XML deserialization fails for pedigree/commits on a metadata/tools/components component
维护者通常 1 天内回复
@Dushyant7090 已经在做这个了。
开始于 2026年9月24日。
评估
调研方向
Start with org.cyclonedx.parsers.XmlParser and the metadata/tools path in ToolInformationDeserializer, then reproduce the supplied XML with XmlParser.parse(). Compare this path with the working JSON and top-level component cases; done means the minimal XML parses successfully and the serialized structure round-trips without the reported ArrayList mapping error.
由索引模型根据 Issue 内容生成。
描述
A CycloneDX 1.5 BOM whose metadata → tools → components component carries a pedigree with commits/commit cannot be deserialized from XML. XmlParser.parse() throws while mapping
Pedigree.commits. The same document deserializes fine as JSON, and the same pedigree/commit on a top-level component deserializes fine from XML — so this is specific to the XML +
tools-component code path. The library will happily serialize this structure but then cannot read its own output, breaking round-tripping.
Version
org.cyclonedx:cyclonedx-core-java:13.2.0 (latest on Maven Central). Runtime: jackson-databind/jackson-dataformat-xml 2.22.2, woodstox-core 7.2.0.
Minimal reproduction
Parse the following (minimal — everything non-essential removed) with new XmlParser().parse(bytes):
<?xml version="1.0" encoding="UTF-8"?>
<bom xmlns="http://cyclonedx.org/schema/bom/1.5">
<metadata>
<tools>
<components>
<component type="application">
<name>t</name>
<pedigree>
<commits>
<commit>
<uid>u</uid>
</commit>
</commits>
</pedigree>
</component>
</components>
</tools>
</metadata>
</bom>
Code to reproduce
byte[] xml = Files.readAllBytes(Path.of("trigger.xml"));
new org.cyclonedx.parsers.XmlParser().parse(xml); // throws
Stack tracke:
org.cyclonedx.exception.ParseException: com.fasterxml.jackson.databind.JsonMappingException:
Cannot deserialize value of type `java.util.ArrayList<org.cyclonedx.model.Commit>` from Object value (token `JsonToken.START_OBJECT`)
(through reference chain: org.cyclonedx.model.Component["pedigree"]->org.cyclonedx.model.Pedigree["commits"]) (through reference chain: org.cyclonedx.model.Bom["metadata"])
at org.cyclonedx.parsers.XmlParser.parse(XmlParser.java:101)
...
Caused by: java.lang.IllegalArgumentException: Cannot deserialize value of type `java.util.ArrayList<org.cyclonedx.model.Commit>` from Object value (token `JsonToken.START_OBJECT`)
at com.fasterxml.jackson.databind.ObjectMapper.convertValue(ObjectMapper.java:4661)
at org.cyclonedx.util.deserializer.ToolInformationDeserializer.parseComponents(ToolInformationDeserializer.java:71)
at org.cyclonedx.util.deserializer.ToolInformationDeserializer.parseToolInformation(ToolInformationDeserializer.java:49)
at org.cyclonedx.util.deserializer.ToolInformationDeserializer.deserialize(ToolInformationDeserializer.java:43)
at org.cyclonedx.util.ToolsJsonParser.parse(ToolsJsonParser.java:49)
at org.cyclonedx.util.deserializer.MetadataDeserializer.deserialize(MetadataDeserializer.java:91)
...
Caused by: com.fasterxml.jackson.databind.exc.MismatchedInputException: Cannot deserialize value of type `java.util.ArrayList<org.cyclonedx.model.Commit>` from Object value (token
`JsonToken.START_OBJECT`)
at com.fasterxml.jackson.databind.deser.std.CollectionDeserializer.handleNonArray(CollectionDeserializer.java:404)
at com.fasterxml.jackson.databind.deser.std.CollectionDeserializer.deserialize(CollectionDeserializer.java:253)
Open PR #833 appears to address exactly this path but is not yet merged/released.
- 主要语言
- Java
- 星标
- 121
- 派生
- 93
- 平均合并
- 2 天 4 小时
- 30 天内合并 PR
- 10
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 没有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
CycloneDX/cyclonedx-core-java 的其他 Issue
-
breaking change
难度 2/5 1-3 小时 新手友好度 72/100
CycloneDX/cyclonedx-core-java#917 · 1 条评论 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 78/100
CycloneDX/cyclonedx-core-java#819 · 1 条评论 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 72/100
CycloneDX/cyclonedx-core-java#681 · 1 条评论 ·
维护者通常 1 天内回复
-
难度 3/5 1-2 天 新手友好度 68/100
CycloneDX/cyclonedx-core-java#938 · 1 条评论 ·
维护者通常 1 天内回复
-
难度 3/5 1-2 天 新手友好度 55/100
CycloneDX/cyclonedx-core-java#902 ·
维护者通常 1 天内回复
查看 CycloneDX/cyclonedx-core-java 的全部 Issue
相似的 Issue
-
难度 2/5 1-3 小时 新手友好度 77/100
apache/rocketmq-dashboard#6610 ·
维护者通常 3 天内回复
-
`RedisList.reversed()` view returns an empty `range` and `trim` removes all elements可能已有人在做 @CCCLL 今天认领。 未关闭status: waiting-for-triage
难度 2/5 1-3 小时 新手友好度 72/100
spring-projects/spring-data-redis#3461 ·
维护者通常 2 天内回复
-
难度 2/5 1-3 小时 新手友好度 73/100
javapathfinder/jpf-core#649 ·
-
bug
难度 2/5 1-3 小时 新手友好度 72/100
devops-thiago/ThrillhouseBot#1093 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 67/100
wimdeblauwe/htmx-spring-boot#205 ·