fix: update jq checker

Update jq pattern to avoid false positives with the following strings: 0.2 jqPzsA Moreover, add a new pattern to detect jq 1.7.1 Signed-off-by: Fabrice Fontaine <fabrice.fontaine@orange.com>
ffontaine · Aug 29, 2024 · e54393e · e54393e
1 parent eb8da07
commit e54393e
Show file tree

Hide file tree

Showing 3 changed files with 12 additions and 2 deletions.
diff --git a/cve_bin_tool/checkers/jq.py b/cve_bin_tool/checkers/jq.py
@@ -17,5 +17,8 @@
 class JqChecker(Checker):
     CONTAINS_PATTERNS: list[str] = []
     FILENAME_PATTERNS: list[str] = []
-    VERSION_PATTERNS = [r"([0-9]+\.[0-9]+)[a-zA-Z0-9:\-\r\n]*jq"]
+    VERSION_PATTERNS = [
+        r"jq-([0-9]+\.[0-9]+\.[0-9]+)",
+        r"([0-9]+\.[0-9]+(\.[0-9]+)?)[a-zA-Z0-9:\-\r\n]*jq[ :]",
+    ]
     VENDOR_PRODUCT = [("jq_project", "jq"), ("jqlang", "jq")]
diff --git a/test/condensed-downloads/jq_1.7.1-3_arm64.deb.tar.gz b/test/condensed-downloads/jq_1.7.1-3_arm64.deb.tar.gz
diff --git a/test/test_data/jq.py b/test/test_data/jq.py
@@ -2,7 +2,8 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 mapping_test_data = [
-    {"product": "jq", "version": "1.5", "version_strings": ["1.5\njq:"]}
+    {"product": "jq", "version": "1.5", "version_strings": ["1.5\njq:"]},
+    {"product": "jq", "version": "1.7.1", "version_strings": ["jq-1.7.1"]},
 ]
 package_test_data = [
     {
@@ -17,6 +18,12 @@
         "product": "jq",
         "version": "1.5",
     },
+    {
+        "url": "http://ftp.fr.debian.org/debian/pool/main/j/jq/",
+        "package_name": "jq_1.7.1-3_arm64.deb",
+        "product": "jq",
+        "version": "1.7.1",
+    },
     {
         "url": "https://downloads.openwrt.org/releases/packages-19.07/x86_64/packages/",
         "package_name": "jq_1.6-1_x86_64.ipk",