From ed1bc8d12b82c28351fa44046cf94229244d5ad3 Mon Sep 17 00:00:00 2001 From: SHIVANSH-ux-ys Date: Wed, 28 Oct 2026 01:16:19 +0530 Subject: [PATCH] fix(validation): flag empty or missing package name as invalid (#850, #885) Per clause 7.1 of the SPDX specification, package name is a mandatory field. Previously, package_validator.py only validated download_location, homepage, checksums, etc., but did not check whether package.name is present and non-empty. This allowed packages with missing, empty, or whitespace-only names to pass validation undetected. Validate that package.name is non-empty and emit an actionable ValidationMessage if it is missing or blank. Add unit test coverage in test_package_validator.py. Fixes #850 Fixes #885 Signed-off-by: SHIVANSH-ux-ys --- src/spdx_tools/spdx/validation/package_validator.py | 3 +++ tests/spdx/validation/test_package_validator.py | 12 ++++++++++++ 2 files changed, 15 insertions(+) diff --git a/src/spdx_tools/spdx/validation/package_validator.py b/src/spdx_tools/spdx/validation/package_validator.py index 25cd6147f..0d7e75f2a 100644 --- a/src/spdx_tools/spdx/validation/package_validator.py +++ b/src/spdx_tools/spdx/validation/package_validator.py @@ -111,6 +111,9 @@ def validate_package( spdx_id=package.spdx_id, element_type=SpdxElementType.PACKAGE, full_element=package ) + if package.name is None or not str(package.name).strip(): + validation_messages.append(ValidationMessage("package name is mandatory and cannot be empty", context)) + download_location = package.download_location if isinstance(download_location, str): for message in validate_download_location(download_location): diff --git a/tests/spdx/validation/test_package_validator.py b/tests/spdx/validation/test_package_validator.py index d0516fff2..0203df94d 100644 --- a/tests/spdx/validation/test_package_validator.py +++ b/tests/spdx/validation/test_package_validator.py @@ -154,3 +154,15 @@ def test_v2_2mandatory_fields(): expected = [ValidationMessage(f"{field} is mandatory in SPDX-2.2", context) for field in mandatory_fields] TestCase().assertCountEqual(validation_messages, expected) + + +@pytest.mark.parametrize("invalid_name", ["", " ", "\t\n"]) +def test_invalid_package_name(invalid_name): + package = package_fixture(name=invalid_name) + validation_messages = validate_package(package, "SPDX-2.3") + + context = ValidationContext(spdx_id=package.spdx_id, element_type=SpdxElementType.PACKAGE, full_element=package) + expected = [ValidationMessage("package name is mandatory and cannot be empty", context)] + + assert validation_messages == expected +