diff --git a/src/main/java/io/github/nscuro/versatile/VersUtils.java b/src/main/java/io/github/nscuro/versatile/VersUtils.java index 8487ec9..df58ce2 100644 --- a/src/main/java/io/github/nscuro/versatile/VersUtils.java +++ b/src/main/java/io/github/nscuro/versatile/VersUtils.java @@ -23,6 +23,7 @@ import java.util.List; import java.util.Map; +import java.util.Optional; import java.util.Set; import static org.apache.commons.lang3.StringUtils.trimToNull; @@ -105,8 +106,8 @@ public static Vers versFromOsvRange(final String type, final String ecosystem, }; if (scheme == VersioningScheme.DEB - && (comparator == Comparator.LESS_THAN || comparator == Comparator.LESS_THAN_OR_EQUAL) - && Set.of("", "").contains(event.getValue())) { + && (comparator == Comparator.LESS_THAN || comparator == Comparator.LESS_THAN_OR_EQUAL) + && Set.of("", "").contains(event.getValue())) { // Some ranges in the Debian ecosystem use these special values for their upper bound, // to signal that all versions are affected. As they are not valid versions, we skip them. // @@ -132,20 +133,21 @@ public static Vers versFromOsvRange(final String type, final String ecosystem, /** * Convert ranges or exact version as used by NVD to a {@link Vers} range. * - * @param versionStartExcluding The versionStartExcluding in the range - * @param versionStartIncluding The versionStartIncluding in the range + * @param versionStartExcluding The versionStartExcluding in the range + * @param versionStartIncluding The versionStartIncluding in the range * @param versionEndExcluding The versionEndExcluding in the range * @param versionEndIncluding The versionEndIncluding in the range - * @param exactVersion The exact version in CpeMatch - * @return The resulting {@link Vers} + * @param exactVersion The exact version in CpeMatch + * @return An {@link Optional} containing the resulting {@link Vers}, or {@link Optional#empty()} + * when no constraints could be inferred from the given parameters * @throws IllegalArgumentException When the provided cpe match is invalid, * or the provided {@code events} contains an invalid event * @throws VersException When the produced {@link Vers} is invalid * @throws InvalidVersionException When any version in the range is invalid according to the inferred {@link VersioningScheme} */ - public static Vers versFromNvdRange(final String versionStartExcluding, final String versionStartIncluding, - final String versionEndExcluding, final String versionEndIncluding, - final String exactVersion) { + public static Optional versFromNvdRange(final String versionStartExcluding, final String versionStartIncluding, + final String versionEndExcluding, final String versionEndIncluding, + final String exactVersion) { // Using 'generic' as versioning scheme for NVD due to lack of package data. final var versBuilder = Vers.builder(VersioningScheme.GENERIC); @@ -178,7 +180,13 @@ public static Vers versFromNvdRange(final String versionStartExcluding, final St versBuilder.withConstraint(Comparator.WILDCARD, null); } } - return versBuilder.build(); + + if (!versBuilder.hasConstraints()) { + // NB: This happens when the CPE's version is NA ("-"). + return Optional.empty(); + } + + return Optional.of(versBuilder.build()); } static VersioningScheme schemeFromGhsaEcosystem(final String ecosystem) { diff --git a/src/test/java/io/github/nscuro/versatile/VersUtilsTest.java b/src/test/java/io/github/nscuro/versatile/VersUtilsTest.java index b963452..f4f8f79 100644 --- a/src/test/java/io/github/nscuro/versatile/VersUtilsTest.java +++ b/src/test/java/io/github/nscuro/versatile/VersUtilsTest.java @@ -51,6 +51,7 @@ import java.util.Enumeration; import java.util.List; import java.util.Map; +import java.util.Optional; import java.util.stream.Stream; import java.util.zip.ZipEntry; import java.util.zip.ZipFile; @@ -315,6 +316,10 @@ private static Stream testVersFromNvdRangeArguments() { arguments( null, "2.2.0", null, null, "6.0.7", "vers:generic/>=2.2.0" + ), + arguments( + null, null, null, null, "-", + null ) ); } @@ -324,7 +329,11 @@ private static Stream testVersFromNvdRangeArguments() { void testVersFromNvdRange(final String versionStartExcluding, final String versionStartIncluding, final String versionEndExcluding, final String versionEndIncluding, final String exactVersion, final String expectedVers) { - assertThat(versFromNvdRange(versionStartExcluding, versionStartIncluding, versionEndExcluding, versionEndIncluding, exactVersion)) - .hasToString(expectedVers); + final Optional optionalVers = versFromNvdRange(versionStartExcluding, versionStartIncluding, versionEndExcluding, versionEndIncluding, exactVersion); + if (expectedVers == null) { + assertThat(optionalVers).isNotPresent(); + } else { + assertThat(optionalVers).map(Vers::toString).contains(expectedVers); + } } } \ No newline at end of file