Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fails to parse --hash= values embedded in requirements.txt #16

Open
anotherbridge opened this issue Jul 5, 2023 · 2 comments
Open

Fails to parse --hash= values embedded in requirements.txt #16

anotherbridge opened this issue Jul 5, 2023 · 2 comments

Comments

@anotherbridge
Copy link

anotherbridge commented Jul 5, 2023

Describe the bug
When considering a requirements.txt file that contains additional information on the python version for which a package should be installed as well as additional arguments passed to pip, pyscan says there are no dependencies and it fails parsing the API response:

pyscan v0.1.5 | by Aswin S (github.com/aswinnnn)
Using requirements.txt/constraints.txt as source...
Found 0 dependencies
Invalid parse of API reponse at src/scanner/api.rs::query_batched

To Reproduce
Steps to reproduce the behavior:

  1. Use the following requirements.txt file: https://github.com/anotherbridge/pdfalyzer/blob/master/requirements.txt
  2. Run pyscan
  3. Observe the output

Expected behavior
Since the requirements.txt file is in a valid format (c.f. https://pip.pypa.io/en/latest/reference/requirements-file-format/) and can also be installed via pip without any issue, it is expected that pyscan detects the correct version according to the option that is specified.

Desktop (please complete the following information):

  • OS: macOS Ventura ARM architecture
@aswinnnn aswinnnn linked a pull request Jul 5, 2023 that will close this issue
9 tasks
@aswinnnn
Copy link
Owner

aswinnnn commented Jul 5, 2023

This seems to be a failure of the crate that I'm using to parse PEP-508 text. Might be a bit hard to fix since it doesn't originate from my code, but I will look into it

@aswinnnn aswinnnn self-assigned this Jul 5, 2023
@aswinnnn aswinnnn removed their assignment Sep 28, 2023
@aswinnnn aswinnnn removed a link to a pull request Oct 15, 2023
9 tasks
@aswinnnn
Copy link
Owner

ah, i tried to have a workaround by removing the hash values from the text before parsing, but pep-508 still picks up some other complications. The reason the hashes are there is for security and it seems ironic that a security tool should avoid it just to get by. Looks like this problem would not have a stable solution till @figsoda allows for parsing hash values, through flavoring or whatever method he picks.
The newest pyscan version (v0.1.6) will have to be released without resolving this issue.

@aswinnnn aswinnnn changed the title Parsing of requirements.txt file with options and python version fails Fails to parse --hash= values embedded in requirements.txt Oct 15, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants