Conversation
The SBOM endpoint auto-detects the media type of an SBOM when no media type is configured. Detection only recognized JSON formats, so a CycloneDX XML SBOM (the default output of the cyclonedx-maven-plugin that the reference documentation tells Maven users to add) fell through to unknown and was served without its content type. Add a CYCLONE_DX_XML case carrying application/vnd.cyclonedx+xml, matched on the CycloneDX XML namespace. Explicitly configured media types and genuinely unknown files keep their previous behaviour. Closes spring-projectsgh-51836 Signed-off-by: wuwei <ww_xyy@163.com>
spring-projects-issues
added
the
status: waiting-for-triage
wilkinsona
added
status: declined
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The SBOM endpoint auto-detects an SBOM's media type when none is configured, but the detection only knows JSON formats: a CycloneDX XML SBOM falls through to
UNKNOWNand the endpoint then serves it without a content type. The reference documentation tells Maven users to add thecyclonedx-maven-plugin, whose default output format is XML, so the documented default setup hits this.This adds a
CYCLONE_DX_XMLcase carryingapplication/vnd.cyclonedx+xml, matched on the CycloneDX XML namespace (http://cyclonedx.org/schema/bom/, which does not collide with the JSON$schemavaluehttp://cyclonedx.org/schema/bom-1.5.schema.json).Behaviour is unchanged for explicitly configured media types (they keep precedence) and for genuinely unknown files (still no content type).
Fixes #51836
Testing:
shouldAutoDetectContentTypeForCycloneDxXml()— red before the change (content type wasnull), green aftershouldAutodetectFormatsnow also covers the new case and keeps asserting the formats stay mutually exclusive:module:spring-boot-actuator:test --tests "org.springframework.boot.actuate.sbom.*": 19 tests, 0 failures (17 on the same base commit without the two new tests):module:spring-boot-actuator:checkstyleMain checkstyleTestand:module:spring-boot-actuator:formatpassThe commit includes the required
Signed-off-bytrailer.