Update semver_dialects gem to support wildcard range
Proposal
We originally planned on only using the < character in the advisory-exporter as discussed here, however, we ended up changing this to use the * character to represent empty fixed_version values, but we didn't update the semver_dialects gem to handle this, and instead added a conditional in the rails backend code to check for this scenario.
The purpose of this issue is to update the semver_dialects gem to return true whenever the affected range contains the * character, and remove the conditional from the rails backend.
Implementation Plan
-
Update SemverDialects.os_pkg_version_sat?to check for the*character:diff --git a/lib/semver_dialects.rb b/lib/semver_dialects.rb index 6233f74..fada9a7 100644 --- a/lib/semver_dialects.rb +++ b/lib/semver_dialects.rb @@ -63,8 +63,8 @@ module SemverDialects def self.os_pkg_version_sat?(typ, raw_ver, raw_constraint) if typ == 'deb' - # we only support the less than operator, because that's the only one currently output - # by the advisory exporter for operating system packages. + return true if raw_constraint == '*' + raise SemverDialects::Error, 'malformed constraint' unless raw_constraint[0] == '<' v1 = DebVersion.new(raw_ver) -
Update the semver_dialects unit tests for the above change. -
Release a new version of the semver_dialectsgem and update the rails Gemfile to use this new version. -
Remove the wildcard range check from the rails backend code: diff --git a/ee/lib/gitlab/vulnerability_scanning/container_scanning/affected_version_range_matcher.rb b/ee/lib/gitlab/vulnerability_scanning/container_scanning/affected_version_range_matcher.rb index e262d24ea618..7a24809fb496 100644 --- a/ee/lib/gitlab/vulnerability_scanning/container_scanning/affected_version_range_matcher.rb +++ b/ee/lib/gitlab/vulnerability_scanning/container_scanning/affected_version_range_matcher.rb @@ -18,9 +18,6 @@ def affected? return false unless Feature.enabled?(:container_scanning_continuous_vulnerability_scans, type: :beta) return false unless distro_matches? - # a wildcard range means that all versions are affected - return true if range == '*' - SemverDialects::VersionChecker.version_sat?(purl_type, version, range) end