Cargotoml support

extractor/filesystem/language/rust/cargotoml/cargotoml.go

@@ -0,0 +1,165 @@
+// Copyright 2025 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//	http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Package cargotoml extracts Cargo.toml files for rust projects
+package cargotoml
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"path/filepath"
+	"regexp"
+
+	"github.com/BurntSushi/toml"
+
+	"github.com/google/osv-scalibr/extractor"
+	"github.com/google/osv-scalibr/extractor/filesystem"
+	"github.com/google/osv-scalibr/plugin"
+	"github.com/google/osv-scalibr/purl"
+)
+
+var shaPattern = regexp.MustCompile("^[0-9a-f]{40}$")
+
+type cargoTomlDependency struct {
+	Version string
+	Git     string
+	Rev     string
+}
+
+// UnmarshalTOML parses a dependency from a Cargo.toml file.
+//
+// Dependencies in Cargo.toml can be defined as simple strings (e.g., version)
+// or as more complex objects (e.g., with version, path, etc.)
+//
+// in case both the Version and Git/Path are specified the version should be considered
+// the source of truth
+func (v *cargoTomlDependency) UnmarshalTOML(data any) error {
+	getString := func(m map[string]any, key string) string {
+		v, ok := m[key]
+		if !ok {
+			return ""
+		}
+		s, _ := v.(string)
+		return s
+	}
+
+	switch data := data.(type) {
+	case string:
+		// if the type is string then the data is version
+		v.Version = data
+		return nil
+	case map[string]any:
+		*v = cargoTomlDependency{
+			Version: getString(data, "version"),
+			Git:     getString(data, "git"),
+			Rev:     getString(data, "rev"),
+		}
+		return nil
+	default:
+		return errors.New("invalid format for Cargo.toml dependency")
+	}
+}
+
+// IsCommitSpecified checks if the dependency specifies a Git commit.
+func (v *cargoTomlDependency) IsCommitSpecified() bool {
+	return v.Git != "" && shaPattern.MatchString(v.Rev)
+}
+
+type cargoTomlPackage struct {
+	Name    string `toml:"name"`
+	Version string `toml:"version"`
+}
+
+type cargoTomlFile struct {
+	Package      cargoTomlPackage               `toml:"package"`
+	Dependencies map[string]cargoTomlDependency `toml:"dependencies"`
+}
+
+// Extractor extracts crates.io packages from Cargo.toml files.
+type Extractor struct{}
+
+// Name of the extractor
+func (e Extractor) Name() string { return "rust/Cargotoml" }
+
+// Version of the extractor
+func (e Extractor) Version() int { return 0 }
+
+// FileRequired returns true if the specified file matches Cargo toml file patterns.
+func (e Extractor) FileRequired(api filesystem.FileAPI) bool {
+	return filepath.Base(api.Path()) == "Cargo.toml"
+}
+
+// Requirements of the extractor
+func (e Extractor) Requirements() *plugin.Capabilities {
+	return &plugin.Capabilities{}
+}
+
+// Extract extracts packages from Cargo.toml files passed through the scan input.
+func (e Extractor) Extract(_ context.Context, input *filesystem.ScanInput) ([]*extractor.Inventory, error) {
+	var parsedTomlFile cargoTomlFile
+
+	_, err := toml.NewDecoder(input.Reader).Decode(&parsedTomlFile)
+	if err != nil {
+		return nil, fmt.Errorf("could not extract from %s: %w", input.Path, err)
+	}
+
+	packages := make([]*extractor.Inventory, 0, len(parsedTomlFile.Dependencies)+1)
+
+	packages = append(packages, &extractor.Inventory{
+		Name:      parsedTomlFile.Package.Name,
+		Version:   parsedTomlFile.Package.Version,
+		Locations: []string{input.Path},
+	})
+
+	for name, dependency := range parsedTomlFile.Dependencies {
+		var srcCode *extractor.SourceCodeIdentifier
+		if dependency.IsCommitSpecified() {
+			srcCode = &extractor.SourceCodeIdentifier{
+				Repo:   dependency.Git,
+				Commit: dependency.Rev,
+			}
+		}
+
+		// Skip dependencies that have no version and no useful source code information
+		if dependency.Version == "" && srcCode == nil {
+			continue
+		}
+
+		packages = append(packages, &extractor.Inventory{
+			Name:       name,
+			Version:    dependency.Version,
+			Locations:  []string{input.Path},
+			SourceCode: srcCode,
+		})
+	}
+
+	return packages, nil
+}
+
+// ToPURL converts an inventory created by this extractor into a PURL.
+func (e Extractor) ToPURL(i *extractor.Inventory) *purl.PackageURL {
+	return &purl.PackageURL{
+		Type:    purl.TypeCargo,
+		Name:    i.Name,
+		Version: i.Version,
+	}
+}
+
+// Ecosystem returns the OSV ecosystem ('crates.io') of the software extracted by this extractor.
+func (e Extractor) Ecosystem(_ *extractor.Inventory) string {
+	return "crates.io"
+}
+
+var _ filesystem.Extractor = Extractor{}

