1use std::fs::File;
5use std::io::BufReader;
6use std::path::Path;
7
8use crate::models::{DatasourceId, Dependency, PackageData, PackageType};
9use crate::parser_warn as warn;
10use packageurl::PackageUrl;
11use quick_xml::Reader;
12use quick_xml::events::Event;
13
14use super::super::PackageParser;
15use super::super::license_normalization::{
16 empty_declared_license_data, normalize_spdx_declared_license,
17};
18use super::super::utils::{MAX_ITERATION_COUNT, truncate_field};
19use super::{
20 build_nuget_description, build_nuget_party, build_nuget_purl, build_nuget_urls,
21 check_file_size, default_package_data, insert_extra_string, parse_repository_metadata,
22};
23
24pub struct NuspecParser;
25
26impl PackageParser for NuspecParser {
27 const PACKAGE_TYPE: PackageType = PackageType::Nuget;
28
29 fn is_match(path: &Path) -> bool {
30 path.extension()
31 .and_then(|ext| ext.to_str())
32 .is_some_and(|ext| ext == "nuspec")
33 }
34
35 fn extract_packages(path: &Path) -> Vec<PackageData> {
36 if let Err(e) = check_file_size(path) {
37 warn!("{}", e);
38 return vec![default_package_data(Some(DatasourceId::NugetNuspec))];
39 }
40
41 let file = match File::open(path) {
42 Ok(f) => f,
43 Err(e) => {
44 warn!("Failed to open .nuspec at {:?}: {}", path, e);
45 return vec![default_package_data(Some(DatasourceId::NugetNuspec))];
46 }
47 };
48
49 let reader = BufReader::new(file);
50 let mut xml_reader = Reader::from_reader(reader);
51 xml_reader.config_mut().trim_text(true);
52
53 let mut name = None;
54 let mut version = None;
55 let mut summary = None;
56 let mut description = None;
57 let mut title = None;
58 let mut homepage_url = None;
59 let mut parties = Vec::new();
60 let mut dependencies = Vec::new();
61 let mut extracted_license_statement = None;
62 let mut license_type = None;
63 let mut copyright = None;
64 let mut vcs_url = None;
65 let mut repository_branch = None;
66 let mut repository_commit = None;
67
68 let mut buf = Vec::new();
69 let mut current_element = String::new();
70 let mut in_metadata = false;
71 let mut in_dependencies = false;
72 let mut current_group_framework = None;
73 let mut iteration_count: usize = 0;
74
75 loop {
76 iteration_count += 1;
77 if iteration_count > MAX_ITERATION_COUNT {
78 warn!(
79 "Iteration limit exceeded in .nuspec at {:?}; stopping at {} items",
80 path, MAX_ITERATION_COUNT
81 );
82 break;
83 }
84 match xml_reader.read_event_into(&mut buf) {
85 Ok(Event::Start(e)) => {
86 let tag_name = String::from_utf8_lossy(e.name().as_ref()).to_string();
87 current_element = tag_name.clone();
88
89 if tag_name == "metadata" {
90 in_metadata = true;
91 } else if tag_name == "dependencies" && in_metadata {
92 in_dependencies = true;
93 } else if tag_name == "group" && in_dependencies {
94 current_group_framework = e
95 .attributes()
96 .filter_map(|a| a.ok())
97 .find(|attr| attr.key.as_ref() == b"targetFramework")
98 .and_then(|attr| String::from_utf8(attr.value.to_vec()).ok());
99 } else if tag_name == "repository" && in_metadata {
100 let repository = parse_repository_metadata(&e);
101 vcs_url = repository.vcs_url;
102 repository_branch = repository.branch;
103 repository_commit = repository.commit;
104 } else if tag_name == "license" && in_metadata {
105 license_type = e
106 .attributes()
107 .filter_map(|a| a.ok())
108 .find(|attr| attr.key.as_ref() == b"type")
109 .and_then(|attr| String::from_utf8(attr.value.to_vec()).ok());
110 }
111 }
112 Ok(Event::Empty(e)) => {
113 let tag_name = String::from_utf8_lossy(e.name().as_ref()).to_string();
114
115 if tag_name == "dependency" && in_dependencies {
116 if let Some(dep) =
117 parse_nuspec_dependency(&e, current_group_framework.as_deref())
118 {
119 dependencies.push(dep);
120 }
121 } else if tag_name == "repository" && in_metadata {
