feat(java): detect JAR licenses from packaged LICENSE files

Author: nikpivkin

docs/guide/coverage/language/java.md

@@ -38,9 +38,15 @@ To find information about these JARs[^2], the same logic is used as for the base
 `table` format only contains the name of root JAR[^2] . To get the full path to inner JARs[^2] use the `json` format.
 
 ### Licenses
-Trivy detects licenses declared in the `<licenses>` block of the embedded `META-INF/maven/<groupId>/<artifactId>/pom.xml` and attaches them to the matching package.
+Trivy detects licenses for a JAR[^2] from two sources, in this order:
 
-Coverage is limited: many JARs declare a license only in a parent POM (which is not expanded in the embedded `pom.xml`) or ship no Maven descriptor at all.
+1. **Embedded POM** — the `<licenses>` block of the embedded `META-INF/maven/<groupId>/<artifactId>/pom.xml`, matched to the package by `groupId:artifactId`.
+2. **License files** — `LICENSE`, `LICENCE` or `COPYRIGHT` files (including variants like `LICENSE.txt`) located at the JAR[^2] root or directly under `META-INF/`. Their content is classified with the [license classifier](../../scanner/license.md). A license file carries no `groupId:artifactId`, so it is attached only when the JAR[^2] contains a single artifact; in uber/shaded JARs[^2] (multiple artifacts) the owner is ambiguous and such files are skipped.
+
+Notes and limitations:
+
+- Coverage is limited: many JARs[^2] declare a license only in a parent POM (which is not expanded in the embedded `pom.xml`) or ship no Maven descriptor at all.
+- A single license file may bundle the texts of third-party components (e.g. Spring or Tomcat artifacts), so a package can be reported with several licenses found in that file, not only its own.
 
 ## pom.xml
 Trivy parses your `pom.xml` file and tries to find files with dependencies from these local locations.

integration/testdata/spring4shell-jre11.json.golden

@@ -257,7 +257,7 @@
           "PkgPath": "usr/local/tomcat/webapps/helloworld.war/WEB-INF/lib/spring-beans-5.3.15.jar",
           "PkgIdentifier": {
             "PURL": "pkg:maven/org.springframework/spring-beans@5.3.15",
-            "UID": "382ba53322e3ac2a"
+            "UID": "59399c43172e6917"
           },
           "InstalledVersion": "5.3.15",
           "FixedVersion": "5.3.18",

integration/testdata/spring4shell-jre8.json.golden

@@ -257,7 +257,7 @@
           "PkgPath": "usr/local/tomcat/webapps/helloworld.war/WEB-INF/lib/spring-beans-5.3.15.jar",
           "PkgIdentifier": {
             "PURL": "pkg:maven/org.springframework/spring-beans@5.3.15",
-            "UID": "382ba53322e3ac2a"
+            "UID": "59399c43172e6917"
           },
           "InstalledVersion": "5.3.15",
           "FixedVersion": "5.3.18",

pkg/dependency/parser/java/jar/parse.go

@@ -21,11 +21,19 @@ import (
 	"golang.org/x/xerrors"
 
 	ftypes "github.com/aquasecurity/trivy/pkg/fanal/types"
+	"github.com/aquasecurity/trivy/pkg/licensing"
 	"github.com/aquasecurity/trivy/pkg/log"
+	"github.com/aquasecurity/trivy/pkg/set"
 	xio "github.com/aquasecurity/trivy/pkg/x/io"
 	xos "github.com/aquasecurity/trivy/pkg/x/os"
 )
 
+// licenseFileStems are the base names (without extension) of files treated as
+// license files inside a jar, matched case-insensitively. It mirrors the set used
+// by the standalone license file analyzer (its acceptedFileNames), but matching is
+// done on the stem so common variants like LICENSE.txt are also recognized.
+var licenseFileStems = set.NewCaseInsensitive("license", "licence", "copyright")
+
 var (
 	jarFileRegEx = regexp.MustCompile(`^([a-zA-Z0-9\._-]*[^-*])-(\d\S*(?:-SNAPSHOT)?).jar$`)
 )
@@ -37,10 +45,11 @@ type Client interface {
 }
 
