CycloneDX / CycloneDX/cyclonedx-python-lib

Validation errors are hard to present safely to the user (missing abstraction)

未关闭
#827 6 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看
enhancement help wanted
主要语言
Python
星标
116
派生
67
平均合并
8 天 2 小时
30 天内合并 PR
2

描述

https://cyclonedx-python-library.readthedocs.io/en/v10.2.0/autoapi/cyclonedx/validation/

We are using both JSON and XML inputs, and when something is wrong with the input, it is not easy to get the location of the problem or even what is wrong can be hidden in a multi-MB message.

One of the problem is, that the underlying libraries make it hard:
- `jsonschema` includes all the input (`instance`) in the error message, which in the SBOM case can be quite big, producing the above mentioned multi-MB message (this [`uniqueItems`](https://github.com/python-jsonschema/jsonschema/blob/f5cfc0ead76a8fc69db040cd94ed3a5e505dca81/jsonschema/_keywords.py#L212
) check can fail on e.g. the `dependencies`):
```py
yield ValidationError(f"{instance!r} has non-unique elements")
```
- in the xml case, somehow the easiest solution was to get the error from the logs: https://github.com/CycloneDX/cyclonedx-python-lib/blob/1a932a2ab00efb029c7b685cba7d9e5af3b7ea19/cyclonedx/validation/xml.py#L71

The other problem is, that CycloneDX makes no attempt at transforming these different object types into something sensible and type-safe for users, the raw objects are simply leaked through the interface as is in https://github.com/CycloneDX/cyclonedx-python-lib/blob/1a932a2ab00efb029c7b685cba7d9e5af3b7ea19/cyclonedx/validation/__init__.py#L36

Code samples triggering long messages:
```py
from cyclonedx.validation.json import JsonStrictValidator
from cyclonedx.schema import SchemaVersion

test_data_file = "tests/_data/schemaTestData/1.2/invalid-license-id-1.2.json"
schema_version = SchemaVersion.V1_2
validator = JsonStrictValidator(schema_version)
with open(test_data_file) as tdfh:
test_data = tdfh.read()
validation_error = validator.validate_str(test_data)
print(str(validation_error))
```
This message is 35508 characters long - 767 lines!

```py
from cyclonedx.validation.xml import XmlValidator
from cyclonedx.schema import SchemaVersion

test_data_file = "tests/_data/schemaTestData/1.1/invalid-license-id-1.1.xml"
schema_version = SchemaVersion.V1_1

validator = XmlValidator(schema_version)
with open(test_data_file) as tdfh:
test_data = tdfh.read()
validation_error = validator.validate_str(test_data)
print(str(validation_error))
```
This message is 12423 characters long - 1 line.

----

I would expect the errors returned/raised by CycloneDX something like below:

```py
class ValidationError:
# abstract class
data: Any
"raw problem, for debugging"

path: str
message: str

class XmlValidationError(ValidationError):
# this subclass knows what data is
@property
def path(self):
return self.data.path

@property
def message(self):
return self.data.message

class JsonValidationError(ValidationError):
# this subclass knows what data is
@property
def path(self):
return self.data.json_path

@property
def message(self):
# ensures the error is transformed to something sensible
# resolving a problem caused by using jsonscheme for CycloneDX users
instance = repr(self.data.instance)
return self.data.message.replace(instance, shortened(instance))
# where shortened(long_text) ~ 'first n ... last n', that is the middle of the string replaced
# this would still add some context, but it will be safe to display
```

These would provide a stable abstraction over generally useful validation error properties, and also hide implementation details from users, like third party objects `lxml.etree._LogEntry` and `jsonschema.exceptions.ValidationError`. The above proposal is also backward compatible, keeping `data` intact, if someone depends on it.

贡献指南

打开贡献指南

调研方向

从 cyclonedx/validation/__init__.py 以及 issue 中引用的 validation/json.py 和 validation/xml.py 入口点开始,然后使用列出的 schemaTestData 文件复现示例。当 JSON 和 XML 验证通过一个通用抽象提供稳定的路径和安全的消息,同时在 data 中保留底层原始错误时,即视为完成。

由索引模型根据 Issue 内容生成。

评估

技术栈
python
领域
api, backend
Issue 类型
功能
难度
5/5
预计耗时
一周以上
活跃度
停滞
描述清晰度
基本清楚
新手友好度
35/100

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。