Detect invalid license expressions containing ()
#879
+18
−8
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
The following condensed list of expressions are all currently
mislabelled as valid by `canonicalize_license_expression()`.
( ) or MIT
MIT and ( )
( ) and MIT or MIT
( ) with ( MIT )
( ) with ( ) or MIT
MIT with ( ) with ( ) or MIT
The trick of converting license expressions to Python statements runs
afoul of `()` being an empty tuple (i.e. valid syntax and falsy).
Depending on how `()` is combined with real `False`s, it may or may not
get caught by the subsequent `eval(python_expression) is False` check:
MIT or () -> False or () -> () # Caught
() or MIT -> () or False -> False # Not caught
Consider a license expression invalid if a `)` comes immediately after a
`(` token. This also removes the one case where the `eval()` would
return something other than `False` so that `eval()` can now be
downgraded to a `compile()` (which I find very anxiety relieving even
though I can't think of any way the old `eval()` could ever have been
exposed to more than `False`s or `()`s).
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The following condensed list of expressions are all currently mislabelled as valid by
canonicalize_license_expression().The trick of converting license expressions to Python statements runs afoul of
()being an empty tuple (i.e. valid syntax and falsy). Depending on how()is combined with realFalses, it may or may not get caught by the subsequenteval(python_expression) is Falsecheck:Consider a license expression invalid if a
)comes immediately after a(token. This also removes the one case where theeval()would return something other thanFalseso thateval()can now be downgraded to acompile()(which I find very anxiety relieving even though I can't think of any way the oldeval()could ever have been exposed to more thanFalses or()s).