Skip to content

Conversation

@zahidblackduck
Copy link
Collaborator

@zahidblackduck zahidblackduck commented Dec 4, 2025

JIRA Ticket

IDETECT-4925

Description

Both Cargo detectors were failing to parse name and version from Cargo projects using workspace inheritance syntax (version.workspace = true). For example, a valid Cargo.toml,

[workspace]
members = ["extra-lib"]
resolver = "2"

[workspace.package]
version = "0.5.0"
edition = "2021"
repository = "https://github.com/example/repo"

[package]
name = "root-app"
version.workspace = true
edition.workspace = true
repository.workspace = true

The CargoTomlParser was incorrectly assuming version to be a string, but in cases of workspace inheritance, version is represented as a toml table. This caused TomlInvalidTypeException during dependency extraction.

Proposed Fix:

  • Updated CargoTomlParser to detect when version is a table and handle workspace inheritance correctly.
  • Added unit tests to validate parsing of Cargo.toml files with version.workspace = true.

Note: This is meant to be shipped with detect 11.2 release.


String name = packageTable.getString(NAME_KEY);
String version = null;
Object versionObj = packageTable.get(VERSION_KEY);
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What do we want to do for conditions when versionObj is null, I have seen examples in python where version is not specified, do we have similar concept in Cargo?

Copy link
Collaborator Author

@zahidblackduck zahidblackduck Dec 8, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That's an interesting question which I didn't think of earlier. I'll explore further whether there is any possibility of an version section being null and if so, then how cargo declares / handles this.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants