fix: mvn

opensca/sca/java/mvn.go

@@ -357,23 +357,26 @@ func parsePom(ctx context.Context, pom *Pom, getpom getPomFunc) *model.DepGraph
 
 			np.Update(dep)
 
-			// 非根pom直接引入的依赖使用当前pom的dependencyManagement补全
-			if np != pom {
-				if d, ok := depManagement[dep.Index2()]; ok {
-					exclusion := append(dep.Exclusions, d.Exclusions...)
+			// 使用当前pom的dependencyManagement补全
+			if d, ok := depManagement[dep.Index2()]; ok {
+				exclusion := append(dep.Exclusions, d.Exclusions...)
+				if dep.Version == "" {
 					dep = d
-					dep.Exclusions = exclusion
-					np.Update(dep)
 				}
+				dep.Exclusions = exclusion
+				np.Update(dep)
 			}
 
 			// 非根pom直接引入的依赖 或者组件版本号为空 需要再次使用根pom的dependencyManagement补全
 			if np != pom || dep.Version == "" {
 				d, ok := rootPomManagement[dep.Index2()]
 				if ok {
-					// exclusion 需要保留
 					exclusion := append(dep.Exclusions, d.Exclusions...)
+					originVersion := dep.Version
 					dep = d
+					if dep.Version == "" {
+						dep.Version = originVersion
+					}
 					dep.Exclusions = exclusion
 					pom.Update(dep)
 				}

test/java/16/pom.xml

@@ -0,0 +1,48 @@
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+  <modelVersion>4.0.0</modelVersion>
+  <groupId>org.example</groupId>
+  <artifactId>demo</artifactId>
+  <version>1.0</version>
+  <dependencyManagement>
+    <dependencies>
+      <dependency>
+        <groupId>com.aliyun</groupId>
+        <artifactId>tea</artifactId>
+        <scope>test</scope>
+        <exclusions>
+          <exclusion>
+            <groupId>*</groupId>
+            <artifactId>*</artifactId>
+          </exclusion>
+        </exclusions>
+      </dependency>
+      <dependency>
+        <groupId>com.aliyun</groupId>
+        <artifactId>alibabacloud-dkms-gcs-sdk</artifactId>
+        <version>0.5.2</version>
+        <exclusions>
+          <exclusion>
+            <groupId>com.squareup.okhttp3</groupId>
+            <artifactId>okhttp</artifactId>
+          </exclusion>
+          <exclusion>
+            <groupId>com.aliyun</groupId>
+            <artifactId>alibabacloud-dkms-gcs-openapi</artifactId>
+          </exclusion>
+          <exclusion>
+            <groupId>com.aliyun</groupId>
+            <artifactId>alibabacloud-dkms-gcs-openapi-util</artifactId>
+          </exclusion>
+        </exclusions>
+      </dependency>
+    </dependencies>
+  </dependencyManagement>
+  <dependencies>
+    <dependency>
+      <groupId>com.aliyun</groupId>
+      <artifactId>alibabacloud-dkms-gcs-sdk</artifactId>
+      <version>0.5.2</version>
+    </dependency>
+  </dependencies>
+</project>

test/java/java_test.go

@@ -174,6 +174,18 @@ var cases = []tool.TaskCase{
 			),
 		),
 	)},
+
+	// 依赖的pom中DependencyManagement管理范围
+	{Path: "16", Result: tool.Dep("", "",
+		tool.Dep3("org.example", "demo", "1.0",
+			tool.Dep3("com.aliyun", "alibabacloud-dkms-gcs-sdk", "0.5.2",
+				tool.DevDep3("com.aliyun", "tea", "1.2.3"),
+				tool.Dep3("com.aliyun", "tea-util", "0.2.18",
+					tool.Dep3("com.google.code.gson", "gson", "2.8.9"),
+				),
+			),
+		),
+	)},
 }
 
 func Test_JavaWithStatic(t *testing.T) {