1use std::fs::File;
5use std::io::BufReader;
6use std::path::Path;
7
8use crate::models::{DatasourceId, Dependency, PackageData, PackageType};
9use crate::parser_warn as warn;
10use packageurl::PackageUrl;
11use quick_xml::Reader;
12use quick_xml::events::Event;
13
14use super::super::PackageParser;
15use super::super::license_normalization::{
16 empty_declared_license_data, normalize_spdx_declared_license,
17};
18use super::super::utils::{MAX_ITERATION_COUNT, truncate_field};
19use super::{
20 build_nuget_description, build_nuget_party, build_nuget_purl, build_nuget_urls,
21 check_file_size, default_package_data, insert_extra_string, parse_repository_metadata,
22};
23
24pub struct NuspecParser;
25
26impl PackageParser for NuspecParser {
27 const PACKAGE_TYPE: PackageType = PackageType::Nuget;
28
29 fn is_match(path: &Path) -> bool {
30 path.extension()
31 .and_then(|ext| ext.to_str())
32 .is_some_and(|ext| ext == "nuspec")
33 }
34
35 fn extract_packages(path: &Path) -> Vec<PackageData> {
36 if let Err(e) = check_file_size(path) {
37 warn!("{}", e);
38 return vec![default_package_data(Some(DatasourceId::NugetNuspec))];
39 }
40
41 let file = match File::open(path) {
42 Ok(f) => f,
43 Err(e) => {
44 warn!("Failed to open .nuspec at {:?}: {}", path, e);
45 return vec![default_package_data(Some(DatasourceId::NugetNuspec))];
46 }
47 };
48
49 let reader = BufReader::new(file);
50 let mut xml_reader = Reader::from_reader(reader);
51 xml_reader.config_mut().trim_text(true);
52
53 let mut name = None;
54 let mut version = None;
55 let mut summary = None;
56 let mut description = None;
57 let mut title = None;
58 let mut homepage_url = None;
59 let mut parties = Vec::new();
60 let mut dependencies = Vec::new();
61 let mut extracted_license_statement = None;
62 let mut license_type = None;
63 let mut copyright = None;
64 let mut vcs_url = None;
65 let mut repository_branch = None;
66 let mut repository_commit = None;
67
68 let mut buf = Vec::new();
69 let mut current_element = String::new();
70 let mut in_metadata = false;
71 let mut in_dependencies = false;
72 let mut current_group_framework = None;
73 let mut iteration_count: usize = 0;
74
75 loop {
76 iteration_count += 1;
77 if iteration_count > MAX_ITERATION_COUNT {
78 warn!(
79 "Iteration limit exceeded in .nuspec at {:?}; stopping at {} items",
80 path, MAX_ITERATION_COUNT
81 );
82 break;
83 }
84 match xml_reader.read_event_into(&mut buf) {
85 Ok(Event::Start(e)) => {
86 let tag_name = String::from_utf8_lossy(e.name().as_ref()).to_string();
87 current_element = tag_name.clone();
88
89 if tag_name == "metadata" {
90 in_metadata = true;
91 } else if tag_name == "dependencies" && in_metadata {
92 in_dependencies = true;
93 } else if tag_name == "group" && in_dependencies {
94 current_group_framework = e
95 .attributes()
96 .filter_map(|a| a.ok())
97 .find(|attr| attr.key.as_ref() == b"targetFramework")
98 .and_then(|attr| String::from_utf8(attr.value.to_vec()).ok());
99 } else if tag_name == "repository" && in_metadata {
100 let repository = parse_repository_metadata(&e);
101 vcs_url = repository.vcs_url;
102 repository_branch = repository.branch;
103 repository_commit = repository.commit;
104 } else if tag_name == "license" && in_metadata {
105 license_type = e
106 .attributes()
107 .filter_map(|a| a.ok())
108 .find(|attr| attr.key.as_ref() == b"type")
109 .and_then(|attr| String::from_utf8(attr.value.to_vec()).ok());
110 }
111 }
112 Ok(Event::Empty(e)) => {
113 let tag_name = String::from_utf8_lossy(e.name().as_ref()).to_string();
114
115 if tag_name == "dependency" && in_dependencies {
116 if let Some(dep) =
117 parse_nuspec_dependency(&e, current_group_framework.as_deref())
118 {
119 dependencies.push(dep);
120 }
121 } else if tag_name == "repository" && in_metadata {
