kendjohnson / cpe-rs Goto Github PK

That way, instead of having a compile-time distinction between strict and permissive parsing, a consumer of this crate could be optionally permissive or strict based on runtime logic.

This library implements the CPE 2.2 spec, which was released in 2009. The CPE 2.3 spec was released in 2011: https://cpe.mitre.org/specification/. It would be great if the library defined types for parsing the 2.3 spec - namely for parsing formatted string binding such as cpe:2.3:a:gnu:bash:4.0:*:*:*:*:*:*:*. CPE 2.3 is backwards compatible with parsing WFN and URI in CPE 2.2 format.

When using the zero pad flag ({cpe:0}) not only the value, but also the : is being omitted.

Which might lead to fields being shifted. For example:

    #[test]
    fn test_zero() {
        use cpe::cpe::Cpe;

        let original = "cpe:/a:foo:bar:1.2::x";
        let parsed = OwnedUri::from_str(original).unwrap();

        let formatted = format!("{parsed:0}");
        let reparsed = OwnedUri::from_str(&formatted).unwrap();

        assert_eq!(parsed.part(), reparsed.part());
        assert_eq!(parsed.vendor(), reparsed.vendor());
        assert_eq!(parsed.product(), reparsed.product());
        assert_eq!(parsed.version(), reparsed.version());
        assert_eq!(parsed.update(), reparsed.update());
        assert_eq!(parsed.edition(), reparsed.edition());
    }

The test will fail for:

assert_eq!(parsed.update(), reparsed.update());

With:

assertion `left == right` failed
  left: Any
 right: Value("x")

Left:  Any
Right: Value("x")

As the value shifted:

• Original: cpe:/a:foo:bar:1.2::x
• Formatted: cpe:/a:foo:bar:1.2:x

It looks to make like a CPE containing * or ANY fails to parse correctly.

* gets rejected, despite this being printed out with the "alternate" format.
ANY gets translated into Component::Value("ANY").
And `` (empty) gets translated into Component::Any. But fails for the `Language`.