Skip to content

Conversation

yuvalmich
Copy link
Contributor

@yuvalmich yuvalmich commented Jun 8, 2025

Bug Summary

This PR fixes a logic bug in the technique filtering block where the code attempted to check for an intersection between two sets (usedTechniques and allowedTechniques) using:

if (!new Set([...usedTechniques].filter((i) => allowedTechniques.has(i))))

However, this condition is flawed because new Set(...) always returns a truthy object, even if the set is empty. As a result, the condition never evaluated to true, and the intended filtering logic was never triggered.

Fix

The condition has been updated to use .some() without set usage:

if (
  usedTechniques &&
  ![...usedTechniques].some((i) => allowedTechniques.has(i))
)

This correctly checks whether any technique in usedTechniques is present in allowedTechniques, and filters out the component if there is no match.

Linked Issue

#1849

@yuvalmich yuvalmich requested a review from prabhu as a code owner June 8, 2025 08:58
@yuvalmich yuvalmich force-pushed the bugfix/technique-option-filter branch from f8b63d7 to 02871ea Compare June 8, 2025 09:10
…re found

Signed-off-by: Yuval Michaeli <yuvalmich2@gmail.com>
@@ -304,7 +304,7 @@ export function filterBom(bomJson, options) {
// Set.intersection is only available in node >= 22. See Bug# 1651
if (
usedTechniques &&
!new Set([...usedTechniques].filter((i) => allowedTechniques.has(i)))
![...usedTechniques].some((i) => allowedTechniques.has(i))
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Have you tried adding .size? That must work too.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes it also works.

However, using .some() is a bit more efficient than converting to a Set and checking .size because it stops at the first match and avoids creating intermediate data structures.

@prabhu prabhu merged commit 1252f36 into CycloneDX:master Jun 8, 2025
68 of 69 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

[Bug] technique Filtering Logic Is Ineffective Due to Always-Truthy Set Check
2 participants