Getting error with newer cdxgen versions for Android projects with FETCH_LICENSE true

[ghost]

We are receiving the error shown below when trying to generate SBOMs for our Android (Java) project with the below command. If we downgrade to version 10.4.3 it works as expected.

Command:
cdxgen -t java -o example-bom.json --spec-version 1.4

Error:
`
file:///opt/homebrew/Cellar/cdxgen/10.8.1/libexec/lib/node_modules/@cyclonedx/cdxgen/utils.js:534
} else if (Object.keys(l).length) {
^

TypeError: Cannot convert undefined or null to object
at Function.keys ()
at file:///opt/homebrew/Cellar/cdxgen/10.8.1/libexec/lib/node_modules/@cyclonedx/cdxgen/utils.js:534:27
at Array.map ()
at getLicenses (file:///opt/homebrew/Cellar/cdxgen/10.8.1/libexec/lib/node_modules/@cyclonedx/cdxgen/utils.js:507:15)
at addComponent (file:///opt/homebrew/Cellar/cdxgen/10.8.1/libexec/lib/node_modules/@cyclonedx/cdxgen/index.js:814:38)
at file:///opt/homebrew/Cellar/cdxgen/10.8.1/libexec/lib/node_modules/@cyclonedx/cdxgen/index.js:771:7
at Array.forEach ()
at listComponents (file:///opt/homebrew/Cellar/cdxgen/10.8.1/libexec/lib/node_modules/@cyclonedx/cdxgen/index.js:770:9)
at buildBomNSData (file:///opt/homebrew/Cellar/cdxgen/10.8.1/libexec/lib/node_modules/@cyclonedx/cdxgen/index.js:1080:22)
at createJavaBom (file:///opt/homebrew/Cellar/cdxgen/10.8.1/libexec/lib/node_modules/@cyclonedx/cdxgen/index.js:2204:10)

Node.js v20.15.1
`

[prabhu]

Looks like some kind of edge case. The below fix needs to be added here

} else if (l && Object.keys(l).length) {

Could you kindly try with this change and send a PR?

[ghost]

I tried your suggestion and got the below error. Interesting that the comment block for this method mentions being specifically for spec 1.5 but I am specifying 1.4 in my command.

file:///opt/homebrew/Cellar/cdxgen/10.8.1/libexec/lib/node_modules/@cyclonedx/cdxgen/utils.js:478
return f.expression;
^

TypeError: Cannot read properties of undefined (reading 'expression')
at file:///opt/homebrew/Cellar/cdxgen/10.8.1/libexec/lib/node_modules/@cyclonedx/cdxgen/utils.js:478:14
at Array.filter ()
at adjustLicenseInformation (file:///opt/homebrew/Cellar/cdxgen/10.8.1/libexec/lib/node_modules/@cyclonedx/cdxgen/utils.js:477:32)
at getLicenses (file:///opt/homebrew/Cellar/cdxgen/10.8.1/libexec/lib/node_modules/@cyclonedx/cdxgen/utils.js:506:12)
at addComponent (file:///opt/homebrew/Cellar/cdxgen/10.8.1/libexec/lib/node_modules/@cyclonedx/cdxgen/index.js:814:38)
at file:///opt/homebrew/Cellar/cdxgen/10.8.1/libexec/lib/node_modules/@cyclonedx/cdxgen/index.js:771:7
at Array.forEach ()
at listComponents (file:///opt/homebrew/Cellar/cdxgen/10.8.1/libexec/lib/node_modules/@cyclonedx/cdxgen/index.js:770:9)
at buildBomNSData (file:///opt/homebrew/Cellar/cdxgen/10.8.1/libexec/lib/node_modules/@cyclonedx/cdxgen/index.js:1080:22)
at createJavaBom (file:///opt/homebrew/Cellar/cdxgen/10.8.1/libexec/lib/node_modules/@cyclonedx/cdxgen/index.js:2204:10)

Node.js v20.15.1

[prabhu]

hmm, do you know which package is triggering this error? Like add some console.log in index.js line 814 in your machine to find this.

[ghost]

Ah looks like this package has no license...

{
group: 'net.zetetic',
name: 'android-database-sqlcipher',
version: '4.5.1',
qualifiers: { type: 'jar' },
purl: 'pkg:maven/net.zetetic/[email protected]?type=jar',
'bom-ref': 'pkg:maven/net.zetetic/[email protected]?type=jar',
scope: 'optional',
properties: [
{
name: 'GradleProfileName',
value: 'debugAndroidTestCompileClasspath'
}
],
publisher: '',
description: 'SQLCipher for Android is a plugin to SQLite that provides full database encryption.',
repository: {
url: 'https://github.com/sqlcipher/android-database-sqlcipher.git'
},
license: [ undefined ]
}

[prabhu]

are you getting the same error with the latest version as well?

[ghost]

Yes we tried 10.8.6

[ghost]

This change seems to fix it but I have not tested much yet...

return adjustLicenseInformation(
      license.filter((l) => l !== undefined).map((l) => {

[prabhu]

Please send a PR once you have managed to test this. Also create a unit test based on the response for this package. Thank you!