Added util func around semver to allow for custom preprocessing. Upgraded semver lib #25437
Conversation
server/vulnerabilities/nvd/cve.go
Outdated
| @@ -632,7 +632,7 @@ func getMatchingVersionEndExcluding(ctx context.Context, cve string, hostSoftwar | |||
|
|
|||
| // convert the host software version to semver for later comparison | |||
| formattedVersion := preprocessVersion(wfn.StripSlashes(hostSoftwareMeta.Version)) | |||
| softwareVersion, err := semver.NewVersion(formattedVersion) | |||
| softwareVersion, err := fleet.VersionToSemverVersion(formattedVersion) | |||
There was a problem hiding this comment.
This is failing because semver v3 considers6.72.10-06 an invalid prerelease value.
V1 seems to be ok parsing it.
major: 6
minor: 72
patch: 10
pre: "06"
metadata: ""
original: "6.72.10-06"
Looking at the regex https://regex101.com/r/Ly7O1x/3/ this is indeed technically "not valid"
There was a problem hiding this comment.
https://github.com/fleetdm/fleet/blob/main/server/vulnerabilities/nvd/cve_test.go#L710-L719
{
name: "Can compare 4th version part",
cve: "CVE-2022-45889",
meta: &wfn.Attributes{
Vendor: "planetestream",
Product: "planet_estream",
Version: "6.72.10.06",
},
want: "6.72.10.07",
wantErr: false,
},
There was a problem hiding this comment.
Added as part of #17683
There was a problem hiding this comment.
Changing this test to something like 6.72.10.1 and 6.72.10.2 would make this test pass. The 0\d+ pattern is what is considered "invalid"
There was a problem hiding this comment.
Going to skip this location as #24810 will most likely be removing semver usage here.
6.72.10.07 is a real software version number > https://nvd.nist.gov/vuln/detail/CVE-2022-45889
So trying to munge this sort of parsing to be valid semver seems futile.
There was a problem hiding this comment.
Should server/vulnerabilities/nvd/cve.go#L731 be merged with the new func VersionToSemverVersion?
Answer: No. This code is going to be dealt with #24810
ksykulev
force-pushed
the
22919-semver-util
branch
from
4b2c25b to
63b61fa
Compare
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## main #25437 +/- ##
=======================================
Coverage 63.58% 63.59%
=======================================
Files 1619 1619
Lines 154939 154986 +47
Branches 4038 4038
=======================================
+ Hits 98524 98568 +44
- Misses 48646 48648 +2
- Partials 7769 7770 +1
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. |
orbit/pkg/luks/luks_linux.go
Outdated
| @@ -406,7 +406,7 @@ func isCryptsetupVersionLessThan2_4() (bool, error) { | |||
| return false, fmt.Errorf("unexpected output format: %s", outputStr) | |||
| } | |||
|
|
|||
| installedVersion, err := semver.NewVersion(parts[1]) | |||
| installedVersion, err := fleet.VersionToSemverVersion(parts[1]) | |||
There was a problem hiding this comment.
i'd argue we don't need to change this (possibly adding risk) since this code only touches cryptsetup on linux
orbit/pkg/packaging/linux_shared.go
Outdated
| @@ -89,7 +90,7 @@ func buildNFPM(opt Options, pkger nfpm.Packager) (string, error) { | |||
| } | |||
|
|
|||
| varLibSymlink := false | |||
| if orbitSemVer, err := semver.NewVersion(updatesData.OrbitVersion); err == nil { | |||
| if orbitSemVer, err := fleet.VersionToSemverVersion(updatesData.OrbitVersion); err == nil { | |||
There was a problem hiding this comment.
same as above, Apple host OS version shouldn't come through this path
orbit/pkg/packaging/macos.go
Outdated
| @@ -88,7 +89,7 @@ func BuildPkg(opt Options) (string, error) { | |||
| opt.Version = updatesData.OrbitVersion | |||
| } | |||
|
|
|||
| if orbitSemVer, err := semver.NewVersion(updatesData.OrbitVersion); err == nil { | |||
| if orbitSemVer, err := fleet.VersionToSemverVersion(updatesData.OrbitVersion); err == nil { | |||
ksykulev
force-pushed
the
22919-semver-util
branch
from
63b61fa to
73131a3
Compare
For #22919
changes/,orbit/changes/oree/fleetd-chrome/changes.See Changes files for more information.