mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-06-13 04:59:52 +00:00
Code Issues Projects Releases Wiki Activity

cve-check: allow comparison of Vendor as well as Product

Browse Source 
Some product names are too vague to be searched without also matching the
vendor, for example Flex could be the parser compiler we ship, or Adobe Flex, or
Apache Flex, or IBM Flex.

If entries in CVE_PRODUCT contain a colon then split it as vendor:product to improve the search.

Also don't use .format() to construct SQL as that can lead to security
issues. Instead, use ? placeholders and lets sqlite3 handle the escaping.

(From OE-Core rev: e6bf90009877d00243417898700d2320fd87b39c)

Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Ross Burton
2019-07-17 11:45:36 +01:00
committed by Richard Purdie
parent da620cc68b
commit a78725c81f
1 changed files with 8 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta/classes/cve-check.bbclass
+8 -4
View File
@@ -190,12 +190,16 @@ def check_cves(d, patched_cves):
import sqlite3
db_file = d.getVar("CVE_CHECK_DB_FILE")
conn = sqlite3.connect(db_file)
c = conn.cursor()
query = "SELECT * FROM PRODUCTS WHERE PRODUCT IS '{0}';"
for product in products:
for row in c.execute(query.format(product, pv)):
c = conn.cursor()
if ":" in product:
vendor, product = product.split(":", 1)
c.execute("SELECT * FROM PRODUCTS WHERE PRODUCT IS ? AND VENDOR IS ?", (product, vendor))
else:
c.execute("SELECT * FROM PRODUCTS WHERE PRODUCT IS ?", (product,))
for row in c:
cve = row[1]
version_start = row[4]
operator_start = row[5]