fix: try/except in _scan_component, serialize_finding to prevent data injection, DRY LLM template, SUPPORTED_ECOSYSTEMS constant

guarddog_nexus/routes/webhooks.py

@@ -159,40 +159,45 @@ async def nexus_webhook(
 
 
 async def _scan_component(repository: str, name: str, version: str, ecosystem: str):
-    from ..core.nexus import nexus_get
-
-    params = urlencode(
-        {
-            "repository": repository,
-            "name": name,
-            "version": version,
-            "format": ecosystem,
-        }
-    )
-    api_path = f"/service/rest/v1/search?{params}"
     try:
-        resp = await nexus_get(api_path)
-        resp.raise_for_status()
-        data = resp.json()
+        from ..core.nexus import nexus_get
+
+        params = urlencode(
+            {
+                "repository": repository,
+                "name": name,
+                "version": version,
+                "format": ecosystem,
+            }
+        )
+        api_path = f"/service/rest/v1/search?{params}"
+        try:
+            resp = await nexus_get(api_path)
+            resp.raise_for_status()
+            data = resp.json()
+        except Exception as e:
+            log.warning("Component lookup error for %s==%s: %s", name, version, e)
+            return
+
+        items = data.get("items", [])
+        if not items:
+            log.warning("No items found in search for %s==%s", name, version)
+            return
+
+        for item in items:
+            for asset in item.get("assets", []):
+                asset_path = _extract_asset_path(asset)
+                if not asset_path or not _is_package_asset(asset_path):
+                    continue
+                download_url = asset.get("downloadUrl") or _build_download_url(
+                    repository, asset_path
+                )
+                log.info("Scanning component asset: %s", asset_path)
+                async for session in get_session():
+                    await harvest(download_url, repository, ecosystem, asset_path, session)
+                    break
     except Exception as e:
-        log.warning("Component lookup error for %s==%s: %s", name, version, e)
-        return
-
-    items = data.get("items", [])
-    if not items:
-        log.warning("No items found in search for %s==%s", name, version)
-        return
-
-    for item in items:
-        for asset in item.get("assets", []):
-            asset_path = _extract_asset_path(asset)
-            if not asset_path or not _is_package_asset(asset_path):
-                continue
-            download_url = asset.get("downloadUrl") or _build_download_url(repository, asset_path)
-            log.info("Scanning component asset: %s", asset_path)
-            async for session in get_session():
-                await harvest(download_url, repository, ecosystem, asset_path, session)
-                break
+        log.error("Component scan failed for %s==%s: %s", name, version, e)
 
 
 async def _scan_in_background(