Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix: update semver regular expression constraint to allow for 1.20rc1 cases no '-' #1434

Merged
merged 6 commits into from
Aug 15, 2023
Merged

fix: update semver regular expression constraint to allow for 1.20rc1 cases no '-' #1434

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
8ea308a
fix: update semver constraint to allow 1.20rc1 cases
spiffcs Aug 15, 2023
b9a48bd
test: add constraints for python and openssl cases
spiffcs Aug 15, 2023
78d7f3c
test: add failing openssl cases
spiffcs Aug 15, 2023
7d173b3
fix: update constraint to be more specific to suffix
spiffcs Aug 15, 2023
271a2c2
test: update test names
spiffcs Aug 15, 2023
9ccdf47
revert: revert test name field
spiffcs Aug 15, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion grype/version/fuzzy_constraint.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ import (
)

// derived from https://semver.org/, but additionally matches partial versions (e.g. "2.0")
var pseudoSemverPattern = regexp.MustCompile(`^(0|[1-9]\d*)(\.(0|[1-9]\d*))?(\.(0|[1-9]\d*))?(?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?$`)
var pseudoSemverPattern = regexp.MustCompile(`^(0|[1-9]\d*)(\.(0|[1-9]\d*))?(\.(0|[1-9]\d*))?(?:(-|alpha|beta|rc)((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?$`)

type fuzzyConstraint struct {
rawPhrase string
Expand Down
95 changes: 95 additions & 0 deletions grype/version/fuzzy_constraint_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -264,6 +264,84 @@ func TestFuzzyConstraintSatisfaction(t *testing.T) {
constraint: "> v1.5",
satisfied: true,
},
{
name: "rc candidates with no '-' can match semver pattern",
version: "1.20rc1",
constraint: " = 1.20.0-rc1",
satisfied: true,
},
{
name: "candidates ahead of alpha",
version: "3.11.0",
constraint: "> 3.11.0-alpha1",
satisfied: true,
},
{
name: "candidates ahead of beta",
version: "3.11.0",
constraint: "> 3.11.0-beta1",
satisfied: true,
},
{
name: "candidates ahead of same alpha versions",
version: "3.11.0-alpha5",
constraint: "> 3.11.0-alpha1",
satisfied: true,
},
{
name: "candidates are placed correctly between alpha and release",
version: "3.11.0-beta5",
constraint: "3.11.0 || = 3.11.0-alpha1",
satisfied: false,
},
{
name: "candidates with letter suffix are alphabetically greater than their versions",
version: "1.0.2a",
constraint: " < 1.0.2w",
satisfied: true,
},
{
name: "candidates with multiple letter suffix are alphabetically greater than their versions",
version: "1.0.2zg",
constraint: " < 1.0.2zh",
satisfied: true,
},
{
name: "candidates with pre suffix are sorted numerically",
version: "1.0.2pre1",
constraint: " < 1.0.2pre2",
satisfied: true,
},
{
name: "candidates with letter suffix and r0 are alphabetically greater than their versions",
version: "1.0.2k-r0",
constraint: " < 1.0.2l-r0",
satisfied: true,
},
{
name: "openssl version with letter suffix and r0 are alphabetically greater than their versions",
version: "1.0.2k-r0",
constraint: ">= 1.0.2",
satisfied: true,
},
{
name: "openssl versions with letter suffix and r0 are alphabetically greater than their versions and compared equally to other lettered versions",
version: "1.0.2k-r0",
constraint: ">= 1.0.2, < 1.0.2m",
satisfied: true,
},
{
name: "openssl pre2 is still considered less than release",
version: "1.1.1-pre2",
constraint: "> 1.1.1-pre1, < 1.1.1",
satisfied: true,
},
{
name: "major version releases are less than their subsequent patch releases with letter suffixes",
version: "1.1.1",
constraint: "> 1.1.1-a",
satisfied: true,
},
}

for _, test := range tests {
Expand All @@ -275,3 +353,20 @@ func TestFuzzyConstraintSatisfaction(t *testing.T) {
})
}
}

func TestPseudoSemverPattern(t *testing.T) {
tests := []struct {
name string
version string
valid bool
}{
{name: "rc candidates are valid semver", version: "1.2.3-rc1", valid: true},
{name: "rc candidates with no dash are valid semver", version: "1.2.3rc1", valid: true},
}

for _, test := range tests {
t.Run(test.name, func(t *testing.T) {
assert.Equal(t, test.valid, pseudoSemverPattern.MatchString(test.version))
})
}
}
6 changes: 6 additions & 0 deletions grype/version/semantic_constraint_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -70,6 +70,12 @@ func TestVersionSemantic(t *testing.T) {
{version: "1.0.0-beta.11", constraint: "< 1.0.0-rc.1", satisfied: true},
{version: "1.0.0-rc.1", constraint: "> 1.0.0", satisfied: false},
{version: "1.0.0-rc.1", constraint: "< 1.0.0", satisfied: true},
{version: "1.20rc1", constraint: " = 1.20.0-rc1", satisfied: true},
{version: "1.21rc2", constraint: " = 1.21.1", satisfied: false},
{version: "1.21rc2", constraint: " = 1.21", satisfied: false},
{version: "1.21rc2", constraint: " = 1.21-rc2", satisfied: true},
{version: "1.21rc2", constraint: " = 1.21.0-rc2", satisfied: true},
{version: "1.21rc2", constraint: " = 1.21.0rc2", satisfied: true},
{version: "1.0.0-alpha.1", constraint: "> 1.0.0-alpha.1", satisfied: false},
{version: "1.0.0-alpha.2", constraint: "> 1.0.0-alpha.1", satisfied: true},
{version: "1.2.0-beta", constraint: ">1.0, <2.0", satisfied: true},
Expand Down