From 8c63a2403c903c5c951dc89080999d410dd72305 Mon Sep 17 00:00:00 2001 From: KR Ravindra Date: Tue, 29 Sep 2026 14:43:53 -0700 Subject: [PATCH] fix: conan expat CPE (#5259) Add libexpat_project vendor and libexpat product candidates for Conan packages named expat, so generated CPEs match the NVD entries used for libexpat vulnerabilities. Signed-off-by: KR Ravindra <42912207+KR-Ravindra@users.noreply.github.com> Co-authored-by: Will Murphy --- .../cpegenerate/candidate_by_package_type.go | 5 +++++ .../candidate_by_package_type_test.go | 7 +++++++ .../internal/cpegenerate/generate_test.go | 16 ++++++++++++++++ 3 files changed, 28 insertions(+) diff --git a/syft/pkg/cataloger/internal/cpegenerate/candidate_by_package_type.go b/syft/pkg/cataloger/internal/cpegenerate/candidate_by_package_type.go index b43906c8b..7a702c071 100644 --- a/syft/pkg/cataloger/internal/cpegenerate/candidate_by_package_type.go +++ b/syft/pkg/cataloger/internal/cpegenerate/candidate_by_package_type.go @@ -518,6 +518,11 @@ var defaultCandidateAdditions = buildCandidateLookup( candidateKey{PkgName: "libxml2"}, candidateAddition{AdditionalVendors: []string{"xmlsoft"}}, }, + { + pkg.ConanPkg, + candidateKey{PkgName: "expat"}, + candidateAddition{AdditionalVendors: []string{"libexpat_project"}, AdditionalProducts: []string{"libexpat"}}, + }, }) var defaultCandidateRemovals = buildCandidateRemovalLookup( diff --git a/syft/pkg/cataloger/internal/cpegenerate/candidate_by_package_type_test.go b/syft/pkg/cataloger/internal/cpegenerate/candidate_by_package_type_test.go index 8f21eeae4..fb73ea799 100644 --- a/syft/pkg/cataloger/internal/cpegenerate/candidate_by_package_type_test.go +++ b/syft/pkg/cataloger/internal/cpegenerate/candidate_by_package_type_test.go @@ -245,3 +245,10 @@ func Test_defaultCandidateAdditions_conan_libxml2(t *testing.T) { vendors := findAdditionalVendors(defaultCandidateAdditions, pkg.ConanPkg, "libxml2", "") assert.Contains(t, vendors, "xmlsoft") } + +func Test_defaultCandidateAdditions_conan_expat(t *testing.T) { + vendors := findAdditionalVendors(defaultCandidateAdditions, pkg.ConanPkg, "expat", "") + assert.Contains(t, vendors, "libexpat_project") + products := findAdditionalProducts(defaultCandidateAdditions, pkg.ConanPkg, "expat") + assert.Contains(t, products, "libexpat") +} diff --git a/syft/pkg/cataloger/internal/cpegenerate/generate_test.go b/syft/pkg/cataloger/internal/cpegenerate/generate_test.go index cdf32d9b7..a4e6d3d08 100644 --- a/syft/pkg/cataloger/internal/cpegenerate/generate_test.go +++ b/syft/pkg/cataloger/internal/cpegenerate/generate_test.go @@ -892,6 +892,22 @@ func TestGeneratePackageCPEs(t *testing.T) { "cpe:2.3:a:rust_package:rust_package:0.5.0:*:*:*:*:rust:*:*", }, }, + { + name: "conan expat: libexpat_project vendor and libexpat product", + p: pkg.Package{ + Name: "expat", + Version: "2.5.0", + Type: pkg.ConanPkg, + }, + expected: []string{ + "cpe:2.3:a:expat:expat:2.5.0:*:*:*:*:*:*:*", + "cpe:2.3:a:expat:libexpat:2.5.0:*:*:*:*:*:*:*", + "cpe:2.3:a:libexpat:expat:2.5.0:*:*:*:*:*:*:*", + "cpe:2.3:a:libexpat:libexpat:2.5.0:*:*:*:*:*:*:*", + "cpe:2.3:a:libexpat_project:expat:2.5.0:*:*:*:*:*:*:*", + "cpe:2.3:a:libexpat_project:libexpat:2.5.0:*:*:*:*:*:*:*", + }, + }, } for _, test := range tests {