Sending HTTP with SBOM Returning Status 500, StackOverFlow Error in Logs

[zvigrinberg]

Description

When Sending HTTP Request with SBOM , it Returns Status 500 with empty body, and in logs StackOverFlow exception is dumped.

Investigation

It appears that if there is Cyclic References in the bom , it causes this infinite loop when trying to build the dependencies tree.

For Instance, takes this partial sbom.

[
  {
            "ref": "pkg:golang/cloud.google.com/[email protected]",
            "dependsOn": [
                "pkg:golang/cloud.google.com/go/[email protected]",
                "pkg:golang/github.com/golang/[email protected]",
                "pkg:golang/github.com/google/[email protected]",
                "pkg:golang/github.com/google/martian/[email protected]",
                "pkg:golang/github.com/googleapis/gax-go/[email protected]",
                "pkg:golang/[email protected]",
                "pkg:golang/golang.org/x/[email protected]",
                "pkg:golang/golang.org/x/[email protected]",
                "pkg:golang/google.golang.org/[email protected]",
                "pkg:golang/google.golang.org/[email protected]",
                "pkg:golang/google.golang.org/[email protected]",
                "pkg:golang/google.golang.org/[email protected]"
            ]
        },

 {
            "ref": "pkg:golang/cloud.google.com/go/[email protected]",
            "dependsOn": [
                "pkg:golang/cloud.google.com/[email protected]",
                "pkg:golang/github.com/google/[email protected]",
                "pkg:golang/github.com/googleapis/gax-go/[email protected]",
                "pkg:golang/golang.org/x/[email protected]",
                "pkg:golang/google.golang.org/[email protected]",
                "pkg:golang/google.golang.org/[email protected]",
                "pkg:golang/google.golang.org/[email protected]",
                "pkg:golang/google.golang.org/[email protected]"
            ]
        }
]

This cyclic references causes to infinite loop, and this cyclic reference is originally from the go mod graph.

Need to decide how to detect such cycle in dependency graph ( cyclic detection) and prune further calls in such case to resolve infinite loop.

[zvigrinberg]

solved by #157