ExternalReference.url XML validation error `xs:anyURI` about cyclonedx-php-composer

[jkowalleck]

Thank you for the error report, @uselab .
Could you drop in the composer.lock you used?

If this bug affects your workflow, you might downgrade cyclonedx-php-composer 3.8 until a fix is ready.
Alternatively you could have cyclonedx-php-composer output as JSON - which might not have these strict validation rules.
Sorry for the inconvenience

[jkowalleck]

issue probably is caused by malformed input in the original composer.json or composer.lock file
caused by "PEAR_Exception" -> https://github.com/pear/PEAR_Exception/blob/master/composer.json

affected versions of cyclonedx-php-composer : 3.9
since the ExternalReferences are read from composer packages and put into XML - JSON not affected

how to reproduce:

• have malformed URI used as a ExtRef
• unittests possible: yes
• demo / integration tests possible: yes

issue was forwarded to core lib: CycloneDX/cyclonedx-php-library#35

Hi @jkowalleck,

Sorry about the late reply, I added the lock file inside the zip.
Not sure if you still need it seeing you already found the same issue it seems
composer.zip

We have a temporary work around by adding --no-validate, seeing the file is accepted by the rest of our pipeline.
Once a fix is in place and released we will update and remove the --no-validate

[jkowalleck]

tried to fix the root cause in upstream via pear/PEAR_Exception#12

[jkowalleck]

Thank you very much for reporting the issue, @uselab

The issue was reproduced and got fixed in v3.9.1 - which was released just a minute ago.

Could you update and see if a valid XML could be generated?

Hi @jkowalleck ,

tested and works like a charm now!