From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-vk1-f182.google.com (mail-vk1-f182.google.com [209.85.221.182]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9F8F649620 for ; Sat, 18 Jul 2026 18:46:07 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.182 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784400369; cv=none; b=gLJfnLXqNBE16IFQgaznBMvJi+He++uW2ydM6IfmiP0rEdoPymCwV9UUFDztNTZREQrJfUhZStuxD4XFGMsl+c0KcKX0sAAbjZKfB6PMK1c+0746Op0RPNfASHFbiGvNWPz9a+qeYzlBqhI9dL2LB+DTEnM0qnn5adMUV6FVY5c= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784400369; c=relaxed/simple; bh=VLunqDnUcQ/jrGJMrjWPqicKfv2gcgfXB57YNIR17xw=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=Fv6kQS/d4+aPZzSiVr7qr0jbaEZVSsSathy4hALI+3uHPIz8xqpiQsIQwUCAIRN46UgXxAHb5bT071wkNeXwHjfOcGmgyXbkc+GS7HI2HEb1PB2rbj2Wory0bvl0GDujXd+fo3jRn7h9mOe1wyfCzGSgQk7WyLsMurk34jO8V/k= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=e8KidTZ/; arc=none smtp.client-ip=209.85.221.182 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="e8KidTZ/" Received: by mail-vk1-f182.google.com with SMTP id 71dfb90a1353d-5bf94664327so3375004e0c.1 for ; Sat, 18 Jul 2026 11:46:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784400366; x=1785005166; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=I5vhvWuDs2NL4jgJBBwCWyI0M3vB4RXgReb3EQTFUkE=; b=e8KidTZ/HBBOM1NQi/XP6R/viP1RQ8zgRpOAEh8Zt8/XuHxHmEhuy/BLSTth+9n3G2 PFBsq3PpPnbBO22z2Cyk2hvvVTMlyn5PMd2TCUZakdLBvl25IiX0jjM06XhIksDAQlQ3 bYq3wmlNqM9NGX02zX4jOq5oMeyMP46IPUfXiKyFmaBoOTIPZtxNXNVvhX9ibNNdGkos LfYFxfFfFIykggGVM2h/vwWCFZGkseA8yrhJMSBU4hAhxF7gWTtGAoQg12AbU6yn3Gax 3YFDuYJm5PjVpfztklxkRxJUjZnZyxoeiuA2jB4iLeC2KHU0wJ8CIsuiRPDdhRcl1diL tTMg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784400366; x=1785005166; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=I5vhvWuDs2NL4jgJBBwCWyI0M3vB4RXgReb3EQTFUkE=; b=XOHh0pC6qaFvhs3eGGHhnjnSKL0+25pk/bJhmaKcmbylxo7KBVUYgUimJ3PMundjda XzqPRyeIVq0jlMY0WyAP44t7qaQDgXFHZQerIrjd9Pl2Qrrganj47v70KDkT1CEfQJdm exDk1o/WBQXMdoo2tzlSyFeoocnBLgZL0oQd5yh/D7DWrkXfp5F7HF1mdVtj2J6cFG6e bGjeIeIYnaPsuGnEAe8psSaJoDPEzFRqlnpvLa5d8mtzBWNOCfmDmX8lPjAUgsBxYHZT sbEPCL59Gna9+oZA7lWZNptLR12bVzD/WkaR23BuBnAHqFbobdScjyRMAD1AV5qyUQLT QeZA== X-Forwarded-Encrypted: i=1; AHgh+Rqqu2Sw12InR3Fvr9d9mK2wxlbkuFN1E8GaJx9bkhs9hDvqKI6dJUAuUPcnGD80lOwqCi1QSoxge9A05tk=@vger.kernel.org X-Gm-Message-State: AOJu0YwXU3qwFatsFBI1p2BKJkCdnIxVEV7IiCQvLQObzbKkRjXWK7fq LKZij+jOAO95weLdVuQLTN+zh0udLx7hCwYA2QGZ/dOCDSZYGkk0EVlgM6hEnA7T X-Gm-Gg: AfdE7cnYYi55XMQxhvMu1ipyuJI8NX80M8/Zt+XKYZJddL1YLtmWvqY0Q4xRO0YmPqz OMQ2kt325eGOMwnCcY/E/u0GfnsPxNUt1K8teuS7Ei+Gx6PpaL+pwQWtUDIhDs0/YVK0DUAYKlL qOd/ox6olJ/ESIZNJeicSuKkEikb1Trkr18t+SRcxTYfatB4ZBLZA2Vuajh8PGAJ9Zw6lRrAiMu dZHYO40pUxMqUBltX+L3yxxhLsad2jUqucGHkx2Veq0V1unCIG7ytZJcm3g2lKwWx7twhx5sUFU lKxHeTl3KnRtI6vtaOLGPNlTif/1dhwhwpDHOeIRGbkMTpg7F7kL0W7yy2qZxxgE/t6rKuJt5W7 pWJtaq6DGrqnm+QbGJn+EP2E3YgJncJ/DqAbLf/6BD08vDupb1sXDdl7ur9SRapyuw6vqfaEfT6 7WsQ== X-Received: by 2002:a05:6122:4698:b0:5bf:b500:c4f4 with SMTP id 71dfb90a1353d-5c1b650ccaemr1303717e0c.2.1784400366353; Sat, 18 Jul 2026 11:46:06 -0700 (PDT) Received: from SadCat ([2804:164:c700:90e0:5471:c1e5:bfcb:6916]) by smtp.gmail.com with ESMTPSA id 71dfb90a1353d-5c1eeccafffsm3256711e0c.1.2026.07.18.11.46.03 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 18 Jul 2026 11:46:05 -0700 (PDT) From: kadu04t To: luis.augenstein@tngtech.com Cc: maximilian.huber@tngtech.com, gregkh@linuxfoundation.org, linux-kernel@vger.kernel.org, kadu04t Subject: [PATCH] scripts/sbom: catch ValueError from malformed shell quoting Date: Sat, 18 Jul 2026 15:44:57 -0300 Message-ID: <20260718184457.1861-1-otakurack@gmail.com> X-Mailer: git-send-email 2.54.0.windows.