search

CycloneDX / cyclonedx-core-java

CycloneDX SBOM Model and Utils for Creating and Validating BOMs
https://cyclonedx.org/
Apache License 2.0
81 stars 59 forks source link

`ObjectLocator` doesn't work when BOM doesn't have a `metadata.component` node #455

Closed nscuro closed 1 month ago

nscuro commented 2 months ago

ObjectLocator#locate does not search any objects in a given BOM, if the BOM is missing a metadata.component node:

https://github.com/CycloneDX/cyclonedx-core-java/blob/e2f7db69fda60632ce759fbf293b8bdf3754cd91/src/main/java/org/cyclonedx/util/ObjectLocator.java#L64-L90

It should be able to search in components, services, and vulnerabilities, even when metadata.component is not set.