122 let repository = parse_repository_metadata(&e);
123 vcs_url = repository.vcs_url;
124 repository_branch = repository.branch;
125 repository_commit = repository.commit;
126 }
127 }
128 Ok(Event::Text(e)) => {
129 if !in_metadata {
130 continue;
131 }
132
133 let text = e.decode().ok().map(|s| s.trim().to_string());
134 if let Some(text) = text.filter(|s| !s.is_empty()) {
135 match current_element.as_str() {
136 "id" => name = Some(text),
137 "version" => version = Some(text),
138 "summary" => summary = Some(text),
139 "description" => description = Some(text),
140 "title" => title = Some(text),
141 "projectUrl" => homepage_url = Some(text),
142 "authors" => {
143 parties.push(build_nuget_party("author", text));
144 }
145 "owners" => {
146 parties.push(build_nuget_party("owner", text));
147 }
148 "license" => {
149 extracted_license_statement = Some(text);
150 }
151 "licenseUrl" if extracted_license_statement.is_none() => {
152 extracted_license_statement = Some(text);
153 }
154 "licenseUrl" => {}
155 "copyright" => copyright = Some(text),
156 _ => {}
157 }
158 }
159 }
160 Ok(Event::End(e)) => {
161 let tag_name = String::from_utf8_lossy(e.name().as_ref()).to_string();
162
163 if tag_name == "metadata" {
164 in_metadata = false;
165 } else if tag_name == "dependencies" {
166 in_dependencies = false;
167 } else if tag_name == "group" {
168 current_group_framework = None;
169 }
170
171 current_element.clear();
172 }
173 Ok(Event::Eof) => break,
174 Err(e) => {
175 warn!("Error parsing .nuspec at {:?}: {}", path, e);
176 return vec![default_package_data(Some(DatasourceId::NugetNuspec))];
177 }
178 _ => {}
179 }
180 buf.clear();
181 }
182
183 let final_description = build_nuget_description(
184 summary.as_deref(),
185 description.as_deref(),
186 title.as_deref(),
187 name.as_deref(),
188 );
189
190 let (repository_homepage_url, repository_download_url, api_data_url) =
191 build_nuget_urls(name.as_deref(), version.as_deref());
192
193 let purl = build_nuget_purl(name.as_deref(), version.as_deref());
194
195 let (declared_license_expression, declared_license_expression_spdx, license_detections) =
196 if license_type.as_deref() == Some("expression") {
197 normalize_spdx_declared_license(extracted_license_statement.as_deref())
198 } else {
199 empty_declared_license_data()
200 };
201
202 let holder = None;
203
204 let mut extra_data = serde_json::Map::new();
205 insert_extra_string(&mut extra_data, "license_type", license_type.clone());
206 if license_type.as_deref() == Some("file") {
207 insert_extra_string(
208 &mut extra_data,
209 "license_file",
210 extracted_license_statement.clone(),
211 );
212 }
213 insert_extra_string(&mut extra_data, "repository_branch", repository_branch);
214 insert_extra_string(&mut extra_data, "repository_commit", repository_commit);
215
216 vec![PackageData {
217 datasource_id: Some(DatasourceId::NugetNuspec),
218 package_type: Some(Self::PACKAGE_TYPE),
219 name: name.map(truncate_field),
220 version: version.map(truncate_field),
221 purl,
222 description: final_description.map(truncate_field),
223 homepage_url: homepage_url.map(truncate_field),
224 parties,
225 dependencies,
226 declared_license_expression,
227 declared_license_expression_spdx,
228 license_detections,
229 extracted_license_statement: extracted_license_statement.map(truncate_field),
230 copyright: copyright.map(truncate_field),
231 holder,
232 vcs_url: vcs_url.map(truncate_field),
233 extra_data: if extra_data.is_empty() {
234 None
235 } else {
236 Some(extra_data.into_iter().collect())
237 },
238 repository_homepage_url,
239 repository_download_url,
240 api_data_url,
241 ..default_package_data(Some(DatasourceId::NugetNuspec))
242 }]
243 }
244}
245
246pub(super) fn parse_nuspec_dependency(
