nuspec parse exception - Githubissues

jeremylong / DependencyCheck

OWASP dependency-check is a software composition analysis utility that detects publicly disclosed vulnerabilities in application dependencies.

https://owasp.org/www-project-dependency-check/

Apache License 2.0

6.41k stars 1.27k forks source link

nuspec parse exception #6664

Open VeereshSSanthebennur opened 5 months ago

VeereshSSanthebennur commented 5 months ago

Hi!!!

I am trying to run the Dependency scan on our CPP projects via azure pipeline, dependency check analyzer throwing an NuspecParseException. please find the log attached.

Please do the needful.

aikebah commented 5 months ago

Without a reproducer project/file for that issue there is not much we can analyze. There is something in your nuspec that is not foreseen in the nuspec parser.

VeereshSSanthebennur commented 5 months ago

I have attached the nuspec file sample as requested below. When I commented out the File element which was pointing for the other local source then it seemed to work fine. It was failing to access the local files. I hope this is the expected one.

The attachment is not accepting the nuspec file, I have attached it in the form of a text file.

Also, I wanted to be double sure the dependency check can scan the C++ desktop projects right?

LegacyNativeRouter.txt

aikebah commented 5 months ago

The underlying cause of your issue is an XML validation in your nuspec:

[Fatal Error] :10:19: Open quote is expected for attribute "src" associated with an  element type  "file".
Exception in thread "main" org.xml.sax.SAXParseException; lineNumber: 10; columnNumber: 19; Open quote is expected for attribute "src" associated with an  element type  "file".
    at java.xml/com.sun.org.apache.xerces.internal.parsers.DOMParser.parse(DOMParser.java:262)
    at java.xml/com.sun.org.apache.xerces.internal.jaxp.DocumentBuilderImpl.parse(DocumentBuilderImpl.java:342)
    at java.xml/javax.xml.parsers.DocumentBuilder.parse(DocumentBuilder.java:122)
    at Scratch.main(scratch.java:36)

The $location$ needs to be quoted for forming syntax-valid XML.