DependencyTrack / DependencyTrack/dependency-track
Fuzzy Matching not escaping ':'-character correctly results in failed parsing for cpe
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
### Current Behavior
When I try to use perl packages which contain '::' in their Names and I activate fuzzy cpe matching it fails because it doesn't correctly escape the ':' characters in the name. I have set LOG_LEVEL to DEBUG and the output I get is as follows:
Here's the log output from the analysis which shows the bug:
```
dtrack-apiserver_1 |2023-03-28 13:08:59,614 INFO [FindingResource] Analysis of project f9014be5-caef-4ce8-a099-ac6328112887 requested by admin
dtrack-apiserver_1 |2023-03-28 13:08:59,615 DEBUG [EventService] Dispatching event: class org.dependencytrack.event.VulnerabilityAnalysisEvent
dtrack-apiserver_1 |2023-03-28 13:08:59,615 DEBUG [EventService] Alerting subscriber org.dependencytrack.tasks.VulnerabilityAnalysisTask
dtrack-apiserver_1 |2023-03-28 13:08:59,618 INFO [InternalAnalysisTask] Starting internal analysis task
dtrack-apiserver_1 |2023-03-28 13:08:59,618 INFO [InternalAnalysisTask] Analyzing 1 component(s)
dtrack-apiserver_1 |2023-03-28 13:08:59,669 DEBUG [FuzzyVulnerableSoftwareSearchManager] Searching for: cpe23:/cpe\:2\.3\:*\:.*\:Test\:\:Simple\:.*\:.*\:.*\:.*\:.*\:.*\:.*\:.*/ - Total Hits: 0 hits
dtrack-apiserver_1 |2023-03-28 13:08:59,669 DEBUG [FuzzyVulnerableSoftwareSearchManager] Performing lucene ~ fuzz matching on 'Test::Simple'
dtrack-apiserver_1 |2023-03-28 13:08:59,669 ERROR [FuzzyVulnerableSoftwareSearchManager] Failed to parse search string
dtrack-apiserver_1 |org.apache.lucene.queryparser.classic.ParseException: Cannot parse 'product:Test::Simple~0.88 AND cpe23:/cpe\:2\.3\:*\:.*\:.*\:.*\:.*\:.*\:.*\:.*\:.*\:.*\:.*/': Encountered " ":" ": "" at line 1, column 12.
dtrack-apiserver_1 |Was expecting one of:
dtrack-apiserver_1 |
dtrack-apiserver_1 | ...
dtrack-apiserver_1 | ...
dtrack-apiserver_1 | ...
dtrack-apiserver_1 | "+" ...
dtrack-apiserver_1 | "-" ...
dtrack-apiserver_1 | ...
dtrack-apiserver_1 | "(" ...
dtrack-apiserver_1 | "*" ...
dtrack-apiserver_1 | "^" ...
dtrack-apiserver_1 | ...
dtrack-apiserver_1 | ...
dtrack-apiserver_1 | ...
dtrack-apiserver_1 | ...
dtrack-apiserver_1 | ...
dtrack-apiserver_1 | ...
dtrack-apiserver_1 | "[" ...
dtrack-apiserver_1 | "{" ...
dtrack-apiserver_1 | ...
