From 8bafaf59c95196997f667fe240a9dcf960866a1c Mon Sep 17 00:00:00 2001
From: Ranjan Mangla <ranjanmangla1@gmail.com>
Date: Fri, 26 Apr 2024 01:58:52 +0530
Subject: [PATCH] fix: improved cpe parsing in sbom code (#4082)

Signed-off-by: ranjanmangla1 <ranjanmangla1@gmail.com>
Co-authored-by: Terri Oda <terri.oda@intel.com>
---
 cve_bin_tool/sbom_manager/__init__.py | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/cve_bin_tool/sbom_manager/__init__.py b/cve_bin_tool/sbom_manager/__init__.py
index ca5935679a..f2249c9460 100644
--- a/cve_bin_tool/sbom_manager/__init__.py
+++ b/cve_bin_tool/sbom_manager/__init__.py
@@ -343,7 +343,8 @@ def decode_cpe22(self, cpe22) -> (str | None, str | None, str | None):
 
         """
 
-        cpe = cpe22.split(":")
+        # split on `:` only if it's not escaped
+        cpe = re.split(r"(?<!\\):", cpe22)
         vendor, product, version = cpe[2], cpe[3], cpe[4]
         # Return available data, convert empty fields to None
         return [vendor or None, product or None, version or None]
@@ -361,7 +362,8 @@ def decode_cpe23(self, cpe23) -> (str | None, str | None, str | None):
 
         """
 
-        cpe = cpe23.split(":")
+        # split on `:` only if it's not escaped
+        cpe = re.split(r"(?<!\\):", cpe23)
         vendor, product, version = cpe[3], cpe[4], cpe[5]
         # Return available data, convert empty fields to None
         return [vendor or None, product or None, version or None]