AppThreat / AppThreat/vulnerability-db
Simplify `vers` ranges
- Dominant language
- Python
- Stars
- 151
- Forks
- 23
- Avg merge
- 22m
- Merged PRs (30d)
- 7
Description
The `cve_index` table currently contains many `vers` ranges with redundant constraints.

As per `vers` specification:
> These pairs of contiguous constraints with these comparators are redundant and invalid (ignoring
> any != since they can show up anywhere):
>
> * =, < or <= followed by < or <=: this is the same as < or <=
> * \> or >= followed by =, > or >=: this is the same as > or >=
The algorithm to simplify is documented in the spec: https://github.com/package-url/purl-spec/blob/version-range-spec/VERSION-RANGE-SPEC.rst#version-constraints-simplification
I believe the `univers` library supports simplification as well.
Looking at some of the constraints, it makes me wonder if perhaps the current representation is a result of attempting to split ranges into pairs of 2 (as [demonstrated](https://github.com/package-url/purl-spec/blob/version-range-spec/VERSION-RANGE-SPEC.rst#examples) in the spec)?
In that case, care needs to be taken to not break the meaning of range by erroneously omitting the corresponding lower or upper bounds. Sadly, an algorithm for splitting is not part of the spec, but @sahibamittal [implemented](https://github.com/nscuro/versatile/blob/c9f2b1da04612ac7acc05631f0874e587debc3c2/src/main/java/io/github/nscuro/versatile/Vers.java#L97-L117) one in `versatile` recently (tests for verification [here](https://github.com/nscuro/versatile/blob/c9f2b1da04612ac7acc05631f0874e587debc3c2/src/test/java/io/github/nscuro/versatile/VersTest.java#L95-L133)).
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.