diff --git a/generators/GenerateMavenVersions.java b/generators/GenerateMavenVersions.java index 17cbed71..07ae6599 100644 --- a/generators/GenerateMavenVersions.java +++ b/generators/GenerateMavenVersions.java @@ -32,6 +32,46 @@ * */ public class GenerateMavenVersions { + /** + * An array of version comparisons that are known to be unsupported and so + * should be commented out in the generated fixture. + *

+ * Generally this is because the native implementation has a suspected bug + * that causes the comparison to return incorrect results, and so supporting + * such comparisons in the detector would in fact be wrong. + */ + private static final String[] UNSUPPORTED_COMPARISONS = { + "0.0.0-2021-07-06T00-28-13-573087f7 < 0.0.0-2021-07-06T01-14-42-efe42242", + "0.0.0-2021-12-06T00-08-57-89a33731 < 0.0.0-2021-12-06T01-21-56-e3888760", + "0.0.0-2022-02-01T00-45-53-0300684a < 0.0.0-2022-02-01T05-45-16-7258ece0", + "0.0.0-2022-02-28T00-18-39-7fe0d845 < 0.0.0-2022-02-28T04-15-47-83c97ebe", + "0.0.0-2022-04-29T00-08-11-7086a3ec < 0.0.0-2022-04-29T01-20-09-b424f986", + "0.0.0-2022-06-14T00-21-33-f21869a7 < 0.0.0-2022-06-14T02-56-29-1db980e0", + "0.0.0-2022-08-16T00-14-19-aeae3dc3 < 0.0.0-2022-08-16T10-34-26-7a56f709", + "0.0.0-2022-08-22T00-46-32-4652d3db < 0.0.0-2022-08-22T06-46-40-e7409ac5", + "0.0.0-2022-10-31T00-42-12-322ba6b9 < 0.0.0-2022-10-31T01-23-06-c6652489", + "0.0.0-2022-10-31T07-00-43-71eccd49 < 0.0.0-2022-10-31T07-05-43-97874976", + "0.0.0-2022-12-01T00-02-29-fe8d6705 < 0.0.0-2022-12-01T01-56-22-5b442198", + "0.0.0-2022-12-18T00-44-34-a222f475 < 0.0.0-2022-12-18T01-45-19-fec81751", + "0.0.0-2023-03-20T00-52-15-4b4c0e7 < 0.0.0-2023-03-20T01-49-44-80e3135" + }; + + public static boolean isUnsupportedComparison(String line) { + return Arrays.stream(UNSUPPORTED_COMPARISONS).anyMatch(line::equals); + } + + public static String uncomment(String line) { + if(line.startsWith("#")) { + return line.substring(1); + } + + if(line.startsWith("//")) { + return line.substring(2); + } + + return line; + } + public static String downloadMavenDb() throws IOException { URL website = new URL("https://osv-vulnerabilities.storage.googleapis.com/Maven/all.zip"); String file = "./maven-db.zip"; @@ -140,6 +180,12 @@ public static boolean compareVersions(List lines, String select) { line = line.trim(); if(line.isEmpty() || line.startsWith("#") || line.startsWith("//")) { + String maybeUnsupported = uncomment(line).trim(); + + if(isUnsupportedComparison(maybeUnsupported)) { + System.out.printf("\033[96mS\033[0m: \033[93m%s\033[0m\n", maybeUnsupported); + } + continue; } @@ -192,7 +238,13 @@ public static List generateVersionCompares(List versions) { String previousVersion = versions.get(i - 1); String op = compareVers(currentVersion, "=", previousVersion) ? "=" : "<"; - return String.format("%s %s %s", previousVersion, op, currentVersion); + String comparison = String.format("%s %s %s", previousVersion, op, currentVersion); + + if(isUnsupportedComparison(comparison)) { + comparison = "# " + comparison; + } + + return comparison; }).collect(Collectors.toList()); } diff --git a/generators/generate-debian-versions.py b/generators/generate-debian-versions.py index 13c28ca4..6d9a7115 100755 --- a/generators/generate-debian-versions.py +++ b/generators/generate-debian-versions.py @@ -8,7 +8,6 @@ import zipfile from pathlib import Path - # this requires being run on an OS that has a version of "dpkg" which supports the # "--compare-versions" option; also make sure to consider the version of dpkg being # used in case there are changes to the comparing logic (last run with 1.19.7). @@ -18,6 +17,27 @@ # the results of said subprocess calls; a typical no-cache run takes about 5+ # minutes whereas with the cache it only takes seconds. +# An array of version comparisons that are known to be unsupported and so +# should be commented out in the generated fixture. +# +# Generally this is because the native implementation has a suspected bug +# that causes the comparison to return incorrect results, and so supporting +# such comparisons in the detector would in fact be wrong. +UNSUPPORTED_COMPARISONS = [] + + +def is_unsupported_comparison(line): + return line in UNSUPPORTED_COMPARISONS + + +def uncomment(line): + if line.startswith("#"): + return line[1:] + if line.startswith("//"): + return line[2:] + return line + + def download_debian_db(): urllib.request.urlretrieve("https://osv-vulnerabilities.storage.googleapis.com/Debian/all.zip", "debian-db.zip") @@ -128,6 +148,10 @@ def compare_versions(lines, select="all"): line = line.strip() if line == "" or line.startswith('#') or line.startswith('//'): + maybe_unsupported = uncomment(line).strip() + + if is_unsupported_comparison(maybe_unsupported): + print(f"\033[96mS\033[0m: \033[93m{maybe_unsupported}\033[0m") continue v1, op, v2 = line.strip().split(" ") @@ -160,7 +184,12 @@ def generate_version_compares(versions): for i, version in enumerate(versions): if i == 0: continue - comparisons.append(f"{versions[i - 1]} < {version}\n") + + comparison = f"{versions[i - 1]} < {version}\n" + + if is_unsupported_comparison(comparison.strip()): + comparison = "# " + comparison + comparisons.append(comparison) return comparisons diff --git a/generators/generate-packagist-versions.php b/generators/generate-packagist-versions.php index cc7c827e..881d51d5 100644 --- a/generators/generate-packagist-versions.php +++ b/generators/generate-packagist-versions.php @@ -1,5 +1,35 @@ ] +UNSUPPORTED_COMPARISONS = [] + +# @param [String] line +# @return [Boolean] +def is_unsupported_comparison?(line) + UNSUPPORTED_COMPARISONS.include? line +end + +# @param [String] line +# @return [String] +def uncomment(line) + line.sub(/^#|\/\//, "") +end + def download_rubygems_db URI.open("https://osv-vulnerabilities.storage.googleapis.com/RubyGems/all.zip") do |zip| File.open("rubygems-db.zip", "wb") { |f| f.write(zip.read) } @@ -42,7 +64,13 @@ def compare_versions(lines, select = :all) lines.each do |line| line = line.strip - next if line.empty? || line.start_with?("#") || line.start_with?("//") + if line.empty? || line.start_with?("#") || line.start_with?("//") + maybe_unsupported = uncomment(line).strip + + puts "\033[96mS\033[0m: \033[93m#{maybe_unsupported}\033[0m" if is_unsupported_comparison?(maybe_unsupported) + + next + end parts = line.split(" ") v1 = parts[0] @@ -77,7 +105,10 @@ def generate_version_compares(versions) op = "<" op = "=" if versions[i - 1] == version - comparisons << "#{versions[i - 1]} #{op} #{version}" + comparison = "#{versions[i - 1]} #{op} #{version}" + comparison = "# #{comparison}" if is_unsupported_comparison?(comparison) + + comparisons << comparison end comparisons