Repository navigation
fix(validation): flag empty or missing package name as invalid (#850, #885) - #910
Open
ShivanshhhG wants to merge 1 commit into
Open
ShivanshhhG wants to merge 1 commit into
ShivanshhhG wants to merge 1 commit into
Conversation
, spdx#885) Per clause 7.1 of the SPDX specification, package name is a mandatory field. Previously, package_validator.py only validated download_location, homepage, checksums, etc., but did not check whether package.name is present and non-empty. This allowed packages with missing, empty, or whitespace-only names to pass validation undetected. Validate that package.name is non-empty and emit an actionable ValidationMessage if it is missing or blank. Add unit test coverage in test_package_validator.py. Fixes spdx#850 Fixes spdx#885 Signed-off-by: SHIVANSH-ux-ys <singaser78@gmail.com>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Per clause 7.1 of the SPDX specification (Package Name), package name is a mandatory field for every package. Previously,
validate_packageinpackage_validator.pyverified other fields (download location, checksums, verification codes), but did not check whetherpackage.namewas populated. As reported in #850 and #885, a package with a missing, empty (""), or whitespace-only name passed validation without raising an error.Changes
package_validator.py(validate_package): check ifpackage.name is None or not str(package.name).strip(), and emit an actionableValidationMessagewhen empty.test_package_validator.py: added parametrized unit testtest_invalid_package_nameverifying that empty strings, spaces, and whitespace triggers the expected validation error.Fixes #850
Fixes #885