-
Notifications
You must be signed in to change notification settings - Fork 40
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
CPE pattern #693
Labels
csaf 2.1
csaf 2.1 work
editor-revision
already worked on in the editor revision
investigation needed
anything that needs some investigation
Comments
Regarding both parts, the TC needs to decide whether that is something for an errata. I think that heavily depends on the result of 2 as it might be an implementation specific problem. |
tschmidtb51
added a commit
to tschmidtb51/csaf
that referenced
this issue
Mar 27, 2024
- addresses parts of oasis-tcs#693, oasis-tcs#710 - correct pattern to `^((CPE2.3)|(CPE2.2))$` - add additional `\\` to escape previously unescaped `/`
tschmidtb51
added a commit
to tschmidtb51/csaf
that referenced
this issue
Mar 27, 2024
- addresses parts of oasis-tcs#693 - correct parsing of CPE 2.3 Dictionary (to also capture endings `">` instead of just `"/>`)
tschmidtb51
added a commit
to tschmidtb51/csaf
that referenced
this issue
Mar 27, 2024
- addresses parts of oasis-tcs#693 - add new local test cases - adopt test script
This was referenced Mar 27, 2024
Merged
tschmidtb51
added a commit
to tschmidtb51/csaf
that referenced
this issue
Mar 27, 2024
- addresses parts of oasis-tcs#693 - add conversion rule
This was referenced Mar 27, 2024
tschmidtb51
added a commit
to tschmidtb51/csaf
that referenced
this issue
May 25, 2024
- addresses parts of oasis-tcs#693 - add FAQ regarding usage of the new pattern
tschmidtb51
added a commit
to tschmidtb51/csaf
that referenced
this issue
May 25, 2024
- addresses parts of oasis-tcs#693 - add missing `\\` for overlooked `/` - adopt prose to reflect schema
tschmidtb51
added a commit
to tschmidtb51/csaf
that referenced
this issue
May 25, 2024
- addresses parts of oasis-tcs#693 - add new local testcases
tschmidtb51
added a commit
to tschmidtb51/csaf
that referenced
this issue
May 25, 2024
- addresses parts of oasis-tcs#693 - clarify that the pattern was changed in CSAF 2.1
This was referenced May 25, 2024
tschmidtb51
added a commit
to tschmidtb51/csaf
that referenced
this issue
Jan 13, 2025
- addresses parts of oasis-tcs#774, oasis-tcs#781, oasis-tcs#693 - add `\\` to mask `/` (based on discussion in oasis-tcs#693)
sthagen
added a commit
that referenced
this issue
Feb 14, 2025
* Support multiple purl identifiers in product_identification_helper This allows a vendor to specify multiple purl identifiers for a single component (present as a product version branch in the product tree). Multiple purls may identify the same component but point to different locations from where that component may be available. Thus, it is mandatory that if multiple purls are present in a single product_identification_helper object, they must only differ in their qualifiers. Otherwise they should be set up as different product tree branches. * PURLs - addresses parts of #774 - assign new test number based on current master branch * PURLs - addresses parts of #774, #781, #693 - add `\\` to mask `/` (based on discussion in #693) * PURLs - addresses parts of #774, #781 - adapt prose to meet writing style and align with schema * PURLs - addresses parts of #774, #781 - sort list entries * PURLs - addresses parts of #774, #781, #341 - improve wording - add valid example * PURLs - addresses parts of #774, #781, #341 - improve wording of 6.1.42 - move tests to testfiles - add invalid examples - add valid examples - adapt test schema * Test 6.1.13 - addresses parts of #774, #781, #341 - add valid example - add invalid example for oci case (not namespace allowed) * Fixed nits in participants table - names and affiliations should match roster - sorted lines * Seed Editor revision 2025-01-29 - update dates - insert new revision for tracking * ROLIE update - addresses parts of #677 - add `last_updated` ROLIE section in PMD schema * ROLIE update - addresses parts of #677 - adapt examples to reflect change * Hardware and Software - addresses parts of #817 - add section about hardware/software separation with example - add full describe rule * Nit: incomplete word * Hardware and Software - addresses parts of #817 - add optional test to detect potential mixing of hard- and software (6.2.31) - add invalid example - add valid examples * Hardware and Software - addresses parts of #817 - clarify the informative note about test failure * Hardware and Software - addresses parts of review comment of #857 - state linking in vulnerability section as example * Hardware and Software - addresses parts of review comment of #857 - soften statement and link to CVE statistics * Hardware and Software - addresses parts of review comment of #857 - remove "prohibited" from informative paragraph * Update csaf_2.1/prose/edit/src/schema-elements-01-defs-03-full-product-name.md Co-authored-by: tschmidtb51 <[email protected]> * Candidate rewording of informative text Feel free to revert ... * Hardware and Software - addresses parts of #817 - add optional test to detect multiple same PIH (6.2.32) - add invalid examples - add valid examples * Hardware and Software - addresses parts of review comment of #857 - remove merge artifact - clarify text regarding matching * Hardware and Software - addresses parts of #817 - add invalid example - update testcases * Hardware and Software - addresses parts of #817 - update testcase schema to add new test 6.2.32 * Editorial - addresses parts of #841 - correct vers example by removing invalid space * Editorial - addresses parts of #841 - update link to vers * Editorial - addresses parts of #841 - update count of conformance targets * Editorial - addresses parts of #841 - fix refs in date and time (wrong brackets) * Editorial - addresses parts of #841 - fix format mistake - add section 5 to be of relevance for conformance * Editorial - addresses parts of #841 - sort guidance on size - remove obsolete scores from guidance on size * Editorial - addresses parts of #841 - update OpenSSL digest list * Editorial - addresses parts of #841 - update reference to ISO 8601 * Editorial - addresses parts of #841 - update SBOM format references * CWEs - addresses parts of #530, #841 - rephrase test 6.1.11 and 6.3.4 to clarify the test according to the change to multiple CWEs * PURLs - addresses parts of #774, #841 - add conversion rule - correct JSON path by adding missing `product_identification_helper` part * Editorial - addresses parts of #841 - update missing dates - update CVE link * Editorial - addresses parts of #841, #817, #629 - clearly state that additional conventions have to be respected by the consumer * Suggested edit of CVE reference * Added missing section entries * Amended example and section label mappings * Rendered user facing delivery items --------- Signed-off-by: Stefan Hagen <[email protected]> Co-authored-by: Martin Prpič <[email protected]> Co-authored-by: Stefan Hagen <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Labels
csaf 2.1
csaf 2.1 work
editor-revision
already worked on in the editor revision
investigation needed
anything that needs some investigation
The current CPE regex seems to have some issues:
^(CPE2.3|CPE2.2)$
, the pattern uses^(CPE2.3)|(CPE2.2)$
. This allows values likeNOTAVALIDCPEcpe:/o:example:a:42::anyother
resp. (appended ones in CPE2.3)./
as un-escaped character in JSON patterns.Regarding 1:
Regarding 2:
python
andnodejs
) haven't complained so far. So we need to find out whether an un-escaped/
is valid in JSON patterns or just accepted. (This means reading the standard.)\\
to escape/
.The text was updated successfully, but these errors were encountered: