FlatMerge should deduplicate "equivalent" entries and squash their data

src/CycloneDX.Core/BomUtils.cs

@@ -239,4 +239,4 @@ public static void EnumerateAllServices(Bom bom, Action<Service> callback)
             }
         }
     }
-}
+}

src/CycloneDX.Core/Json/Serializer.Serialization.cs

@@ -33,6 +33,14 @@ namespace CycloneDX.Json
     public static partial class Serializer
     {
         private static JsonSerializerOptions _options = Utils.GetJsonSerializerOptions();
+        private static readonly JsonSerializerOptions _options_compact = new Func<JsonSerializerOptions>(() =>
+            {
+                JsonSerializerOptions opts = Utils.GetJsonSerializerOptions();
+                opts.AllowTrailingCommas = false;
+                opts.WriteIndented = false;
+
+                return opts;
+            }) ();
 
         /// <summary>
         /// Serializes a CycloneDX BOM writing the output to a stream.
@@ -58,34 +66,60 @@ public static string Serialize(Bom bom)
             return jsonBom;
         }
 
-        internal static string Serialize(Component component)
-        {
-            Contract.Requires(component != null);
-            return JsonSerializer.Serialize(component, _options);
-        }
-
-        internal static string Serialize(Dependency dependency)
-        {
-            Contract.Requires(dependency != null);
-            return JsonSerializer.Serialize(dependency, _options);
-        }
-
-        internal static string Serialize(Service service)
+        /// <summary>
+        /// Return serialization of a class derived from BomEntity
+        /// with common JsonSerializerOptions defined for this class.
+        /// </summary>
+        /// <param name="entity">A BomEntity-derived class</param>
+        /// <returns>String with JSON markup</returns>
+        internal static string Serialize(BomEntity entity)
         {
-            Contract.Requires(service != null);
-            return JsonSerializer.Serialize(service, _options);
+            return Serialize(entity, _options);
         }
 
-        internal static string Serialize(Tool tool)
+        /// <summary>
+        /// Return serialization of a class derived from BomEntity
+        /// with compact JsonSerializerOptions aimed at minimal
+        /// markup (harder to read for humans, less bytes to parse).
+        /// </summary>
+        /// <param name="entity">A BomEntity-derived class</param>
+        /// <returns>String with JSON markup</returns>
+        internal static string SerializeCompact(BomEntity entity)
         {
-            Contract.Requires(tool != null);
-            return JsonSerializer.Serialize(tool, _options);
+            return Serialize(entity, _options_compact);
         }
 
-        internal static string Serialize(Models.Vulnerabilities.Vulnerability vulnerability)
+        /// <summary>
+        /// Return serialization of a class derived from BomEntity
+        /// with caller-specified JsonSerializerOptions.
+        /// </summary>
+        /// <param name="entity">A BomEntity-derived class</param>
+        /// <param name="options">Options for serializer</param>
+        /// <returns>String with JSON markup</returns>
+        internal static string Serialize(BomEntity entity, JsonSerializerOptions jserOptions)
         {
-            Contract.Requires(vulnerability != null);
-            return JsonSerializer.Serialize(vulnerability, _options);
+            Contract.Requires(entity != null);
+            // Default code tends to return serialization of base class
+            // => empty (no props in BomEntity itself) so we have to
+            // coerce it into seeing the object type we need to parse.
+            // This codepath is critical for us since serialization is
+            // used to compare if entities are Equal() in massive loops
+            // when merging Bom's. Optimizations welcome.
+            string res = null;
+            if (BomEntity.KnownEntityTypeLists.TryGetValue(entity.GetType(), out var listInfo)
+                && listInfo != null && listInfo.genericType != null
+                && listInfo.methodAdd != null && listInfo.methodGetItem != null
+            ) {
+                var castList = Activator.CreateInstance(listInfo.genericType);
+                listInfo.methodAdd.Invoke(castList, new object[] { entity });
+                res = JsonSerializer.Serialize(listInfo.methodGetItem.Invoke(castList, new object[] { 0 }), jserOptions);
+            }
+            else
+            {
+                var castEntity = Convert.ChangeType(entity, entity.GetType());
+                res = JsonSerializer.Serialize(castEntity, jserOptions);
+            }
+            return res;
         }
     }
 }

