Repository navigation
Cyclone dx java - matching - #2057
Merged
Merged
Conversation
crozzy
force-pushed
the
cyclone-dx-java-match
branch
4 times, most recently
from
October 9, 2026 21:45
8be49b9 to
ee6f9ff
Compare
crozzy
force-pushed
the
cyclone-dx-java-match
branch
8 times, most recently
from
October 19, 2026 22:40
1237ce6 to
f677e0d
Compare
crozzy
force-pushed
the
cyclone-dx-java-match
branch
2 times, most recently
from
October 21, 2026 17:51
91b5dc7 to
3d92286
Compare
crozzy
marked this pull request as ready for review
October 21, 2026 18:16
BradLugo
self-requested a review
October 23, 2026 18:31
RepositoryKey is the key for a Red Hat product CPE attributed to a Java component. Signed-off-by: crozzy <joseph.crosland@gmail.com>
pkg:maven rows are now accepted. The package name is namespace:name, ignoring repository_url and type. FixedInVersion is the PURL version for a fixed row. Maven known_not_affected rows are skipped, and a versioned known_affected Maven PURL is not ingested. TODO: resolve what a version on a known_affected Maven PURL means. TODO: move the feed URL back to the production vex-feed once Maven data is published there. Signed-off-by: crozzy <joseph.crosland@gmail.com>
crozzy
force-pushed
the
cyclone-dx-java-match
branch
from
October 23, 2026 21:37
3d92286 to
01e8d32
Compare
BradLugo
reviewed
Oct 23, 2026
BradLugo
left a comment
BradLugo
left a comment
Contributor
There was a problem hiding this comment.
I have some other discussion points, but won't block on them for the sake of time
| slog.WarnContext(ctx, "unable to unbind repo CPE", "reason", err, "vulnerability name", vuln.Name) | ||
| return false, nil | ||
| } | ||
| if !cpe.Compare(vuln.Repo.CPE, record.Repository.CPE).IsSuperset() && !rhel.IsCPESubstringMatch(record.Repository.CPE, vuln.Repo.CPE) { |
Contributor
There was a problem hiding this comment.
I suspect substring matching will produce unexpected results (e.g., 1 > 10)
Contributor
Author
There was a problem hiding this comment.
hmmm, yeah, that seems like an original bug in the CPE subset matching. Honestly I feel like this could deserve its own PR but it makes backporting more annoying. I will include a fix in a commit here and we can discuss it
The matcher selects redhat-java-cpe-repository records. It applies the RHEL CPE check, then compares Maven versions: an installed package is vulnerable when it is strictly older than FixedInVersion, and an empty FixedInVersion matches any installed version. Signed-off-by: crozzy <joseph.crosland@gmail.com>
crozzy
force-pushed
the
cyclone-dx-java-match
branch
3 times, most recently
from
October 26, 2026 17:01
9e7e92b to
c2f47ea
Compare
BradLugo
reviewed
Oct 26, 2026
| if vuln.FixedInVersion == "" { | ||
| return true, nil | ||
| } | ||
| installed, err := maven.ParseVersion(record.Package.Version) |
Contributor
There was a problem hiding this comment.
I think it may be possible to have an empty ("") record.Package.Version
Contributor
Author
There was a problem hiding this comment.
Will check and return not vulnerable if the record.Package.Version is empty
Contributor
Author
There was a problem hiding this comment.
BradLugo
previously approved these changes
Oct 26, 2026
A whole-string prefix matched version 1 to version 10 and treated a dot in any attribute as a boundary. Extend the pattern version when the indexed version continues with a dot, then compare the CPEs once with the normal superset rules. Version 4 still matches 4.13. Signed-off-by: crozzy <joseph.crosland@gmail.com>
crozzy
force-pushed
the
cyclone-dx-java-match
branch
from
October 26, 2026 23:04
c2f47ea to
868672d
Compare
BradLugo
approved these changes
Oct 27, 2026
Contributor
Author
|
/fast-forward |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.