fix(locations): LocationData.code robust to unhashable context; progpilot scalars

CI (the V3-on rest-framework matrix variant) caught two coupled defects the
local V3-off run could not, since the emission only fires under V3:

- LocationData.code filtered unset context with `value not in {"", None}` — a
  SET membership test that hashes `value`, so any unhashable value crashed with
  "cannot use 'list' as a set element". Switched to tuple membership (`in
  ("", None)`), which compares by equality and never hashes — robust for every
  call site, present and future.
- progpilot reports taint-source fields as single-element arrays
  (source_name=["$sql"], source_line=[610]); the sweep passed those lists
  straight into the context kwargs. Now collapsed to scalars via a _first()
  helper, with str()/int guards.

Audited every other converted parser's context kwargs: all pass .text/int/
string scalars (checkmarx pathnode elements, sarif get_snippet, etc.) — progpilot
was the only list-valued source. Verified against the full unittests.tools suite
run with V3_FEATURE_LOCATIONS=True.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: Maffooch

dojo/tools/locations.py

@@ -68,7 +68,9 @@ def code(
             "source_file_path": source_file_path,
             "source_line": source_line,
         }
-        data.update({key: value for key, value in context.items() if value not in {"", None}})
+        # Tuple (not set) membership: uses == rather than hashing, so an unset
+        # check never crashes on an unhashable value a parser might pass.
+        data.update({key: value for key, value in context.items() if value not in ("", None)})
         return cls(type="code", data=data)
 
     @classmethod

dojo/tools/progpilot/parser.py

@@ -6,6 +6,18 @@
 from dojo.tools.locations import LocationData
 
 
+def _first(value):
+    """
+    Collapse progpilot taint-source fields to a scalar.
+
+    progpilot reports them as single-element arrays (e.g. source_name=["$sql"],
+    source_line=[610]); the location context expects the scalar value.
+    """
+    if isinstance(value, list):
+        return value[0] if value else None
+    return value
+
+
 class ProgpilotParser:
     def get_scan_types(self):
         return ["Progpilot Scan"]
@@ -80,14 +92,17 @@ def get_findings(self, filename, test):
             if vuln_cwe is not None:
                 find.cwe = int(vuln_cwe.split("CWE_")[1])
             if settings.V3_FEATURE_LOCATIONS and find.file_path:
+                source_name_scalar = _first(source_name)
+                source_file_scalar = _first(source_file)
+                source_line_scalar = _first(source_line)
                 find.unsaved_locations.append(
                     LocationData.code(
                         file_path=find.file_path,
                         line=find.line,
-                        source_object=source_name or "",
-                        sink_object=sink_name or "",
-                        source_file_path=source_file or "",
-                        source_line=source_line if isinstance(source_line, int) else None,
+                        source_object=str(source_name_scalar) if source_name_scalar else "",
+                        sink_object=str(sink_name) if sink_name else "",
+                        source_file_path=str(source_file_scalar) if source_file_scalar else "",
+                        source_line=source_line_scalar if isinstance(source_line_scalar, int) else None,
                     ),
                 )
             findings.append(find)