122 let repository = parse_repository_metadata(&e);
123 vcs_url = repository.vcs_url;
124 repository_branch = repository.branch;
125 repository_commit = repository.commit;
126 }
127 }
128 Ok(Event::Text(e)) => {
129 if !in_metadata {
130 continue;
131 }
132
133 let text = e.decode().ok().map(|s| s.trim().to_string());
134 if let Some(text) = text.filter(|s| !s.is_empty()) {
135 match current_element.as_str() {
136 "id" => name = Some(text),
137 "version" => version = Some(text),
138 "summary" => summary = Some(text),
139 "description" => description = Some(text),
140 "title" => title = Some(text),
141 "projectUrl" => homepage_url = Some(text),
142 "authors" => {
143 parties.push(build_nuget_party("author", text));
144 }
145 "owners" => {
146 parties.push(build_nuget_party("owner", text));
147 }
148 "license" => {
149 extracted_license_statement = Some(text);
150 }
151 "licenseUrl" => {
152 if extracted_license_statement.is_none() {
153 extracted_license_statement = Some(text);
154 }
155 }
156 "copyright" => copyright = Some(text),
157 _ => {}
158 }
159 }
160 }
161 Ok(Event::End(e)) => {
162 let tag_name = String::from_utf8_lossy(e.name().as_ref()).to_string();
163
164 if tag_name == "metadata" {
165 in_metadata = false;
166 } else if tag_name == "dependencies" {
167 in_dependencies = false;
168 } else if tag_name == "group" {
169 current_group_framework = None;
170 }
171
172 current_element.clear();
173 }
174 Ok(Event::Eof) => break,
175 Err(e) => {
176 warn!("Error parsing .nuspec at {:?}: {}", path, e);
177 return vec![default_package_data(Some(DatasourceId::NugetNuspec))];
178 }
179 _ => {}
180 }
181 buf.clear();
182 }
183
184 let final_description = build_nuget_description(
185 summary.as_deref(),
186 description.as_deref(),
187 title.as_deref(),
188 name.as_deref(),
189 );
190
191 let (repository_homepage_url, repository_download_url, api_data_url) =
192 build_nuget_urls(name.as_deref(), version.as_deref());
193
194 let purl = build_nuget_purl(name.as_deref(), version.as_deref());
195
196 let (declared_license_expression, declared_license_expression_spdx, license_detections) =
197 if license_type.as_deref() == Some("expression") {
198 normalize_spdx_declared_license(extracted_license_statement.as_deref())
199 } else {
200 empty_declared_license_data()
201 };
202
203 let holder = None;
204
205 let mut extra_data = serde_json::Map::new();
206 insert_extra_string(&mut extra_data, "license_type", license_type.clone());
207 if license_type.as_deref() == Some("file") {
208 insert_extra_string(
209 &mut extra_data,
210 "license_file",
211 extracted_license_statement.clone(),
212 );
213 }
214 insert_extra_string(&mut extra_data, "repository_branch", repository_branch);
215 insert_extra_string(&mut extra_data, "repository_commit", repository_commit);
216
217 vec![PackageData {
218 datasource_id: Some(DatasourceId::NugetNuspec),
219 package_type: Some(Self::PACKAGE_TYPE),
220 name: name.map(truncate_field),
221 version: version.map(truncate_field),
222 purl,
223 description: final_description.map(truncate_field),
224 homepage_url: homepage_url.map(truncate_field),
225 parties,
226 dependencies,
227 declared_license_expression,
228 declared_license_expression_spdx,
229 license_detections,
230 extracted_license_statement: extracted_license_statement.map(truncate_field),
231 copyright: copyright.map(truncate_field),
232 holder,
233 vcs_url: vcs_url.map(truncate_field),
234 extra_data: if extra_data.is_empty() {
235 None
236 } else {
237 Some(extra_data.into_iter().collect())
238 },
239 repository_homepage_url,
240 repository_download_url,
241 api_data_url,
242 ..default_package_data(Some(DatasourceId::NugetNuspec))
243 }]
244 }
245}
246
247pub(super) fn parse_nuspec_dependency(