 type Parser struct {
-	logger       *log.Logger
-	rootFilePath string
-	offline      bool
-	size         int64
+	logger                 *log.Logger
+	rootFilePath           string
+	offline                bool
+	size                   int64
+	licenseConfidenceLevel float64
 
 	client Client
 }
@@ -65,6 +74,12 @@ func WithSize(size int64) Option {
 	}
 }
 
+func WithLicenseClassifierConfidenceLevel(level float64) Option {
+	return func(p *Parser) {
+		p.licenseConfidenceLevel = level
+	}
+}
+
 func NewParser(c Client, opts ...Option) *Parser {
 	p := &Parser{
 		logger: log.WithPrefix("jar"),
@@ -93,15 +108,15 @@ func (p *Parser) parseArtifact(filePath string, size int64, r xio.ReadSeekerAt)
 	// e.g. spring-core-5.3.4-SNAPSHOT.jar => sprint-core, 5.3.4-SNAPSHOT
 	fileProps := parseFileName(filePath)
 
-	pkgs, m, foundPomProps, err := p.traverseZip(size, r, fileProps)
+	pkgs, m, foundPomProps, licenseFiles, err := p.traverseZip(size, r, fileProps)
 	if err != nil {
 		return nil, nil, xerrors.Errorf("zip error: %w", err)
 	}
 
 	// If pom.properties is found, it should be preferred than MANIFEST.MF.
 	// Otherwise, resolve the artifact of the jar itself from MANIFEST.MF / SHA-1 / file name.
 	// Such an artifact has no embedded pom.xml (maven-archiver writes pom.xml and
-	// pom.properties together), so it carries no license.
+	// pom.properties together), so it carries no pom.xml license.
 	if !foundPomProps {
 		props, found, err := p.resolveArtifact(r, m, fileProps)
 		if err != nil {
@@ -112,6 +127,10 @@ func (p *Parser) parseArtifact(filePath string, size int64, r xio.ReadSeekerAt)
 		}
 	}
 
+	// Classify and attach the LICENSE file now that the jar's own artifact is resolved
+	// (it may have been added above from MANIFEST.MF / SHA-1 / file name).
+	p.attachFileLicenses(pkgs, fileProps.FilePath, licenseFiles)
+
 	return pkgs, nil, nil
 }
 
@@ -169,19 +188,20 @@ func (p *Parser) resolveArtifact(r xio.ReadSeekerAt, m manifest, fileProps Prope
 }
 
 func (p *Parser) traverseZip(size int64, r xio.ReadSeekerAt, fileProps Properties) (
-	[]ftypes.Package, manifest, bool, error) {
+	[]ftypes.Package, manifest, bool, []*zip.File, error) {
 	var pkgs []ftypes.Package
 	var m manifest
 	var foundPomProps bool
+	var licenseFiles []*zip.File
 
 	// Licenses declared in embedded META-INF/maven/<g>/<a>/pom.xml, keyed by "groupID:artifactID".
 	// The path carries no version, so packages are matched by G:A after the loop
 	// (file order in the zip is not guaranteed).
-	licenses := make(map[string][]string)
+	pomLicenses := make(map[string][]string)
 
 	zr, err := zip.NewReader(r, size)
 	if err != nil {
-		return nil, manifest{}, false, xerrors.Errorf("zip error: %w", err)
+		return nil, manifest{}, false, nil, xerrors.Errorf("zip error: %w", err)
 	}
 
 	for _, fileInJar := range zr.File {
@@ -193,16 +213,21 @@ func (p *Parser) traverseZip(size int64, r xio.ReadSeekerAt, fileProps Propertie
 				continue
 			}
 			if len(names) > 0 {
-				licenses[packageName(groupID, artifactID)] = names
+				pomLicenses[packageName(groupID, artifactID)] = names
 			}
 			continue
 		}
 
