mozilla/foundation-security-advisories

Distinctive difference between package name and version

Hritik14 opened this issue · 5 comments

Hi
I'm writing a package url for the packages in the advisories and I would need the names and versions of packages explicitly. Currently, it appears that the pattern follows package_name version and package_name is also allowed to have spaces.
Though there is no validation to make sure this pattern follows.

Something like the following should be fine:

pkg.split(" ")[-1].replace('.','').isdigit()

Sorry; what packages are you referring to? I'm afraid I don't fully understand what you're trying to do and what the problem is.

I would try to clarify.
Let's say we have the following yaml

announced: April 29, 2014
fixed_in:
- Firefox 29
- Firefox ESR 24.5
- Thunderbird 24.5
- Seamonkey 2.26
impact: High

Now, I need to take out the fixed_in packages in a (package name, version) tuple. So, I'll end up with something like

(Firefox, 29)
(Firefox ESR, 24.5)
(Thunderbird, 24.5)
(Seamonkey, 2.26)

I could create the above tuples using

name=" ".join(fixed_in.split(" ")[0:-1])
version=fixed_in.split(" ")[-1]

(name, version)

But here I'm assuming that a version must follow at the end of the package name and would be separated by space. It could be a right assumption but there doesn't exist any validation currently for me to be sure of it.
For example, if there is an entry

fixed_in:
- Firefox-29

then my current code would not be able to figure out the version from the name. I was hoping to have a validation to make sure the package name follows a certain pattern.

Please let me know if it makes sense.

We treat it as a free fork text field in our own validation schema.
Our generated code uses hardcoded Firefox or Firefox ESR suffixed by the version number. Similar for Firefox for iOS.

All other products are usually copy&paste and manual work - unless @tomrittervg has made local changes to his repo, which aren't on GitHub yet. :)

pmac commented

The website also expects it to be in the <product name> <version> format. The code for that is here:

https://github.com/mozilla/bedrock/blob/bd0f50a1c0a7455115cc2bf9eb3ae9027586a024/bedrock/security/models.py#L28-L30