Repository navigation
feat(vulnfeeds): infer version ranges from comparison URLs - #6192
Open
Pushpak731 wants to merge 1 commit into
Open
Pushpak731 wants to merge 1 commit into
Pushpak731 wants to merge 1 commit into
Conversation
A CVE reference like kovidgoyal/kitty@v0.26.1...v0.26.2 now yields an introduced..fixed version range (preferred over the commit-reference-as-fix fallback), which then resolves to a commit range via the repository's tags like any other version range. Branch comparisons, commit comparisons and wildcard branches are rejected by conservative heuristics on the two sides. Fixes google#2924
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
A CVE reference that is a Git comparison URL with version-like tags on both sides, e.g.
https://github.com/JSONPath-Plus/JSONPath/compare/v9.0.0...v10.1.0https://github.com/kovidgoyal/kitty/compare/v0.26.1...v0.26.2now yields an
introduced..fixedversion range (the left side is where the affected range starts, the right side is where it is fixed — consistent with the existing assumption that reference links are fixes). This is attempted before the existing fallback of treating any commit reference as a fix, so comparison URLs are preferred for CVEs that have both (#2924). Like other version ranges, the result is then resolved to a Git commit range via the repository's tags, or recorded as an unresolved range when the tags can't be matched.Conservative heuristics keep branch and commit comparisons out:
vprefix followed by a digit, and normalizable bygit.NormalizeVersion)e5dd0a3...8b4f5c2), wildcard branches (7.x-3.x), sides containing path separators and self-comparisons are rejected/-/compare/) URLsThe new
REFERENCES_COMPAREversion source records where these ranges came from in conversion metrics.This should help the likes of CVE-2024-21534 convert in an un-analyzed state, as noted in the issue.
Testing
TestExtractVersionRangeFromCompareURL: 15 table-driven cases covering accepted forms (v-prefixed, unprefixed, two-dot, GitLab/-/compare/, trailing slash) and rejected ones (branch, wildcard branch, commit-hash, self-comparison, path side, missing side, non-compare URLs).TestExtractVersionsFromCompareReference/TestExtractVersionsFromBranchCompareReference: end-to-endDefaultVersionExtractor.ExtractVersionstests using a pre-populatedInMemoryRepoTagsCacheand an offline HTTP transport, verifying the resolved Git range (introduced/fixed commits, repo,Range_GITtype) and the metrics source, and that branch comparisons produce nothing.vulnfeedsgo test ./...passes locally (cmd/idshas a pre-existing CRLF-related failure on Windows that also fails on an unmodified checkout).Fixes #2924