src/CycloneDX.Core/ListMergeHelper.cs

@@ -0,0 +1,132 @@
+// This file is part of CycloneDX Library for .NET
+//
+// Licensed under the Apache License, Version 2.0 (the “License”);
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an “AS IS” BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) OWASP Foundation. All Rights Reserved.
+
+using System;
+using System.Collections.Generic;
+using System.Reflection;
+using System.Text.RegularExpressions;
+using CycloneDX.Models;
+
+namespace CycloneDX
+{
+    /// <summary>
+    /// Allows to merge generic lists with items of specified types
+    /// (by default essentially adding entries which are not present
+    /// yet according to List.Contains() method), and calls special
+    /// logic for lists of BomEntry types.<br/>
+    ///
+    /// Used in CycloneDX.Utils various Merge implementations as well
+    /// as in CycloneDX.Core BomEntity-derived classes' MergeWith().<br/>
+    ///
+    /// Does not modify original lists and returns a new instance
+    /// with merged data. One exception is if one of the inputs is
+    /// null or empty - then the other object is returned.
+    /// </summary>
+    /// <typeparam name="T">Type of listed entries</typeparam>
+    public class ListMergeHelper<T>
+    {
+        public List<T> Merge(List<T> list1, List<T> list2)
+        {
+            return Merge(list1, list2, BomEntityListMergeHelperStrategy.Default());
+        }
+
+        public List<T> Merge(List<T> list1, List<T> list2, BomEntityListMergeHelperStrategy listMergeHelperStrategy)
+        {
+            if (!int.TryParse(System.Environment.GetEnvironmentVariable("CYCLONEDX_DEBUG_MERGE"), out int iDebugLevel) || iDebugLevel < 0)
+            {
+                iDebugLevel = 0;
+            }
+
+            // Rule out utterly empty inputs
+            if ((list1 is null || list1.Count < 1) && (list2 is null || list2.Count < 1))
+            {
+                if (!(list1 is null))
+                {
+                    return list1;
+                }
+                if (!(list2 is null))
+                {
+                    return list2;
+                }
+                return new List<T>();
+            }
+
+            // At least one of these entries exists, per above sanity check
+            if (typeof(BomEntity).IsInstanceOfType((!(list1 is null) && list1.Count > 0) ? list1[0] : list2[0]))
+            {
+                MethodInfo methodMerge = null;
+                Object helper;
+                // Use cached info where available
+                if (BomEntity.KnownBomEntityListMergeHelpers.TryGetValue(typeof(T), out BomEntityListMergeHelperReflection refInfo))
+                {
+                    methodMerge = refInfo.methodMerge;
+                    helper = refInfo.helperInstance;
+                }
+                else
+                {
+                    // Inspired by https://stackoverflow.com/a/4661237/4715872
+                    // to craft a List<SpecificType> "result" at run-time:
+                    Type listHelperType = typeof(BomEntityListMergeHelper<>);
+                    var constructedListHelperType = listHelperType.MakeGenericType(typeof(T));
+                    helper = Activator.CreateInstance(constructedListHelperType);
+                    // Gotta use reflection for run-time evaluated type methods:
+                    methodMerge = constructedListHelperType.GetMethod("Merge", 0, new [] { typeof(List<T>), typeof(List<T>), typeof(BomEntityListMergeHelperStrategy) });
+                }
+
+                if (methodMerge != null)
+                {
+                    return (List<T>)methodMerge.Invoke(helper, new object[] {list1, list2, listMergeHelperStrategy});
+                }
+                else
+                {
+                    // Should not get here, but if we do - log and fall through
+                    if (iDebugLevel >= 1)
+                    {
+                        Console.WriteLine($"Warning: List-Merge for BomEntity failed to find a Merge() helper method: {list1?.GetType()?.ToString()} and {list2?.GetType()?.ToString()}");
+                    }
+                }
+            }
+
+            // Lists of legacy types (for BomEntity we use BomEntityListMergeHelper<T> class)
+            if (iDebugLevel >= 1)
+            {
+                Console.WriteLine($"List-Merge for legacy types: {list1?.GetType()?.ToString()} and {list2?.GetType()?.ToString()}");
+            }
+
+            if (list1 is null || list1.Count < 1)
+            {
+                return list2;
+            }
+            if (list2 is null || list2.Count < 1)
+            {
+                return list1;
+            }
+
+            var result = new List<T>(list1);
+
+            foreach (var item in list2)
+            {
+                if (!(result.Contains(item)))
+                {
+                    result.Add(item);
+                }
+            }
+
+            return result;
+        }
+    }
+}

src/CycloneDX.Core/Models/AttachedText.cs

@@ -21,7 +21,7 @@
 namespace CycloneDX.Models
 {
     [ProtoContract]
-    public class AttachedText
+    public class AttachedText : BomEntity
     {
         [XmlAttribute("content-type")]
         [ProtoMember(1)]

src/CycloneDX.Core/Models/Bom.cs

@@ -29,7 +29,7 @@ namespace CycloneDX.Models
     [SuppressMessage("Microsoft.Usage", "CA2227:CollectionPropertiesShouldBeReadOnly")]
     [XmlRoot("bom", IsNullable=false)]
     [ProtoContract]
-    public class Bom
+    public class Bom : BomEntity
     {
         [XmlIgnore]
         public string BomFormat => "CycloneDX";
@@ -133,5 +133,10 @@ public int NonNullableVersion
         [ProtoMember(10)]
         public List<Vulnerabilities.Vulnerability> Vulnerabilities { get; set; }
         public bool ShouldSerializeVulnerabilities() { return Vulnerabilities?.Count > 0; }
+
+        // TODO: MergeWith() might be reasonable but is currently handled
+        // by several strategy implementations in CycloneDX.Utils Merge.cs
+        // so maybe there should be sub-classes or strategy arguments or
+        // properties to select one of those implementations at run-time?..
     }
 }