Merge pull request #11779 from sbidoul/fix-direct_url-invalid-hash-sbi

Do not crash in presence of misformatted hash field in ``direct_url.json``

Author: pradyunsg

news/11773.bugfix.rst

@@ -0,0 +1 @@
+Do not crash in presence of misformatted hash field in ``direct_url.json``.

src/pip/_internal/models/direct_url.py

@@ -108,7 +108,12 @@ def __init__(
         if hash is not None:
             # Auto-populate the hashes key to upgrade to the new format automatically.
             # We don't back-populate the legacy hash key.
-            hash_name, hash_value = hash.split("=", 1)
+            try:
+                hash_name, hash_value = hash.split("=", 1)
+            except ValueError:
+                raise DirectUrlValidationError(
+                    f"invalid archive_info.hash format: {hash!r}"
+                )
             if hashes is None:
                 hashes = {hash_name: hash_value}
             elif hash_name not in hash:

tests/unit/test_direct_url.py

@@ -102,6 +102,13 @@ def test_parsing_validation() -> None:
         match="more than one of archive_info, dir_info, vcs_info",
     ):
         DirectUrl.from_dict({"url": "http://...", "dir_info": {}, "archive_info": {}})
+    with pytest.raises(
+        DirectUrlValidationError,
+        match="invalid archive_info.hash format",
+    ):
+        DirectUrl.from_dict(
+            {"url": "http://...", "archive_info": {"hash": "sha256:aaa"}}
+        )
 
 
 def test_redact_url() -> None: