Replace OTHER with a LicenseRef

ClearlyDefined uses the string `OTHER` for the declared license when
a human has reviewed `NOASSERTION` text and found it to be a valid
license, but one without an SPDX identifier. `OTHER`, unlike
`NOASSERTION`, is not valid. With this change, when `OTHER` appears
in a license string, we'll replace it with
`LicenseRef-clearlydefined-OTHER`, which _is_ valid and will allow
the expressions to parse.

src/spdx.ts

@@ -12,6 +12,7 @@ import parse from 'spdx-expression-parse'
 // accepts a pair of well-formed SPDX expressions. the
 // candidate is tested against the constraint
 export function satisfies(candidateExpr: string, allowList: string[]): boolean {
+  candidateExpr = removeInvalidSPDX(candidateExpr)
   try {
     return spdxSatisfies(candidateExpr, allowList)
   } catch (_) {
@@ -24,6 +25,7 @@ export function satisfiesAny(
   candidateExpr: string,
   licenses: string[]
 ): boolean {
+  candidateExpr = removeInvalidSPDX(candidateExpr)
   try {
     return spdxlib.satisfiesAny(candidateExpr, licenses)
   } catch (_) {
@@ -36,6 +38,7 @@ export function satisfiesAll(
   candidateExpr: string,
   licenses: string[]
 ): boolean {
+  candidateExpr = removeInvalidSPDX(candidateExpr)
   try {
     return spdxlib.satisfiesAll(candidateExpr, licenses)
   } catch (_) {
@@ -45,6 +48,7 @@ export function satisfiesAll(
 
 // accepts any SPDX expression
 export function isValid(spdxExpr: string): boolean {
+  spdxExpr = removeInvalidSPDX(spdxExpr)
   try {
     parse(spdxExpr)
     return true
@@ -52,3 +56,11 @@ export function isValid(spdxExpr: string): boolean {
     return false
   }
 }
+
+const replaceOtherRegex = /(?<![\w-])OTHER(?![\w-])/
+
+// adjusts license expressions to not include the invalid `OTHER`
+// which ClearlyDefined adds to license strings
+export function removeInvalidSPDX(spdxExpr: string): string {
+  return spdxExpr.replace(replaceOtherRegex, 'LicenseRef-clearlydefined-OTHER')
+}