xeol-io/xeol

Not finding EOL'ed version of nginx in container image

bisbell-ngc opened this issue · 0 comments

What happened:
Not finding EOL'ed versions of nginx in official container images

What you expected to happen:

How to reproduce it (as minimally and precisely as possible):
Scan nginx:1.23.3

Anything else we need to know?:
I was able to resolve the issue by updating the normalizeSemver() function in purl.go.
The package version for nginx is listed as: 1.23.3-1~bullseye

I can resolve by adding the following:

	// Handle packages with tilde (~) characters
	// Example: 1.23.3-1~bullseye
	tildeRe := regexp.MustCompile(`^(\d+\.\d+\.\d+)-\d+~\w+`)
	version = tildeRe.ReplaceAllString(version, "$1")

Side Note
Managing a list of regex's for all potential package version strings is likely to become really tedious.
Instead of hard coding all the regex's, perhaps expose this list in config.yaml as a way to append more patterns to the list in normalizeSemver().

match:
  packages:
    regex:
      - '^(\d+\.\d+\.\d+)p\d+'
      - '^(\d+\.\d+\.\d+)-\d+~\w+'

Environment:
Using container image noqcks/xeol:v0.9.10