go-cpe icon indicating copy to clipboard operation
go-cpe copied to clipboard

Version matching results are incorrect

Open geekoftheweek opened this issue 5 years ago • 1 comments

Version matching seems to only consider a prefix. For example, when checking whether cpe:2.3:o:linux:linux_kernel:4.4.1:*:*:*:*:*:*:* is a superset of cpe:2.3:o:linux:linux_kernel:4.4.19:*:*:*:*:*:*:*, the answer comes back as true when I would have expected it to be false.

Likewise for 3.10.2 with 3.10.20, and other such cases.

gore version 0.3.0  :help for help
gore> :import github.com/knqyf263/go-cpe/common
gore> :import github.com/knqyf263/go-cpe/matching
gore> :import github.com/knqyf263/go-cpe/naming
gore> a, err := naming.UnbindFS("cpe:2.3:o:linux:linux_kernel:4.4.1:*:*:*:*:*:*:*")
common.WellFormedName{"target_hw":common.LogicalValue{Any:true, Na:false}, "part":"o", "product":"linux_kernel", "version":"4\\.4\\.1", "update":common.LogicalValue{Any:true, Na:false}, "edition":common.LogicalValue{Any:true, Na:false}, "language":common.LogicalValue{Any:true, Na:false}, "sw_edition":common.LogicalValue{Any:true, Na:false}, "target_sw":common.LogicalValue{Any:true, Na:false}, "other":common.LogicalValue{Any:true, Na:false}, "vendor":"linux"}
<nil>
gore> b, err := naming.UnbindFS("cpe:2.3:o:linux:linux_kernel:4.4.19:*:*:*:*:*:*:*")
common.WellFormedName{"target_sw":common.LogicalValue{Any:true, Na:false}, "target_hw":common.LogicalValue{Any:true, Na:false}, "part":"o", "vendor":"linux", "update":common.LogicalValue{Any:true, Na:false}, "edition":common.LogicalValue{Any:true, Na:false}, "language":common.LogicalValue{Any:true, Na:false}, "sw_edition":common.LogicalValue{Any:true, Na:false}, "other":common.LogicalValue{Any:true, Na:false}, "product":"linux_kernel", "version":"4\\.4\\.19"}
<nil>
gore> matching.IsSuperset(a, b)
true

geekoftheweek avatar Feb 27 '19 16:02 geekoftheweek

I see that when using UnbindFS, the dots are escaped ...e.g: version="4\.4\.1" But in the unit tests in cpe_name_matcher_test.go the wfn is instantiated directly, and the dots are unescaped ...e.g: version="4.4.1" Perhaps this is the source of the problem?

geekoftheweek avatar Feb 27 '19 19:02 geekoftheweek