refactor(purl): guard against empty package name in New - #4
Closed
DmitriyLewen wants to merge 3 commits into
Closed
Conversation
Move the `pkg.Name == ""` guard from applier's newPURL into purl.New so the safety check is applied for all callers and call sites. OCI is unaffected — it returns earlier inside the switch (OCI PURLs are derived from metadata, not pkg.Name). This also fixes a latent bug in pkg/report/github/github.go::buildPurl: previously, a package with empty Name produced a malformed PURL like `pkg:<type>/@<version>` and slipped past the `packageUrl == nil` check; now buildPurl correctly returns "".
Regression test for the fix in purl.New: an npm package without a Name must now produce an empty PackageUrl instead of a malformed `pkg:npm/@<version>`.
- spell out concrete (nil, nil) scenarios in New's godoc: empty pkg.Name, parseGolang for local paths, parseOCI without RepoDigests - expand the OCI case comment to explain the metadata.RepoDigests derivation and why the empty-name guard does not apply - add a Maven test case where parsing collapses Name to ""
Owner
Author
|
Closing — mislabeled target repo. Recreating against aquasecurity/trivy. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Follow-up to review feedback in aquasecurity#10298: move the
pkg.Name == ""guard frompkg/fanal/applier/docker.go::newPURLintopurl.Newso the safety check is centralized and applied for all callers. The TODOmove to "purl" packageinapplier/docker.gois removed.OCI is unaffected — it returns earlier inside the switch (OCI PURLs are derived from
metadata.RepoDigestsand deliberately ignorepkg.Name).Latent bug fix in
pkg/report/github/github.go::buildPurlPreviously a package with empty
Nameproduced a malformed PURL likepkg:npm/@1.0.0and slipped past thepackageUrl == nilcheck. NowbuildPurlcorrectly returns"". A regression test inpkg/report/github/github_test.gocovers this.Changes
pkg/purl/purl.go: add theif name == ""guard after the type-switch; document the(nil, nil)contract onNew; expand the OCI-case comment; drop the redundantif name == ""from the Golang case (now covered by the shared guard).pkg/fanal/applier/docker.go: remove the duplicated guard and stale TODO fromnewPURL; the function stays as the local error+log wrapper.pkg/purl/purl_test.go: add two cases —pkg.Name == ""and a Maven name that parses to empty.pkg/report/github/github_test.go: regression case for an unnamed npm package.Related issues
N/A — follow-up to a review comment.
Related PRs
Checklist