DependencyTrack / DependencyTrack/dependency-track

Fuzzy Matching not escaping ':'-character correctly results in failed parsing for cpe

Open
#2,630 0 comments 0 reactions 0 assignees View on GitHub
defect in triage
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

When I try to use perl packages which contain '::' in their Names and I activate fuzzy cpe matching it fails because it doesn't correctly escape the ':' characters in the name. I have set LOG_LEVEL to DEBUG and the output I get is as follows:

Here's the log output from the analysis which shows the bug:
```
dtrack-apiserver_1 |2023-03-28 13:08:59,614 INFO [FindingResource] Analysis of project f9014be5-caef-4ce8-a099-ac6328112887 requested by admin
dtrack-apiserver_1 |2023-03-28 13:08:59,615 DEBUG [EventService] Dispatching event: class org.dependencytrack.event.VulnerabilityAnalysisEvent
dtrack-apiserver_1 |2023-03-28 13:08:59,615 DEBUG [EventService] Alerting subscriber org.dependencytrack.tasks.VulnerabilityAnalysisTask
dtrack-apiserver_1 |2023-03-28 13:08:59,618 INFO [InternalAnalysisTask] Starting internal analysis task
dtrack-apiserver_1 |2023-03-28 13:08:59,618 INFO [InternalAnalysisTask] Analyzing 1 component(s)
dtrack-apiserver_1 |2023-03-28 13:08:59,669 DEBUG [FuzzyVulnerableSoftwareSearchManager] Searching for: cpe23:/cpe\:2\.3\:*\:.*\:Test\:\:Simple\:.*\:.*\:.*\:.*\:.*\:.*\:.*\:.*/ - Total Hits: 0 hits
dtrack-apiserver_1 |2023-03-28 13:08:59,669 DEBUG [FuzzyVulnerableSoftwareSearchManager] Performing lucene ~ fuzz matching on 'Test::Simple'
dtrack-apiserver_1 |2023-03-28 13:08:59,669 ERROR [FuzzyVulnerableSoftwareSearchManager] Failed to parse search string
dtrack-apiserver_1 |org.apache.lucene.queryparser.classic.ParseException: Cannot parse 'product:Test::Simple~0.88 AND cpe23:/cpe\:2\.3\:*\:.*\:.*\:.*\:.*\:.*\:.*\:.*\:.*\:.*\:.*/': Encountered " ":" ": "" at line 1, column 12.
dtrack-apiserver_1 |Was expecting one of:
dtrack-apiserver_1 |
dtrack-apiserver_1 | ...
dtrack-apiserver_1 | ...
dtrack-apiserver_1 | ...
dtrack-apiserver_1 | "+" ...
dtrack-apiserver_1 | "-" ...
dtrack-apiserver_1 | ...
dtrack-apiserver_1 | "(" ...
dtrack-apiserver_1 | "*" ...
dtrack-apiserver_1 | "^" ...
dtrack-apiserver_1 | ...
dtrack-apiserver_1 | ...
dtrack-apiserver_1 | ...
dtrack-apiserver_1 | ...
dtrack-apiserver_1 | ...
dtrack-apiserver_1 | ...
dtrack-apiserver_1 | "[" ...
dtrack-apiserver_1 | "{" ...
dtrack-apiserver_1 | ...
dtrack-apiserver_1 |
dtrack-apiserver_1 | at org.apache.lucene.queryparser.classic.QueryParserBase.parse(QueryParserBase.java:114)
dtrack-apiserver_1 | at org.dependencytrack.search.FuzzyVulnerableSoftwareSearchManager.searchIndex(FuzzyVulnerableSoftwareSearchManager.java:140)
dtrack-apiserver_1 | at org.dependencytrack.search.FuzzyVulnerableSoftwareSearchManager.fuzzySearch(FuzzyVulnerableSoftwareSearchManager.java:195)
dtrack-apiserver_1 | at org.dependencytrack.search.FuzzyVulnerableSoftwareSearchManager.fuzzyAnalysis(FuzzyVulnerableSoftwareSearchManager.java:116)
dtrack-apiserver_1 | at org.dependencytrack.tasks.scanners.InternalAnalysisTask.versionRangeAnalysis(InternalAnalysisTask.java:149)
dtrack-apiserver_1 | at org.dependencytrack.tasks.scanners.InternalAnalysisTask.analyze(InternalAnalysisTask.java:91)
