From 2a2abce88d091891f8e7ca2159b943d15ae2e7c3 Mon Sep 17 00:00:00 2001
From: Arun Babu Neelicattu <arun.neelicattu@gmail.com>
Date: Fri, 22 Mar 2024 23:39:58 +0100
Subject: [PATCH] inspection: error on unsupported metadata versions

Resolves: #9195
---
 src/poetry/inspection/info.py                    |   5 +++++
 ...ta_version_unknown-0.1.0-py2.py3-none-any.whl | Bin 0 -> 1153 bytes
 tests/inspection/test_info.py                    |  14 ++++++++++++++
 3 files changed, 19 insertions(+)
 create mode 100644 tests/fixtures/distributions/demo_metadata_version_unknown-0.1.0-py2.py3-none-any.whl

diff --git a/src/poetry/inspection/info.py b/src/poetry/inspection/info.py
index e0e4884f868..557ebcf3a11 100644
--- a/src/poetry/inspection/info.py
+++ b/src/poetry/inspection/info.py
@@ -266,6 +266,11 @@ def _from_distribution(
 
         :param dist: The distribution instance to parse information from.
         """
+        if dist.metadata_version not in pkginfo.distribution.HEADER_ATTRS:
+            # This check can be replaced once upstream implements strict parsing
+            # https://bugs.launchpad.net/pkginfo/+bug/2058697
+            raise ValueError("Unknown metadata version")
+
         requirements = cls._requirements_from_distribution(dist)
 
         info = cls(
diff --git a/tests/fixtures/distributions/demo_metadata_version_unknown-0.1.0-py2.py3-none-any.whl b/tests/fixtures/distributions/demo_metadata_version_unknown-0.1.0-py2.py3-none-any.whl
new file mode 100644
index 0000000000000000000000000000000000000000..03988228fec381e1eb7267cbb8a549152ffdffee
GIT binary patch
literal 1153
zcmWIWW@Zs#W?<l8NZeHxVfsw=vNR(D!wDt^23ZCMhLqIYd|d-QLp=k%l+5B1-ORkS
ze0^Wn5Jwls5XY$#&-)#65IFY!w}`U3Y8kVL>Ke_98l9aHoi4WgZv)KB$_xKXRI1EB
zEWUY3f|SMAZ>e?r^Pd^?KQVOgzo;Fl-YaGx*I#)iC`3g;J@tnD%a3;NH@XIJy>(;Q
zZQixWRBY;xNp?&8^EGFm?Aemdlh;&l9(Lf-_w>$l-j@t`&n3HAi%fKi<SN+m_<BgO
z9&h!s^9s5<Gxn{F(M_1d^W%k#-=rDeE4K6ft(AD=d}jBXZ7$EBcm<W#<oPBBYOds-
zu~3gmjK#@eZ|Q8d+*-S=n;o}*)!f)scyU+Z&0U5`Q@^Sf7hU{vJ6dFeOSMV#%wwP5
zE&0r}Y0??d3)7q@IV=ydYCkutMDEmr2PKof{G7mlo{u*_<fme7abW5G!~YlpK%oi@
zKMo*P^mx0fSmrd4#SIKuX<VTi<m&7n<dS=4cUhAG1H*;8`JM(7J{7!h@D<=+DB{AT
zXX(Y|vNBV(wr+3iojvjePhZcT$Gz~}DUQUw|C=&zSg-rO!>@n2$>C?!C;lHhzv{}t
zbGrlPe=FGdRlI5Kq%CtTyyyAx7R;IXCtqPx4tHdbFWai(<<D)FO}TsMhF<m4<4fMT
z&#4X-|LFPX*8{eTt6KF%7Ou;F`gvArOtZoc`DI&pJR{n+3%|3EC^<8^xsUsk!;ecH
zYLe!r^HzC(`5MeGntexC?(91DeZB9Nv&N>eGA5L<qK1LPR37$lpx+~aSPEAdgnPKU
z`tY7|<Z4h5V7;(+`3ENDv<rv0U3Pb@*m`hz%ZyG>@q7F3{dy~2aG9-kbHSFmpVL^J
zg9UrP35w)i+pV|bppH`OvgyxO?f5L1dy#ANvd{gxJC=Vva%jPkvo$d10PSW_WN6|l
zd?^NGfv^A&gA%%ae0*kJW=VX!UO{Did|7Hyab|vAe7u6Kf;u=0sB;B)GcwsT<H{~7
zKyyGqp<ziQh{l_FxEK^bY8V(9Bp4XZ_kUbgbBht323aS<j5{5H4FD1ijA6i(h1EJp
zszNsiJu(mmMFBHDR)fG%gD?lA12Yt1<}7J^2{i{fOar`G*+42-fY1);U|nFb!@vLl
D>XnrS

literal 0
HcmV?d00001

diff --git a/tests/inspection/test_info.py b/tests/inspection/test_info.py
index 66bb1f825fb..99fd04d66c0 100644
--- a/tests/inspection/test_info.py
+++ b/tests/inspection/test_info.py
@@ -199,6 +199,20 @@ def test_info_from_wheel_metadata_version_23(fixture_dir: FixtureDirGetter) -> N
     assert info._source_url == path.resolve().as_posix()
 
 
+def test_info_from_wheel_metadata_version_unknown(
+    fixture_dir: FixtureDirGetter,
+) -> None:
+    path = (
+        fixture_dir("distributions")
+        / "demo_metadata_version_unknown-0.1.0-py2.py3-none-any.whl"
+    )
+
+    with pytest.raises(PackageInfoError) as e:
+        PackageInfo.from_wheel(path)
+
+    assert "Unknown metadata version" in str(e.value)
+
+
 def test_info_from_wheel_metadata(demo_wheel_metadata: RawMetadata) -> None:
     info = PackageInfo.from_metadata(demo_wheel_metadata)
     demo_check_info(info)