feat(pom): add line numbers support

pkg/java/pom/artifact.go

@@ -26,6 +26,9 @@ type artifact struct {
 	Module bool
 	Root   bool
 	Direct bool
+
+	StartLine int
+	EndLine   int
 }
 
 func newArtifact(groupID, artifactID, version string, licenses []string, props map[string]string) artifact {

pkg/java/pom/parse.go

@@ -131,6 +131,13 @@ func (p *parser) parseRoot(root artifact) ([]types.Library, []types.Dependency,
 			if err != nil {
 				return nil, nil, err
 			}
+
+			// We don't need to store the location of module dependencies to avoid confusion.
+			moduleLibs = lo.Map(moduleLibs, func(lib types.Library, _ int) types.Library {
+				lib.Locations = nil
+				return lib
+			})
+
 			libs = append(libs, moduleLibs...)
 			if moduleDeps != nil {
 				deps = append(deps, moduleDeps...)
@@ -148,6 +155,11 @@ func (p *parser) parseRoot(root artifact) ([]types.Library, []types.Dependency,
 			if uniqueArt.Direct {
 				art.Direct = true
 			}
+			// We don't need to overwrite dependency location for hard links
+			if uniqueArt.EndLine != 0 {
+				art.StartLine = uniqueArt.StartLine
+				art.EndLine = uniqueArt.EndLine
+			}
 		}
 
 		result, err := p.resolve(art, rootDepManagement)
@@ -185,9 +197,12 @@ func (p *parser) parseRoot(root artifact) ([]types.Library, []types.Dependency,
 		if !art.IsEmpty() {
 			// Override the version
 			uniqArtifacts[art.Name()] = artifact{
-				Version:  art.Version,
-				Licenses: result.artifact.Licenses,
-				Direct:   art.Direct,
+				Version:   art.Version,
+				Licenses:  result.artifact.Licenses,
+				Direct:    art.Direct,
+				Root:      art.Root,
+				StartLine: art.StartLine,
+				EndLine:   art.EndLine,
 			}
 
 			// save only dependency names
@@ -208,6 +223,15 @@ func (p *parser) parseRoot(root artifact) ([]types.Library, []types.Dependency,
 			License:  art.JoinLicenses(),
 			Indirect: !art.Direct,
 		}
+		// We need to add location only for deps from `Dependencies` tag of base pom.xml file
+		if art.Direct && !art.Root && art.EndLine != 0 {
+			lib.Locations = types.Locations{
+				{
+					StartLine: art.StartLine,
+					EndLine:   art.EndLine,
+				},
+			}
+		}
 		libs = append(libs, lib)
 
 		// Convert dependency names into dependency IDs
@@ -409,7 +433,7 @@ func (p *parser) mergeDependencies(parent, child []artifact, exclusions map[stri
 	var deps []artifact
 	unique := map[string]struct{}{}
 
-	for _, d := range append(parent, child...) {
+	for _, d := range append(child, parent...) {
 		if excludeDep(exclusions, d) {
 			continue
 		}
@@ -466,6 +490,13 @@ func (p *parser) parseParent(currentPath string, parent pomParent) (analysisResu
 		return analysisResult{}, xerrors.Errorf("analyze error: %w", err)
 	}
 
+	// We don't need to store the location of parent dependencies to avoid confusion.
+	result.dependencies = lo.Map(result.dependencies, func(a artifact, _ int) artifact {
+		a.StartLine = 0
+		a.EndLine = 0
+		return a
+	})
+
 	p.cache.put(target, result)
 
 	return result, nil
@@ -642,22 +673,3 @@ func parsePom(r io.Reader) (*pomXML, error) {
 	}
 	return parsed, nil
 }
-
-func (deps *pomDependencies) UnmarshalXML(d *xml.Decoder, start xml.StartElement) error {
-	*deps = pomDependencies{}
-	for {
-		var dep pomDependency
-		err := d.Decode(&dep)
-		if err == io.EOF {
-			break
-		} else if err != nil {
-			return err
-		}
-
-		endLine, _ := d.InputPos()
-		dep.endLine = endLine
-
-		(*deps).Dependency = append((*deps).Dependency, dep)
-	}
-	return nil
-}