dtrack-apiserver_1 | at org.dependencytrack.tasks.scanners.InternalAnalysisTask.inform(InternalAnalysisTask.java:65)
dtrack-apiserver_1 | at org.dependencytrack.tasks.VulnerabilityAnalysisTask.performAnalysis(VulnerabilityAnalysisTask.java:169)
dtrack-apiserver_1 | at org.dependencytrack.tasks.VulnerabilityAnalysisTask.analyzeComponents(VulnerabilityAnalysisTask.java:127)
dtrack-apiserver_1 | at org.dependencytrack.tasks.VulnerabilityAnalysisTask.inform(VulnerabilityAnalysisTask.java:77)
dtrack-apiserver_1 | at alpine.event.framework.BaseEventService.lambda$publish$0(BaseEventService.java:101)
dtrack-apiserver_1 | at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
dtrack-apiserver_1 | at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
dtrack-apiserver_1 | at java.base/java.lang.Thread.run(Unknown Source)
dtrack-apiserver_1 |Caused by: org.apache.lucene.queryparser.classic.ParseException: Encountered " ":" ": "" at line 1, column 12.
dtrack-apiserver_1 |Was expecting one of:
dtrack-apiserver_1 |
dtrack-apiserver_1 | ...
dtrack-apiserver_1 | ...
dtrack-apiserver_1 | ...
dtrack-apiserver_1 | "+" ...
dtrack-apiserver_1 | "-" ...
dtrack-apiserver_1 | ...
dtrack-apiserver_1 | "(" ...
dtrack-apiserver_1 | "*" ...
dtrack-apiserver_1 | "^" ...
dtrack-apiserver_1 | ...
dtrack-apiserver_1 | ...
dtrack-apiserver_1 | ...
dtrack-apiserver_1 | ...
dtrack-apiserver_1 | ...
dtrack-apiserver_1 | ...
dtrack-apiserver_1 | "[" ...
dtrack-apiserver_1 | "{" ...
dtrack-apiserver_1 | ...
dtrack-apiserver_1 |
dtrack-apiserver_1 | at org.apache.lucene.queryparser.classic.QueryParser.generateParseException(QueryParser.java:931)
dtrack-apiserver_1 | at org.apache.lucene.queryparser.classic.QueryParser.jj_consume_token(QueryParser.java:813)
dtrack-apiserver_1 | at org.apache.lucene.queryparser.classic.QueryParser.TopLevelQuery(QueryParser.java:216)
dtrack-apiserver_1 | at org.apache.lucene.queryparser.classic.QueryParserBase.parse(QueryParserBase.java:109)
dtrack-apiserver_1 | ... 13 common frames omitted
dtrack-apiserver_1 |2023-03-28 13:08:59,670 DEBUG [NotificationService] Dispatching notification: class alpine.notification.Notification
dtrack-apiserver_1 |2023-03-28 13:08:59,670 DEBUG [NotificationService] Alerting subscriber org.dependencytrack.notification.NotificationRouter
dtrack-apiserver_1 |2023-03-28 13:08:59,670 INFO [InternalAnalysisTask] Internal analysis complete
dtrack-apiserver_1 |2023-03-28 13:08:59,670 DEBUG [VulnerabilityAnalysisTask] Time taken by perform analysis task by INTERNAL_ANALYZER : 52 milliseconds
dtrack-apiserver_1 |2023-03-28 13:08:59,670 WARN [OssIndexAnalysisTask] An API username or token has not been specified for use with OSS Index. Using anonymous access
dtrack-apiserver_1 |2023-03-28 13:08:59,670 INFO [OssIndexAnalysisTask] Starting Sonatype OSS Index analysis task
dtrack-apiserver_1 |2023-03-28 13:08:59,671 DEBUG [OssIndexAnalysisTask] Cache is current. Skipping analysis. (source: OSSINDEX / targetHost: https://ossindex.sonatype.org/api/v3/component-report / target: pkg:cpan/Test%3A%3ASimple@1.302140
dtrack-apiserver_1 |2023-03-28 13:08:59,671 INFO [OssIndexAnalysisTask] Sonatype OSS Index analysis complete
