Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

CPE pattern #693

Open
tschmidtb51 opened this issue Feb 23, 2024 · 1 comment
Open

CPE pattern #693

tschmidtb51 opened this issue Feb 23, 2024 · 1 comment
Assignees
Labels
csaf 2.1 csaf 2.1 work editor-revision already worked on in the editor revision investigation needed anything that needs some investigation

Comments

@tschmidtb51
Copy link
Contributor

The current CPE regex seems to have some issues:

  1. The CPE version are not restricted correctly. Instead of ^(CPE2.3|CPE2.2)$, the pattern uses ^(CPE2.3)|(CPE2.2)$. This allows values like NOTAVALIDCPEcpe:/o:example:a:42::anyother resp. (appended ones in CPE2.3).
  2. Some implementations (e.g. deno) don't like the / as un-escaped character in JSON patterns.

Regarding 1:

  • That is definitely something that we need to address in CSAF 2.1.

Regarding 2:

  • Our test scripts (using python and nodejs) haven't complained so far. So we need to find out whether an un-escaped / is valid in JSON patterns or just accepted. (This means reading the standard.)
  • We need to consider improving the situation in CSAF 2.1 by adding the \\ to escape /.
@tschmidtb51 tschmidtb51 added csaf 2.1 csaf 2.1 work investigation needed anything that needs some investigation labels Feb 23, 2024
@tschmidtb51
Copy link
Contributor Author

Regarding both parts, the TC needs to decide whether that is something for an errata. I think that heavily depends on the result of 2 as it might be an implementation specific problem.

tschmidtb51 added a commit to tschmidtb51/csaf that referenced this issue Mar 27, 2024
- addresses parts of oasis-tcs#693, oasis-tcs#710
- correct pattern to `^((CPE2.3)|(CPE2.2))$`
- add additional `\\` to escape previously unescaped `/`
tschmidtb51 added a commit to tschmidtb51/csaf that referenced this issue Mar 27, 2024
- addresses parts of oasis-tcs#693
- correct parsing of CPE 2.3 Dictionary (to also capture endings `">` instead of just `"/>`)
tschmidtb51 added a commit to tschmidtb51/csaf that referenced this issue Mar 27, 2024
- addresses parts of oasis-tcs#693
- add new local test cases
- adopt test script
tschmidtb51 added a commit to tschmidtb51/csaf that referenced this issue Mar 27, 2024
- addresses parts of oasis-tcs#693
- add conversion rule
@tschmidtb51 tschmidtb51 added the editor-revision already worked on in the editor revision label Mar 27, 2024
tschmidtb51 added a commit to tschmidtb51/csaf that referenced this issue May 25, 2024
- addresses parts of oasis-tcs#693
- add FAQ regarding usage of the new pattern
tschmidtb51 added a commit to tschmidtb51/csaf that referenced this issue May 25, 2024
- addresses parts of oasis-tcs#693
- add missing `\\` for overlooked `/`
- adopt prose to reflect schema
tschmidtb51 added a commit to tschmidtb51/csaf that referenced this issue May 25, 2024
- addresses parts of oasis-tcs#693
- add new local testcases
tschmidtb51 added a commit to tschmidtb51/csaf that referenced this issue May 25, 2024
- addresses parts of oasis-tcs#693
- clarify that the pattern was changed in CSAF 2.1
@tschmidtb51 tschmidtb51 self-assigned this Jun 26, 2024
tschmidtb51 added a commit to tschmidtb51/csaf that referenced this issue Jan 13, 2025
- addresses parts of oasis-tcs#774, oasis-tcs#781, oasis-tcs#693
- add `\\` to mask `/` (based on discussion in oasis-tcs#693)
sthagen added a commit that referenced this issue Feb 14, 2025
* Support multiple purl identifiers in product_identification_helper

This allows a vendor to specify multiple purl identifiers for a single
component (present as a product version branch in the product tree).
Multiple purls may identify the same component but point to different
locations from where that component may be available. Thus, it is mandatory
that if multiple purls are present in a single
product_identification_helper object, they must only differ in their
qualifiers. Otherwise they should be set up as different product
tree branches.