extractor/filesystem/language/rust/cargotoml/cargotoml_test.go

@@ -0,0 +1,208 @@
+// Copyright 2025 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package cargotoml_test
+
+import (
+	"context"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/google/go-cmp/cmp/cmpopts"
+	"github.com/google/osv-scalibr/extractor"
+	"github.com/google/osv-scalibr/extractor/filesystem/language/rust/cargotoml"
+	"github.com/google/osv-scalibr/extractor/filesystem/simplefileapi"
+	"github.com/google/osv-scalibr/testing/extracttest"
+)
+
+func TestExtractor_FileRequired(t *testing.T) {
+	tests := []struct {
+		name      string
+		inputPath string
+		want      bool
+	}{
+		{
+			name:      "Empty path",
+			inputPath: "",
+			want:      false,
+		},
+		{
+			name:      "",
+			inputPath: "Cargo.toml",
+			want:      true,
+		},
+		{
+			name:      "",
+			inputPath: "path/to/my/Cargo.toml",
+			want:      true,
+		},
+		{
+			name:      "",
+			inputPath: "path/to/my/Cargo.toml/file",
+			want:      false,
+		},
+		{
+			name:      "",
+			inputPath: "path/to/my/Cargo.toml.file",
+			want:      false,
+		},
+		{
+			name:      "",
+			inputPath: "path.to.my.Cargo.toml",
+			want:      false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			e := cargotoml.Extractor{}
+			got := e.FileRequired(simplefileapi.New(tt.inputPath, nil))
+			if got != tt.want {
+				t.Errorf("FileRequired(%s, FileInfo) got = %v, want %v", tt.inputPath, got, tt.want)
+			}
+		})
+	}
+}
+
+// TODO: convert this to toml est
+
+func TestExtractor_Extract(t *testing.T) {
+	tests := []extracttest.TestTableEntry{
+		{
+			Name: "Invalid toml",
+			InputConfig: extracttest.ScanInputMockConfig{
+				Path: "testdata/not-toml.txt",
+			},
+			WantInventory: nil,
+			WantErr:       extracttest.ContainsErrStr{Str: "could not extract from"},
+		},
+		{
+			Name: "no dependencies",
+			InputConfig: extracttest.ScanInputMockConfig{
+				Path: "testdata/no-dependency.toml",
+			},
+			WantInventory: []*extractor.Inventory{
+				{
+					Name:      "hello_world",
+					Version:   "0.1.0",
+					Locations: []string{"testdata/no-dependency.toml"},
+				},
+			},
+		},
+		{
+			Name: "dependency with only version specified",
+			InputConfig: extracttest.ScanInputMockConfig{
+				Path: "testdata/only-version-dependency.toml",
+			},
+			WantInventory: []*extractor.Inventory{
+				{
+					Name:      "hello_world",
+					Version:   "0.1.0",
+					Locations: []string{"testdata/only-version-dependency.toml"},
+				},
+				{
+					Name:      "regex",
+					Version:   "0.0.1",
+					Locations: []string{"testdata/only-version-dependency.toml"},
+				},
+			},
+		},
+		{
+			// dependencies with only tag specified should be skipped
+			Name: "git dependency with tag specified",
+			InputConfig: extracttest.ScanInputMockConfig{
+				Path: "testdata/git-dependency-tagged.toml",
+			},
+			WantInventory: []*extractor.Inventory{
+				{
+					Name:      "hello_world",
+					Version:   "0.1.0",
+					Locations: []string{"testdata/git-dependency-tagged.toml"},
+				},
+			},
+		},
+		{
+			Name: "git dependency with commit specified",
