fix: skip pyproject.toml unless it contains tool.poetry (#6316)

jeremylong · Dec 18, 2023 · 1eedf4c · 1eedf4c
1 parent 667fde1
commit 1eedf4c
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/core/src/main/java/org/owasp/dependencycheck/analyzer/PoetryAnalyzer.java b/core/src/main/java/org/owasp/dependencycheck/analyzer/PoetryAnalyzer.java
@@ -155,6 +155,10 @@ protected void analyzeDependency(Dependency dependency, Engine engine) throws An
         }
 
         final Toml result = new Toml().read(dependency.getActualFile());
+        if (PYPROJECT_TOML.equals(dependency.getActualFile().getName()) && result.getTables("tool.poetry") == null) {
+            LOGGER.debug("skipping {} as it does not contain `tool.poetry`", dependency.getDisplayFileName());
+            return;
+        }
         final List<Toml> projectsLocks = result.getTables("package");
         if (projectsLocks == null) {
             return;