CycloneDX / CycloneDX/cyclonedx-python-lib

Wrong input should result into an exception

未关闭
#766 2 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看
breaking change
主要语言
Python
星标
116
派生
67
平均合并
8 天 2 小时
30 天内合并 PR
2

描述

The code in spdx.py function `is_compound_expression` may run into an exception for several cases, and this results into a `return False`.

This is semantically overloaded.
In case of `False` we cannot distinguish between
- the value cannot be interpreted at all (invalid characters)
- it is a compound expression, but consists of partially unknown, but maybe valid simple (e.g. LicenseRef-*) expression(s)

So it may not be clear what is feasible of how to proceed in case of False.

In case of invalid characters the exception should not be caught, but (re)raised so that an appropriate exception handling can be applied.

The `validate` parameter should be made available in the `is_compound_expression` function to allow either both license item validation along with the compound check or compound check only.

贡献指南

打开贡献指南

调研方向

Start in spdx.py at is_compound_expression and trace the exception handling for invalid characters and partially unknown license expressions. Review how the validate parameter is handled elsewhere, then make invalid input propagate an appropriate exception while allowing compound checking with or without license-item validation. Done means callers can distinguish invalid input from a valid compound expression containing unknown items.

由索引模型根据 Issue 内容生成。

评估

技术栈
python
领域
backend
Issue 类型
缺陷
难度
3/5
预计耗时
1-2 天
活跃度
停滞
描述清晰度
基本清楚
新手友好度
45/100

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。