+			InputConfig: extracttest.ScanInputMockConfig{
+				Path: "testdata/git-dependency-with-commit.toml",
+			},
+			WantInventory: []*extractor.Inventory{
+				{
+					Name:      "hello_world",
+					Version:   "0.1.0",
+					Locations: []string{"testdata/git-dependency-with-commit.toml"},
+				},
+				{
+					Name: "regex",
+					SourceCode: &extractor.SourceCodeIdentifier{
+						Repo:   "https://github.com/rust-lang/regex.git",
+						Commit: "0c0990399270277832fbb5b91a1fa118e6f63dba",
+					},
+					Locations: []string{"testdata/git-dependency-with-commit.toml"},
+				},
+			},
+		},
+		{
+			Name: "git dependency with pr rev specified",
+			InputConfig: extracttest.ScanInputMockConfig{
+				Path: "testdata/git-dependency-with-pr.toml",
+			},
+			WantInventory: []*extractor.Inventory{
+				{
+					Name:      "hello_world",
+					Version:   "0.1.0",
+					Locations: []string{"testdata/git-dependency-with-pr.toml"},
+				},
+			},
+		},
+		{
+			Name: "two dependencies",
+			InputConfig: extracttest.ScanInputMockConfig{
+				Path: "testdata/two-dependencies.toml",
+			},
+			WantInventory: []*extractor.Inventory{
+				{
+					Name:      "hello_world",
+					Version:   "0.1.0",
+					Locations: []string{"testdata/two-dependencies.toml"},
+				},
+				{
+					Name:      "futures",
+					Version:   "0.3",
+					Locations: []string{"testdata/two-dependencies.toml"},
+				},
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.Name, func(t *testing.T) {
+			extr := cargotoml.Extractor{}
+
+			scanInput := extracttest.GenerateScanInputMock(t, tt.InputConfig)
+			defer extracttest.CloseTestScanInput(t, scanInput)
+
+			got, err := extr.Extract(context.Background(), &scanInput)
+
+			if diff := cmp.Diff(tt.WantErr, err, cmpopts.EquateErrors()); diff != "" {
+				t.Errorf("%s.Extract(%q) error diff (-want +got):\n%s", extr.Name(), tt.InputConfig.Path, diff)
+				return
+			}
+
+			if diff := cmp.Diff(tt.WantInventory, got, cmpopts.SortSlices(extracttest.InventoryCmpLess)); diff != "" {
+				t.Errorf("%s.Extract(%q) diff (-want +got):\n%s", extr.Name(), tt.InputConfig.Path, diff)
+			}
+		})
+	}
+}

extractor/filesystem/language/rust/cargotoml/testdata/git-dependency-tagged.toml

@@ -0,0 +1,6 @@
+[package]
+  name = "hello_world"
+  version = "0.1.0"
+
+[dependencies]
+  regex = { git = "https://github.com/rust-lang/regex.git", tag = "0.0.1"}

extractor/filesystem/language/rust/cargotoml/testdata/git-dependency-with-commit.toml

@@ -0,0 +1,6 @@
+[package]
+  name = "hello_world"
+  version = "0.1.0"
+
+[dependencies]
+  regex = { git = "https://github.com/rust-lang/regex.git", rev = "0c0990399270277832fbb5b91a1fa118e6f63dba"}

extractor/filesystem/language/rust/cargotoml/testdata/git-dependency-with-pr.toml

@@ -0,0 +1,6 @@
+[package]
+  name = "hello_world"
+  version = "0.1.0"
+
+[dependencies]
+  regex = { git = "https://github.com/rust-lang/regex.git", rev = "refs/pull/493/head"}

extractor/filesystem/language/rust/cargotoml/testdata/no-dependency.toml

@@ -0,0 +1,3 @@
+[package]
+  name = "hello_world"
+  version = "0.1.0"