War analysis require pom.xml?

[mvanini]

Is pom.xml inside artifact required when I analyze a war/ear?
I have some artifacts built with Apache Ant (so without a pom inside) and cdxgen fail to analyze them:

root@5a1a49758fe7:/app# cdxgen --version
3.2.9
root@5a1a49758fe7:/app# cdxgen -t java myapplication.war
Cleaning up /tmp/war-deps-SjtRrX
Unable to produce BOM for myapplication.war
root@5a1a49758fe7:/app#

[prabhu]

@mvanini The logic is here - https://github.com/AppThreat/cdxgen/blob/master/utils.js#L2261

I'm looking at MANIFEST.MF recursively. Would you be able to share a sample war file with me directly so that I can think about a different mode?

Email: prabhu @ appthreat .com