Tightening the CPE matching to reduce false positive rate.#15187
Conversation
| Select("c.rowid", "c.product", "c.vendor", "c.deprecated", goqu.L("4 as weight")). | ||
| Where( | ||
| goqu.Or(goqu.L("c.vendor = ?", strings.ToLower(bundleParts[1]))), goqu.L("c.product = ?", strings.ToLower(bundleParts[2])), | ||
| goqu.L("c.vendor = ?", strings.ToLower(bundleParts[1])), goqu.L("c.product = ?", strings.ToLower(bundleParts[2])), |
There was a problem hiding this comment.
This was just unnecessary OR statement.
| // 4 - Try vendor/product from bundle identifier, like tld.vendor.product | ||
| bundleParts := strings.Split(software.BundleIdentifier, ".") | ||
| if len(bundleParts) >= 3 { | ||
| if len(bundleParts) == 3 { |
There was a problem hiding this comment.
This was the bug. Software with 4 part bundle identifiers was matching without considering the 4th part of the bundle.
If we encounter software with a long bundle identifier that we need to match, we can add it later. I scanned a list of software on my machine and didn't see anything interesting with a long bundle identifier that we'd want to match.
| "filter": { | ||
| "product": ["pycharm"], | ||
| "vendor": ["jetbrains"] | ||
| } |
There was a problem hiding this comment.
This is so that com.jetbrains.pycharm.ce bundle matches JetBrains PyCharm.
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## main #15187 +/- ##
==========================================
+ Coverage 59.03% 59.16% +0.13%
==========================================
Files 965 965
Lines 81941 82307 +366
Branches 2277 2277
==========================================
+ Hits 48371 48697 +326
- Misses 29842 29870 +28
- Partials 3728 3740 +12
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. |
#15176 This was already fixed earlier in the sprint by #15187 Adding docs and a test. # Checklist for submitter If some of the following don't apply, delete the relevant line. <!-- Note that API documentation changes are now addressed by the product design team. --> - [x] Changes file added for user-visible changes in `changes/` or `orbit/changes/`. See [Changes files](https://fleetdm.com/docs/contributing/committing-changes#changes-files) for more information. - [x] Added/updated tests
2 participants
#15143 and #15162
Previous fix for #13889 caused false positives on software with similar names. Tightening the matching to reduce false positive rate.
Checklist for submitter
changes/ororbit/changes/.See Changes files for more information.