247 element: &quick_xml::events::BytesStart,
248 framework: Option<&str>,
249) -> Option<Dependency> {
250 let mut id = None;
251 let mut version = None;
252 let mut include = None;
253 let mut exclude = None;
254
255 for attr in element.attributes().filter_map(|a| a.ok()) {
256 match attr.key.as_ref() {
257 b"id" => id = String::from_utf8(attr.value.to_vec()).ok(),
258 b"version" => version = String::from_utf8(attr.value.to_vec()).ok(),
259 b"include" => include = String::from_utf8(attr.value.to_vec()).ok(),
260 b"exclude" => exclude = String::from_utf8(attr.value.to_vec()).ok(),
261 _ => {}
262 }
263 }
264
265 let name = id?;
266 let purl = PackageUrl::new("nuget", &name).ok().map(|p| p.to_string());
267
268 let mut extra_data = serde_json::Map::new();
269 if let Some(fw) = framework {
270 extra_data.insert(
271 "framework".to_string(),
272 serde_json::Value::String(fw.to_string()),
273 );
274 }
275 if let Some(inc) = include {
276 extra_data.insert("include".to_string(), serde_json::Value::String(inc));
277 }
278 if let Some(exc) = exclude {
279 extra_data.insert("exclude".to_string(), serde_json::Value::String(exc));
280 }
281
282 Some(Dependency {
283 purl,
284 extracted_requirement: version,
285 scope: Some("dependency".to_string()),
286 is_runtime: Some(true),
287 is_optional: Some(false),
288 is_pinned: Some(false),
289 is_direct: Some(true),
290 resolved_package: None,
291 extra_data: if extra_data.is_empty() {
292 None
293 } else {
294 Some(extra_data.into_iter().collect())
295 },
296 })
297}
298
299pub(super) fn parse_nuspec_content(content: &str) -> Result<PackageData, String> {
300 use quick_xml::Reader;
301
302 let mut xml_reader = Reader::from_str(content);
303 xml_reader.config_mut().trim_text(true);
304
305 let mut name = None;
306 let mut version = None;
307 let mut description = None;
308 let mut homepage_url = None;
309 let mut parties = Vec::new();
310 let mut dependencies = Vec::new();
311 let mut extracted_license_statement = None;
312 let mut license_type = None;
313 let mut copyright = None;
314 let mut vcs_url = None;
315 let mut repository_branch = None;
316 let mut repository_commit = None;
317
318 let mut buf = Vec::new();
319 let mut current_element = String::new();
320 let mut in_metadata = false;
321 let mut in_dependencies = false;
322 let mut current_group_framework = None;
323 let mut iteration_count: usize = 0;
324
325 loop {
326 iteration_count += 1;
327 if iteration_count > MAX_ITERATION_COUNT {
328 return Err(format!(
329 "Iteration limit exceeded parsing .nuspec content; stopping at {} items",
330 MAX_ITERATION_COUNT
331 ));
332 }
333 match xml_reader.read_event_into(&mut buf) {
334 Ok(Event::Start(e)) => {
335 let tag_name = String::from_utf8_lossy(e.name().as_ref()).to_string();
336 current_element = tag_name.clone();
337
338 if tag_name == "metadata" {
339 in_metadata = true;
340 } else if tag_name == "dependencies" && in_metadata {
341 in_dependencies = true;
342 } else if tag_name == "group" && in_dependencies {
343 current_group_framework = e
344 .attributes()
345 .filter_map(|a| a.ok())
346 .find(|attr| attr.key.as_ref() == b"targetFramework")
347 .and_then(|attr| String::from_utf8(attr.value.to_vec()).ok());
348 } else if tag_name == "repository" && in_metadata {
349 let repository = parse_repository_metadata(&e);
350 vcs_url = repository.vcs_url;
351 repository_branch = repository.branch;
352 repository_commit = repository.commit;
353 } else if tag_name == "license" && in_metadata {
354 license_type = e
355 .attributes()
356 .filter_map(|a| a.ok())
357 .find(|attr| attr.key.as_ref() == b"type")
358 .and_then(|attr| String::from_utf8(attr.value.to_vec()).ok());
359 }
360 }
361 Ok(Event::Empty(e)) => {
362 let tag_name = String::from_utf8_lossy(e.name().as_ref()).to_string();
