Improve missing package URL handling #109

felickz · 2025-05-09T05:16:35Z

This pull request enhances the robustness of the ComponentDetection class by adding defensive programming measures to handle invalid or missing packageUrl values gracefully. The changes improve error handling and debugging capabilities to ensure the system can handle edge cases without crashing. The dependency submission API is keyed by package url so this scenario will prevent the dependency graph from having any information about this package.

Fixes TypeError: Cannot read properties of null (reading 'Scheme')

Seems to be a highly visible issue introduced with component detection V5.2.16 that introduced a new detector: microsoft/component-detection#1388

Before:

2025-05-09T04:41:52.6402315Z ##[notice]Submitting snapshot...
2025-05-09T04:41:52.7223924Z 
2025-05-09T04:41:52.7225614Z /home/runner/work/_actions/advanced-security/component-detection-dependency-submission-action/v0.0.3/webpack:/component-detection-action/componentDetection.ts:124
2025-05-09T04:41:52.7227254Z     var packageUrl = `${packageUrlJson.Scheme}:${packageUrlJson.Type}/`;
2025-05-09T04:41:52.7227944Z ^
2025-05-09T04:41:52.7228418Z TypeError: Cannot read properties of null (reading 'Scheme')
2025-05-09T04:41:52.7230034Z     at Function.makePackageUrl (/home/runner/work/_actions/advanced-security/component-detection-dependency-submission-action/v0.0.3/webpack:/component-detection-action/componentDetection.ts:124:1)
2025-05-09T04:41:52.7232136Z     at Function.<anonymous> (/home/runner/work/_actions/advanced-security/component-detection-dependency-submission-action/v0.0.3/webpack:/component-detection-action/componentDetection.ts:78:1)
2025-05-09T04:41:52.7232956Z     at Generator.next (<anonymous>)
2025-05-09T04:41:52.7233520Z     at /home/runner/work/_actions/advanced-security/component-detection-dependency-submission-action/v0.0.3/dist/index.js:24837:71
2025-05-09T04:41:52.7234088Z     at new Promise (<anonymous>)
2025-05-09T04:41:52.7234783Z     at __webpack_modules__.4878.__awaiter (/home/runner/work/_actions/advanced-security/component-detection-dependency-submission-action/v0.0.3/dist/index.js:24833:12)
2025-05-09T04:41:52.7236261Z     at /home/runner/work/_actions/advanced-security/component-detection-dependency-submission-action/v0.0.3/webpack:/component-detection-action/componentDetection.ts:77:1
2025-05-09T04:41:52.7237489Z     at Array.forEach (<anonymous>)
2025-05-09T04:41:52.7238779Z     at Function.<anonymous> (/home/runner/work/_actions/advanced-security/component-detection-dependency-submission-action/v0.0.3/webpack:/component-detection-action/componentDetection.ts:77:1)
2025-05-09T04:41:52.7240288Z     at Generator.next (<anonymous>)

After (debug test):

##[debug]Skipping component detected without packageUrl: {
##[debug]  "id": "8.0.115 net8.0 unknown - DotNet",
##[debug]  "name": "unnamed",
##[debug]  "type": "DotNet"
##[debug]}

Test 2:

##[debug]Skipping component detected without packageUrl: {
##[debug]  "id": "8.0.115 netcoreapp2.0 unknown - DotNet",
##[debug]  "name": "unnamed",
##[debug]  "type": "DotNet"
##[debug]}
##[debug]Sorting out transitive dependencies
##[debug]Manifests: 1

…ling

felickz · 2025-05-09T05:42:19Z

Impacted by #104

felickz · 2025-05-09T05:42:43Z

Fixes #107

GeekMasher · 2025-05-09T07:58:50Z

The tests are failing. Are you going to update then before merging?

felickz · 2025-05-09T14:14:07Z

The tests are failing. Are you going to update then before merging?

Tests are failing due to #104 so wasn't planning on delaying this fix (hard failures on every dotnet project) to refactor those

felickz · 2025-05-09T21:45:44Z

The tests are failing. Are you going to update then before merging?

Tests are failing due to #104 so wasn't planning on delaying this fix (hard failures on every dotnet project) to refactor those

Fixing jest/eslint with major version bump: #111

…urls

Copilot

Pull Request Overview

This PR enhances the ComponentDetection class to skip invalid or missing packageUrl values and adds defensive checks in makePackageUrl to prevent runtime errors. It also includes new unit tests to cover null inputs.

Added early returns and debug logs when a component or referrer lacks a valid packageUrl.
Wrapped URL construction in a try-catch and added a null/undefined guard.
Introduced tests for makePackageUrl handling of null arguments and properties.

Reviewed Changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

File	Description
componentDetection.ts	Added defensive checks for missing/invalid `packageUrl` and wrapped URL creation in try-catch with debug logging.
componentDetection.test.ts	Added tests for `makePackageUrl` to verify behavior on null inputs.

