Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[SDC-1140] - fix(vex): allow VEX matching when no subcomponents #124

Merged
merged 3 commits into from
Jul 15, 2024

Conversation

felipecruz91
Copy link
Contributor

Description

This PR refactors the VEX matching logic as I've identified the following bugs:

  • The product id was not being taken into account when matching the purl.
  • All CVEs under the same purl were being considered affected when there was a match as the CVE ID was not being taken into account.

Furthermore, I've extended the logic to allow VEX matching when no subcomponents.

See the unit tests for more details.

Related PRs

None

@felipecruz91 felipecruz91 requested a review from a team July 11, 2024 11:00
@felipecruz91 felipecruz91 requested a review from a team as a code owner July 11, 2024 11:00
@felipecruz91 felipecruz91 changed the title fix(vex): allow VEX matching when no subcomponents [SDC-1140] - fix(vex): allow VEX matching when no subcomponents Jul 11, 2024
@felipecruz91 felipecruz91 merged commit b1f233f into main Jul 15, 2024
2 checks passed
@felipecruz91 felipecruz91 deleted the vex-no-subcomponents branch July 15, 2024 13:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants