Merge pull request #747 from safedep/fix/maven-pomxml-transient-fetch-retry

test: stabilize Maven-resolving tests + e2e CSV against Maven Central rate limits

Author: KunalSin9h

pkg/parser/pomxml_test.go

@@ -1,6 +1,7 @@
 package parser
 
 import (
+	"strings"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -13,9 +14,31 @@ var deps = []string{
 	"org.opentest4j:opentest4j",                 // Transitive
 }
 
+// skipIfMavenRegistryUnavailable skips a test that depends on resolving
+// dependencies live from Maven Central when the registry is unreachable or
+// rate-limits the request (HTTP 429). CI runners share egress IPs that are
+// frequently rate-limited by Maven Central - an external, non-deterministic
+// condition unrelated to the code under test. Any other error still fails the
+// test so genuine parsing/resolution regressions are caught.
+func skipIfMavenRegistryUnavailable(t *testing.T, err error) {
+	t.Helper()
+
+	msg := err.Error()
+	for _, signal := range []string{
+		"failed to fetch Maven project",     // resolver could not retrieve a POM
+		"failed to load parent from remote", // remote parent fetch failed
+		"Maven registry query",              // wraps non-200 (e.g. 429) and transport errors
+	} {
+		if strings.Contains(msg, signal) {
+			t.Skipf("skipping: Maven registry unavailable or rate-limited: %v", err)
+		}
+	}
+}
+
 func Test_MavenPomXmlParser_Simple(t *testing.T) {
 	manifest, err := parseMavenPomXmlFile("./fixtures/java/pom.xml", &ParserConfig{})
 	if err != nil {
+		skipIfMavenRegistryUnavailable(t, err)
 		t.Fatal(err)
 	}
 
@@ -30,6 +53,7 @@ func Test_MavenPomXmlParser_ChildParentRelation(t *testing.T) {
 	// 	<relativePath>../parent/pom.xml</relativePath>
 	manifest, err := parseMavenPomXmlFile("./fixtures/java/child/pom.xml", &ParserConfig{})
 	if err != nil {
+		skipIfMavenRegistryUnavailable(t, err)
 		t.Fatal(err)
 	}
 
@@ -42,6 +66,7 @@ func Test_MavenPomXmlParser_ChildParentRelation(t *testing.T) {
 func Test_MavenPomXmlParser_RemoteParent(t *testing.T) {
 	manifest, err := parseMavenPomXmlFile("./fixtures/java/remote/pom.xml", &ParserConfig{})
 	if err != nil {
+		skipIfMavenRegistryUnavailable(t, err)
 		t.Fatal(err)
 	}
 

pkg/readers/dir_reader_test.go

@@ -2,13 +2,53 @@ package readers
 
 import (
 	"errors"
+	"os"
+	"path/filepath"
+	"strings"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
 
 	"github.com/safedep/vet/pkg/models"
+	"github.com/safedep/vet/pkg/parser"
 )
 
+// mavenResolutionAvailable resolves a fixture pom.xml through the same parser
+// the directory reader uses, and reports whether Maven dependency resolution
+// is currently working. It returns false when Maven Central is unreachable or
+// rate-limiting (HTTP 429) - an external, non-deterministic condition (CI
+// runners share egress IPs frequently throttled by Maven Central) that should
+// not turn the build red. Cases that enumerate a pom.xml are skipped in that
+// situation. Doing a full resolution (rather than a single HTTP probe) makes
+// the signal representative of what the test cases actually do, so we don't run
+// the cases only to have the resolution burst fail partway.
+func mavenResolutionAvailable() bool {
+	const pom = "./fixtures/java-multi/pom.xml"
+
+	p, err := parser.FindParser(pom, "pom.xml")
+	if err != nil {
+		return true // cannot probe; let the test run and report the real error
+	}
+
+	if _, err := p.Parse(pom); err != nil {
+		msg := err.Error()
+		if strings.Contains(msg, "failed to fetch Maven project") ||
+			strings.Contains(msg, "failed to load parent from remote") ||
+			strings.Contains(msg, "Maven registry query") {
+			return false
+		}
+	}
+
+	return true
+}
+
+// dirContainsPomXML reports whether the fixture directory has a pom.xml, which
+// means enumerating it requires live Maven dependency resolution.
+func dirContainsPomXML(dir string) bool {
+	_, err := os.Stat(filepath.Join(dir, "pom.xml"))
+	return err == nil
+}
+
 func TestNewDirectoryReader(t *testing.T) {
 	cases := []struct {
 		name       string
@@ -131,8 +171,14 @@ func TestDirectoryReaderEnumPackages(t *testing.T) {
 		},
 	}
 
+	mavenOK := mavenResolutionAvailable()
+
 	for _, test := range cases {
 		t.Run(test.name, func(t *testing.T) {
+			if !mavenOK && dirContainsPomXML(test.path) {
+				t.Skipf("skipping: Maven Central unavailable or rate-limited; %s requires live pom.xml resolution", test.path)
+			}
+
 			reader, _ := NewDirectoryReader(DirectoryReaderConfig{
 				Path:       test.path,
 				Exclusions: test.exclusions,

test/scenarios/scenario-11-code-csvreport.sh

@@ -35,6 +35,7 @@ PyPI,*,*,flask,1.0.4,cli-filter,flask,flask,PYSEC-2023-62,CVE-2023-30861,,,1,$E2
 PyPI,*,*,langchain,0.2.1,cli-filter,langchain,langchain,GHSA-3hjh-jh2h-vrg6,CVE-2024-2965,MEDIUM,Denial of service in langchain-community,0,
 PyPI,*,*,langchain,0.2.1,cli-filter,langchain,langchain,PYSEC-2024-118,CVE-2024-2965,MEDIUM,,0,
 PyPI,*,*,langchain,0.2.1,cli-filter,langchain,langchain,GHSA-3644-q5cj-c5c7,CVE-2026-45134,HIGH,LangSmith SDK: Public prompt pull deserializes untrusted manifests without trust boundary warning,0,
+PyPI,*,*,langchain,0.2.1,cli-filter,langchain,langchain,GHSA-gr75-jv2w-4656,,MEDIUM,LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders,0,
 EOL
 
 # Process CSV files to exclude environment-dependent fields