Skip to content

RepoVerifierMaven raises IndexError for a group id with fewer than three segments #1463

Description

@lenamonj

RepoVerifierMaven.verify_domains indexes the third segment of the Maven group id while comparing it with the reported repository URL:

group_parts = self.namespace.split(".")
...
group_parts[0].lower() in {"io", "com"}
and group_parts[1].lower() == platform.lower()
and group_parts[1].lower() == reported_hostname.lower()
and group_parts[2].lower() == reported_account.lower()

A group id with fewer than three segments that starts with io or com, for example com.github or io.github with a repository reported on github.com, raises IndexError here instead of returning a verification result. verify_repo in the analyzer calls this with the target's own PURL namespace and has no handler around it, so the analysis aborts.

Expected: the same UNKNOWN / git_ns_mismatch result a namespace with a wrong account gets, which is what the sibling comparison in maven_central_registry.same_organization returns for the same shape.

Reproduces on main at 16c6a1e with a parametrized test over com.github, io.github, com and io; a fix with the test follows as a PR.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions