oss/syft
2
0
Fork 0
mirror of https://github.com/anchore/syft.git synced 2026-10-11 21:57:22 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix: conan expat CPE (#5259)

Browse Source 
Add libexpat_project vendor and libexpat product candidates for Conan
packages named expat, so generated CPEs match the NVD entries used for
libexpat vulnerabilities.

Signed-off-by: KR Ravindra <42912207+KR-Ravindra@users.noreply.github.com>
Co-authored-by: Will Murphy <willmurphyscode@users.noreply.github.com>
This commit is contained in:
KR Ravindra
2026-09-29 21:43:53 +00:00
committed by GitHub
co-authored by Will Murphy
parent e4ff7f5973
commit 8c63a2403c
3 changed files with 28 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
syft/pkg/cataloger/internal/cpegenerate/candidate_by_package_type.go
+5
View File
@@ -518,6 +518,11 @@ var defaultCandidateAdditions = buildCandidateLookup(
candidateKey{PkgName: "libxml2"},
candidateAddition{AdditionalVendors: []string{"xmlsoft"}},
},
{
pkg.ConanPkg,
candidateKey{PkgName: "expat"},
candidateAddition{AdditionalVendors: []string{"libexpat_project"}, AdditionalProducts: []string{"libexpat"}},
},
})
var defaultCandidateRemovals = buildCandidateRemovalLookup(
syft/pkg/cataloger/internal/cpegenerate/candidate_by_package_type_test.go
+7
View File
@@ -245,3 +245,10 @@ func Test_defaultCandidateAdditions_conan_libxml2(t *testing.T) {
vendors := findAdditionalVendors(defaultCandidateAdditions, pkg.ConanPkg, "libxml2", "")
assert.Contains(t, vendors, "xmlsoft")
}
func Test_defaultCandidateAdditions_conan_expat(t *testing.T) {
vendors := findAdditionalVendors(defaultCandidateAdditions, pkg.ConanPkg, "expat", "")
assert.Contains(t, vendors, "libexpat_project")
products := findAdditionalProducts(defaultCandidateAdditions, pkg.ConanPkg, "expat")
assert.Contains(t, products, "libexpat")
}
syft/pkg/cataloger/internal/cpegenerate/generate_test.go
+16
View File
@@ -892,6 +892,22 @@ func TestGeneratePackageCPEs(t *testing.T) {
"cpe:2.3:a:rust_package:rust_package:0.5.0:*:*:*:*:rust:*:*",
},
},
{
name: "conan expat: libexpat_project vendor and libexpat product",
p: pkg.Package{
Name: "expat",
Version: "2.5.0",
Type: pkg.ConanPkg,
},
expected: []string{
"cpe:2.3:a:expat:expat:2.5.0:*:*:*:*:*:*:*",
"cpe:2.3:a:expat:libexpat:2.5.0:*:*:*:*:*:*:*",
"cpe:2.3:a:libexpat:expat:2.5.0:*:*:*:*:*:*:*",
"cpe:2.3:a:libexpat:libexpat:2.5.0:*:*:*:*:*:*:*",
"cpe:2.3:a:libexpat_project:expat:2.5.0:*:*:*:*:*:*:*",
"cpe:2.3:a:libexpat_project:libexpat:2.5.0:*:*:*:*:*:*:*",
},
},
}
for _, test := range tests {