Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(uC/lib): handling of product names with special characters #4959

Open
wants to merge 5 commits into
base: main
Choose a base branch
from

Conversation

JigyasuRajput
Copy link
Contributor

@JigyasuRajput JigyasuRajput commented Mar 22, 2025

Description-

Fixes #4417
In this issue cve-bin tool was deleting the triage data for micrium uC/Lib, it showed unexplored in the html & csv reports (which was not expected)

This was occurring because of the way URNs were parsed in cve-bin tool for the product names (specially for special characters like "/")
for ex - urn:cbt:1/micrium#uc/lib:1.38.01 - the slash in "uc/lib" was causing the issue.

Solution -

  • Improved the current URN handling to make sure slashes in the product names are maintained
  • HTML ID Normalization - Added a normalize_id() function which safely converts product names with special characters into valid HTML IDs
  • added tests to reproduce and verify the fix

Steps to reproduce the issue From comments

  1. add the file test_SBOM.csv
  2. add the file test_cve-bin-tool_triageFile.json
  3. Run this command (with venv) -
    cve-bin-tool -i test_SBOM.csv --vex-file test_cve-bin-tool_triageFile.json -f csv,html --vex-output triage0919a.json

Python version - Python 3.11.0rc1
OS - Windows 10 (WSL)

Output after the fix - Output csv file

Html reports screenshots -

  1. image
  2. image

@terriko
Copy link
Contributor

terriko commented Mar 26, 2025

I'm going to approve the tests to run, but I'm not sure if this will actually solve our problem: we may need less normalization because I think the character is actually in the CPE definition so taking it out may break things.

@ffontaine
Copy link
Contributor

In addition to @terriko remark, location has been dropped from ProductInfo since commit 96ff61b resulting in the following build failure:

FAILED test/test_vex.py::TestVexParse::test_parse_cyclonedx[cyclonedx-test_cyclonedx_vex.json-expected_parsed_data0] - TypeError: ProductInfo.__new__() got an unexpected keyword argument 'location'

PR should be updated to take this change into account.

@JigyasuRajput
Copy link
Contributor Author

yes! thanks for information, and sorry for the delay (due to end-sem exams). I'll soon update the PR to fix this issue...

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

micrium uC/Lib vulnerability causes cve-bin-tool to delete triage response data from triage input file
3 participants