Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Improves detection of PyPI package names in environment dependencies #1699

Merged
merged 4 commits into from
Aug 21, 2024
Merged

Improves detection of PyPI package names in environment dependencies #1699

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
9161e5c
Improves detection of PyPi package names in environment dependencies
andrewnester Aug 20, 2024
40e1f83
added few more test cases
andrewnester Aug 20, 2024
28e1bed
support url lookups
andrewnester Aug 20, 2024
974525e
fixes
andrewnester Aug 21, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 18 additions & 4 deletions bundle/libraries/local_path.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ package libraries
import (
"net/url"
"path"
"regexp"
"strings"
)

Expand Down Expand Up @@ -65,14 +66,27 @@ func IsLibraryLocal(dep string) bool {
return IsLocalPath(dep)
}

// ^[a-zA-Z0-9\-_]+: Matches the package name, allowing alphanumeric characters, dashes (-), and underscores (_).
// \[.*\])?: Optionally matches any extras specified in square brackets, e.g., [security].
// ((==|!=|<=|>=|~=|>|<)\d+(\.\d+){0,2}(\.\*)?)?: Optionally matches version specifiers, supporting various operators (==, !=, etc.) followed by a version number (e.g., 2.25.1).
// Spec for package name and version specifier: https://pip.pypa.io/en/stable/reference/requirement-specifiers/
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for including the spec.

var packageRegex = regexp.MustCompile(`^[a-zA-Z0-9\-_]+\s?(\[.*\])?\s?((==|!=|<=|>=|~=|==|>|<)\s?\d+(\.\d+){0,2}(\.\*)?)?$`)

func isPackage(name string) bool {
// If the dependency has ==, it's a package with version
if strings.Contains(name, "==") {
if packageRegex.MatchString(name) {
return true
}

// If the dependency has no extension, it's a PyPi package name
return path.Ext(name) == ""
return isUrlBasedLookup(name)
}

func isUrlBasedLookup(name string) bool {
parts := strings.Split(name, " @ ")
if len(parts) != 2 {
return false
}

return packageRegex.MatchString(parts[0]) && isRemoteStorageScheme(parts[1])
}

func isRemoteStorageScheme(path string) bool {
Expand Down
9 changes: 9 additions & 0 deletions bundle/libraries/local_path_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,7 +54,16 @@ func TestIsLibraryLocal(t *testing.T) {
{path: "-r /Workspace/my_project/requirements.txt", expected: false},
{path: "s3://mybucket/path/to/package", expected: false},
{path: "dbfs:/mnt/path/to/package", expected: false},
{path: "beautifulsoup4", expected: false},
{path: "beautifulsoup4==4.12.3", expected: false},
{path: "beautifulsoup4 >= 4.12.3", expected: false},
{path: "beautifulsoup4 < 4.12.3", expected: false},
{path: "beautifulsoup4 ~= 4.12.3", expected: false},
{path: "beautifulsoup4[security, tests]", expected: false},
{path: "beautifulsoup4[security, tests] ~= 4.12.3", expected: false},
{path: "https://github.com/pypa/pip/archive/22.0.2.zip", expected: false},
{path: "pip @ https://github.com/pypa/pip/archive/22.0.2.zip", expected: false},
{path: "requests [security] @ https://github.com/psf/requests/archive/refs/heads/main.zip", expected: false},
}

for i, tc := range testCases {
Expand Down
Loading