From 5b9abe309195bbbeb063d282b78073a3a19badec Mon Sep 17 00:00:00 2001
From: luotianqi777 <luotianqi777@gmail.com>
Date: Wed, 8 May 2024 18:41:36 +0800
Subject: [PATCH] fix: mvn

---
 opensca/sca/java/mvn.go | 17 +++++++++------
 test/java/16/pom.xml    | 48 +++++++++++++++++++++++++++++++++++++++++
 test/java/java_test.go  | 12 +++++++++++
 3 files changed, 70 insertions(+), 7 deletions(-)
 create mode 100644 test/java/16/pom.xml

diff --git a/opensca/sca/java/mvn.go b/opensca/sca/java/mvn.go
index 088aa2ca..f65c7430 100644
--- a/opensca/sca/java/mvn.go
+++ b/opensca/sca/java/mvn.go
@@ -357,23 +357,26 @@ func parsePom(ctx context.Context, pom *Pom, getpom getPomFunc) *model.DepGraph
 
 			np.Update(dep)
 
-			// 非根pom直接引入的依赖使用当前pom的dependencyManagement补全
-			if np != pom {
-				if d, ok := depManagement[dep.Index2()]; ok {
-					exclusion := append(dep.Exclusions, d.Exclusions...)
+			// 使用当前pom的dependencyManagement补全
+			if d, ok := depManagement[dep.Index2()]; ok {
+				exclusion := append(dep.Exclusions, d.Exclusions...)
+				if dep.Version == "" {
 					dep = d
-					dep.Exclusions = exclusion
-					np.Update(dep)
 				}
+				dep.Exclusions = exclusion
+				np.Update(dep)
 			}
 
 			// 非根pom直接引入的依赖 或者组件版本号为空 需要再次使用根pom的dependencyManagement补全
 			if np != pom || dep.Version == "" {
 				d, ok := rootPomManagement[dep.Index2()]
 				if ok {
-					// exclusion 需要保留
 					exclusion := append(dep.Exclusions, d.Exclusions...)
+					originVersion := dep.Version
 					dep = d
+					if dep.Version == "" {
+						dep.Version = originVersion
+					}
 					dep.Exclusions = exclusion
 					pom.Update(dep)
 				}
diff --git a/test/java/16/pom.xml b/test/java/16/pom.xml
new file mode 100644
index 00000000..92ba3ed6
--- /dev/null
+++ b/test/java/16/pom.xml
@@ -0,0 +1,48 @@
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+  <modelVersion>4.0.0</modelVersion>
+  <groupId>org.example</groupId>
+  <artifactId>demo</artifactId>
+  <version>1.0</version>
+  <dependencyManagement>
+    <dependencies>
+      <dependency>
+        <groupId>com.aliyun</groupId>
+        <artifactId>tea</artifactId>
+        <scope>test</scope>
+        <exclusions>
+          <exclusion>
+            <groupId>*</groupId>
+            <artifactId>*</artifactId>
+          </exclusion>
+        </exclusions>
+      </dependency>
+      <dependency>
+        <groupId>com.aliyun</groupId>
+        <artifactId>alibabacloud-dkms-gcs-sdk</artifactId>
+        <version>0.5.2</version>
+        <exclusions>
+          <exclusion>
+            <groupId>com.squareup.okhttp3</groupId>
+            <artifactId>okhttp</artifactId>
+          </exclusion>
+          <exclusion>
+            <groupId>com.aliyun</groupId>
+            <artifactId>alibabacloud-dkms-gcs-openapi</artifactId>
+          </exclusion>
+          <exclusion>
+            <groupId>com.aliyun</groupId>
+            <artifactId>alibabacloud-dkms-gcs-openapi-util</artifactId>
+          </exclusion>
+        </exclusions>
+      </dependency>
+    </dependencies>
+  </dependencyManagement>
+  <dependencies>
+    <dependency>
+      <groupId>com.aliyun</groupId>
+      <artifactId>alibabacloud-dkms-gcs-sdk</artifactId>
+      <version>0.5.2</version>
+    </dependency>
+  </dependencies>
+</project>
diff --git a/test/java/java_test.go b/test/java/java_test.go
index 719703a5..8415c905 100644
--- a/test/java/java_test.go
+++ b/test/java/java_test.go
@@ -174,6 +174,18 @@ var cases = []tool.TaskCase{
 			),
 		),
 	)},
+
+	// 依赖的pom中DependencyManagement管理范围
+	{Path: "16", Result: tool.Dep("", "",
+		tool.Dep3("org.example", "demo", "1.0",
+			tool.Dep3("com.aliyun", "alibabacloud-dkms-gcs-sdk", "0.5.2",
+				tool.DevDep3("com.aliyun", "tea", "1.2.3"),
+				tool.Dep3("com.aliyun", "tea-util", "0.2.18",
+					tool.Dep3("com.google.code.gson", "gson", "2.8.9"),
+				),
+			),
+		),
+	)},
 }
 
 func Test_JavaWithStatic(t *testing.T) {