Fix crashes in MatchSpec, VersionSpec parsing #12014
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
We require contributors to sign our Contributor License Agreement and we don't have one on file for @pkmooreanaconda. In order for us to review and merge your code, please e-sign the Contributor License Agreement PDF. We then need to manually verify your signature. We will ping the bot to refresh the PR status when we have confirmed your signature. |
|
@conda-bot check |
36f1683 to
3f8282d
Compare
6129258 to
21b4967
Compare
chenghlee
previously requested changes
Oct 28, 2022
21b4967 to
6105560
Compare
23da2cf to
f32280c
Compare
|
@pkmooreanaconda I just noticed that your GPG isn't uploaded on GitHub, making your commits unverified, could you rectify that? |
kenodegard
requested changes
Nov 1, 2022
Co-authored-by: Ken Odegard <kodegard@anaconda.com>
kenodegard
approved these changes
Nov 1, 2022
5 tasks
Will research this issue outside of this PR.
chenghlee
approved these changes
Nov 2, 2022
2 tasks
jeskowagner
pushed a commit
to jeskowagner/conda
that referenced
this pull request
Nov 9, 2022
* Fix regex related crash in MatchSpec * Fix crash related to mishandling of local version separator * Fix crash related to mishandling of "==" * Clean up news item, small format string fixes Co-authored-by: Ken Odegard <kodegard@anaconda.com>
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
This PR attempts to address the set of crashes referenced in #11999. These fixes are intended to be minimal in order to reduce the chances of unintended MatchSpec behavior changes. The changes can be split into three commits:
Regex-In-MatchSpec related fixes: These fixes wrap attempts to compile regular expressions built from user input in order to catch regular expressions and raise InvalidMatchSpec with an informative error message instead.
version.py fix: Fix a bug in handling the "local version separator (+)." I've made a minimal correction to this code which makes versions like "+", "+a", "+1", and "+1.2" invalid. These cases are invalid because it doesn't make sense to only specify a local version. Cases like "1.2+", "1+", "a+" are already caught as invalid.
"==" fix: "==" was unintentionally treated differently than "<=" and ">=" due to some weird translation code (link). This meant that cases line "numpy<=" and "numpy>=" would raise an error while "numpy==" would crash. I made a small fix to bypass the translation code in the "numpy==" case so invalid version "==" can reach the existing error handling code like its friends. The way this is handled is very weird. We allow the strings "<=", ">=" and (now) "==" to be considered versions for a while after parsing and catch them later on with an "invalid operator" error. But that's a job for another time.
Checklist
newsdirectory (using the template) for the next release's release notes?