oss/syft
2
0
Fork 0
mirror of https://github.com/anchore/syft.git synced 2026-08-22 01:53:35 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(cpe): fix generated cpe for rust packages

Browse Source 
---------
Signed-off-by: Xenira <1288524+Xenira@users.noreply.github.com>
This commit is contained in:
Xenira 2026-08-20 21:01:24 +02:00 committed by GitHub
parent fd4796b0d8
commit 490732aa58
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 69 additions and 36 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

86
syft/pkg/cataloger/internal/cpegenerate/generate.go
View File

@ -184,9 +184,13 @@ func FromPackageAttributes(p pkg.Package) []cpe.CPE {
}
func candidateTargetSw(p pkg.Package) []string {
if p.Type == pkg.WordpressPluginPkg {
switch p.Type {
case pkg.WordpressPluginPkg:
return []string{"wordpress"}
case pkg.RustPkg:
return []string{"rust"}
}
return []string{cpe.Any}
}
@ -217,6 +221,50 @@ func candidateVendors(p pkg.Package) []string {
}
}
vendors = candidateVendorsByType(p, vendors)
if p.Type == pkg.BinaryPkg && endsWithNumber(p.Name) {
// add binary package digit-suffix variations (e.g. Qt5 -> Qt)
addBinaryPackageDigitVariations(vendors)
}
// We should no longer be generating vendor candidates with these values ["" and "*"]
// (since CPEs will match any other value)
vendors.removeByValue("")
vendors.removeByValue("*")
// try swapping hyphens for underscores, vice versa, and removing separators altogether
addDelimiterVariations(vendors)
// rust vendor name needs to be added after the `addDelimiterVariations` call as `-project` suffix is used otherwise
if p.Language == pkg.Rust {
vendors.addValue(p.Name + "_project")
}
// generate sub-selections of each candidate based on separators (e.g. jenkins-ci -> [jenkins, jenkins-ci])
addAllSubSelections(vendors)
// add more candidates based on the package info for each vendor candidate
for _, vendor := range vendors.uniqueValues() {
vendors.addValue(findAdditionalVendors(defaultCandidateAdditions, p.Type, p.Name, vendor)...)
}
// remove known mis
vendors.removeByValue(findVendorsToRemove(defaultCandidateRemovals, p.Type, p.Name)...)
uniqueVendors := vendors.uniqueValues()
// if any known vendor was detected, pick that one.
for _, vendor := range uniqueVendors {
if knownVendors.Has(vendor) {
return []string{vendor}
}
}
return uniqueVendors
}
func candidateVendorsByType(p pkg.Package, vendors fieldCandidateSet) fieldCandidateSet {
switch p.Metadata.(type) {
case pkg.DotnetDepsEntry, pkg.DotnetPackagesLockEntry, pkg.DotnetPortableExecutableEntry:
vendors.clear()
@ -240,41 +288,7 @@ func candidateVendors(p pkg.Package) []string {
vendors.clear()
vendors.union(candidateVendorsForWordpressPlugin(p))
}
if p.Type == pkg.BinaryPkg && endsWithNumber(p.Name) {
// add binary package digit-suffix variations (e.g. Qt5 -> Qt)
addBinaryPackageDigitVariations(vendors)
}
// We should no longer be generating vendor candidates with these values ["" and "*"]
// (since CPEs will match any other value)
vendors.removeByValue("")
vendors.removeByValue("*")
// try swapping hyphens for underscores, vice versa, and removing separators altogether
addDelimiterVariations(vendors)
// generate sub-selections of each candidate based on separators (e.g. jenkins-ci -> [jenkins, jenkins-ci])
addAllSubSelections(vendors)
// add more candidates based on the package info for each vendor candidate
for _, vendor := range vendors.uniqueValues() {
vendors.addValue(findAdditionalVendors(defaultCandidateAdditions, p.Type, p.Name, vendor)...)
}
// remove known mis
vendors.removeByValue(findVendorsToRemove(defaultCandidateRemovals, p.Type, p.Name)...)
uniqueVendors := vendors.uniqueValues()
// if any known vendor was detected, pick that one.
for _, vendor := range uniqueVendors {
if knownVendors.Has(vendor) {
return []string{vendor}
}
}
return uniqueVendors
return vendors
}
func candidateProducts(p pkg.Package) []string {

19
syft/pkg/cataloger/internal/cpegenerate/generate_test.go
View File

@ -855,6 +855,25 @@ func TestGeneratePackageCPEs(t *testing.T) {
},
expected: []string{},
},
{
name: "rust package",
p: pkg.Package{
Name: "rust-package",
Version: "0.5.0",
Type: pkg.RustPkg,
Language: pkg.Rust,
},
expected: []string{
"cpe:2.3:a:rust-package_project:rust-package:0.5.0:*:*:*:*:rust:*:*",
"cpe:2.3:a:rust-package_project:rust_package:0.5.0:*:*:*:*:rust:*:*",
"cpe:2.3:a:rust-package:rust-package:0.5.0:*:*:*:*:rust:*:*",
"cpe:2.3:a:rust-package:rust_package:0.5.0:*:*:*:*:rust:*:*",
"cpe:2.3:a:rust:rust-package:0.5.0:*:*:*:*:rust:*:*",
"cpe:2.3:a:rust:rust_package:0.5.0:*:*:*:*:rust:*:*",
"cpe:2.3:a:rust_package:rust-package:0.5.0:*:*:*:*:rust:*:*",
"cpe:2.3:a:rust_package:rust_package:0.5.0:*:*:*:*:rust:*:*",
},
},
}
for _, test := range tests {