ParseMavenLock hangs when parsing some Maven archetypes files

[spencerschrock]

Both of these small pom.xml files seem to cause osv-scanner to hang. One invocation ran for 5+ hours before the program was terminated for other reasons.

Reproducible with:

osv-scanner -L ./pom.xml

https://github.com/Open-Wide/owsi-nuxeo-boilerplate/blob/96a65826d8f610d17b269d0da1d577bbb5d46cb1/archetype/src/main/resources/archetype-resources/pom.xml

https://github.com/BeOne-PL/promena/blob/adbc25d2cd3acf1990f7188938fee25d834aa0db/sdk/promena-transformer/promena-transformer-archetype/src/main/resources/archetype-resources/configuration/pom.xml

[G-Rath]

Looks like it's because these are technically invalid XML - not sure why it doesn't just crash though; might require implementing a custom parser to properly support 🤔

[spencerschrock]

Do you know if this is a problem with encoding/xml, or with func (p *MavenLockProperties) UnmarshalXML?

My profiler seemed to end up in a loop with the latter

[G-Rath]

Yup doesn't surprise me that the problem is there

[spencerschrock]

Knowing that it's invalid XML helped narrow it down.
Adding some logic to handle the error that d.Token returns here seems to break the loop.

osv-scanner/pkg/lockfile/parse-maven-lock.go

Lines 75 to 81 in 96a62e9

	func (p *MavenLockProperties) UnmarshalXML(d *xml.Decoder, start xml.StartElement) error {
	p.m = map[string]string{}
	for {
	t, _ := d.Token()
	switch tt := t.(type) {

Let me know if you'd prefer to handle it, or I can send a PR.

[G-Rath]

I've got about half a day of work left before I can look into this more deeply, so if you're ready to do a PR right now go for it