Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat: improved support for unknown version matches #3394

Open
wants to merge 2 commits into
base: main
Choose a base branch
from
Open

feat: improved support for unknown version matches #3394

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
62b647c
feat: improved support for unknown version matches
sw-sdiepold Oct 6, 2023
4d0eb1f
fix: added missing line
sw-sdiepold Oct 6, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
69 changes: 37 additions & 32 deletions cve_bin_tool/cve_scanner.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -104,7 +104,7 @@ def get_cves(self, product_info: ProductInfo, triage_data: TriageData):
parsed_version, parsed_version_between = self.canonical_convert(product_info)
# If canonical form of version numbering not found, exit
if parsed_version == "UNKNOWN":
return
pass

self.cursor.execute(query, [vendor, product_info.product, str(parsed_version)])

Expand Down Expand Up @@ -147,45 +147,50 @@ def get_cves(self, product_info: ProductInfo, triage_data: TriageData):

# check the start range
passes_start = False
if (
version_start_including is not self.RANGE_UNSET
and parsed_version >= parse_version(version_start_including)
):
passes_start = True

if (
version_start_excluding is not self.RANGE_UNSET
and parsed_version > parse_version(version_start_excluding)
):
if parsed_version == "UNKNOWN":
passes_start = True
else:
if (
version_start_including is not self.RANGE_UNSET
and parsed_version >= parse_version(version_start_including)
):
passes_start = True
if (
version_start_excluding is not self.RANGE_UNSET
and parsed_version > parse_version(version_start_excluding)
):
passes_start = True

if (
version_start_including is self.RANGE_UNSET
and version_start_excluding is self.RANGE_UNSET
):
# then there is no start range so just say true
passes_start = True
if (
version_start_including is self.RANGE_UNSET
and version_start_excluding is self.RANGE_UNSET
):
# then there is no start range so just say true
passes_start = True

# check the end range
passes_end = False
if (
version_end_including is not self.RANGE_UNSET
and parsed_version <= parse_version(version_end_including)
):
if parsed_version == "UNKNOWN":
passes_end = True
else:
if (
version_end_including is not self.RANGE_UNSET
and parsed_version <= parse_version(version_end_including)
):
passes_end = True

if (
version_end_excluding is not self.RANGE_UNSET
and parsed_version < parse_version(version_end_excluding)
):
passes_end = True
if (
version_end_excluding is not self.RANGE_UNSET
and parsed_version < parse_version(version_end_excluding)
):
passes_end = True

if (
version_end_including is self.RANGE_UNSET
and version_end_excluding is self.RANGE_UNSET
):
# then there is no end range so it passes
passes_end = True
if (
version_end_including is self.RANGE_UNSET
and version_end_excluding is self.RANGE_UNSET
):
# then there is no end range so it passes
passes_end = True
# if it fits into both ends of the range, add the cve number
if passes_start and passes_end:
cve_list.append(cve_number)
Expand Down
10 changes: 10 additions & 0 deletions cve_bin_tool/version_scanner.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -265,6 +265,16 @@ def run_checkers(self, filename: str, lines: str) -> Iterator[ScanInfo]:
yield ScanInfo(
ProductInfo(vendor, product, version), file_path
)
# else for unknown versions add if identified to package
elif "is" in result["is_or_contains"]:
file_path = "".join(self.file_stack)
self.logger.debug(
f'{file_path} {result["is_or_contains"]} {dummy_checker_name} {version}'
)
for vendor, product in checker.VENDOR_PRODUCT:
yield ScanInfo(
ProductInfo(vendor, product, version), file_path
)

self.logger.debug(f"Done scanning file: {filename}")

Expand Down