dtrack-apiserver_1 |
dtrack-apiserver_1 | at org.apache.lucene.queryparser.classic.QueryParserBase.parse(QueryParserBase.java:114)
dtrack-apiserver_1 | at org.dependencytrack.search.FuzzyVulnerableSoftwareSearchManager.searchIndex(FuzzyVulnerableSoftwareSearchManager.java:140)
dtrack-apiserver_1 | at org.dependencytrack.search.FuzzyVulnerableSoftwareSearchManager.fuzzySearch(FuzzyVulnerableSoftwareSearchManager.java:195)
dtrack-apiserver_1 | at org.dependencytrack.search.FuzzyVulnerableSoftwareSearchManager.fuzzyAnalysis(FuzzyVulnerableSoftwareSearchManager.java:116)
dtrack-apiserver_1 | at org.dependencytrack.tasks.scanners.InternalAnalysisTask.versionRangeAnalysis(InternalAnalysisTask.java:149)
dtrack-apiserver_1 | at org.dependencytrack.tasks.scanners.InternalAnalysisTask.analyze(InternalAnalysisTask.java:91)
dtrack-apiserver_1 | at org.dependencytrack.tasks.scanners.InternalAnalysisTask.inform(InternalAnalysisTask.java:65)
dtrack-apiserver_1 | at org.dependencytrack.tasks.VulnerabilityAnalysisTask.performAnalysis(VulnerabilityAnalysisTask.java:169)
dtrack-apiserver_1 | at org.dependencytrack.tasks.VulnerabilityAnalysisTask.analyzeComponents(VulnerabilityAnalysisTask.java:127)
dtrack-apiserver_1 | at org.dependencytrack.tasks.VulnerabilityAnalysisTask.inform(VulnerabilityAnalysisTask.java:77)
dtrack-apiserver_1 | at alpine.event.framework.BaseEventService.lambda$publish$0(BaseEventService.java:101)
dtrack-apiserver_1 | at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
dtrack-apiserver_1 | at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
dtrack-apiserver_1 | at java.base/java.lang.Thread.run(Unknown Source)
dtrack-apiserver_1 |Caused by: org.apache.lucene.queryparser.classic.ParseException: Encountered " ":" ": "" at line 1, column 12.
dtrack-apiserver_1 |Was expecting one of:
dtrack-apiserver_1 |
dtrack-apiserver_1 | ...
dtrack-apiserver_1 | ...
dtrack-apiserver_1 | ...
dtrack-apiserver_1 | "+" ...
dtrack-apiserver_1 | "-" ...
dtrack-apiserver_1 | ...
dtrack-apiserver_1 | "(" ...
dtrack-apiserver_1 | "*" ...
dtrack-apiserver_1 | "^" ...
dtrack-apiserver_1 | ...
dtrack-apiserver_1 | ...
dtrack-apiserver_1 | ...
dtrack-apiserver_1 | ...
dtrack-apiserver_1 | ...
dtrack-apiserver_1 | ...
dtrack-apiserver_1 | "[" ...
dtrack-apiserver_1 | "{" ...
dtrack-apiserver_1 | ...
dtrack-apiserver_1 |
dtrack-apiserver_1 | at org.apache.lucene.queryparser.classic.QueryParser.generateParseException(QueryParser.java:931)
dtrack-apiserver_1 | at org.apache.lucene.queryparser.classic.QueryParser.jj_consume_token(QueryParser.java:813)
dtrack-apiserver_1 | at org.apache.lucene.queryparser.classic.QueryParser.TopLevelQuery(QueryParser.java:216)
dtrack-apiserver_1 | at org.apache.lucene.queryparser.classic.QueryParserBase.parse(QueryParserBase.java:109)
dtrack-apiserver_1 | ... 13 common frames omitted
dtrack-apiserver_1 |2023-03-28 13:08:59,670 DEBUG [NotificationService] Dispatching notification: class alpine.notification.Notification
dtrack-apiserver_1 |2023-03-28 13:08:59,670 DEBUG [NotificationService] Alerting subscriber org.dependencytrack.notification.NotificationRouter
dtrack-apiserver_1 |2023-03-28 13:08:59,670 INFO [InternalAnalysisTask] Internal analysis complete
dtrack-apiserver_1 |2023-03-28 13:08:59,670 DEBUG [VulnerabilityAnalysisTask] Time taken by perform analysis task by INTERNAL_ANALYZER : 52 milliseconds
dtrack-apiserver_1 |2023-03-28 13:08:59,670 WARN [OssIndexAnalysisTask] An API username or token has not been specified for use with OSS Index. Using anonymous access
dtrack-apiserver_1 |2023-03-28 13:08:59,670 INFO [OssIndexAnalysisTask] Starting Sonatype OSS Index analysis task
