Handle CPEs with NA (-) versions (#63)

Signed-off-by: nscuro <[email protected]>
nscuro · Apr 9, 2024 · f2335e2 · f2335e2
1 parent 265121e
commit f2335e2
Show file tree

Hide file tree

Showing 2 changed files with 29 additions and 12 deletions.
diff --git a/src/main/java/io/github/nscuro/versatile/VersUtils.java b/src/main/java/io/github/nscuro/versatile/VersUtils.java
@@ -23,6 +23,7 @@
 
 import java.util.List;
 import java.util.Map;
+import java.util.Optional;
 import java.util.Set;
 
 import static org.apache.commons.lang3.StringUtils.trimToNull;
@@ -105,8 +106,8 @@ public static Vers versFromOsvRange(final String type, final String ecosystem,
             };
 
             if (scheme == VersioningScheme.DEB
-                    && (comparator == Comparator.LESS_THAN || comparator == Comparator.LESS_THAN_OR_EQUAL)
-                    && Set.of("<end-of-life>", "<unfixed>").contains(event.getValue())) {
+                && (comparator == Comparator.LESS_THAN || comparator == Comparator.LESS_THAN_OR_EQUAL)
+                && Set.of("<end-of-life>", "<unfixed>").contains(event.getValue())) {
                 // Some ranges in the Debian ecosystem use these special values for their upper bound,
                 // to signal that all versions are affected. As they are not valid versions, we skip them.
                 //
@@ -132,20 +133,21 @@ public static Vers versFromOsvRange(final String type, final String ecosystem,
     /**
      * Convert ranges or exact version as used by NVD to a {@link Vers} range.
      *
-     * @param versionStartExcluding   The versionStartExcluding in the range
-     * @param versionStartIncluding   The versionStartIncluding in the range
+     * @param versionStartExcluding The versionStartExcluding in the range
+     * @param versionStartIncluding The versionStartIncluding in the range
      * @param versionEndExcluding   The versionEndExcluding in the range
      * @param versionEndIncluding   The versionEndIncluding in the range
-     * @param exactVersion  The exact version in CpeMatch
-     * @return The resulting {@link Vers}
+     * @param exactVersion          The exact version in CpeMatch
+     * @return An {@link Optional} containing the resulting {@link Vers}, or {@link Optional#empty()}
+     * when no constraints could be inferred from the given parameters
      * @throws IllegalArgumentException When the provided cpe match is invalid,
      *                                  or the provided {@code events} contains an invalid event
      * @throws VersException            When the produced {@link Vers} is invalid
      * @throws InvalidVersionException  When any version in the range is invalid according to the inferred {@link VersioningScheme}
      */
-    public static Vers versFromNvdRange(final String versionStartExcluding, final String versionStartIncluding,
-                                        final String versionEndExcluding, final String versionEndIncluding,
-                                        final String exactVersion) {
+    public static Optional<Vers> versFromNvdRange(final String versionStartExcluding, final String versionStartIncluding,
+                                                  final String versionEndExcluding, final String versionEndIncluding,
+                                                  final String exactVersion) {
 
         // Using 'generic' as versioning scheme for NVD due to lack of package data.
         final var versBuilder = Vers.builder(VersioningScheme.GENERIC);
@@ -178,7 +180,13 @@ public static Vers versFromNvdRange(final String versionStartExcluding, final St
                 versBuilder.withConstraint(Comparator.WILDCARD, null);
             }
         }
-        return versBuilder.build();
+
+        if (!versBuilder.hasConstraints()) {
+            // NB: This happens when the CPE's version is NA ("-").
+            return Optional.empty();
+        }
+
+        return Optional.of(versBuilder.build());
     }
 
     static VersioningScheme schemeFromGhsaEcosystem(final String ecosystem) {

diff --git a/src/test/java/io/github/nscuro/versatile/VersUtilsTest.java b/src/test/java/io/github/nscuro/versatile/VersUtilsTest.java
@@ -51,6 +51,7 @@
 import java.util.Enumeration;
 import java.util.List;
 import java.util.Map;
+import java.util.Optional;
 import java.util.stream.Stream;
 import java.util.zip.ZipEntry;
 import java.util.zip.ZipFile;
@@ -315,6 +316,10 @@ private static Stream<Arguments> testVersFromNvdRangeArguments() {
                 arguments(
                         null, "2.2.0", null, null, "6.0.7",
                         "vers:generic/>=2.2.0"
+                ),
+                arguments(
+                        null, null, null, null, "-",
+                        null
                 )
         );
     }
@@ -324,7 +329,11 @@ private static Stream<Arguments> testVersFromNvdRangeArguments() {
     void testVersFromNvdRange(final String versionStartExcluding, final String versionStartIncluding,
                               final String versionEndExcluding, final String versionEndIncluding,
                               final String exactVersion, final String expectedVers) {
-        assertThat(versFromNvdRange(versionStartExcluding, versionStartIncluding, versionEndExcluding, versionEndIncluding, exactVersion))
-                .hasToString(expectedVers);
+        final Optional<Vers> optionalVers = versFromNvdRange(versionStartExcluding, versionStartIncluding, versionEndExcluding, versionEndIncluding, exactVersion);
+        if (expectedVers == null) {
+            assertThat(optionalVers).isNotPresent();
+        } else {
+            assertThat(optionalVers).map(Vers::toString).contains(expectedVers);
+        }
     }
 }