_dependency_source/pip: Log a warning and skip auditing for packages with invalid versions

pip_audit/_dependency_source/pip.py

@@ -7,7 +7,7 @@
 from typing import Iterator, Optional
 
 import pip_api
-from packaging.version import Version
+from packaging.version import InvalidVersion, Version
 
 from pip_audit._dependency_source import DependencySource, DependencySourceError
 from pip_audit._service import Dependency
@@ -62,12 +62,18 @@ def collect(self) -> Iterator[Dependency]:
         # We collect them all into a single well-defined error.
         try:
             for (_, dist) in pip_api.installed_distributions(local=self._local).items():
-                dep = Dependency(name=dist.name, version=Version(str(dist.version)))
-                if self.state is not None:
-                    self.state.update_state(
-                        f"Collecting {dep.name} ({dep.version})"
-                    )  # pragma: no cover
-                yield dep
+                try:
+                    dep = Dependency(name=dist.name, version=Version(str(dist.version)))
+                    if self.state is not None:
+                        self.state.update_state(
+                            f"Collecting {dep.name} ({dep.version})"
+                        )  # pragma: no cover
+                    yield dep
+                except InvalidVersion:
+                    logger.warning(
+                        "Warning: Package has invalid version and could not be audited: "
+                        f"{dist.name} ({dist.version})"
+                    )
         except Exception as e:
             raise PipSourceError("failed to list installed distributions") from e
 

test/dependency_source/test_pip.py

@@ -1,3 +1,6 @@
+from dataclasses import dataclass
+from typing import Dict
+
 import pip_api
 import pretend
 import pytest
@@ -43,3 +46,32 @@ def explode():
 
     with pytest.raises(pip.PipSourceError):
         list(source.collect())
+
+
+def test_pip_source_invalid_version(monkeypatch):
+    logger = pretend.stub(warning=pretend.call_recorder(lambda s: None))
+    monkeypatch.setattr(pip, "logger", logger)
+
+    source = pip.PipSource()
+
+    @dataclass(frozen=True)
+    class MockDistribution:
+        name: str
+        version: str
+
+    # Return a distribution with a version that doesn't conform to PEP 440.
+    # We should log a warning and skip it.
+    def mock_installed_distributions(local: bool) -> Dict[str, MockDistribution]:
+        return {
+            "pytest": MockDistribution("pytest", "0.1"),
+            "pip-audit": MockDistribution("pip-audit", "1.0-ubuntu0.21.04.1"),
+            "pip-api": MockDistribution("pip-api", "1.0"),
+        }
+
+    monkeypatch.setattr(pip_api, "installed_distributions", mock_installed_distributions)
+
+    specs = list(source.collect())
+    assert len(logger.warning.calls) == 1
+    assert len(specs) == 2
+    assert Dependency(name="pytest", version=Version("0.1")) in specs
+    assert Dependency(name="pip-api", version=Version("1.0")) in specs