From 024b9d59013b02b9a31d6e3ff0c3b1da3a56f4a4 Mon Sep 17 00:00:00 2001 From: Atishyy27 Date: Wed, 29 Jul 2026 18:29:58 +0530 Subject: [PATCH] fix: reject an uppercase checksum value instead of silently dropping it The tag-value checksum lexer captured the value with ([a-f0-9]*), so an uppercase checksum matched a zero-length value and produced Checksum(SHA1, "") - the digits were swallowed as junk tokens and the document parsed as valid. Use ([a-f0-9]+) so the line falls through to the existing grammar error recovery and reports a clear parse error. Fixes #903 Signed-off-by: Atishyy27 --- src/spdx_tools/spdx/parser/tagvalue/lexer.py | 2 +- tests/spdx/parser/tagvalue/test_file_parser.py | 14 ++++++++++++++ 2 files changed, 15 insertions(+), 1 deletion(-) diff --git a/src/spdx_tools/spdx/parser/tagvalue/lexer.py b/src/spdx_tools/spdx/parser/tagvalue/lexer.py index 9a857827b..73328e9c3 100644 --- a/src/spdx_tools/spdx/parser/tagvalue/lexer.py +++ b/src/spdx_tools/spdx/parser/tagvalue/lexer.py @@ -139,7 +139,7 @@ def t_text_error(self, t): @TOKEN( r":\s*(ADLER32|BLAKE2b-256|BLAKE2b-384|BLAKE2b-512|BLAKE3|MD2|MD4|MD5|MD6|SHA1|SHA224|SHA256|SHA384|SHA512|" - r"SHA3-256|SHA3-384|SHA3-512):\s*([a-f0-9]*)" + r"SHA3-256|SHA3-384|SHA3-512):\s*([a-f0-9]+)" ) def t_CHECKSUM(self, t): t.value = t.value[1:].strip() diff --git a/tests/spdx/parser/tagvalue/test_file_parser.py b/tests/spdx/parser/tagvalue/test_file_parser.py index aedf197b5..7749af66e 100644 --- a/tests/spdx/parser/tagvalue/test_file_parser.py +++ b/tests/spdx/parser/tagvalue/test_file_parser.py @@ -68,3 +68,17 @@ def test_parse_invalid_file(): "Error while parsing File: ['Invalid FileType: SOUCE. Line 3', 'Error while " "parsing FileChecksum: Token did not match specified grammar rule. Line: 5']" ] + + +def test_parse_file_uppercase_checksum_raises(): + # An uppercase checksum value used to silently produce Checksum(SHA1, "") + # instead of raising; the lexer must reject it as a grammar error. + file_str = "\n".join( + [ + "FileName: f", + "SPDXID: SPDXRef-File", + "FileChecksum: SHA1: D6A770BA38583ED4BB4525BD96E50461655D2758", + ] + ) + with pytest.raises(SPDXParsingError): + Parser().parse("\n".join([DOCUMENT_STR, file_str]))