+		if isJarLicenseFile(fileInJar.Name) {
+			licenseFiles = append(licenseFiles, fileInJar)
+			continue
+		}
+
 		switch {
 		case filepath.Base(fileInJar.Name) == "pom.properties":
 			props, err := parsePomProperties(fileInJar, fileProps.FilePath)
 			if err != nil {
-				return nil, manifest{}, false, xerrors.Errorf("failed to parse %s: %w", fileInJar.Name, err)
+				return nil, manifest{}, false, nil, xerrors.Errorf("failed to parse %s: %w", fileInJar.Name, err)
 			}
 			// Validation of props to avoid getting packages with empty Name/Version
 			if props.Valid() {
@@ -216,7 +241,7 @@ func (p *Parser) traverseZip(size int64, r xio.ReadSeekerAt, fileProps Propertie
 		case filepath.Base(fileInJar.Name) == "MANIFEST.MF":
 			m, err = parseManifest(fileInJar)
 			if err != nil {
-				return nil, manifest{}, false, xerrors.Errorf("failed to parse MANIFEST.MF: %w", err)
+				return nil, manifest{}, false, nil, xerrors.Errorf("failed to parse MANIFEST.MF: %w", err)
 			}
 		case isArtifact(fileInJar.Name):
 			innerPkgs, _, err := p.parseInnerJar(fileInJar, fileProps.FilePath) // TODO process inner deps
@@ -229,18 +254,57 @@ func (p *Parser) traverseZip(size int64, r xio.ReadSeekerAt, fileProps Propertie
 	}
 
 	// Attach licenses from embedded pom.xml, matched by "groupID:artifactID".
+	attachPomLicenses(pkgs, pomLicenses)
+
+	return pkgs, m, foundPomProps, licenseFiles, nil
+}
+
+// attachPomLicenses attaches licenses declared in embedded pom.xml files to packages,
+// matched by "groupID:artifactID". Packages that already have a license (e.g. set by a
+// nested jar from its own pom.xml) are left untouched.
+func attachPomLicenses(pkgs []ftypes.Package, pomLicenses map[string][]string) {
 	for i := range pkgs {
 		pkg := &pkgs[i]
-		// Keep licenses already set by a nested jar from its own pom.xml.
 		if len(pkg.Licenses) > 0 {
 			continue
 		}
-		if names, ok := licenses[pkg.Name]; ok {
+		if names, ok := pomLicenses[pkg.Name]; ok {
 			pkg.Licenses = names
 		}
 	}
+}
+
+// attachFileLicenses classifies the LICENSE file packed in a jar and attaches it to the
+// jar's own package, but only when the owner is unambiguous: a single LICENSE file, a
+// single package belonging to this jar, and no license from its pom.xml yet.
+func (p *Parser) attachFileLicenses(pkgs []ftypes.Package, filePath string, licenseFiles []*zip.File) {
+	if len(licenseFiles) != 1 {
+		return
+	}
+
+	var own []int
+	for i := range pkgs {
+		if pkgs[i].FilePath == filePath {
+			own = append(own, i)
+		}
+	}
+	if len(own) != 1 {
+		return
+	}
+
+	pkg := &pkgs[own[0]]
+	if len(pkg.Licenses) > 0 {
+		return
+	}
 
-	return pkgs, m, foundPomProps, nil
+	names, err := p.classifyPackedLicense(licenseFiles[0])
+	if err != nil {
+		p.logger.Debug("Failed to classify license file", log.String("file", licenseFiles[0].Name), log.Err(err))
+		return
+	}
+	if len(names) > 0 {
+		pkg.Licenses = names
+	}
 }
 
 func (p *Parser) parseInnerJar(zf *zip.File, rootPath string) ([]ftypes.Package, []ftypes.Dependency, error) {
@@ -407,6 +471,40 @@ func decodePomLicenses(r io.Reader) ([]string, error) {
 	return names, nil
 }
 
+// isJarLicenseFile reports whether a zip entry is a license file eligible for
+// classification: located at the jar root or directly under META-INF/ (not in a subdirectory),
+// with a base name whose stem is license/licence/copyright (e.g. LICENSE, LICENSE.txt).
+// Vendored licenses use prefixed names (e.g. FastDoubleParser-LICENSE) or nested
+// paths, so they are intentionally excluded.
+func isJarLicenseFile(name string) bool {
+	dir := path.Dir(name)
+	if dir != "." && dir != "META-INF" {
+		return false
+	}
+	base := path.Base(name)
+	stem := strings.TrimSuffix(base, path.Ext(base))
+	return licenseFileStems.Contains(stem)
+}
+
+// classifyPackedLicense classifies a LICENSE file packed in a jar and returns the
+// detected license names.
+func (p *Parser) classifyPackedLicense(f *zip.File) ([]string, error) {
+	file, err := f.Open()
+	if err != nil {
+		return nil, xerrors.Errorf("unable to open %s: %w", f.Name, err)
+	}
+	defer file.Close()
+
+	lf, err := licensing.Classify(f.Name, file, p.licenseConfidenceLevel)
+	if err != nil {
+		return nil, xerrors.Errorf("license classification error: %w", err)
+	}
+	if lf == nil {
+		return nil, nil
+	}
+	return lf.Findings.Names(), nil
+}
+
 type manifest struct {
 	implementationVersion  string
 	implementationTitle    string

