Fix for issues/533 (dual licensed dependency with one license on whitelist and the other on blacklist) (#670)

* issues/533: Prepare changes by asserting current state

* issues/533: refactor

* issues/533: if a project has 2 licences, only 1 whitelisted licence should be sufficient to allow the project, because this is the licence you choose.

* ran 'mvn spotless:apply'

* use mockito 4 to be jdk 8 compatible

* Update src/test/java/org/codehaus/mojo/license/AbstractAddThirdPartyMojoTest.java

fixed spelling

Co-authored-by: Copilot <[email protected]>

* more spelling from british to american english

* more spelling from british to american english

---------

Co-authored-by: Copilot <[email protected]>
Co-authored-by: Slawomir Jaranowski <[email protected]>

Author: 3 people

pom.xml

@@ -289,6 +289,13 @@
       <scope>test</scope>
     </dependency>
 
+    <dependency>
+      <groupId>org.mockito</groupId>
+      <artifactId>mockito-core</artifactId>
+      <version>4.11.0</version>
+      <scope>test</scope>
+    </dependency>
+
     <!-- Needed for extended constants in JARs MANIFEST.MF -->
     <dependency>
       <groupId>org.osgi</groupId>

src/main/java/org/codehaus/mojo/license/AbstractAddThirdPartyMojo.java

@@ -438,7 +438,7 @@ public abstract class AbstractAddThirdPartyMojo extends AbstractLicenseMojo {
      * <ul style="list-style-type:none;">
      * <li>The Apache Software License, Version 2.0</li>
      * <li>Apache License, Version 2.0</li>
-     * <li>Bouncy Castle Licence</li>
+     * <li>Bouncy Castle License</li>
      * <li>MIT License</li>
      * </ul>
      * empty lines will be ignored.</li>
@@ -491,7 +491,7 @@ public abstract class AbstractAddThirdPartyMojo extends AbstractLicenseMojo {
      * <ul style="list-style-type:none;">
      * <li>The Apache Software License, Version 2.0</li>
      * <li>Apache License, Version 2.0</li>
-     * <li>Bouncy Castle Licence</li>
+     * <li>Bouncy Castle license</li>
      * <li>MIT License</li>
      * </ul>
      * empty lines will be ignored.</li>
@@ -919,15 +919,15 @@ void checkUnsafeDependencies() {
     boolean checkForbiddenLicenses() {
         List<String> whiteLicenses = getIncludedLicenses();
         List<String> blackLicenses = getExcludedLicenses();
-        Set<String> unsafeLicenses = new HashSet<>();
+        LicenseMap unsafeLicenses = new LicenseMap();
         if (CollectionUtils.isNotEmpty(blackLicenses)) {
             Set<String> licenses = licenseMap.keySet();
             LOG.info("Excluded licenses (blacklist): {}", blackLicenses);
 
             for (String excludeLicense : blackLicenses) {
                 if (licenses.contains(excludeLicense) && CollectionUtils.isNotEmpty(licenseMap.get(excludeLicense))) {
                     // bad license found
-                    unsafeLicenses.add(excludeLicense);
+                    unsafeLicenses.put(excludeLicense, licenseMap.get(excludeLicense));
                 }
             }
         }
@@ -936,59 +936,59 @@ boolean checkForbiddenLicenses() {
             Set<String> dependencyLicenses = licenseMap.keySet();
             LOG.info("Included licenses (whitelist): {}", whiteLicenses);
 
+            for (final String unsafelicense : unsafeLicenses.keySet()) {
+                for (MavenProject potentiallyUnsafeProject : unsafeLicenses.get(unsafelicense)) {
+
+                    final boolean whiteListed =
+                            isDependencyWhitelisted(potentiallyUnsafeProject, unsafelicense, whiteLicenses);
+
+                    if (whiteListed) {
+                        LOG.debug(
+                                "Project {} has black listed license {} but also white listed dependency",
+                                potentiallyUnsafeProject,
+                                unsafelicense);
+
+                        unsafeLicenses.get(unsafelicense).remove(potentiallyUnsafeProject);
+                    }
+                }
+            }
+
             for (String dependencyLicense : dependencyLicenses) {
                 LOG.debug("Testing license '{}'", dependencyLicense);
+
                 if (!whiteLicenses.contains(dependencyLicense)
                         && CollectionUtils.isNotEmpty(licenseMap.get(dependencyLicense))) {
                     LOG.debug("Testing dependency license '{}' against all other licenses", dependencyLicense);
 
