)
+				if ret == 0 {
+					return libList[i].Version < libList[j].Version
+				}
+				return ret < 0
+			})
+
+			sort.Slice(v.libraries, func(i, j int) bool {
+				ret := strings.Compare(v.libraries[i].Name, v.libraries[j].Name)
+				if ret == 0 {
+					return v.libraries[i].Version < v.libraries[j].Version
+				}
+				return ret < 0
+			})
+
+			if len(libList) != len(v.libraries) {
+				t.Fatalf("lib length: %s", pretty.Compare(libList, v.libraries))
+			}
+
+			for i, got := range libList {
+				want := v.libraries[i]
+				if want.Name != got.Name {
+					t.Errorf("%d: Name: got %s, want %s", i, got.Name, want.Name)
+				}
+				if want.Version != got.Version {
+					t.Errorf("%d: Version: got %s, want %s", i, got.Version, want.Version)
+				}
+			}
+		})
+	}
+}

pkg/nuget/parse_testcase.go

@@ -0,0 +1,98 @@
+package nuget
+
+import "github.com/aquasecurity/go-dep-parser/pkg/types"
+
+var (
+    // docker run --rm -i -t mcr.microsoft.com/dotnet/sdk:latest
+    // cd /usr/local/src
+    // dotnet new mvc
+    // dotnet add package Newtonsoft.Json
+    // dotnet add package NuGet.Frameworks
+    // dotnet restore --use-lock-file
+    // cat packages.lock.json | jq -rc '.dependencies[] | keys[] as $k | "{\"\($k)\", \"\(.[$k] | .resolved)\"},"'
+    NuGetSimple = []types.Library{
+        {"Newtonsoft.Json", "12.0.3"},
+        {"NuGet.Frameworks", "5.7.0"},
+    }
+
+    // docker run --rm -i -t mcr.microsoft.com/dotnet/sdk:latest
+    // cd /usr/local/src
+    // dotnet new webapi
+    // dotnet add package Newtonsoft.Json
+    // dotnet add package NuGet.Frameworks
+    // dotnet restore --use-lock-file
+    // cat packages.lock.json | jq -rc '.dependencies[] | keys[] as $k | "{\"\($k)\", \"\(.[$k] | .resolved)\"},"'
+    NuGetSubDependencies = []types.Library{
+        {"Microsoft.Extensions.ApiDescription.Server", "3.0.0"},
+        {"Microsoft.OpenApi", "1.1.4"},
+        {"Newtonsoft.Json", "12.0.3"},
+        {"NuGet.Frameworks", "5.7.0"},
+        {"Swashbuckle.AspNetCore", "5.5.1"},
+        {"Swashbuckle.AspNetCore.Swagger", "5.5.1"},
+        {"Swashbuckle.AspNetCore.SwaggerGen", "5.5.1"},
+        {"Swashbuckle.AspNetCore.SwaggerUI", "5.5.1"},
+    }
+
+    // mcr.microsoft.com/dotnet/sdk:latest
+    // cd /usr/local/src
+    // dotnet new console
+    // dotnet add package Newtonsoft.Json
+    // dotnet add package AWSSDK.Core
+    // dotnet restore --use-lock-file
+    // cat packages.lock.json | jq -rc '.dependencies[] | keys[] as $k | "{\"\($k)\", \"\(.[$k] | .resolved)\"},"'
+    NuGetLegacy = []types.Library{
+        {"AWSSDK.Core", "3.5.1.30"},
+        {"Newtonsoft.Json", "12.0.3"},
+    }
+
+    // docker run --rm -i -t mcr.microsoft.com/dotnet/sdk:latest
+    // cd /usr/local/src
+    // dotnet new classlib -f net5.0
+    // sed -i 's~TargetFramework>net5.0</TargetFramework~TargetFrameworks>net4.0;netstandard2.0;netstandard1.0;net35;net2.0</TargetFrameworks~' src.csproj
+    // dotnet add package Newtonsoft.Json
+    // dotnet restore --use-lock-file
+    // dotnet add package AWSSDK.Core