pkg/dependency/parser/java/jar/parse_test.go

@@ -65,6 +65,7 @@ var (
 			Name:     "org.apache.commons:commons-lang3",
 			Version:  "3.11",
 			FilePath: "testdata/maven.war/WEB-INF/lib/commons-lang3-3.11.jar",
+			Licenses: []string{"Apache-2.0"},
 		},
 	}
 
@@ -77,11 +78,13 @@ var (
 			Name:     "commons-dbcp:commons-dbcp",
 			Version:  "1.4",
 			FilePath: "testdata/gradle.war/WEB-INF/lib/commons-dbcp-1.4.jar",
+			Licenses: []string{"Apache-2.0"},
 		},
 		{
 			Name:     "commons-pool:commons-pool",
 			Version:  "1.6",
 			FilePath: "testdata/gradle.war/WEB-INF/lib/commons-pool-1.6.jar",
+			Licenses: []string{"Apache-2.0"},
 		},
 		{
 			Name:     "log4j:log4j",
@@ -93,6 +96,7 @@ var (
 			Name:     "org.apache.commons:commons-compress",
 			Version:  "1.19",
 			FilePath: "testdata/gradle.war/WEB-INF/lib/commons-compress-1.19.jar",
+			Licenses: []string{"Apache-2.0"},
 		},
 	}
 

pkg/fanal/analyzer/language/java/jar/jar.go

@@ -33,12 +33,14 @@ var requiredExtensions = []string{
 
 // javaLibraryAnalyzer analyzes jar/war/ear/par files
 type javaLibraryAnalyzer struct {
-	parallel int
+	parallel                         int
+	licenseClassifierConfidenceLevel float64
 }
 
 func newJavaLibraryAnalyzer(options analyzer.AnalyzerOptions) (analyzer.PostAnalyzer, error) {
 	return &javaLibraryAnalyzer{
-		parallel: options.Parallel,
+		parallel:                         options.Parallel,
+		licenseClassifierConfidenceLevel: options.LicenseScannerOption.ClassifierConfidenceLevel,
 	}, nil
 }
 
@@ -57,7 +59,8 @@ func (a *javaLibraryAnalyzer) PostAnalyze(ctx context.Context, input analyzer.Po
 
 	// It will be called on each JAR file
 	onFile := func(path string, info fs.FileInfo, r xio.ReadSeekerAt) (*types.Application, error) {
-		p := jar.NewParser(client, jar.WithSize(info.Size()), jar.WithFilePath(path))
+		p := jar.NewParser(client, jar.WithSize(info.Size()), jar.WithFilePath(path),
+			jar.WithLicenseClassifierConfidenceLevel(a.licenseClassifierConfidenceLevel))
 		return language.ParsePackage(ctx, types.Jar, path, r, p, input.Options.FileChecksum)
 	}
 

pkg/fanal/analyzer/language/java/jar/jar_test.go

@@ -69,6 +69,7 @@ func Test_javaLibraryAnalyzer_Analyze(t *testing.T) {
 								Name:     "org.apache.commons:commons-lang3",
 								FilePath: "testdata/test.war/WEB-INF/lib/commons-lang3-3.11.jar",
 								Version:  "3.11",
+								Licenses: []string{"Apache-2.0"},
 							},
 							{
 								Name:     "com.example:web-app",
@@ -114,6 +115,7 @@ func Test_javaLibraryAnalyzer_Analyze(t *testing.T) {
 								Name:     "org.apache.tomcat.embed:tomcat-embed-websocket",
 								FilePath: "testdata/test.jar",
 								Version:  "9.0.65",
+								Licenses: []string{"Apache-2.0"},
 							},
 						},
 					},