oracle / oracle/macaron

RepoVerifierMaven raises IndexError for a group id with fewer than three segments

Open
#1,463 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
210
Forks
36
Avg merge
1d 10h
Merged PRs (30d)
2

Description

RepoVerifierMaven.verify_domains indexes the third segment of the Maven group id while comparing it with the reported repository URL:

group_parts = self.namespace.split(".")
...
group_parts[0].lower() in {"io", "com"}
and group_parts[1].lower() == platform.lower()
and group_parts[1].lower() == reported_hostname.lower()
and group_parts[2].lower() == reported_account.lower()

A group id with fewer than three segments that starts with io or com, for example com.github or io.github with a repository reported on github.com, raises IndexError here instead of returning a verification result. verify_repo in the analyzer calls this with the target's own PURL namespace and has no handler around it, so the analysis aborts.

Expected: the same UNKNOWN / git_ns_mismatch result a namespace with a wrong account gets, which is what the sibling comparison in maven_central_registry.same_organization returns for the same shape.

Reproduces on main at 16c6a1e with a parametrized test over com.github, io.github, com and io; a fix with the test follows as a PR.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in RepoVerifierMaven.verify_domains and inspect the parametrized test described for com.github, io.github, com, and io at commit 16c6a1e. Verify that short namespaces return UNKNOWN with git_ns_mismatch rather than raising IndexError, then run the relevant analyzer tests.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
build-system, security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Active
Clarity
Clearly specified
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.