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit parse_inputs_from_commands() only caught CmdParsingError and IndexError when dispatching to command parsers, but several parsers call shlex.split() internally, which raises ValueError on malformed shell quoting (e.g. an unterminated quote). This exception was not caught, so a single malformed build command would abort SBOM generation entirely, even with fail_on_unknown_build_command=False, defeating the purpose of tolerant mode. Catch ValueError alongside CmdParsingError and IndexError so such commands are logged as a warning/error and skipped instead of aborting the whole run. Add tests covering a malformed quoting command and a command missing a required positional argument. Signed-off-by: kadu04t --- .../savedcmd_parser/savedcmd_parser.py | 2 +- .../tests/cmd_graph/test_savedcmd_parser.py | 25 +++++++++++++++++++ 2 files changed, 26 insertions(+), 1 deletion(-) diff --git a/scripts/sbom/sbom/cmd_graph/savedcmd_parser/savedcmd_parser.py b/scripts/sbom/sbom/cmd_graph/savedcmd_parser/savedcmd_parser.py index 6a7ea4787aa1..d2ca842a7849 100644 --- a/scripts/sbom/sbom/cmd_graph/savedcmd_parser/savedcmd_parser.py +++ b/scripts/sbom/sbom/cmd_graph/savedcmd_parser/savedcmd_parser.py @@ -57,7 +57,7 @@ def parse_inputs_from_commands( try: inputs = matched_parser(single_command) input_files.extend(inputs) - except (CmdParsingError, IndexError) as e: + except (CmdParsingError, IndexError, ValueError) as e: log_error_or_warning( "Skipped parsing command {single_command} because of command parsing error: {error_message}", single_command=single_command, diff --git a/scripts/sbom/tests/cmd_graph/test_savedcmd_parser.py b/scripts/sbom/tests/cmd_graph/test_savedcmd_parser.py index a061a748e1bf..d7776f072e03 100644 --- a/scripts/sbom/tests/cmd_graph/test_savedcmd_parser.py +++ b/scripts/sbom/tests/cmd_graph/test_savedcmd_parser.py @@ -19,6 +19,31 @@ class TestSavedCmdParser(unittest.TestCase): errors = sbom_logging._error_logger._message_counts # type: ignore self.assertEqual(errors, {}) + # Error handling tests + def test_malformed_shell_quoting(self): + command = 'gcc "unterminated' + with patch.object(sbom_logging, "warning") as warning: + parsed = parse_inputs_from_commands(command, fail_on_unknown_build_command=False) + + self.assertEqual(parsed, []) + warning.assert_called_once_with( + "Skipped parsing command {single_command} because of command parsing error: {error_message}", + single_command=command, + error_message="No closing quotation", + ) + + def test_missing_positional_argument(self): + command = "objcopy" + with patch.object(sbom_logging, "warning") as warning: + parsed = parse_inputs_from_commands(command, fail_on_unknown_build_command=False) + + self.assertEqual(parsed, []) + warning.assert_called_once_with( + "Skipped parsing command {single_command} because of command parsing error: {error_message}", + single_command=command, + error_message="list index out of range", + ) + # Compound command tests def test_dd_cat(self): cmd = "(dd if=arch/x86/boot/setup.bin bs=4k conv=sync status=none; cat arch/x86/boot/vmlinux.bin) >arch/x86/boot/bzImage" -- 2.54.0.windows.1