Merge branch 'main' into improve-test-nvd-api

Author: Saksham-Sirohi

.github/workflows/codeql-analysis.yml

@@ -51,7 +51,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@60168efe1c415ce0f5521ea06d5c2062adbeed1b # v3.28.17
+      uses: github/codeql-action/init@ff0a06e83cb2de871e5a09832bc6a81e7276941f # v3.28.18
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -76,4 +76,4 @@ jobs:
     #   make release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@60168efe1c415ce0f5521ea06d5c2062adbeed1b # v3.28.17
+      uses: github/codeql-action/analyze@ff0a06e83cb2de871e5a09832bc6a81e7276941f # v3.28.18

.github/workflows/dependency-review.yml

@@ -24,4 +24,4 @@ jobs:
       - name: 'Checkout Repository'
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - name: 'Dependency Review'
-        uses: actions/dependency-review-action@38ecb5b593bf0eb19e335c03f97670f792489a8b # v4.7.0
+        uses: actions/dependency-review-action@da24556b548a50705dd671f47852072ea4c105d9 # v4.7.1

.github/workflows/scorecard.yml

@@ -27,7 +27,7 @@ jobs:
           persist-credentials: false
 
       - name: "Run analysis"
-        uses: ossf/scorecard-action@f49aabe0b5af0936a0987cfb85d86b75731b0186 # v2.4.1
+        uses: ossf/scorecard-action@05b42c624433fc40578a4040d5cf5e36ddca8cde # v2.4.2
         with:
           results_file: results.sarif
           results_format: sarif

.github/workflows/spelling.yml

@@ -20,7 +20,7 @@ jobs:
         egress-policy: audit
 
     - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
-    - uses: check-spelling/[email protected].24
+    - uses: check-spelling/[email protected].25
       with:
         extra_dictionaries:
           cspell:python/src/python/python.txt

.github/workflows/testing.yml

@@ -285,7 +285,7 @@ jobs:
           --ignore=test/test_language_parser.py
       - name: Upload code coverage to codecov
         if: env.sbom != 'true'
-        uses: codecov/codecov-action@ad3126e916f78f00edff4ed0317cf185271ccc2d # v5.4.2
+        uses: codecov/codecov-action@18283e04ce6e62d37312384ff67231eb8fd56d24 # v5.4.3
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           files: coverage.xml
@@ -388,7 +388,7 @@ jobs:
           test/test_language_scanner.py
       - name: Upload code coverage to codecov
         if: env.sbom != 'true'
-        uses: codecov/codecov-action@ad3126e916f78f00edff4ed0317cf185271ccc2d # v5.4.2
+        uses: codecov/codecov-action@18283e04ce6e62d37312384ff67231eb8fd56d24 # v5.4.3
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           files: coverage.xml
@@ -491,7 +491,7 @@ jobs:
           test/test_scanner.py
       - name: Upload code coverage to codecov
         if: env.sbom != 'true'
-        uses: codecov/codecov-action@ad3126e916f78f00edff4ed0317cf185271ccc2d # v5.4.2
+        uses: codecov/codecov-action@18283e04ce6e62d37312384ff67231eb8fd56d24 # v5.4.3
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           files: coverage.xml
@@ -595,7 +595,7 @@ jobs:
           test/test_cvedb.py
       - name: Upload code coverage to codecov
         if: env.sbom != 'true'
-        uses: codecov/codecov-action@ad3126e916f78f00edff4ed0317cf185271ccc2d # v5.4.2
+        uses: codecov/codecov-action@18283e04ce6e62d37312384ff67231eb8fd56d24 # v5.4.3
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           files: coverage.xml
@@ -873,7 +873,7 @@ jobs:
           -o junit_family=legacy  
           --durations=50
       - name: Upload code coverage to codecov
-        uses: codecov/codecov-action@ad3126e916f78f00edff4ed0317cf185271ccc2d # v5.4.2
+        uses: codecov/codecov-action@18283e04ce6e62d37312384ff67231eb8fd56d24 # v5.4.3
         with:
           files: coverage.xml
           flags: windows_long_tests