* PURLs

- addresses parts of #774
- assign new test number based on current master branch

* PURLs

- addresses parts of #774, #781, #693
- add `\\` to mask `/` (based on discussion in #693)

* PURLs

- addresses parts of #774, #781
- adapt prose to meet writing style and align with schema

* PURLs

- addresses parts of #774, #781
- sort list entries

* PURLs

- addresses parts of #774, #781, #341
- improve wording
- add valid example

* PURLs

- addresses parts of #774, #781, #341
- improve wording of 6.1.42
- move tests to testfiles
- add invalid examples
- add valid examples
- adapt test schema

* Test 6.1.13

- addresses parts of #774, #781, #341
- add valid example
- add invalid example for oci case (not namespace allowed)

* Fixed nits in participants table

- names and affiliations should match roster
- sorted lines

* Seed Editor revision 2025-01-29

- update dates
- insert new revision for tracking

* ROLIE update

- addresses parts of #677
- add `last_updated` ROLIE section in PMD schema

* ROLIE update

- addresses parts of #677
- adapt examples to reflect change

* Hardware and Software

- addresses parts of #817
- add section about hardware/software separation with example
- add full describe rule

* Nit: incomplete word

* Hardware and Software

- addresses parts of #817
- add optional test to detect potential mixing of hard- and software (6.2.31)
- add invalid example
- add valid examples

* Hardware and Software

- addresses parts of #817
- clarify the informative note about test failure

* Hardware and Software

- addresses parts of review comment of #857
- state linking in vulnerability section as example

* Hardware and Software

- addresses parts of review comment of #857
- soften statement and link to CVE statistics

* Hardware and Software

- addresses parts of review comment of #857
- remove "prohibited" from informative paragraph

* Update csaf_2.1/prose/edit/src/schema-elements-01-defs-03-full-product-name.md

Co-authored-by: tschmidtb51 <[email protected]>

* Candidate rewording of informative text

Feel free to revert ...

* Hardware and Software

- addresses parts of #817
- add optional test to detect multiple same PIH (6.2.32)
- add invalid examples
- add valid examples

* Hardware and Software

- addresses parts of review comment of #857
- remove merge artifact
- clarify text regarding matching

* Hardware and Software

- addresses parts of #817
- add invalid example
- update testcases

* Hardware and Software

- addresses parts of #817
- update testcase schema to add new test 6.2.32

* Editorial

- addresses parts of #841
- correct vers example by removing invalid space

* Editorial

- addresses parts of #841
- update link to vers

* Editorial

- addresses parts of #841
- update count of conformance targets

* Editorial

- addresses parts of #841
- fix refs in date and time (wrong brackets)

* Editorial

- addresses parts of #841
- fix format mistake
- add section 5 to be of relevance for conformance

* Editorial

- addresses parts of #841
- sort guidance on size
- remove obsolete scores from guidance on size

* Editorial

- addresses parts of #841
- update OpenSSL digest list

* Editorial

- addresses parts of #841
- update reference to ISO 8601

* Editorial

- addresses parts of #841
- update SBOM format references

* CWEs

- addresses parts of #530, #841
- rephrase test 6.1.11 and 6.3.4 to clarify the test according to the change to multiple CWEs

* PURLs

- addresses parts of #774, #841
- add conversion rule
- correct JSON path by adding missing `product_identification_helper` part

* Editorial

- addresses parts of #841
- update missing dates
- update CVE link

* Editorial

- addresses parts of #841, #817, #629
- clearly state that additional conventions have to be respected by the consumer

* Suggested edit of CVE reference

* Added missing section entries

* Amended example and section label mappings

* Rendered user facing delivery items

---------

Signed-off-by: Stefan Hagen <[email protected]>
Co-authored-by: Martin Prpič <[email protected]>
Co-authored-by: Stefan Hagen <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
csaf 2.1 csaf 2.1 work editor-revision already worked on in the editor revision investigation needed anything that needs some investigation
Projects
None yet
Development

No branches or pull requests

1 participant