Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

PR# 263 for v6 #264

Merged
merged 1 commit into from
Feb 27, 2024
Merged

PR# 263 for v6 #264

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions depscan/lib/config.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -85,6 +85,7 @@ def resource_path(relative_path):
"io.springfox": "smartbear",
"log4net": "apache",
"github": "github actions",
"microsoft": "azure"
}

# Package aliases
Expand Down
19 changes: 15 additions & 4 deletions depscan/lib/normalize.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -137,6 +137,8 @@ def create_pkg_variations(pkg_dict):
vendor_aliases.add(v)
elif name == k:
vendor_aliases.add(v)
elif name.startswith(v):
vendor_aliases.add(k)
# This will add false positives to ubuntu
if "/" in name and os_distro and "ubuntu" not in os_distro:
name_aliases.add(name.split("/")[-1])
Expand All @@ -145,6 +147,13 @@ def create_pkg_variations(pkg_dict):
if not name.startswith("python-"):
name_aliases.add("python-" + name)
name_aliases.add("python-" + name + "_project")
# Eg: numpy:numpy
vendor_aliases.add(name)
# Issue #262
# Eg: cpe:2.3:a:microsoft:azure_storage_blobs:*:*:*:*:*:python:*:*
# pypi name is pkg:pypi/azure-storage-blob@12.8.0
if not name.endswith("s"):
name_aliases.add(name.replace("-", "_") + "s")
vendor_aliases.add("pip")
vendor_aliases.add("pypi")
vendor_aliases.add("python")
Expand Down Expand Up @@ -204,10 +213,12 @@ def create_pkg_variations(pkg_dict):
if "-bin" not in name:
name_aliases.add(name + "-bin")
else:
# Filter vendor aliases that are also name aliases
vendor_aliases = [
x for x in vendor_aliases if x not in name_aliases or x == vendor
]
# Filter vendor aliases that are also name aliases for non pypi packages
# This is needed for numpy which has the vendor name numpy
if not purl.startswith("pkg:pypi"):
vendor_aliases = [
x for x in vendor_aliases if x not in name_aliases or x == vendor
]
if len(vendor_aliases) > 1:
for vvar in list(vendor_aliases):
for nvar in list(name_aliases):
Expand Down
Loading