Fix #1791: Ignore NuGet metadata files in extracted .nupkg archives

Fixes #1791

Fix #1791: Ignore NuGet metadata files in extracted .nupkg archives

Author: Monal-Reddy

scanpipe/pipelines/__init__.py

@@ -77,6 +77,7 @@ def flag_ignored_resources(self):
         if isinstance(ignored_patterns, str):
             ignored_patterns = ignored_patterns.splitlines()
         ignored_patterns.extend(flag.DEFAULT_IGNORED_PATTERNS)
+        ignored_patterns.extend(flag.NUGET_IGNORED_PATTERNS)
 
         flag.flag_ignored_patterns(
             codebaseresources=self.project.codebaseresources.no_status(),

scanpipe/pipes/flag.py

@@ -77,6 +77,19 @@
     "*/policies.yml",
     "*/__MACOSX*",  # macOS metadata folder
 ]
+# NuGet ecosystem files that are not useful for analysis when found inside
+# extracted .nupkg archives.
+NUGET_IGNORED_PATTERNS = [
+    "*_rels/.rels",
+    "*Content_Types*.xml",
+    "*package/services/metadata*",
+    "*.signature.p7s",
+    "*.runtimeconfig.json",
+    "*.dll.config",
+    "*.exe.config",
+    "*.shasum",
+    "*.png",
+]
 
 
 def flag_empty_files(project):

scanpipe/tests/pipes/test_flag.py

@@ -20,6 +20,8 @@
 # ScanCode.io is a free software code scanning tool from nexB Inc. and others.
 # Visit https://github.com/nexB/scancode.io for support and download.
 
+from fnmatch import fnmatch
+
 from django.test import TestCase
 
 from scanpipe import pipes
@@ -137,3 +139,20 @@ def test_scanpipe_pipes_flag_flag_mapped_resources(self):
         self.resource2.refresh_from_db()
         self.assertEqual("mapped", self.resource1.status)
         self.assertEqual("mapped", self.resource2.status)
+
+    def test_nuget_ignored_patterns_match_expected_files(self):
+        paths = [
+            "package/_rels/.rels",
+            "package/[Content_Types].xml",
+            "package/services/metadata/core-properties",
+            "foo.runtimeconfig.json",
+            "bar.dll.config",
+            "baz.exe.config",
+            "test.shasum",
+            "image.png",
+        ]
+        for path in paths:
+            matched = any(
+                fnmatch(path, pattern) for pattern in flag.NUGET_IGNORED_PATTERNS
+            )
+            self.assertTrue(matched, path)

scanpipe/tests/test_pipelines.py

@@ -427,7 +427,11 @@ def test_scanpipe_pipeline_class_flag_ignored_resources(self):
             pipeline.flag_ignored_resources()
 
         mock_flag.assert_called_once()
-        patterns_args = ["*.ext", *flag.DEFAULT_IGNORED_PATTERNS]
+        patterns_args = [
+            "*.ext",
+            *flag.DEFAULT_IGNORED_PATTERNS,
+            *flag.NUGET_IGNORED_PATTERNS,
+        ]
         self.assertEqual(mock_flag.mock_calls[0].kwargs["patterns"], patterns_args)
         self.assertEqual(mock_flag.mock_calls[0].kwargs["codebaseresources"].count(), 0)