Comments suppressed due to low confidence (3)

componentDetection.ts:157

makePackageUrl currently only guards against null or undefined packageUrlJson, but allows objects with null Scheme or Type to produce strings like 'null:null/'. Add checks to return an empty string when Scheme or Type are missing or not valid strings.

public static makePackageUrl(packageUrlJson: any): string {

componentDetection.ts:77

[nitpick] The loop variable 'component' shadows the nested 'component.component' property, which can be confusing. Consider renaming the iterator variable (e.g., to 'detectedComponent') for clarity.

json.componentsFound.forEach(async (component: any) => {

componentDetection.ts:157

[nitpick] Consider adding a JSDoc comment for makePackageUrl to describe its parameters, behavior, and the meaning of an empty-string return for invalid inputs.

public static makePackageUrl(packageUrlJson: any): string {

componentDetection.test.ts

Co-authored-by: Copilot <[email protected]>

Copilot

Pull Request Overview

Enhance ComponentDetection to gracefully handle missing or invalid packageUrl values and prevent runtime errors by adding defensive checks and improving debugging output.

Skip processing components and referrers when packageUrl is missing or invalid, with explanatory debug logs
Wrap URL construction in makePackageUrl with null checks and try/catch to return an empty string on failure
Add unit tests covering null and undefined packageUrlJson inputs

Reviewed Changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.

File	Description
componentDetection.ts	Added guards for missing/invalid `packageUrl` and enhanced `makePackageUrl` with null checks and error handling
componentDetection.test.ts	Introduced tests for `makePackageUrl` handling of null/undefined inputs and added negative test cases

componentDetection.ts

componentDetection.test.ts

Co-authored-by: Copilot <[email protected]>

dangoor

That looks much more robust. Thanks!

felickz added 4 commits May 9, 2025 05:15

Add debug logging for missing packageUrl and improve package URL hand…

5cef7e7

…ling

Improve package URL validation and skip components with invalid URLs

6cf9067

comments

ce6986e

Compile change

977f836

felickz changed the title ~~Add debug logging for missing packageUrl and improve package URL handling~~ Improve package URL handling May 9, 2025

felickz added the enhancement New feature or request label May 9, 2025

felickz marked this pull request as ready for review May 9, 2025 05:41

felickz requested review from a team as code owners May 9, 2025 05:41

felickz requested review from GeekMasher and aegilops and removed request for a team May 9, 2025 05:41

felickz added 3 commits May 12, 2025 20:03

Merge remote-tracking branch 'origin/main' into feature/handle-null-p…

0b3ad66

…urls

Update index.js.map with new build output

5840bc4

Add tests

b69d2d2

felickz changed the title ~~Improve package URL handling~~ Improve missing package URL handling May 12, 2025

felickz requested a review from Copilot May 12, 2025 21:32

Copilot AI reviewed May 12, 2025

View reviewed changes

componentDetection.test.ts Outdated Show resolved Hide resolved

componentDetection.test.ts Outdated Show resolved Hide resolved

componentDetection.test.ts Outdated Show resolved Hide resolved

Update componentDetection.test.ts

fcd2c80

Co-authored-by: Copilot <[email protected]>

felickz requested a review from Copilot May 12, 2025 21:37

Copilot AI reviewed May 12, 2025

View reviewed changes

componentDetection.ts Outdated Show resolved Hide resolved

componentDetection.test.ts Outdated Show resolved Hide resolved

componentDetection.test.ts Outdated Show resolved Hide resolved

componentDetection.test.ts Outdated Show resolved Hide resolved

felickz and others added 4 commits May 12, 2025 17:39

Update componentDetection.test.ts

3f82ca7

Co-authored-by: Copilot <[email protected]>

Update componentDetection.test.ts

203f6e5

Co-authored-by: Copilot <[email protected]>

Refactor tests

47ec470

Validate packageUrlJson structure in makePackageUrl method

73e1388

Merge branch 'main' into feature/handle-null-purls

4a59086

dangoor approved these changes May 14, 2025

View reviewed changes

felickz merged commit 1874d0f into main May 14, 2025
5 of 6 checks passed

felickz deleted the feature/handle-null-purls branch May 14, 2025 18:14

This was referenced May 14, 2025

New DotNet detector breaking the snapshot submission #107

Closed

The run fails because packageUrlJson object is null #80

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Improve missing package URL handling #109

Improve missing package URL handling #109

Uh oh!

felickz commented May 9, 2025 •

edited

Loading

Uh oh!

felickz commented May 9, 2025

Uh oh!

felickz commented May 9, 2025

Uh oh!

GeekMasher commented May 9, 2025

Uh oh!

felickz commented May 9, 2025 •

edited

Loading

Uh oh!

felickz commented May 9, 2025 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

dangoor left a comment

Uh oh!

Uh oh!

Uh oh!

Improve missing package URL handling #109

Improve missing package URL handling #109

Uh oh!

Conversation

felickz commented May 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

felickz commented May 9, 2025

Uh oh!

felickz commented May 9, 2025

Uh oh!

GeekMasher commented May 9, 2025

Uh oh!

felickz commented May 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

felickz commented May 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

dangoor left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

felickz commented May 9, 2025 •

edited

Loading

felickz commented May 9, 2025 •

edited

Loading

felickz commented May 9, 2025 •

edited

Loading