fix: sanitize Pipfile.lock to prevent upstream dparse KeyError (Issue…

[Palodeaza]

… 849)

Description

Fixes #849.

This PR addresses a bug where running a scan on a Pipfile.lock causes an unhandled KeyError: 'hashes' exception, aborting the entire scan process.

Root Cause Analysis

After tracing the unhandled exception, it was discovered that the bug originates in the upstream dparse library (dparse.parser). dparse assumes that every dependency object in a Pipfile.lock contains a "hashes" key. If even a single dependency lacks this key (which can happen with certain local or legacy package installations), dparse throws a KeyError and fails.

Solution

Since we cannot directly modify the upstream dparse library in the user's environment, this PR introduces a defensive middleware approach within Safety's process_files pipeline.

In safety/scan/ecosystems/python/dependencies.py:

• We intercept the file content before it is passed to dparse.
• If the file is strictly named Pipfile.lock, we parse the JSON and iterate through the default and develop sections.
• If any package is missing the "hashes" key, we inject an empty list ("hashes": []).
• This satisfies dparse's strict requirement, allowing the parser to successfully extract the dependency names and versions without crashing.

Type of Change

• Bug fix
• New feature
• Documentation update
• Refactor
• Other (please describe):

Related Issues

Testing

• Tests added or updated
• No tests required
  Although tests were checked before commiting to ensure that everything works as it should

Checklist

• Code is well-documented
• Changelog is updated (if needed)
• No sensitive information (e.g., keys, credentials) is included in the code
• All PR feedback is addressed

Additional Notes

Scope limitation: The sanitization logic is strictly gated behind if path.endswith("Pipfile.lock"): to ensure we do not accidentally attempt to parse requirements.txt (plain text) or poetry.lock (TOML) as JSON, preventing any unintended side effects.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 1075099e-6b16-4f2a-abd5-a578cf3504c1

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}