feat: resolve Maven properties in found POMs (#271)

Signed-off-by: Ben Selwyn-Smith <benselwynsmith@googlemail.com>

Author: benmss

src/macaron/dependency_analyzer/java_repo_finder.py

@@ -3,6 +3,7 @@
 
 """This module tries to find urls of repositories that match artifacts passed in 'group:artifact:version' form."""
 import logging
+import re
 import typing
 from collections.abc import Iterator
 from xml.etree.ElementTree import Element  # nosec
@@ -120,7 +121,7 @@ def find_parent(pom: Element) -> tuple[str, str, str]:
     return "", "", ""
 
 
-def find_scm(pom: Element, tags: list[str]) -> tuple[Iterator[str], int]:
+def find_scm(pom: Element, tags: list[str], resolve_properties: bool = True) -> tuple[Iterator[str], int]:
     """
     Parse the passed pom and extract the passed tags.
 
@@ -130,6 +131,8 @@ def find_scm(pom: Element, tags: list[str]) -> tuple[Iterator[str], int]:
         The parsed POM.
     tags : list[str]
         The list of tags to try extracting from the POM.
+    resolve_properties: bool
+        Whether to attempt resolution of Maven properties within the POM.
 
     Returns
     -------
@@ -141,7 +144,15 @@ def find_scm(pom: Element, tags: list[str]) -> tuple[Iterator[str], int]:
     # Try to match each tag with the contents of the POM.
     for tag in tags:
         element: typing.Optional[Element] = pom
-        tag_parts = tag.split(".")
+
+        if tag.startswith("properties."):
+            # Tags under properties are often "." separated
+            # These can be safely split into two resulting tags as nested tags are not allowed here
+            tag_parts = ["properties", tag[11:]]
+        else:
+            # Other tags can be split into distinct elements via "."
+            tag_parts = tag.split(".")
+
         for index, tag_part in enumerate(tag_parts):
             element = _find_element(element, tag_part)
             if element is None:
@@ -150,9 +161,53 @@ def find_scm(pom: Element, tags: list[str]) -> tuple[Iterator[str], int]:
                 # Add the contents of the final tag
                 results.append(element.text.strip())
 
+    # Resolve any Maven properties within the results
+    if resolve_properties:
+        results = _resolve_properties(pom, results)
+
     return iter(results), len(results)
 
 
+def _resolve_properties(pom: Element, values: list[str]) -> list[str]:
+    """Resolve any Maven properties found within the passed list of values.
+
+    Maven POM files have five different use cases for properties (see https://maven.apache.org/pom.html).
+    Only the two that relate to contents found elsewhere within the same POM file are considered here.
+    That is: ${project.x} where x can be a child tag at any depth, or ${x} where x is found at project.properties.x.
+    Entries with unresolved properties are not included in the returned list. In the case of chained properties,
+    only the top most property is evaluated.
+    """
+    resolved_values = []
+    for value in values:
+        replacements: list = []
+        # Calculate replacements - matches any number of ${...} entries in the current value
+        for match in re.finditer("\\$\\{[^}]+}", value):
+            text = match.group().replace("$", "").replace("{", "").replace("}", "")
+            if text.startswith("project."):
+                text = text.replace("project.", "")
+            else:
+                text = f"properties.{text}"
+            # Call find_scm with property resolution flag set to False to prevent the possibility of endless looping
+            value_iterator, count = find_scm(pom, [text], False)
+            if count == 0:
+                break
+            replacements.append([match.start(), next(value_iterator), match.end()])
+
+        # Apply replacements in reverse order
+        # E.g.
+        # git@github.com:owner/project${javac.src.version}-${project.inceptionYear}.git
+        # ->
+        # git@github.com:owner/project${javac.src.version}-2023.git
+        # ->
+        # git@github.com:owner/project1.8-2023.git
+        for replacement in reversed(replacements):
+            value = f"{value[:replacement[0]]}{replacement[1]}{value[replacement[2]:]}"
+
+        resolved_values.append(value)
+
+    return resolved_values
+
+
 def parse_pom(pom: str) -> Element | None:
     """
     Parse the passed POM using defusedxml.

tests/dependency_analyzer/java_repo_finder/resources/example_pom.xml

@@ -23,17 +23,17 @@
     <inceptionYear>2023</inceptionYear>
     <licenses>
         <license>
-            <name>Example License</name>
+            <name>Example_License</name>
             <url>https://example.example/license</url>
-            <distribution>repo</distribution>
+            <distribution>${licenses.license.distribution}</distribution>
         </license>
     </licenses>
     <scm>
         <connection>
-            ssh://git@hostname:port/owner/project.git
+            ssh://git@hostname:port/owner/${project.licenses.license.name}.git
         </connection>
         <developerConnection>
-            git@github.com:owner/project.git
+            git@github.com:owner/project${javac.src.version}-${project.inceptionYear}.git
         </developerConnection>
         <url>https://github.com/owner/project</url>
         <tag>example-0.0.1</tag>

tests/dependency_analyzer/java_repo_finder/test_java_repo_finder.py

@@ -27,12 +27,15 @@ def test_java_repo_finder() -> None:
         file_data = file.read()
         pom = parse_pom(file_data)
         assert pom is not None
-        found_urls, count = find_scm(pom, ["scm.url", "scm.connection", "scm.developerConnection"])
-        assert count == 3
+        found_urls, count = find_scm(
+            pom, ["scm.url", "scm.connection", "scm.developerConnection", "licenses.license.distribution"]
+        )
+        assert count == 4
         expected = [
             "https://github.com/owner/project",
-            "ssh://git@hostname:port/owner/project.git",
-            "git@github.com:owner/project.git",
+            "ssh://git@hostname:port/owner/Example_License.git",
+            "git@github.com:owner/project1.8-2023.git",
+            "${licenses.license.distribution}",
         ]
         assert expected == list(found_urls)