feat: out-factor SPDX compund detection

Signed-off-by: Jan Kowalleck <[email protected]>

Author: jkowalleck

cyclonedx/spdx.py

@@ -54,4 +54,7 @@ def is_compound_expression(value: str) -> bool:
 
     .. _SPDX license expression spec: https://spdx.github.io/spdx-spec/v2.3/SPDX-license-expressions/
     """
-    return value.startswith('(') and value.endswith(')')
+    # shortest known valid expression: (A or B) - 8 characters long
+    return len(value) >= 8 \
+        and value.startswith('(') \
+        and value.endswith(')')

tests/test_spdx.py

@@ -88,6 +88,7 @@ def test_positive(self, valid_expression: str) -> None:
 
     @data(
         'something invalid',
+        '(c) John Doe'
     )
     def test_negative(self, invalid_expression: str) -> None:
         actual = spdx.is_compound_expression(invalid_expression)