dtrack-apiserver_1 |2023-03-28 13:08:59,671 DEBUG [VulnerabilityAnalysisTask] Time taken by perform analysis task by OSSINDEX_ANALYZER : 1 milliseconds
dtrack-apiserver_1 |2023-03-28 13:08:59,671 INFO [PolicyEngine] Evaluating 1 component(s) against applicable policies
dtrack-apiserver_1 |2023-03-28 13:08:59,673 INFO [PolicyEngine] Policy analysis complete
dtrack-apiserver_1 |2023-03-28 13:08:59,673 DEBUG [EventService] Dispatching event: class org.dependencytrack.event.ProjectMetricsUpdateEvent
dtrack-apiserver_1 |2023-03-28 13:08:59,673 DEBUG [EventService] Alerting subscriber org.dependencytrack.tasks.metrics.ProjectMetricsUpdateTask
dtrack-apiserver_1 |2023-03-28 13:08:59,673 DEBUG [EventService] Calling onSuccess
dtrack-apiserver_1 |2023-03-28 13:08:59,673 INFO [ProjectMetricsUpdateTask] Executing metrics update for project f9014be5-caef-4ce8-a099-ac6328112887
dtrack-apiserver_1 |2023-03-28 13:08:59,673 DEBUG [ProjectMetricsUpdateTask] Fetching first components page for project f9014be5-caef-4ce8-a099-ac6328112887
dtrack-apiserver_1 |2023-03-28 13:08:59,673 DEBUG [ComponentMetricsUpdateTask] Executing metrics update for component 59c903f5-8a7f-4cb8-88d4-2b933432ece3
dtrack-apiserver_1 |2023-03-28 13:08:59,674 DEBUG [ComponentMetricsUpdateTask] Metrics of component 59c903f5-8a7f-4cb8-88d4-2b933432ece3 did not change
dtrack-apiserver_1 |2023-03-28 13:08:59,674 DEBUG [ComponentMetricsUpdateTask] Completed metrics update for component 59c903f5-8a7f-4cb8-88d4-2b933432ece3 in 00:00:001
dtrack-apiserver_1 |2023-03-28 13:08:59,674 DEBUG [ProjectMetricsUpdateTask] Fetching next components page for project f9014be5-caef-4ce8-a099-ac6328112887
dtrack-apiserver_1 |2023-03-28 13:08:59,675 DEBUG [ProjectMetricsUpdateTask] Metrics of project f9014be5-caef-4ce8-a099-ac6328112887 did not change
dtrack-apiserver_1 |2023-03-28 13:08:59,675 INFO [ProjectMetricsUpdateTask] Completed metrics update for project f9014be5-caef-4ce8-a099-ac6328112887 in 00:00:002
dtrack-apiserver_1 |2023-03-28 13:08:59,675 DEBUG [EventService] Calling onSuccess
```

### Steps to Reproduce

1. Use this simple bom in a project:
```
{
"bomFormat": "CycloneDX",
"specVersion": "1.4",
"version": 1,
"components": [
{
"type": "library",
"name": "Test::Simple",
"version": "1.302140",
"purl": "pkg:cpan/Test::Simple@1.302140"
}
]
}

```
2. enable fuzzy cpe matching in "internal" configuration
3. trigger "Re-Analyze" in vulnerability scanning or re-upload the bom in question.
4. observe error logfile and fuzzy matching not working

### Expected Behavior

Properly escaping the ':' characters which are perfectly valid in a perl package name and I cannot escape them in the BOM to make it works it actually renders the BOM to not be parsable so there's no workaround to make it work. For this specific Module it still finds the vulnerability through OSS Scanner but I have others which are not found by OSS but could be found by cpe's so it's important to make it work properly.

### Dependency-Track Version

4.7.1

### Dependency-Track Distribution

Container Image

### Database Server

H2

### Database Server Version

_No response_

### Browser

Google Chrome

### Checklist

- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.