248 element: &quick_xml::events::BytesStart,
249 framework: Option<&str>,
250) -> Option<Dependency> {
251 let mut id = None;
252 let mut version = None;
253 let mut include = None;
254 let mut exclude = None;
255
256 for attr in element.attributes().filter_map(|a| a.ok()) {
257 match attr.key.as_ref() {
258 b"id" => id = String::from_utf8(attr.value.to_vec()).ok(),
259 b"version" => version = String::from_utf8(attr.value.to_vec()).ok(),
260 b"include" => include = String::from_utf8(attr.value.to_vec()).ok(),
261 b"exclude" => exclude = String::from_utf8(attr.value.to_vec()).ok(),
262 _ => {}
263 }
264 }
265
266 let name = id?;
267 let purl = PackageUrl::new("nuget", &name).ok().map(|p| p.to_string());
268
269 let mut extra_data = serde_json::Map::new();
270 if let Some(fw) = framework {
271 extra_data.insert(
272 "framework".to_string(),
273 serde_json::Value::String(fw.to_string()),
274 );
275 }
276 if let Some(inc) = include {
277 extra_data.insert("include".to_string(), serde_json::Value::String(inc));
278 }
279 if let Some(exc) = exclude {
280 extra_data.insert("exclude".to_string(), serde_json::Value::String(exc));
281 }
282
283 Some(Dependency {
284 purl,
285 extracted_requirement: version,
286 scope: Some("dependency".to_string()),
287 is_runtime: Some(true),
288 is_optional: Some(false),
289 is_pinned: Some(false),
290 is_direct: Some(true),
291 resolved_package: None,
292 extra_data: if extra_data.is_empty() {
293 None
294 } else {
295 Some(extra_data.into_iter().collect())
296 },
297 })
298}
299
300pub(super) fn parse_nuspec_content(content: &str) -> Result<PackageData, String> {
301 use quick_xml::Reader;
302
303 let mut xml_reader = Reader::from_str(content);
304 xml_reader.config_mut().trim_text(true);
305
306 let mut name = None;
307 let mut version = None;
308 let mut description = None;
309 let mut homepage_url = None;
310 let mut parties = Vec::new();
311 let mut dependencies = Vec::new();
312 let mut extracted_license_statement = None;
313 let mut license_type = None;
314 let mut copyright = None;
315 let mut vcs_url = None;
316 let mut repository_branch = None;
317 let mut repository_commit = None;
318
319 let mut buf = Vec::new();
320 let mut current_element = String::new();
321 let mut in_metadata = false;
322 let mut in_dependencies = false;
323 let mut current_group_framework = None;
324 let mut iteration_count: usize = 0;
325
326 loop {
327 iteration_count += 1;
328 if iteration_count > MAX_ITERATION_COUNT {
329 return Err(format!(
330 "Iteration limit exceeded parsing .nuspec content; stopping at {} items",
331 MAX_ITERATION_COUNT
332 ));
333 }
334 match xml_reader.read_event_into(&mut buf) {
335 Ok(Event::Start(e)) => {
336 let tag_name = String::from_utf8_lossy(e.name().as_ref()).to_string();
337 current_element = tag_name.clone();
338
339 if tag_name == "metadata" {
340 in_metadata = true;
341 } else if tag_name == "dependencies" && in_metadata {
342 in_dependencies = true;
343 } else if tag_name == "group" && in_dependencies {
344 current_group_framework = e
345 .attributes()
346 .filter_map(|a| a.ok())
347 .find(|attr| attr.key.as_ref() == b"targetFramework")
348 .and_then(|attr| String::from_utf8(attr.value.to_vec()).ok());
349 } else if tag_name == "repository" && in_metadata {
350 let repository = parse_repository_metadata(&e);
351 vcs_url = repository.vcs_url;
352 repository_branch = repository.branch;
353 repository_commit = repository.commit;
354 } else if tag_name == "license" && in_metadata {
355 license_type = e
356 .attributes()
357 .filter_map(|a| a.ok())
358 .find(|attr| attr.key.as_ref() == b"type")
359 .and_then(|attr| String::from_utf8(attr.value.to_vec()).ok());
360 }
361 }
362 Ok(Event::Empty(e)) => {
363 let tag_name = String::from_utf8_lossy(e.name().as_ref()).to_string();