363
364 if tag_name == "dependency" && in_dependencies {
365 if let Some(dep) =
366 parse_nuspec_dependency(&e, current_group_framework.as_deref())
367 {
368 dependencies.push(dep);
369 }
370 } else if tag_name == "repository" && in_metadata {
371 let repository = parse_repository_metadata(&e);
372 vcs_url = repository.vcs_url;
373 repository_branch = repository.branch;
374 repository_commit = repository.commit;
375 }
376 }
377 Ok(Event::Text(e)) => {
378 if !in_metadata {
379 continue;
380 }
381
382 let text = e.decode().ok().map(|s| s.trim().to_string());
383 if let Some(text) = text.filter(|s| !s.is_empty()) {
384 match current_element.as_str() {
385 "id" => name = Some(text),
386 "version" => version = Some(text),
387 "description" => description = Some(text),
388 "projectUrl" => homepage_url = Some(text),
389 "authors" => {
390 parties.push(build_nuget_party("author", text));
391 }
392 "owners" => {
393 parties.push(build_nuget_party("owner", text));
394 }
395 "license" => {
396 extracted_license_statement = Some(text);
397 }
398 "licenseUrl" if extracted_license_statement.is_none() => {
399 extracted_license_statement = Some(text);
400 }
401 "licenseUrl" => {}
402 "copyright" => copyright = Some(text),
403 _ => {}
404 }
405 }
406 }
407 Ok(Event::End(e)) => {
408 let tag_name = String::from_utf8_lossy(e.name().as_ref()).to_string();
409
410 if tag_name == "metadata" {
411 in_metadata = false;
412 } else if tag_name == "dependencies" {
413 in_dependencies = false;
414 } else if tag_name == "group" {
415 current_group_framework = None;
416 }
417
418 current_element.clear();
419 }
420 Ok(Event::Eof) => break,
421 Err(e) => {
422 return Err(format!("XML parsing error: {}", e));
423 }
424 _ => {}
425 }
426 buf.clear();
427 }
428
429 let (repository_homepage_url, repository_download_url, api_data_url) =
430 build_nuget_urls(name.as_deref(), version.as_deref());
431
432 let (declared_license_expression, declared_license_expression_spdx, license_detections) =
433 if license_type.as_deref() == Some("expression") {
434 normalize_spdx_declared_license(extracted_license_statement.as_deref())
435 } else {
436 empty_declared_license_data()
437 };
438
439 let holder = None;
440
441 let mut extra_data = serde_json::Map::new();
442 insert_extra_string(&mut extra_data, "license_type", license_type.clone());
443 if license_type.as_deref() == Some("file") {
444 insert_extra_string(
445 &mut extra_data,
446 "license_file",
447 extracted_license_statement.clone(),
448 );
449 }
450 insert_extra_string(&mut extra_data, "repository_branch", repository_branch);
451 insert_extra_string(&mut extra_data, "repository_commit", repository_commit);
452
453 Ok(PackageData {
454 datasource_id: Some(DatasourceId::NugetNupkg),
455 package_type: Some(super::nupkg::NupkgParser::PACKAGE_TYPE),
456 name: name.map(truncate_field),
457 version: version.map(truncate_field),
458 description: description.map(truncate_field),
459 homepage_url: homepage_url.map(truncate_field),
460 parties,
461 dependencies,
462 declared_license_expression,
463 declared_license_expression_spdx,
464 license_detections,
465 extracted_license_statement: extracted_license_statement.map(truncate_field),
466 copyright: copyright.map(truncate_field),
467 holder,
468 vcs_url: vcs_url.map(truncate_field),
469 extra_data: if extra_data.is_empty() {
470 None
471 } else {
472 Some(extra_data.into_iter().collect())
473 },
474 repository_homepage_url,
475 repository_download_url,
476 api_data_url,
477 ..default_package_data(Some(DatasourceId::NugetNupkg))
478 })
479}
480
481crate::register_parser!(
482 ".NET .nuspec package specification",
483 &["**/*.nuspec"],
484 "nuget",
485 "C#",
486 Some("https://learn.microsoft.com/en-us/nuget/reference/nuspec"),
487);