Skip to content

fix(conda): strip pip "~=" and "!=" operators from dependency names - #11057

Open
sueun-dev wants to merge 1 commit into
aquasecurity:mainfrom
sueun-dev:fix-conda-pip-operators
Open

fix(conda): strip pip "~=" and "!=" operators from dependency names#11057
sueun-dev wants to merge 1 commit into
aquasecurity:mainfrom
sueun-dev:fix-conda-pip-operators

Conversation

@sueun-dev

Copy link
Copy Markdown
Contributor

Description

environment.yml can carry a pip: subsection whose entries use PEP 440 version operators. parseDependency separates the name from the version by replacing >, < and = with spaces, but not ~ or !, so the operator character stays glued to the name:

django~=5.0.6  ->  name "django~"
flask!=2.0     ->  name "flask!"

The analyzer copies the parsed name verbatim, so the SBOM ends up with django~/flask!, and vulnerability matching (which keys on the name) finds nothing for those packages.

This adds ~ and ! to the replacer so the name comes out clean, the same way > and < already are. Like the other range operators, ~=/!= record no pinned version — they are ranges, not pins.

Tested with a new pip: fixture (django~=5.0.6, flask!=2.0, requests==2.31.0) added to the parser table test: it fails on main (names django~, flask!) and passes with the change. go test ./pkg/dependency/parser/conda/... and the conda analyzer tests pass.

Related issues

None.

Checklist

  • I've read the guidelines for contributing to this repository.
  • I've followed the conventions in the PR title.
  • I've added tests that prove my fix is effective or that my feature works.
  • I've updated the documentation with the relevant information (if needed).
  • I've added usage information (if the PR introduces new options)
  • I've included a "before" and "after" example to the description (if the PR is a user interface change).

environment.yml pip: entries use PEP 440 operators. parseDependency
separated the name from the version by replacing >, < and =, but not ~ or
!, so django~=5.0.6 parsed to the name "django~" and flask!=2.0 to
"flask!". The analyzer copies the name verbatim, so the SBOM and
name-keyed vulnerability matching used the corrupted name.

Add ~ and ! to the replacer so the name comes out clean, matching how >
and < are handled; like the other range operators, ~=/!= record no
pinned version.
@nikpivkin

Copy link
Copy Markdown
Contributor

Hi @sueun-dev !

Please open a discussion before submitting a PR, where you describe the issue and include steps to reproduce it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants