fix(entrypoints): bound dependency array scan to avoid false positives on unterminated arrays (#27)

An unclosed dependencies = [ in a truncated/corrupt pyproject.toml
previously scanned to end of file and harvested quoted strings from
later TOML tables as fake dependencies. Bound the scan to the next
table header and return None when the array never closes, matching
pre-fix behaviour of detecting nothing from a malformed file.

Author: rahlk

codeanalyzer/entrypoints/detect.py

@@ -16,6 +16,7 @@
 
 _REQ = re.compile(r"^\s*['\"]?([A-Za-z0-9_.\-]+)")
 _DEPS_START = re.compile(r"dependencies\s*=\s*\[")
+_TABLE_HEADER = re.compile(r"(?m)^[ \t]*\[")
 _PKG = re.compile(r"['\"]([A-Za-z0-9][A-Za-z0-9_.\-]*)")
 
 
@@ -87,14 +88,22 @@ def _strip_comments(text: str) -> str:
 def _deps_array_span(text: str) -> Optional[str]:
     """Return the contents between the `dependencies = [` and its matching
     `]`, counting bracket depth so a nested `[...]` (extras, e.g.
-    `celery[redis]`) doesn't close the span early."""
+    `celery[redis]`) doesn't close the span early.
+
+    Bounded by the next TOML table header (a `[` starting a line): if the
+    array never closes before then, it's unterminated (truncated/corrupt
+    file) and this returns None rather than harvesting quoted strings out
+    of whatever table follows.
+    """
     m = _DEPS_START.search(text)
     if not m:
         return None
+    boundary = _TABLE_HEADER.search(text, m.end())
+    limit = boundary.start() if boundary else len(text)
     depth = 1
     in_str = None
     i = m.end()
-    while i < len(text) and depth > 0:
+    while i < limit and depth > 0:
         ch = text[i]
         if in_str:
             if ch == in_str:
@@ -106,4 +115,6 @@ def _deps_array_span(text: str) -> Optional[str]:
         elif ch == "]":
             depth -= 1
         i += 1
+    if depth != 0:
+        return None
     return text[m.end() : i - 1]

test/test_entrypoint_detect.py

@@ -57,3 +57,21 @@ def test_commented_out_dependency_is_not_detected(tmp_path: Path):
     got = detected_frameworks(_app("os"), tmp_path, load_rules())
     assert "celery" not in got
     assert "flask" in got
+
+
+def test_unterminated_dependencies_array_detects_nothing(tmp_path: Path):
+    """A truncated/corrupt pyproject.toml must not leak quoted strings from
+    a later table (e.g. an author email or homepage URL) into the detected
+    package set -- matching pre-fix behaviour of "malformed file, nothing
+    detected"."""
+    (tmp_path / "pyproject.toml").write_text(
+        "[project]\n"
+        'name = "x"\n'
+        "dependencies = [\n"
+        '    "celery>=5"\n'
+        "\n"
+        "[project.urls]\n"
+        'Homepage = "https://flask.example.com"\n'
+    )
+    got = detected_frameworks(_app("os"), tmp_path, load_rules())
+    assert got == set()