From 0168880b2215a9474f929cd0c033b1f38d0d7334 Mon Sep 17 00:00:00 2001 From: mastersans Date: Sun, 7 Apr 2024 23:21:17 +0530 Subject: [PATCH 1/3] feat: purl generation for dart --- cve_bin_tool/parsers/dart.py | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/cve_bin_tool/parsers/dart.py b/cve_bin_tool/parsers/dart.py index 60fdcadae5..9272dbde95 100644 --- a/cve_bin_tool/parsers/dart.py +++ b/cve_bin_tool/parsers/dart.py @@ -1,6 +1,8 @@ # Copyright (C) 2024 Intel Corporation # SPDX-License-Identifier: GPL-3.0-or-later +import re + import yaml from cve_bin_tool.parsers import Parser @@ -15,6 +17,25 @@ class DartParser(Parser): def __init__(self, cve_db, logger): super().__init__(cve_db, logger) + self.purl_pkg_type = "pub" + + def generate_purl(self, product, version, vendor, qualifier={}, subpath=None): + """Generates PURL after normalizing all components.""" + # Normalize product, version, and vendor for Dart packages + product = re.sub(r"[^a-zA-Z0-9_]", "", product).lower() + version = re.sub(r"[^a-z0-9.+-]", "", version) + vendor = "UNKNOWN" # The vendor is not explicitly defined for pub packages + if not product or not version: + return None + purl = super().generate_purl( + product, + version, + vendor, + qualifier, + subpath, + ) + + return purl def run_checker(self, filename): """ From ddd547fd262bc223c674a5e0e59e27b92e90424e Mon Sep 17 00:00:00 2001 From: Terri Oda Date: Tue, 16 Apr 2024 09:26:40 -0700 Subject: [PATCH 2/3] docs: add reference links directly into code --- cve_bin_tool/parsers/dart.py | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/cve_bin_tool/parsers/dart.py b/cve_bin_tool/parsers/dart.py index 9272dbde95..18379c8cbd 100644 --- a/cve_bin_tool/parsers/dart.py +++ b/cve_bin_tool/parsers/dart.py @@ -20,7 +20,11 @@ def __init__(self, cve_db, logger): self.purl_pkg_type = "pub" def generate_purl(self, product, version, vendor, qualifier={}, subpath=None): - """Generates PURL after normalizing all components.""" + """ + Generates PURL after normalizing all components. + pubspec: https://dart.dev/tools/pub/pubspec#name + purl-spec for pub: https://github.com/package-url/purl-spec/blob/master/PURL-TYPES.rst#pub + """ # Normalize product, version, and vendor for Dart packages product = re.sub(r"[^a-zA-Z0-9_]", "", product).lower() version = re.sub(r"[^a-z0-9.+-]", "", version) From 1e1c3a48bf7557d2cc838afed99c8af5a07986e2 Mon Sep 17 00:00:00 2001 From: mastersans Date: Tue, 16 Apr 2024 23:11:09 +0530 Subject: [PATCH 3/3] fix: linter --- cve_bin_tool/parsers/dart.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/cve_bin_tool/parsers/dart.py b/cve_bin_tool/parsers/dart.py index 18379c8cbd..1903489113 100644 --- a/cve_bin_tool/parsers/dart.py +++ b/cve_bin_tool/parsers/dart.py @@ -23,7 +23,7 @@ def generate_purl(self, product, version, vendor, qualifier={}, subpath=None): """ Generates PURL after normalizing all components. pubspec: https://dart.dev/tools/pub/pubspec#name - purl-spec for pub: https://github.com/package-url/purl-spec/blob/master/PURL-TYPES.rst#pub + purl-spec for pub: https://github.com/package-url/purl-spec/blob/master/PURL-TYPES.rst#pub """ # Normalize product, version, and vendor for Dart packages product = re.sub(r"[^a-zA-Z0-9_]", "", product).lower()