BUG: Scan (sometimes?) fails with dual-licensed packages - `argument.trim is not a function`

[snspinn]

Trying to do a scan on a fairly old repo. Can't publish the list of packages but I'm only mentioning its age because newer repos get scanned fine. When scanning, I get the error argument.trim is not a function.

Description

Running npx --verbose @onebeyond/license-checker scan --failOn GPL-1.0-or-later.

Also tested with different node/npm version combinations, same behaviour.

Expected Behavior

Should scan the repo and output a licence report file.

Actual Behavior

Full terminal output:

npm verb cli [
npm verb cli   '/home/username/.proto/tools/node/16.20.2/bin/node',
npm verb cli   '/home/username/.proto/tools/npm/7.24.2/bin/npm-cli.js',
npm verb cli   'exec',
npm verb cli   '--loglevel',
npm verb cli   'verbose',
npm verb cli   '--',
npm verb cli   '@onebeyond/license-checker',
npm verb cli   'scan',
npm verb cli   '--failOn',
npm verb cli   'GPL-1.0-or-later'
npm verb cli ]
npm info using npm@7.24.2
npm info using node@v16.20.2
npm timing npm:load:whichnode Completed in 0ms
npm timing config:load:defaults Completed in 1ms
npm timing config:load:file:/home/username/.proto/tools/npm/7.24.2/npmrc Completed in 1ms
npm timing config:load:builtin Completed in 1ms
npm timing config:load:cli Completed in 2ms
npm timing config:load:env Completed in 0ms
npm timing config:load:file:/home/username/Projects/apps/project/.npmrc Completed in 0ms
npm timing config:load:project Completed in 1ms
npm timing config:load:file:/home/username/.npmrc Completed in 1ms
npm timing config:load:user Completed in 1ms
npm timing config:load:file:/home/username/.proto/tools/node/16.20.2/etc/npmrc Completed in 1ms
npm timing config:load:global Completed in 1ms
npm timing config:load:validate Completed in 0ms
npm timing config:load:credentials Completed in 1ms
npm timing config:load:setEnvs Completed in 0ms
npm timing config:load Completed in 8ms
npm timing npm:load:configload Completed in 8ms
npm timing npm:load:setTitle Completed in 0ms
npm timing npm:load:setupLog Completed in 1ms
npm timing config:load:flatten Completed in 2ms
npm timing npm:load:cleanupLog Completed in 1ms
npm timing npm:load:configScope Completed in 0ms
npm timing npm:load:projectScope Completed in 1ms
npm timing npm:load Completed in 21ms
npm http fetch GET 200 https://registry.npmjs.org/@onebeyond%2flicense-checker 328ms (cache revalidated)
npm timing arborist:ctor Completed in 1ms
npm timing arborist:ctor Completed in 0ms
npm timing arborist:ctor Completed in 0ms
npm timing arborist:ctor Completed in 0ms
argument.trim is not a function
npm timing command:exec Completed in 5061ms
npm verb exit 1
npm timing npm Completed in 5236ms
npm verb code 1

Possible Fix

N/A

Steps to Reproduce

Cannot provide steps to reproduce right now but will work on doing so.

Context

Preventing use of the scan tool entirely.

Your Environment

• Version used:
• Environment name and version (e.g. Chrome 39, node.js 5.4): node 16.20.2; npm 7.24.2
• Operating System and version (desktop or mobile): Ubuntu 22.04
• Link to your project: N/A

[snspinn]

Chasing this down, I've isolated the .trim() to line 7 of node_modules/spdx-expression-validate/index.js

Looks like one of my packages is dual licensed and the parser cannot handle the Array input. If I print out the argument to spdxExpressionValidate I get [ 'AFLv2.1', 'BSD' ]

This is the stack trace for the error:

argument.trim is not a function
TypeError: argument.trim is not a function
    at spdxExpressionValidate (/home/username/license-checker/node_modules/spdx-expression-validate/index.js:7:14)
    at packages.reduce.forbidden (/home/username/license-checker/src/utils.js:128:10)
    at Array.reduce (<anonymous>)
    at checkPackagesLicenses (/home/username/license-checker/src/utils.js:125:19)
    at scan (/home/username/license-checker/src/runner.js:43:7)
    at runMicrotasks (<anonymous>)
    at processTicksAndRejections (node:internal/process/task_queues:96:5)
    at async Object.exports.handler (/home/username/license-checker/commands/scan.js:66:5)

[snspinn]

Quickfix

Hacked this by updating node_modules/spdx-expression-validate/index.js directly to do a type check:

module.exports = function spdxExpressionValidate (argument) {
  if ((typeof argument) == "object") {
    argument = argument.toString()
  }
  var fatString = (
    argument.trim() !== argument ||
    containsRepeatedSpace.test(argument)
  )
// Rest of function
}

Seems spdx-expression-validate is no longer maintained, patching this there is unlikely.