364
365 if tag_name == "dependency" && in_dependencies {
366 if let Some(dep) =
367 parse_nuspec_dependency(&e, current_group_framework.as_deref())
368 {
369 dependencies.push(dep);
370 }
371 } else if tag_name == "repository" && in_metadata {
372 let repository = parse_repository_metadata(&e);
373 vcs_url = repository.vcs_url;
374 repository_branch = repository.branch;
375 repository_commit = repository.commit;
376 }
377 }
378 Ok(Event::Text(e)) => {
379 if !in_metadata {
380 continue;
381 }
382
383 let text = e.decode().ok().map(|s| s.trim().to_string());
384 if let Some(text) = text.filter(|s| !s.is_empty()) {
385 match current_element.as_str() {
386 "id" => name = Some(text),
387 "version" => version = Some(text),
388 "description" => description = Some(text),
389 "projectUrl" => homepage_url = Some(text),
390 "authors" => {
391 parties.push(build_nuget_party("author", text));
392 }
393 "owners" => {
394 parties.push(build_nuget_party("owner", text));
395 }
396 "license" => {
397 extracted_license_statement = Some(text);
398 }
399 "licenseUrl" => {
400 if extracted_license_statement.is_none() {
401 extracted_license_statement = Some(text);
402 }
403 }
404 "copyright" => copyright = Some(text),
405 _ => {}
406 }
407 }
408 }
409 Ok(Event::End(e)) => {
410 let tag_name = String::from_utf8_lossy(e.name().as_ref()).to_string();
411
412 if tag_name == "metadata" {
413 in_metadata = false;
414 } else if tag_name == "dependencies" {
415 in_dependencies = false;
416 } else if tag_name == "group" {
417 current_group_framework = None;
418 }
419
420 current_element.clear();
421 }
422 Ok(Event::Eof) => break,
423 Err(e) => {
424 return Err(format!("XML parsing error: {}", e));
425 }
426 _ => {}
427 }
428 buf.clear();
429 }
430
431 let (repository_homepage_url, repository_download_url, api_data_url) =
432 build_nuget_urls(name.as_deref(), version.as_deref());
433
434 let (declared_license_expression, declared_license_expression_spdx, license_detections) =
435 if license_type.as_deref() == Some("expression") {
436 normalize_spdx_declared_license(extracted_license_statement.as_deref())
437 } else {
438 empty_declared_license_data()
439 };
440
441 let holder = None;
442
443 let mut extra_data = serde_json::Map::new();
444 insert_extra_string(&mut extra_data, "license_type", license_type.clone());
445 if license_type.as_deref() == Some("file") {
446 insert_extra_string(
447 &mut extra_data,
448 "license_file",
449 extracted_license_statement.clone(),
450 );
451 }
452 insert_extra_string(&mut extra_data, "repository_branch", repository_branch);
453 insert_extra_string(&mut extra_data, "repository_commit", repository_commit);
454
455 Ok(PackageData {
456 datasource_id: Some(DatasourceId::NugetNupkg),
457 package_type: Some(super::nupkg::NupkgParser::PACKAGE_TYPE),
458 name: name.map(truncate_field),
459 version: version.map(truncate_field),
460 description: description.map(truncate_field),
461 homepage_url: homepage_url.map(truncate_field),
462 parties,
463 dependencies,
464 declared_license_expression,
465 declared_license_expression_spdx,
466 license_detections,
467 extracted_license_statement: extracted_license_statement.map(truncate_field),
468 copyright: copyright.map(truncate_field),
469 holder,
470 vcs_url: vcs_url.map(truncate_field),
471 extra_data: if extra_data.is_empty() {
472 None
473 } else {
474 Some(extra_data.into_iter().collect())
475 },
476 repository_homepage_url,
477 repository_download_url,
478 api_data_url,
479 ..default_package_data(Some(DatasourceId::NugetNupkg))
480 })
481}
482
483crate::register_parser!(
484 ".NET .nuspec package specification",
485 &["**/*.nuspec"],
486 "nuget",
487 "C#",
488 Some("https://learn.microsoft.com/en-us/nuget/reference/nuspec"),
489);