AppThreat / AppThreat/vulnerability-db

Simplify `vers` ranges

Open
#132 8 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
151
Forks
23
Avg merge
22m
Merged PRs (30d)
7

Description

The `cve_index` table currently contains many `vers` ranges with redundant constraints.

![image](https://github.com/AppThreat/vulnerability-db/assets/5693141/2bc9e7e3-dde6-49ae-8c2b-48781e0163b0)

As per `vers` specification:

> These pairs of contiguous constraints with these comparators are redundant and invalid (ignoring
> any != since they can show up anywhere):
>
> * =, < or <= followed by < or <=: this is the same as < or <=
> * \> or >= followed by =, > or >=: this is the same as > or >=

The algorithm to simplify is documented in the spec: https://github.com/package-url/purl-spec/blob/version-range-spec/VERSION-RANGE-SPEC.rst#version-constraints-simplification

I believe the `univers` library supports simplification as well.

Looking at some of the constraints, it makes me wonder if perhaps the current representation is a result of attempting to split ranges into pairs of 2 (as [demonstrated](https://github.com/package-url/purl-spec/blob/version-range-spec/VERSION-RANGE-SPEC.rst#examples) in the spec)?

In that case, care needs to be taken to not break the meaning of range by erroneously omitting the corresponding lower or upper bounds. Sadly, an algorithm for splitting is not part of the spec, but @sahibamittal [implemented](https://github.com/nscuro/versatile/blob/c9f2b1da04612ac7acc05631f0874e587debc3c2/src/main/java/io/github/nscuro/versatile/Vers.java#L97-L117) one in `versatile` recently (tests for verification [here](https://github.com/nscuro/versatile/blob/c9f2b1da04612ac7acc05631f0874e587debc3c2/src/test/java/io/github/nscuro/versatile/VersTest.java#L95-L133)).

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.