Skip to content

Commit 6e9307a

Browse files
committed
Discard allow list entries that are not SPDX IDs
The allow-licenses list is expected (and documented) to be a list of SPDX license IDs (LicenseRefs are also valid). If someone puts an expression in the list (e.g. "GPL-3.0-only OR MIT"), it should be discarded so that the whole list does not become invalid. Fixes #907
1 parent 8805179 commit 6e9307a

File tree

4 files changed

+32
-3
lines changed

4 files changed

+32
-3
lines changed

__tests__/licenses.test.ts

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -290,6 +290,19 @@ test('it does filters out changes if they are not on the exclusions list', async
290290
expect(invalidLicenses.forbidden[1]).toBe(npmChange)
291291
})
292292

293+
test('it does not fail if there is a license expression in the allow list', async () => {
294+
const changes: Changes = [
295+
{...npmChange, license: 'MIT AND Apache-2.0'},
296+
{...rubyChange, license: 'BSD-3-Clause'}
297+
]
298+
299+
const {forbidden} = await getInvalidLicenseChanges(changes, {
300+
allow: ['BSD-3-Clause', 'MIT AND Apache-2.0', 'MIT', 'Apache-2.0']
301+
})
302+
303+
expect(forbidden.length).toEqual(0)
304+
})
305+
293306
describe('GH License API fallback', () => {
294307
test('it calls licenses endpoint if atleast one of the changes has null license and valid source_repository_url', async () => {
295308
const nullLicenseChange = {

dist/index.js

Lines changed: 8 additions & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

dist/index.js.map

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

src/licenses.ts

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,16 @@ export async function getInvalidLicenseChanges(
2929
licenseExclusions?: string[]
3030
}
3131
): Promise<InvalidLicenseChanges> {
32-
const {allow, deny} = licenses
32+
const deny = licenses.deny
33+
let allow = licenses.allow
34+
35+
// Filter out elements of the allow list that include AND
36+
// or OR because the list should be simple license IDs and
37+
// not expressions.
38+
allow = allow?.filter(license => {
39+
return !license.includes(' AND ') && !license.includes(' OR ')
40+
})
41+
3342
const licenseExclusions = licenses.licenseExclusions?.map(
3443
(pkgUrl: string) => {
3544
return parsePURL(pkgUrl)

0 commit comments

Comments
 (0)