go-cpe
go-cpe copied to clipboard
Version matching results are incorrect
Version matching seems to only consider a prefix. For example, when checking whether cpe:2.3:o:linux:linux_kernel:4.4.1:*:*:*:*:*:*:*
is a superset of cpe:2.3:o:linux:linux_kernel:4.4.19:*:*:*:*:*:*:*
, the answer comes back as true
when I would have expected it to be false
.
Likewise for 3.10.2
with 3.10.20
, and other such cases.
gore version 0.3.0 :help for help
gore> :import github.com/knqyf263/go-cpe/common
gore> :import github.com/knqyf263/go-cpe/matching
gore> :import github.com/knqyf263/go-cpe/naming
gore> a, err := naming.UnbindFS("cpe:2.3:o:linux:linux_kernel:4.4.1:*:*:*:*:*:*:*")
common.WellFormedName{"target_hw":common.LogicalValue{Any:true, Na:false}, "part":"o", "product":"linux_kernel", "version":"4\\.4\\.1", "update":common.LogicalValue{Any:true, Na:false}, "edition":common.LogicalValue{Any:true, Na:false}, "language":common.LogicalValue{Any:true, Na:false}, "sw_edition":common.LogicalValue{Any:true, Na:false}, "target_sw":common.LogicalValue{Any:true, Na:false}, "other":common.LogicalValue{Any:true, Na:false}, "vendor":"linux"}
<nil>
gore> b, err := naming.UnbindFS("cpe:2.3:o:linux:linux_kernel:4.4.19:*:*:*:*:*:*:*")
common.WellFormedName{"target_sw":common.LogicalValue{Any:true, Na:false}, "target_hw":common.LogicalValue{Any:true, Na:false}, "part":"o", "vendor":"linux", "update":common.LogicalValue{Any:true, Na:false}, "edition":common.LogicalValue{Any:true, Na:false}, "language":common.LogicalValue{Any:true, Na:false}, "sw_edition":common.LogicalValue{Any:true, Na:false}, "other":common.LogicalValue{Any:true, Na:false}, "product":"linux_kernel", "version":"4\\.4\\.19"}
<nil>
gore> matching.IsSuperset(a, b)
true
I see that when using UnbindFS, the dots are escaped ...e.g:
version="4\.4\.1"
But in the unit tests in cpe_name_matcher_test.go
the wfn is instantiated directly, and the dots are unescaped ...e.g:
version="4.4.1"
Perhaps this is the source of the problem?