cve_bin_tool/checkers/ffmpeg.py

@@ -28,7 +28,7 @@ class FfmpegChecker(Checker):
         r"ffmpeg",
     ]
     VERSION_PATTERNS = [
-        r"%s version ([0-9]+\.[0-9]+\.[0-9]+)[a-zA-Z0-9 \(\)%~\-\r\n]*(?:avutil|FFmpeg)",
-        r"FFmpeg version n?([0-9]+\.[0-9]+\.[0-9]+)",
+        r"%s version ([0-9]+\.[0-9]+(\.[0-9]+)?)[a-zA-Z0-9 \(\)%~\-\r\n]*(?:avutil|FFmpeg)",
+        r"FFmpeg version n?([0-9]+\.[0-9]+(\.[0-9]+)?)",
     ]
     VENDOR_PRODUCT = [("ffmpeg", "ffmpeg")]

cve_bin_tool/checkers/linuxptp.py

@@ -17,6 +17,6 @@ class LinuxptpChecker(Checker):
     CONTAINS_PATTERNS: list[str] = []
     FILENAME_PATTERNS: list[str] = []
     VERSION_PATTERNS = [
-        r"(?:ptp|PTP_)[A-Za-z0-9_:% \[\]\-\.\r\n]*\r?\n([0-9]\.[0-9])\r?\n"
+        r"[ \n]+(?:ptp|PTP_)[A-Za-z0-9_:% \[\]\-\.\r\n]*\r?\n([0-9]\.[0-9])\r?\n"
     ]
     VENDOR_PRODUCT = [("linuxptp_project", "linuxptp")]

cve_bin_tool/data_sources/nvd_source.py

@@ -420,7 +420,7 @@ async def fetch_cves(self):
             tasks = [
                 self.cache_update(self.session, url, meta["sha256"])
                 for url, meta in nvd_metadata.items()
-                if meta is not None
+                if meta is not None and meta.get("sha256") is not None
             ]
 
         total_tasks = len(tasks)
@@ -579,6 +579,9 @@ async def cache_update(
             # Raise for all other 4xx errors
             response.raise_for_status()
             gzip_data = await response.read()
+        if len(gzip_data) == 0:
+            self.LOGGER.debug(f"Missing data for {filename}")
+            return
         json_data = gzip.decompress(gzip_data)
         gotsha = hashlib.sha256(json_data).hexdigest().upper()
         async with FileIO(filepath, "wb") as filepath_handle:

cve_bin_tool/parsers/opkg.py

@@ -39,9 +39,10 @@ def run_checker(self, filename):
             if cpe_id is None:
                 self.logger.debug(f"{filename} doesn't contain any CPE-ID")
                 return
-            # version is always suffixed by a digit (e.g. 2.90-1 instead of 2.90)
+            # version is always suffixed (e.g. 2.90-r1 instead of 2.90)
+            # it can sometimes be prefixed (e.g. gen_2.90_v0.2.3-r1)
             version = search(
-                compile(r"^Version: (.+)-([0-9\.]+)$", MULTILINE), lines
+                compile(r"^Version: [a-z_]*([0-9_\-\.]+)[-_]+", MULTILINE), lines
             ).group(1)
             vendor, product, _ = decode_cpe22(f"{cpe_id.group(1)}:{version}")
             vendorlist: list[ScanInfo] = [

doc/MANUAL.md

@@ -870,7 +870,7 @@ To disable multiple data sources, the data sources should be specified as a comm
 
 ### -s SKIPS, --skips SKIPS
 
-This option allows one to skip (disable) a comma-separated list of checkers. This can be useful for improving the performance of the tool when you have some prior knowledge about what checkers may apply to the binary you are scanning.
+This option allows one to skip (disable) a comma-separated list of checkers and language parsers. This can be useful for improving the performance of the tool when you have some prior knowledge about what checkers may apply to the binary you are scanning or what language parsers are needed. The `--skips` flag works for both binary checkers and language parsers.
 
 ### -r CHECKERS, --runs CHECKERS