STRLCPY/syft

Fix panic in apkdb parsing on empty "provides" values (#1494)

* Add failing test for strip version specifiers panic

Signed-off-by: Dan Luhring <[email protected]>

* Fix test

Signed-off-by: Dan Luhring <[email protected]>

* Prevent panic scenario in helper func

Signed-off-by: Dan Luhring <[email protected]>

* Fix lint issue

Signed-off-by: Dan Luhring <[email protected]>

* add tests for apk stripVersionSpecifier() and remove caller empty value check

Signed-off-by: Alex Goodman <[email protected]>

Signed-off-by: Dan Luhring <[email protected]>
Signed-off-by: Alex Goodman <[email protected]>
Co-authored-by: Alex Goodman <[email protected]>

Dan Luhring committed with GitHub 1 year ago

e58050ba

1 parent 36a0945c

Revision indexing in progress... (symbol navigation in revisions will be accurate after indexed)

Total 2 files Show one by one

■ ■ ■ ■ ■ ■

syft/pkg/cataloger/apkdb/parse_apk_db.go

		skipped 360 lines
361	361		// examples:
362	362		// musl>=1 --> musl
363	363		// cmd:scanelf=1.3.4-r0 --> cmd:scanelf
364		-	return splitAny(s, "<>=")[0]
	364	+
	365	+	items := splitAny(s, "<>=")
	366	+	if len(items) == 0 {
	367	+	return s
	368	+	}
	369	+
	370	+	return items[0]
365	371		}
366	372

■ ■ ■ ■ ■ ■

syft/pkg/cataloger/apkdb/parse_apk_db_test.go

		skipped 911 lines
912	912		},
913	913		},
914	914		{
	915	+	name: "strip version specifiers with empty provides value",
	916	+	genFn: func() ([]pkg.Package, []artifact.Relationship) {
	917	+	a := pkg.Package{
	918	+	Name: "package-a",
	919	+	Metadata: pkg.ApkMetadata{
	920	+	Dependencies: []string{"so:libc.musl-x86_64.so.1"},
	921	+	},
	922	+	}
	923	+	a.SetID()
	924	+	b := pkg.Package{
	925	+	Name: "package-b",
	926	+	Metadata: pkg.ApkMetadata{
	927	+	Provides: []string{""},
	928	+	},
	929	+	}
	930	+	b.SetID()
	931	+
	932	+	return []pkg.Package{a, b}, nil
	933	+	},
	934	+	},
	935	+	{
915	936		name: "depends on package name",
916	937		genFn: func() ([]pkg.Package, []artifact.Relationship) {
917	938		a := pkg.Package{
		skipped 209 lines
1127	1148		return source.NewLocationReadCloser(source.NewLocation(path), f)
1128	1149		}
1129	1150
	1151	+	func Test_stripVersionSpecifier(t *testing.T) {
	1152	+	tests := []struct {
	1153	+	name string
	1154	+	version string
	1155	+	want string
	1156	+	}{
	1157	+	{
	1158	+	name: "empty expression",
	1159	+	version: "",
	1160	+	want: "",
	1161	+	},
	1162	+	{
	1163	+	name: "no expression",
	1164	+	version: "cmd:foo",
	1165	+	want: "cmd:foo",
	1166	+	},
	1167	+	{
	1168	+	name: "=",
	1169	+	version: "cmd:scanelf=1.3.4-r0",
	1170	+	want: "cmd:scanelf",
	1171	+	},
	1172	+	{
	1173	+	name: ">=",
	1174	+	version: "cmd:scanelf>=1.3.4-r0",
	1175	+	want: "cmd:scanelf",
	1176	+	},
	1177	+	{
	1178	+	name: "<",
	1179	+	version: "cmd:scanelf<1.3.4-r0",
	1180	+	want: "cmd:scanelf",
	1181	+	},
	1182	+	}
	1183	+	for _, tt := range tests {
	1184	+	t.Run(tt.name, func(t *testing.T) {
	1185	+	assert.Equal(t, tt.want, stripVersionSpecifier(tt.version))
	1186	+	})
	1187	+	}
	1188	+	}
	1189	+