Skip to content

Limit full tree size when converting from BOM #630

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
attiasas wants to merge 2 commits into
base: dev
Choose a base branch
from
Open

Limit full tree size when converting from BOM #630

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
716425a
Limit full tree size when converting from BOM
attiasas Dec 25, 2025
44b09e7
fix static
attiasas Dec 25, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 13 additions & 5 deletions utils/results/common.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,9 @@ const (
DirectDependencyPathLength = 2
nodeModules = "node_modules"

// MaxUniqueAppearances defines the maximum number of times a dependency can appear in a dependency tree.
MaxUniqueAppearances = 10

// <FILE_REF>#L<START_LINE>C<START_COLUMN>-L<END_LINE>C<END_COLUMN>
LocationIdTemplate = "%s#L%dC%d-L%dC%d"
// Applicability properties for cdx
Expand Down Expand Up @@ -1024,10 +1027,11 @@ func BomToFullTree(sbom *cyclonedx.BOM, convertToXrayCompId bool) (fullDependenc
// No dependencies or components in the SBOM, return an empty slice
return
}
dependencyAppearances := map[string]int8{}
for _, rootEntry := range cdxutils.GetRootDependenciesEntries(sbom, false) {
// Create a new GraphNode with ref as the ID, when populating the tree we need to use the ref as the ID
currentTree := &xrayUtils.GraphNode{Id: rootEntry.Ref}
populateDepsNodeDataFromBom(currentTree, sbom.Dependencies)
populateDepsNodeDataFromBom(currentTree, sbom.Dependencies, dependencyAppearances)
fullDependencyTrees = append(fullDependencyTrees, currentTree)
}
// Translate refs to Purl/Xray IDs
Expand All @@ -1037,17 +1041,21 @@ func BomToFullTree(sbom *cyclonedx.BOM, convertToXrayCompId bool) (fullDependenc
return
}

func populateDepsNodeDataFromBom(node *xrayUtils.GraphNode, dependencies *[]cyclonedx.Dependency) {
if node == nil || node.NodeHasLoop() {
// If the node is nil or has a loop, return
func populateDepsNodeDataFromBom(node *xrayUtils.GraphNode, dependencies *[]cyclonedx.Dependency, dependencyAppearances map[string]int8) {
if node == nil {
return
}
dependencyAppearances[node.Id]++
if dependencyAppearances[node.Id] >= MaxUniqueAppearances || node.NodeHasLoop() {
// If the node has a loop or appeared too many times, stop the recursion
return
}
for _, dep := range cdxutils.GetDirectDependencies(dependencies, node.Id) {
depNode := &xrayUtils.GraphNode{Id: dep, Parent: node}
// Add the dependency to the current node
node.Nodes = append(node.Nodes, depNode)
// Recursively populate the node data
populateDepsNodeDataFromBom(depNode, dependencies)
populateDepsNodeDataFromBom(depNode, dependencies, dependencyAppearances)
}
}

Expand Down
Loading