+    // cat packages.lock.json | jq -rc '.dependencies[] | keys[] as $k | "{\"\($k)\", \"\(.[$k] | .resolved)\"},"' | sort -u
+    NuGetMultiTarget = []types.Library{
+        {"AWSSDK.Core", "3.5.1.30"},
+        {"Microsoft.Bcl.AsyncInterfaces", "1.1.0"},
+        {"Microsoft.CSharp", "4.3.0"},
+        {"Microsoft.NETCore.Platforms", "1.1.0"},
+        {"Microsoft.NETCore.Targets", "1.1.0"},
+        {"Microsoft.NETFramework.ReferenceAssemblies", "1.0.0"},
+        {"Microsoft.NETFramework.ReferenceAssemblies.net20", "1.0.0"},
+        {"Microsoft.NETFramework.ReferenceAssemblies.net40", "1.0.0"},
+        {"NETStandard.Library", "1.6.1"},
+        {"NETStandard.Library", "2.0.3"},
+        {"Newtonsoft.Json", "12.0.3"},
+        {"System.Collections", "4.3.0"},
+        {"System.ComponentModel", "4.3.0"},
+        {"System.ComponentModel.Primitives", "4.3.0"},
+        {"System.ComponentModel.TypeConverter", "4.3.0"},
+        {"System.Diagnostics.Debug", "4.3.0"},
+        {"System.Diagnostics.Tools", "4.3.0"},
+        {"System.Dynamic.Runtime", "4.3.0"},
+        {"System.Globalization", "4.3.0"},
+        {"System.IO", "4.3.0"},
+        {"System.Linq", "4.3.0"},
+        {"System.Linq.Expressions", "4.3.0"},
+        {"System.Net.Primitives", "4.3.0"},
+        {"System.ObjectModel", "4.3.0"},
+        {"System.Reflection", "4.3.0"},
+        {"System.Reflection.Extensions", "4.3.0"},
+        {"System.Reflection.Primitives", "4.3.0"},
+        {"System.Resources.ResourceManager", "4.3.0"},
+        {"System.Runtime", "4.3.0"},
+        {"System.Runtime.CompilerServices.Unsafe", "4.5.2"},
+        {"System.Runtime.Extensions", "4.3.0"},
+        {"System.Runtime.Serialization.Primitives", "4.3.0"},
+        {"System.Text.Encoding", "4.3.0"},
+        {"System.Text.Encoding.Extensions", "4.3.0"},
+        {"System.Text.RegularExpressions", "4.3.0"},
+        {"System.Threading", "4.3.0"},
+        {"System.Threading.Tasks", "4.3.0"},
+        {"System.Threading.Tasks.Extensions", "4.5.2"},
+        {"System.Xml.ReaderWriter", "4.3.0"},
+        {"System.Xml.XDocument", "4.3.0"},
+    }
+)

pkg/nuget/testdata/packages_lock_legacy.json

@@ -0,0 +1,26 @@
+{
+    "version": 1,
+    "dependencies": {
+        ".NETCoreApp,Version=v5.0": {
+            "AWSSDK.Core": {
+                "type": "Direct",
+                "requested": "[3.5.1.30, )",
+                "resolved": "3.5.1.30",
+                "contentHash": "kNqzY/py4pDlW9aPn2SpnG7y7Mr4Z0jg/BdkHiRr9WLt7k/lwGMmJ5hd3x/ZHDkv8kIdjllkVrrhYkXvj6AkCA=="
+            },
+            "Newtonsoft.Json": {
+                "type": "Direct",
+                "requested": "[12.0.3, )",
+                "resolved": "12.0.3",
+                "contentHash": "6mgjfnRB4jKMlzHSl+VD+oUc1IebOZabkbyWj2RiTgWwYPPuaK1H97G1sHqGwPlS5npiF5Q0OrxN1wni2n5QWg=="
+            },
+            "my.project": {
+                "type": "Project",
+                "dependencies": {
+                    "Newtonsoft.Json": "12.0.3",
+                    "AWSSDK.Core": "3.5.1.30"
+                }
+            }
+        }
+    }
+}