IDETECT-5134 : fix(pnpm): use UTF-8 encoding when reading pnpm-lock.yaml to handle emojis and non-ASCII characters

build.gradle

@@ -22,7 +22,7 @@ buildscript {
 
 group = 'com.blackduck.integration'
 
-version = '12.0.0-SIGQA3-SNAPSHOT'
+version = '12.0.0-SIGQA4-IDETECT-5134-SNAPSHOT'
 
 apply plugin: 'com.blackduck.integration.solution'
 apply plugin: 'org.springframework.boot'

detectable/src/main/java/com/blackduck/integration/detectable/detectables/pnpm/lockfile/process/PnpmLockYamlParserInitial.java

@@ -1,9 +1,10 @@
 package com.blackduck.integration.detectable.detectables.pnpm.lockfile.process;
 
 import java.io.File;
-import java.io.FileNotFoundException;
-import java.io.FileReader;
+import java.io.FileInputStream;
 import java.io.IOException;
+import java.io.InputStreamReader;
+import java.nio.charset.StandardCharsets;
 import java.util.List;
 
 import org.jetbrains.annotations.Nullable;
@@ -62,9 +63,9 @@ public List<CodeLocation> parse(File pnpmLockYamlFile, @Nullable NameVersion pro
      * 
      * @param pnpmLockYamlFile the File path to the pnpm-lock.yaml file
      * @return a memory representation of the lock file.
-     * @throws FileNotFoundException
+     * @throws IOException if the file cannot be read or closed
      */
-    private PnpmLockYamlBase parseYamlFile(File pnpmLockYamlFile) throws FileNotFoundException {
+    private PnpmLockYamlBase parseYamlFile(File pnpmLockYamlFile) throws IOException {
         DumperOptions dumperOptions = new DumperOptions();
         Representer representer = new Representer(dumperOptions);
         representer.getPropertyUtils().setSkipMissingProperties(true);
@@ -74,11 +75,15 @@ private PnpmLockYamlBase parseYamlFile(File pnpmLockYamlFile) throws FileNotFoun
             // Try to read the lockfile into the current Yaml classes. It's more common and 
             // should hopefully work more of the time.
             Yaml yaml = new Yaml(new Constructor(PnpmLockYaml.class, loaderOptions), representer);
-            return yaml.load(new FileReader(pnpmLockYamlFile));
+            try (InputStreamReader reader = new InputStreamReader(new FileInputStream(pnpmLockYamlFile), StandardCharsets.UTF_8)) {
+                return yaml.load(reader);
+            }
         } catch (ConstructorException e) {
             // If the reading fails try to read a v5 Yaml. 
             Yaml yaml = new Yaml(new Constructor(PnpmLockYamlv5.class, loaderOptions), representer);
-            return yaml.load(new FileReader(pnpmLockYamlFile));
+            try (InputStreamReader reader = new InputStreamReader(new FileInputStream(pnpmLockYamlFile), StandardCharsets.UTF_8)) {
+                return yaml.load(reader);
+            }
         }
     }
 }

detectable/src/test/java/com/blackduck/integration/detectable/detectables/pnpm/unit/PnpmLockYamlParserUtf8Test.java

@@ -0,0 +1,65 @@
+package com.blackduck.integration.detectable.detectables.pnpm.unit;
+
+import java.io.File;
+import java.io.IOException;
+import java.util.Collections;
+import java.util.List;
+
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Test;
+
+import com.google.gson.Gson;
+import com.blackduck.integration.detectable.detectable.codelocation.CodeLocation;
+import com.blackduck.integration.detectable.detectable.util.EnumListFilter;
+import com.blackduck.integration.detectable.detectables.pnpm.lockfile.PnpmLockOptions;
+import com.blackduck.integration.detectable.detectables.pnpm.lockfile.model.PnpmDependencyType;
+import com.blackduck.integration.detectable.detectables.pnpm.lockfile.process.PnpmLinkedPackageResolver;
+import com.blackduck.integration.detectable.detectables.pnpm.lockfile.process.PnpmLockYamlParserInitial;
+import com.blackduck.integration.detectable.detectables.yarn.packagejson.PackageJsonFiles;
+import com.blackduck.integration.detectable.detectables.yarn.packagejson.PackageJsonReader;
+import com.blackduck.integration.detectable.util.FunctionalTestFiles;
+import com.blackduck.integration.exception.IntegrationException;
+import com.blackduck.integration.util.NameVersion;
+
+/**
+ * Tests that pnpm-lock.yaml files containing emojis and non-ASCII content
+ * are parsed correctly when read with explicit UTF-8 encoding
+ * (InputStreamReader + StandardCharsets.UTF_8).
+ */
+public class PnpmLockYamlParserUtf8Test {
+
+    private List<CodeLocation> parseLockFile(String resourcePath) throws IOException, IntegrationException {
+        File pnpmLockYaml = FunctionalTestFiles.asFile(resourcePath);
+
+        EnumListFilter<PnpmDependencyType> dependencyTypeFilter = EnumListFilter.excludeNone();
+        PnpmLockOptions pnpmLockOptions = new PnpmLockOptions(dependencyTypeFilter, Collections.emptyList(), Collections.emptyList());
+
+        PnpmLockYamlParserInitial parser = new PnpmLockYamlParserInitial(pnpmLockOptions);
+        PnpmLinkedPackageResolver linkedPackageResolver = new PnpmLinkedPackageResolver(
+            pnpmLockYaml.getParentFile(),
+            new PackageJsonFiles(new PackageJsonReader(new Gson()))
+        );
+
+        return parser.parse(pnpmLockYaml, new NameVersion("project", "1.0.0"), linkedPackageResolver);
+    }
+
+    @Test
+    public void testParseV9WithEmojiComments() throws IOException, IntegrationException {
+        // YAML contains emoji characters (🚀🎉✅❌🔥💡) in comments
+        List<CodeLocation> codeLocations = parseLockFile("/pnpm/unicode/v9-emoji-comments/pnpm-lock.yaml");
+
+        Assertions.assertNotNull(codeLocations, "Code locations should not be null when parsing YAML with emoji comments");
+        Assertions.assertFalse(codeLocations.isEmpty(), "Should produce at least one code location");
+    }
+
+    @Test
+    public void testParseV5WithAccentedComments() throws IOException, IntegrationException {
+        // YAML contains accented (Ünïcödé, Ñoño, résumé, naïveté) and Greek characters in comments
+        List<CodeLocation> codeLocations = parseLockFile("/pnpm/unicode/v5-accented/pnpm-lock.yaml");
+
+        Assertions.assertNotNull(codeLocations, "Code locations should not be null when parsing YAML with accented comments");
+        Assertions.assertFalse(codeLocations.isEmpty(), "Should produce at least one code location");
+    }
+
+}
+