From 2b526d90791da501c9870dd6d3993fcfa7d15249 Mon Sep 17 00:00:00 2001 From: Lee Chee Yang Date: Fri, 29 Jan 2021 11:51:15 +0800 Subject: cve_check: add CVE_VERSION_SUFFIX to indicate suffix in versioning add CVE_VERSION_SUFFIX to indicate the version suffix type, currently works in two value, "alphabetical" if the version string uses single alphabetical character suffix as incremental release, blank to not consider the unidentified suffixes. This can be expand when more suffix pattern identified. refactor cve_check.Version class to use functools and add parameter to handle suffix condition. Also update testcases to cover new changes. (From OE-Core rev: 37a40c30709bf80c74948f47361b2be2c646c9d8) Signed-off-by: Lee Chee Yang Signed-off-by: Richard Purdie (cherry picked from commit 5dfd5ad5144708b474ef31eaa89a846c57be8ac0) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie --- meta/classes/cve-check.bbclass | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) (limited to 'meta/classes/cve-check.bbclass') diff --git a/meta/classes/cve-check.bbclass b/meta/classes/cve-check.bbclass index 93af667544..dbff852e18 100644 --- a/meta/classes/cve-check.bbclass +++ b/meta/classes/cve-check.bbclass @@ -50,6 +50,9 @@ CVE_CHECK_PN_WHITELIST ?= "" # CVE_CHECK_WHITELIST ?= "" +# set to "alphabetical" for version using single alphabetical character as increament release +CVE_VERSION_SUFFIX ??= "" + python cve_save_summary_handler () { import shutil import datetime @@ -207,6 +210,7 @@ def check_cves(d, patched_cves): pn = d.getVar("PN") real_pv = d.getVar("PV") + suffix = d.getVar("CVE_VERSION_SUFFIX") cves_unpatched = [] # CVE_PRODUCT can contain more than one product (eg. curl/libcurl) @@ -260,8 +264,8 @@ def check_cves(d, patched_cves): else: if operator_start: try: - vulnerable_start = (operator_start == '>=' and Version(pv) >= Version(version_start)) - vulnerable_start |= (operator_start == '>' and Version(pv) > Version(version_start)) + vulnerable_start = (operator_start == '>=' and Version(pv,suffix) >= Version(version_start,suffix)) + vulnerable_start |= (operator_start == '>' and Version(pv,suffix) > Version(version_start,suffix)) except: bb.warn("%s: Failed to compare %s %s %s for %s" % (product, pv, operator_start, version_start, cve)) @@ -271,8 +275,8 @@ def check_cves(d, patched_cves): if operator_end: try: - vulnerable_end = (operator_end == '<=' and Version(pv) <= Version(version_end) ) - vulnerable_end |= (operator_end == '<' and Version(pv) < Version(version_end) ) + vulnerable_end = (operator_end == '<=' and Version(pv,suffix) <= Version(version_end,suffix) ) + vulnerable_end |= (operator_end == '<' and Version(pv,suffix) < Version(version_end,suffix) ) except: bb.warn("%s: Failed to compare %s %s %s for %s" % (product, pv, operator_end, version_end, cve)) -- cgit v1.2.3-54-g00ecf