                     for (MavenProject dependency : licenseMap.get(dependencyLicense)) {
-                        LOG.debug("- testing dependency {}" + dependency);
-
-                        boolean forbiddenLicenseUsed = true;
-
-                        for (String otherLicense : dependencyLicenses) {
-                            // skip this license if it is the same as the dependency license
-                            // skip this license if it has no projects assigned
-                            if (otherLicense.equals(dependencyLicense)
-                                    || licenseMap.get(dependencyLicense).isEmpty()) {
-                                continue;
-                            }
-
-                            // skip this license if it isn't one of the whitelisted
-                            if (!whiteLicenses.contains(otherLicense)) {
-                                continue;
-                            }
-
-                            if (licenseMap.get(otherLicense).contains(dependency)) {
-                                LOG.info(
-                                        "License: '{}' for '{}' is OK since it is also licensed under '{}'",
-                                        dependencyLicense,
-                                        dependency,
-                                        otherLicense);
-                                // this dependency is licensed under another license from white list
-                                forbiddenLicenseUsed = false;
-                                break;
-                            }
-                        }
+                        LOG.debug("testing dependency {}", dependency);
+
+                        boolean islicenseWhitelistedAndUsed =
+                                isDependencyWhitelisted(dependency, dependencyLicense, whiteLicenses);
 
                         // bad license found
-                        if (forbiddenLicenseUsed) {
-                            unsafeLicenses.add(dependencyLicense);
+                        if (!islicenseWhitelistedAndUsed) {
+                            unsafeLicenses.put(dependencyLicense, dependency);
                             break;
                         }
                     }
                 }
             }
         }
 
-        boolean safe = CollectionUtils.isEmpty(unsafeLicenses);
+        for (final String s : unsafeLicenses.keySet()) {
+            if (CollectionUtils.isEmpty(unsafeLicenses.get(s))) {
+                unsafeLicenses.remove(s);
+            }
+        }
+
+        boolean safe = CollectionUtils.isEmpty(unsafeLicenses.keySet());
 
         if (!safe) {
             LOG.warn("There are {} forbidden licenses used:", unsafeLicenses.size());
-            for (String unsafeLicense : unsafeLicenses) {
+            for (String unsafeLicense : unsafeLicenses.keySet()) {
 
-                SortedSet<MavenProject> deps = licenseMap.get(unsafeLicense);
+                SortedSet<MavenProject> deps = unsafeLicenses.get(unsafeLicense);
                 if (!deps.isEmpty()) {
                     StringBuilder sb = new StringBuilder();
                     sb.append("License: '")
@@ -1006,6 +1006,36 @@ boolean checkForbiddenLicenses() {
         return safe;
     }
 
+    private boolean isDependencyWhitelisted(
+            final MavenProject dependency, final String dependencyLicense, final List<String> whiteLicenses) {
+
+        final Set<String> dependencyLicenses = licenseMap.keySet();
+        for (String otherLicense : dependencyLicenses) {
+            // skip this license if it is the same as the dependency license
+            // skip this license if it has no projects assigned
+            if (otherLicense.equals(dependencyLicense)
+                    || licenseMap.get(dependencyLicense).isEmpty()) {
+                continue;
+            }
+
+            // skip this license if it isn't one of the whitelisted
+            if (!whiteLicenses.contains(otherLicense)) {
+                continue;
+            }
+
+            if (licenseMap.get(otherLicense).contains(dependency)) {
+                LOG.info(
+                        "License: '{}' for '{}' is OK since it is also licensed under '{}'",
+                        dependencyLicense,
+                        dependency,
+                        otherLicense);
+                // this dependency is licensed under another license from white list
+                return true;
+            }
+        }
+        return false;
+    }
+
     void writeThirdPartyFile() throws IOException {
 
         if (doGenerate) {