vulncheck
0b71453c48
Comments across the codebase credited one individual by role and, in places, described that person's own machines: which SQL Server versions a host ran, which devices were enrolled, what a particular dashboard showed, how many findings sat open on which server. In a public repository that reads as a profile of someone's unpatched estate. The observations are why the code looks the way it does, so they stay. Every CVE id, version, build number, count and date is preserved, as are the verbatim quotes that motivated specific sort and filter rules — only the attribution changes, to "field report", "observed", "a host". A local variable in tests/test_autodesk_year.py was renamed for the same reason; its value and every assertion around it are byte-identical. PROJECT_OVERVIEW.md additionally loses a subtitle naming the kind of organisation this was built for, and a support section pointing at an internal team, both replaced with neutral wording. Comments, docstrings and markdown prose only: 74 files, 200 lines, one-for-one swaps. detect_changes reports 104 touched symbols and zero affected execution flows, and all 55 test scripts pass. Nothing here needs re-testing.
63 lines
2.8 KiB
Python
63 lines
2.8 KiB
Python
"""version == bound: two meanings — run: python tests/test_inclusive_bound.py
|
|
|
|
A record whose `version` equals its upper bound reads differently depending on
|
|
which bound it is, and treating both the same produced false positives.
|
|
|
|
version == lessThan zero-width, impossible. Chrome emits it; NVD
|
|
reads it as an open floor, and rightly so — a
|
|
Chrome CVE fixed in 151.0.7922.72 does affect
|
|
150.x.
|
|
|
|
version == lessThanOrEqual inclusive, so the entry names ONE release line.
|
|
Node states CVE-2026-56846 as 24.18.0 and
|
|
22.23.1, and its description says "affects
|
|
Node.js 24.x and 22.x". Opening the floor made
|
|
"up to 24.18.0" swallow 22.23.2 — already
|
|
patched — and 20.x, never affected at all.
|
|
"""
|
|
import os
|
|
import sys
|
|
|
|
sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
|
|
|
|
from app.services.cvelistv5_scan_service import _affected, _ranges_from_affected
|
|
|
|
|
|
def _hits(aff, version):
|
|
return any(_affected(version, s, lt, lte)
|
|
for s, lt, lte in _ranges_from_affected(aff))
|
|
|
|
|
|
def demo():
|
|
# CVE-2026-56846 verbatim.
|
|
node = {"vendor": "nodejs", "product": "node", "defaultStatus": "unaffected",
|
|
"versions": [
|
|
{"version": "24.18.0", "lessThanOrEqual": "24.18.0",
|
|
"versionType": "semver", "status": "affected"},
|
|
{"version": "22.23.1", "lessThanOrEqual": "22.23.1",
|
|
"versionType": "semver", "status": "affected"}]}
|
|
assert _ranges_from_affected(node) == [("24", None, "24.18.0"),
|
|
("22", None, "22.23.1")]
|
|
assert _hits(node, "24.13.1") # the reported host — was a false negative
|
|
assert _hits(node, "24.18.0") # the bound itself, inclusive
|
|
assert not _hits(node, "24.18.1") # fixed
|
|
assert _hits(node, "22.20.0") # the other release line
|
|
assert not _hits(node, "22.23.2") # fixed there too — was a false positive
|
|
assert not _hits(node, "20.5.0") # never affected — was a false positive
|
|
|
|
# Chrome keeps its open floor: version == lessThan is a different case.
|
|
chrome = {"vendor": "Google", "product": "Chrome",
|
|
"versions": [{"version": "151.0.7922.72",
|
|
"lessThan": "151.0.7922.72",
|
|
"versionType": "custom", "status": "affected"}]}
|
|
assert _ranges_from_affected(chrome) == [(None, "151.0.7922.72", None)]
|
|
assert _hits(chrome, "150.0.7871.182") # older major still affected
|
|
assert _hits(chrome, "151.0.7922.71")
|
|
assert not _hits(chrome, "151.0.7922.72")
|
|
|
|
print("inclusive bound OK")
|
|
|
|
|
|
if __name__ == "__main__":
|
|
demo()
|