fix: reject an uppercase checksum value instead of silently dropping it - #904
Open
Atishyy27 wants to merge 1 commit into
Open
fix: reject an uppercase checksum value instead of silently dropping it#904Atishyy27 wants to merge 1 commit into
Atishyy27 wants to merge 1 commit into
Conversation
The tag-value checksum lexer captured the value with ([a-f0-9]*), so an uppercase checksum matched a zero-length value and produced Checksum(SHA1, "") - the digits were swallowed as junk tokens and the document parsed as valid. Use ([a-f0-9]+) so the line falls through to the existing grammar error recovery and reports a clear parse error. Fixes spdx#903 Signed-off-by: Atishyy27 <sethatishayjain@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #903.
Problem
The tag-value checksum lexer rule captured the value with
([a-f0-9]*). For an uppercase checksum, the value group matched zero characters, producing aCHECKSUMtoken with an empty value; the real digits became junk tokens the parser silently swallowed, soChecksum(SHA1, "")was stored and the document "parsed successfully".Change
([a-f0-9]*)→([a-f0-9]+). The uppercase line now fails to match the checksum token and falls through to the grammar's existingfile_checksum : FILE_CHECKSUM errorrecovery, giving a clear "Token did not match specified grammar rule" error. Valid lowercase checksums are unaffected. (Lowercase-only validation is intentional per #452 — this reports rather than accepts uppercase.)Testing
test_parse_file_uppercase_checksum_raises— an uppercaseFileChecksumnow raisesSPDXParsingError(was silentlyChecksum(SHA1, "")). Fails on the original regex, passes after;black/isort/flake8clean.