normalize VULNERABLESOFTWARE table, make CPE matching case-insensitive

stohrendorf · stohrendorf · commit 5dcdd7f7ce7a · 2025-09-06T20:42:58.000+02:00
Signed-off-by: Steffen Ohrendorf &lt;steffen.ohrendorf@gmx.de&gt;
diff --git a/src/main/java/org/dependencytrack/model/VulnerableSoftware.java b/src/main/java/org/dependencytrack/model/VulnerableSoftware.java
@@ -262,23 +262,23 @@ public String getPart() {
     }
 
     public void setPart(String part) {
-        this.part = part;
+        this.part = part == null ? null : part.toLowerCase();
     }
 
     public String getVendor() {
         return vendor;
     }
 
     public void setVendor(String vendor) {
-        this.vendor = vendor;
+        this.vendor = vendor == null ? null : vendor.toLowerCase();
     }
 
     public String getProduct() {
         return product;
     }
 
     public void setProduct(String product) {
-        this.product = product;
+        this.product = product == null ? null : product.toLowerCase();
     }
 
     public String getVersion() {
diff --git a/src/main/java/org/dependencytrack/persistence/VulnerableSoftwareQueryManager.java b/src/main/java/org/dependencytrack/persistence/VulnerableSoftwareQueryManager.java
@@ -276,9 +276,9 @@ public List<VulnerableSoftware> getAllVulnerableSoftware(
         //   SELECT "ID" FROM "VULNERABLESOFTWARE" WHERE "PART" = 'foo' ...
 
         if (cpePart != null && cpeVendor != null && cpeProduct != null) {
-            final List<CpeFilterCondition> partConditions = buildCpeFilterConditions("\"PART\"", cpePart);
-            final List<CpeFilterCondition> vendorConditions = buildCpeFilterConditions("\"VENDOR\"", cpeVendor);
-            final List<CpeFilterCondition> productConditions = buildCpeFilterConditions("\"PRODUCT\"", cpeProduct);
+            final List<CpeFilterCondition> partConditions = buildCpeFilterConditions("\"PART\"", cpePart.toLowerCase());
+            final List<CpeFilterCondition> vendorConditions = buildCpeFilterConditions("\"VENDOR\"", cpeVendor.toLowerCase());
+            final List<CpeFilterCondition> productConditions = buildCpeFilterConditions("\"PRODUCT\"", cpeProduct.toLowerCase());
 
             for (final CpeFilterCondition partCondition : partConditions) {
                 for (final CpeFilterCondition vendorCondition : vendorConditions) {
diff --git a/src/main/java/org/dependencytrack/search/FuzzyVulnerableSoftwareSearchManager.java b/src/main/java/org/dependencytrack/search/FuzzyVulnerableSoftwareSearchManager.java
@@ -45,7 +45,6 @@
 import us.springett.parsers.cpe.values.Part;
 
 import java.io.IOException;
-
 import java.util.ArrayList;
 import java.util.Collections;
 import java.util.HashMap;
@@ -262,7 +261,7 @@ public static String getLuceneCpeRegexp(String cpeString) {
 
     private static String getComponentRegex(String component) {
         if (component != null) {
-            return component.replace("*", ".*");
+            return component.replace("*", ".*").toLowerCase();
         } else {
             return ".*";
         }
@@ -274,7 +273,7 @@ private static String escapeLuceneQuery(final String input) {
         } else if (input.equals(".*")) {
             return input;
         }
-        return QueryParser.escape(input);
+        return QueryParser.escape(input.toLowerCase());
     }
 
 }
diff --git a/src/main/java/org/dependencytrack/search/VulnerableSoftwareIndexer.java b/src/main/java/org/dependencytrack/search/VulnerableSoftwareIndexer.java
@@ -126,8 +126,10 @@ private static List<VulnerableSoftwareDocument> fetchNext(final QueryManager qm,
     private Document convertToDocument(final VulnerableSoftwareDocument vs) {
         final var doc = new Document();
         addField(doc, IndexConstants.VULNERABLESOFTWARE_UUID, vs.uuid().toString(), Field.Store.YES, false);
-        addField(doc, IndexConstants.VULNERABLESOFTWARE_CPE_22, vs.cpe22(), Field.Store.YES, false);
-        addField(doc, IndexConstants.VULNERABLESOFTWARE_CPE_23, vs.cpe23(), Field.Store.YES, false);
+        final var cpe22 = vs.cpe22() != null ? vs.cpe22().toLowerCase() : null;
+        addField(doc, IndexConstants.VULNERABLESOFTWARE_CPE_22, cpe22, Field.Store.YES, false);
+        final var cpe23 = vs.cpe23() != null ? vs.cpe23().toLowerCase() : null;
+        addField(doc, IndexConstants.VULNERABLESOFTWARE_CPE_23, cpe23, Field.Store.YES, false);
         addField(doc, IndexConstants.VULNERABLESOFTWARE_VENDOR, vs.vendor(), Field.Store.YES, true);
         addField(doc, IndexConstants.VULNERABLESOFTWARE_PRODUCT, vs.product(), Field.Store.YES, true);
         addField(doc, IndexConstants.VULNERABLESOFTWARE_VERSION, vs.version(), Field.Store.YES, true);
diff --git a/src/main/java/org/dependencytrack/tasks/scanners/AbstractVulnerableSoftwareAnalysisTask.java b/src/main/java/org/dependencytrack/tasks/scanners/AbstractVulnerableSoftwareAnalysisTask.java
@@ -65,16 +65,20 @@ protected void analyzeVersionRange(final QueryManager qm, final List<VulnerableS
             }
         }
     }
+
+    private static String toLowerCaseNullable(final String string) {
+        return string == null ? null : string.toLowerCase();
+    }
     
