fix: guard against index-out-of-range panics on empty fields

[akshita317]

Description

Fixes #10976

Several dependency parsers and the Amazon OS detector call strings.Fields(...)[0] (or index a field slice) without checking that the slice is non-empty. When the input string reduces to only whitespace after normalization, strings.Fields returns an empty slice, so the [0] access panics with index out of range [0] with length 0 — crashing the entire scan. Some of these are externally triggerable (e.g. a version-less /etc/system-release, or dependencies = [""] in a pyproject.toml).

Changes

Added a length guard before indexing at each location, skipping malformed entries gracefully — following the pattern already used in bundler/parse.go (if len(ss) == 0 { continue }):

File	Fix
pkg/detector/ospkg/amazon/amazon.go (Detect)	Leave the version empty and fall through to the existing Amazon Linux 1 default
pkg/detector/ospkg/amazon/amazon.go (IsSupportedVersion)	Return false (unsupported) when the version string is empty
pkg/dependency/parser/python/pyproject/pyproject.go	continue on an empty dependency entry
pkg/dependency/parser/swift/cocoapods/parse.go	continue on an empty dependency string
pkg/dependency/parser/hex/mix/parse.go	Guard ss[0] when the field slice is empty
pkg/dependency/parser/ruby/bundler/parse.go	Wrap s[0] in if len(s) > 0

A note on the amazon detector

Both Detect and IsSupportedVersion index the version string, and ospkg.Detector.Detect calls them in sequence — IsSupportedVersion first, then Detect unconditionally (detect.go#L129-L145). Guarding only IsSupportedVersion therefore leaves the scan panicking one call later, so both are guarded here.

For Detect I kept the empty version and let it fall through to the existing osVer = "1" fallback, which is how any other unrecognized version string is already treated. Happy to return early with no vulnerabilities instead if you'd prefer that an unknown version not be matched against Amazon Linux 1 advisories — it's a behavior change either way, so I went with the option consistent with the current code.

Testing

Added a regression test per guard. Each one panics with index out of range [0] with length 0 without its guard and passes with it:

Test	Input that triggers the empty slice
amazon: TestScanner_Detect/version-less system-release	osVer: ""
amazon: TestScanner_IsSupportedVersion/empty version	osVer: ""
mix: TestParser_Parse/no fields	"bunt": with nothing after the colon
cocoapods: TestParse/sad path. blank child dependency	a child dependency of " "
bundler: TestParser_Parse/blank dependency line	a whitespace-only line in the dependency graph
pyproject: TestParser_Parse/empty dependency	dependencies = ["", "flask == 1.1.4"]

• go test ./pkg/detector/ospkg/... ./pkg/dependency/parser/hex/mix/... ./pkg/dependency/parser/python/pyproject/... ./pkg/dependency/parser/swift/cocoapods/... ./pkg/dependency/parser/ruby/bundler/... — all pass.
• gofmt and go vet clean on the affected packages.

The Conda case mentioned in the issue was already handled by #10955, so it is not included here.

[CLAassistant]

All committers have signed the CLA.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[ghost]

Revisar .

https://github.com/copilot/share/c266101e-4be4-8ac1-a140-1c4b6073495f

[ghost]

Revisado