dtrack-apiserver_1 |2023-03-28 13:08:59,671 DEBUG [OssIndexAnalysisTask] Cache is current. Skipping analysis. (source: OSSINDEX / targetHost: https://ossindex.sonatype.org/api/v3/component-report / target: pkg:cpan/Test%3A%3ASimple@1.302140
dtrack-apiserver_1 |2023-03-28 13:08:59,671 INFO [OssIndexAnalysisTask] Sonatype OSS Index analysis complete
dtrack-apiserver_1 |2023-03-28 13:08:59,671 DEBUG [VulnerabilityAnalysisTask] Time taken by perform analysis task by OSSINDEX_ANALYZER : 1 milliseconds
dtrack-apiserver_1 |2023-03-28 13:08:59,671 INFO [PolicyEngine] Evaluating 1 component(s) against applicable policies
dtrack-apiserver_1 |2023-03-28 13:08:59,673 INFO [PolicyEngine] Policy analysis complete
dtrack-apiserver_1 |2023-03-28 13:08:59,673 DEBUG [EventService] Dispatching event: class org.dependencytrack.event.ProjectMetricsUpdateEvent
dtrack-apiserver_1 |2023-03-28 13:08:59,673 DEBUG [EventService] Alerting subscriber org.dependencytrack.tasks.metrics.ProjectMetricsUpdateTask
dtrack-apiserver_1 |2023-03-28 13:08:59,673 DEBUG [EventService] Calling onSuccess
dtrack-apiserver_1 |2023-03-28 13:08:59,673 INFO [ProjectMetricsUpdateTask] Executing metrics update for project f9014be5-caef-4ce8-a099-ac6328112887
dtrack-apiserver_1 |2023-03-28 13:08:59,673 DEBUG [ProjectMetricsUpdateTask] Fetching first components page for project f9014be5-caef-4ce8-a099-ac6328112887
dtrack-apiserver_1 |2023-03-28 13:08:59,673 DEBUG [ComponentMetricsUpdateTask] Executing metrics update for component 59c903f5-8a7f-4cb8-88d4-2b933432ece3
dtrack-apiserver_1 |2023-03-28 13:08:59,674 DEBUG [ComponentMetricsUpdateTask] Metrics of component 59c903f5-8a7f-4cb8-88d4-2b933432ece3 did not change
dtrack-apiserver_1 |2023-03-28 13:08:59,674 DEBUG [ComponentMetricsUpdateTask] Completed metrics update for component 59c903f5-8a7f-4cb8-88d4-2b933432ece3 in 00:00:001
dtrack-apiserver_1 |2023-03-28 13:08:59,674 DEBUG [ProjectMetricsUpdateTask] Fetching next components page for project f9014be5-caef-4ce8-a099-ac6328112887
dtrack-apiserver_1 |2023-03-28 13:08:59,675 DEBUG [ProjectMetricsUpdateTask] Metrics of project f9014be5-caef-4ce8-a099-ac6328112887 did not change
dtrack-apiserver_1 |2023-03-28 13:08:59,675 INFO [ProjectMetricsUpdateTask] Completed metrics update for project f9014be5-caef-4ce8-a099-ac6328112887 in 00:00:002
dtrack-apiserver_1 |2023-03-28 13:08:59,675 DEBUG [EventService] Calling onSuccess
```
### Steps to Reproduce
1. Use this simple bom in a project:
```
{
"bomFormat": "CycloneDX",
"specVersion": "1.4",
"version": 1,
"components": [
{
"type": "library",
"name": "Test::Simple",
"version": "1.302140",
"purl": "pkg:cpan/Test::Simple@1.302140"
}
]
}
```
2. enable fuzzy cpe matching in "internal" configuration
3. trigger "Re-Analyze" in vulnerability scanning or re-upload the bom in question.
4. observe error logfile and fuzzy matching not working
### Expected Behavior
Properly escaping the ':' characters which are perfectly valid in a perl package name and I cannot escape them in the BOM to make it works it actually renders the BOM to not be parsable so there's no workaround to make it work. For this specific Module it still finds the vulnerability through OSS Scanner but I have others which are not found by OSS but could be found by cpe's so it's important to make it work properly.
### Dependency-Track Version
4.7.1
### Dependency-Track Distribution
Container Image
### Database Server
H2
### Database Server Version
_No response_
### Browser
Google Chrome
### Checklist
- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported
Contributor guide
Assessment
This issue has not been assessed yet.