Update semver_dialects gem to support wildcard range

Proposal

We originally planned on only using the < character in the advisory-exporter as discussed here, however, we ended up changing this to use the * character to represent empty fixed_version values, but we didn't update the semver_dialects gem to handle this, and instead added a conditional in the rails backend code to check for this scenario.

The purpose of this issue is to update the semver_dialects gem to return true whenever the affected range contains the * character, and remove the conditional from the rails backend.

Implementation Plan

  1. Update SemverDialects.os_pkg_version_sat? to check for the * character:

    diff --git a/lib/semver_dialects.rb b/lib/semver_dialects.rb
    index 6233f74..fada9a7 100644
    --- a/lib/semver_dialects.rb
    +++ b/lib/semver_dialects.rb
    @@ -63,8 +63,8 @@ module SemverDialects
    
         def self.os_pkg_version_sat?(typ, raw_ver, raw_constraint)
           if typ == 'deb'
    -        # we only support the less than operator, because that's the only one currently output
    -        # by the advisory exporter for operating system packages.
    +        return true if raw_constraint == '*'
    +
             raise SemverDialects::Error, 'malformed constraint' unless raw_constraint[0] == '<'
    
             v1 = DebVersion.new(raw_ver)
  2. Update the semver_dialects unit tests for the above change.

  3. Release a new version of the semver_dialects gem and update the rails Gemfile to use this new version.

  4. Remove the wildcard range check from the rails backend code:

    diff --git a/ee/lib/gitlab/vulnerability_scanning/container_scanning/affected_version_range_matcher.rb b/ee/lib/gitlab/vulnerability_scanning/container_scanning/affected_version_range_matcher.rb
    index e262d24ea618..7a24809fb496 100644
    --- a/ee/lib/gitlab/vulnerability_scanning/container_scanning/affected_version_range_matcher.rb
    +++ b/ee/lib/gitlab/vulnerability_scanning/container_scanning/affected_version_range_matcher.rb
    @@ -18,9 +18,6 @@ def affected?
               return false unless Feature.enabled?(:container_scanning_continuous_vulnerability_scans, type: :beta)
               return false unless distro_matches?
    
    -          # a wildcard range means that all versions are affected
    -          return true if range == '*'
    -
               SemverDialects::VersionChecker.version_sat?(purl_type, version, range)
             end   

/cc @thiagocsf @hacks4oats

Edited by Adam Cohen