google/osv.dev

vulnfeeds: detect when version range has introduced > fixed

Open

#215 opened on Sep 1, 2021

View on GitHub
 (5 comments) (0 reactions) (0 assignees)Go (339 forks)auto 404
buggood first issuevulnfeeds

Repository metrics

Stars
 (2,810 stars)
PR merge metrics
 (PR metrics pending)

Description

For PyPI vulnfeeds, there are some cases of bad data in the form of:

introduced: 1.0
fixed: 1.0b4

Encoded like so, this means that everything after and including 1.0 is affeted (because 1.0b4 comes before 1.0). This should instead be something like

introduced: 1.0a0
fixed: 1.0b4

We need to detect these cases in the vulnfeeds tool.

Contributor guide

Research direction
Examine PyPI version parsing in vulnfeeds, locate where introduced and fixed are compared, and add a check to flag when introduced > fixed.
Tech stack
go
Domain
backend
Issue type
Bug
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
2
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-3 hours
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Mostly clear
Prerequisites
Git
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
65