Fix: Update parsing of CVE issue title to use regex-based extraction

[4rivappa]

Description

This update replaces the parsing logic with a regex-based approach that:

• Matches the start of the title to avoid removing CVEs from description
• Handles in case of multiple leading CVEs separated by commas, colons, or dashes

Resolves #145

Differences between prev JSON and newly generated JSON

diff prev.json new.json

348c348
<             "summary": "Bypass of seccomp profile enforcement ",
---
>             "summary": "Bypass of seccomp profile enforcement",
790c790
<             "summary": "Bearer tokens are revealed in logs",
---
>             "summary": "TOB-K8S-001: Bearer tokens are revealed in logs",
842c842
<             "summary": "container uid changes to root after first restart or if image is already pulled to the node",
---
>             "summary": "v1.14.2, v1.13.6: container uid changes to root after first restart or if image is already pulled to the node",
855c855
<             "summary": "rest.AnonymousClientConfig() does not remove the serviceaccount credentials from config created by rest.InClusterConfig()",
---
>             "summary": "v1.12.0-v1.12.4, v1.13.0: rest.AnonymousClientConfig() does not remove the serviceaccount credentials from config created by rest.InClusterConfig()",
868c868
<             "summary": "`kubectl:-http-cache=<world-accessible dir>` creates world-writeable cached schema files",
---
>             "summary": "`kubectl --http-cache=<world-accessible dir>` creates world-writeable cached schema files",

Exception

Raises a LookupError if the title does not start with a valid CVE block.
This will fail the whole fetch-cve-feed.sh bash script run.

Example:

Traceback (most recent call last):
  File "/workspaces/sig-security/sig-security-tooling/cve-feed/hack/fetch-official-cve-feed.py", line 108, in <module>
    cve_ids, description = parse_cve_title(item['title'])
                           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/workspaces/sig-security/sig-security-tooling/cve-feed/hack/fetch-official-cve-feed.py", line 32, in parse_cve_title
    raise LookupError(f"Title does not start with CVE block: {title}")
LookupError: Title does not start with CVE block:

[mtardy]

Hey, thanks a lot for that!!

Exception
Raises a LookupError if the title does not start with a valid CVE block.
This will fail the whole fetch-cve-feed.sh bash script run.

Example:

Traceback (most recent call last):
File "/workspaces/sig-security/sig-security-tooling/cve-feed/hack/fetch-official-cve-feed.py", line 108, in
cve_ids, description = parse_cve_title(item['title'])
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/workspaces/sig-security/sig-security-tooling/cve-feed/hack/fetch-official-cve-feed.py", line 32, in parse_cve_title
raise LookupError(f"Title does not start with CVE block: {title}")
LookupError: Title does not start with CVE block:

Looks nice but if we can just warn instead of fail since it would just be a "one entry issue", and return a non zero error code (so that prow generates a warn email) that would be perfect.

[mtardy]

/lgtm

Thanks a lot, this looks better, Tabitha updated some of the titles of the issues so now the diff looks like this:

361c361
<             "summary": "Bypass of seccomp profile enforcement ",
---
>             "summary": "Bypass of seccomp profile enforcement",
881c881
<             "summary": "`kubectl:-http-cache=<world-accessible dir>` creates world-writeable cached schema files",
---
>             "summary": "`kubectl --http-cache=<world-accessible dir>` creates world-writeable cached schema files",

Next step would be to print to stderr information about the non_parsable_cve_list so that we can debug this further easily. Thank you!

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: 4rivappa, mtardy

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• sig-security-tooling/cve-feed/OWNERS [mtardy]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment