Skip to content

Conversation

@Harshit28j
Copy link

Overview

Fixes #249

This PR extends the version extraction regex in ExtractVersionsFromText to support additional common phrases found in CVE descriptions.

Details

Problem

The existing regex only matched through and before keywords, causing version information to be lost when CVE descriptions used other common phrasing.

Solution

Added support for the following phrases:

  • up to and including (e.g., "versions 1.0 up to and including 2.3.4")
  • prior to (e.g., "versions prior to 2.3.4")
  • below (e.g., "versions below 2.3.4")
  • and earlier (e.g., "version 2.3.4 and earlier")
  • or older (e.g., "version 2.3.4 or older")
  • and below (e.g., "version 2.3.4 and below")

The implementation uses two regex patterns:

  1. Prefix pattern: For phrases where version comes after the keyword (before, prior to, below, etc.)
  2. Trailing pattern: For phrases where version comes before the keyword (and earlier, or older, and below)

Testing

  • Existing tests pass (go test -run TestExtractVersionInfo)
  • Code formatted (go fmt ./...)
  • Code vetted (go vet ./...)
image

@another-rex
Copy link
Contributor

Please add real world examples of these different version formats, and add tests for them. (i.e. link to the CVEs, add them as test cases.)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

vulnfeeds: Add some more common phrases when extracting versions from CVE description

2 participants