Limit full tree size when converting from BOM

cli/gitcommands.go

@@ -99,7 +99,6 @@ func GitAuditCmd(c *components.Context) error {
 	gitAuditCmd.SetUploadCdxResults(uploadResults).SetRtResultRepository(c.GetStringFlagValue(flags.UploadRtRepoPath))
 	// Run the command with progress bar if needed, Reporting error if Xsc service is enabled
 	err = reportErrorIfExists(xrayVersion, xscVersion, serverDetails, gitAuditCmd.GetProjectKey(), progressbar.ExecWithProgress(gitAuditCmd))
-	log.Info("####### jf git audit Scan Finished #######")
 	return err
 }
 

cli/scancommands.go

@@ -481,7 +481,6 @@ func AuditCmd(c *components.Context) error {
 	auditCmd.SetThreads(threads)
 	// Reporting error if Xsc service is enabled
 	err = reportErrorIfExists(xrayVersion, xscVersion, serverDetails, auditCmd.GetProjectKey(), progressbar.ExecWithProgress(auditCmd))
-	log.Info("####### jf audit Scan Finished #######")
 	return err
 }
 

commands/audit/audit.go

@@ -242,7 +242,7 @@ func (auditCmd *AuditCommand) Run() (err error) {
 			return errors.Join(err, auditResults.GetErrors())
 		}
 	}
-
+	log.Info("####### jf audit Scan Finished #######")
 	return OutputResultsAndCmdError(auditResults, auditCmd.getResultWriter(auditResults), auditCmd.Fail)
 }
 

commands/git/audit/gitaudit.go

@@ -62,6 +62,7 @@ func (gaCmd *GitAuditCommand) Run() (err error) {
 			return errors.Join(err, auditResults.GetErrors())
 		}
 	}
+	log.Info("####### jf git audit Scan Finished #######")
 	return sourceAudit.OutputResultsAndCmdError(auditResults, gaCmd.getResultWriter(auditResults), gaCmd.failBuild)
 }
 

utils/results/common.go

@@ -33,6 +33,9 @@ const (
 	DirectDependencyPathLength = 2
 	nodeModules                = "node_modules"
 
+	// MaxUniqueAppearances defines the maximum number of times a dependency can appear in a dependency tree.
+	MaxUniqueAppearances = 10
+
 	// <FILE_REF>#L<START_LINE>C<START_COLUMN>-L<END_LINE>C<END_COLUMN>
 	LocationIdTemplate = "%s#L%dC%d-L%dC%d"
 	// Applicability properties for cdx
@@ -1024,10 +1027,11 @@ func BomToFullTree(sbom *cyclonedx.BOM, convertToXrayCompId bool) (fullDependenc
 		// No dependencies or components in the SBOM, return an empty slice
 		return
 	}
+	dependencyAppearances := map[string]int8{}
 	for _, rootEntry := range cdxutils.GetRootDependenciesEntries(sbom, false) {
 		// Create a new GraphNode with ref as the ID, when populating the tree we need to use the ref as the ID
 		currentTree := &xrayUtils.GraphNode{Id: rootEntry.Ref}
-		populateDepsNodeDataFromBom(currentTree, sbom.Dependencies)
+		populateDepsNodeDataFromBom(currentTree, sbom.Dependencies, dependencyAppearances)
 		fullDependencyTrees = append(fullDependencyTrees, currentTree)
 	}
 	// Translate refs to Purl/Xray IDs
@@ -1037,17 +1041,21 @@ func BomToFullTree(sbom *cyclonedx.BOM, convertToXrayCompId bool) (fullDependenc
 	return
 }
 
-func populateDepsNodeDataFromBom(node *xrayUtils.GraphNode, dependencies *[]cyclonedx.Dependency) {
-	if node == nil || node.NodeHasLoop() {
-		// If the node is nil or has a loop, return
+func populateDepsNodeDataFromBom(node *xrayUtils.GraphNode, dependencies *[]cyclonedx.Dependency, dependencyAppearances map[string]int8) {
+	if node == nil {
+		return
+	}
+	dependencyAppearances[node.Id]++
+	if dependencyAppearances[node.Id] >= MaxUniqueAppearances || node.NodeHasLoop() {
+		// If the node has a loop or appeared too many times, stop the recursion
 		return
 	}
 	for _, dep := range cdxutils.GetDirectDependencies(dependencies, node.Id) {
 		depNode := &xrayUtils.GraphNode{Id: dep, Parent: node}
 		// Add the dependency to the current node
 		node.Nodes = append(node.Nodes, depNode)
 		// Recursively populate the node data
-		populateDepsNodeDataFromBom(depNode, dependencies)
+		populateDepsNodeDataFromBom(depNode, dependencies, dependencyAppearances)
 	}
 }