     private Boolean maybeMatchCpe(final VulnerableSoftware vs, final Cpe targetCpe, final String targetVersion) {
         if (targetCpe == null || vs.getCpe23() == null) {
             return null;
         }
 
         final List<Relation> relations = List.of(
-                Cpe.compareAttribute(vs.getPart(), targetCpe.getPart().getAbbreviation()),
-                Cpe.compareAttribute(vs.getVendor(), targetCpe.getVendor()),
-                Cpe.compareAttribute(vs.getProduct(), targetCpe.getProduct()),
+                Cpe.compareAttribute(vs.getPart(), toLowerCaseNullable(targetCpe.getPart().getAbbreviation())),
+                Cpe.compareAttribute(vs.getVendor(), toLowerCaseNullable(targetCpe.getVendor())),
+                Cpe.compareAttribute(vs.getProduct(), toLowerCaseNullable(targetCpe.getProduct())),
                 Cpe.compareAttribute(vs.getVersion(), targetVersion),
                 Cpe.compareAttribute(vs.getUpdate(), targetCpe.getUpdate()),
                 Cpe.compareAttribute(vs.getEdition(), targetCpe.getEdition()),
diff --git a/src/main/java/org/dependencytrack/upgrade/UpgradeItems.java b/src/main/java/org/dependencytrack/upgrade/UpgradeItems.java
@@ -45,6 +45,7 @@ class UpgradeItems {
         UPGRADE_ITEMS.add(org.dependencytrack.upgrade.v4130.v4130Updater.class);
         UPGRADE_ITEMS.add(org.dependencytrack.upgrade.v4130.v4130_1Updater.class);
         UPGRADE_ITEMS.add(org.dependencytrack.upgrade.v4131.v4131Updater.class);
+        UPGRADE_ITEMS.add(org.dependencytrack.upgrade.v4135.v4135Updater.class);
     }
 
     static List<Class<? extends UpgradeItem>> getUpgradeItems() {
diff --git a/src/main/java/org/dependencytrack/upgrade/v4135/v4135Updater.java b/src/main/java/org/dependencytrack/upgrade/v4135/v4135Updater.java
@@ -0,0 +1,50 @@
+/*
+ * This file is part of Dependency-Track.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ * Copyright (c) OWASP Foundation. All Rights Reserved.
+ */
+package org.dependencytrack.upgrade.v4135;
+
+import alpine.common.logging.Logger;
+import alpine.persistence.AlpineQueryManager;
+import alpine.server.upgrade.AbstractUpgradeItem;
+
+import java.sql.Connection;
+import java.sql.SQLException;
+import java.sql.Statement;
+
+public class v4135Updater extends AbstractUpgradeItem {
+    private static final Logger LOGGER = Logger.getLogger(v4135Updater.class);
+
+    @Override
+    public String getSchemaVersion() {
+        return "4.13.5";
+    }
+
+    @Override
+    public void executeUpgrade(final AlpineQueryManager qm, final Connection connection) throws Exception {
+        normalizeCpeData(connection);
+    }
+
+    private void normalizeCpeData(final Connection connection) throws SQLException {
+        try (final Statement statement = connection.createStatement()) {
+            LOGGER.info("Normalizing \"VULNERABLESOFTWARE\" CPE columns");
+            statement.execute(/* language=SQL */ """
+                    UPDATE TABLE "VULNERABLESOFTWARE" SET "PART" = LOWER("PART"), "VENDOR" = LOWER("VENDOR"), "PRODUCT" = LOWER("PRODUCT")
+                    """);
+        }
+    }
+}
diff --git a/src/test/java/org/dependencytrack/search/FuzzyVulnerableSoftwareSearchManagerTest.java b/src/test/java/org/dependencytrack/search/FuzzyVulnerableSoftwareSearchManagerTest.java
@@ -101,7 +101,7 @@ void getLuceneCpeRegexp() throws CpeValidationException, CpeEncodingException {
         us.springett.parsers.cpe.Cpe os = new us.springett.parsers.cpe.Cpe( Part.OPERATING_SYSTEM, "vendor", "product", "1\\.0", "2", "33","en", "inside", "Vista", "x86", "other");
 
         Assertions.assertEquals("cpe23:/cpe\\:2\\.3\\:a\\:.*\\:.*\\:.*\\:.*\\:.*\\:.*\\:.*\\:.*\\:.*\\:.*/", FuzzyVulnerableSoftwareSearchManager.getLuceneCpeRegexp("cpe:2.3:a:*:*:*:*:*:*:*:*:*:*"));
-        Assertions.assertEquals("cpe23:/cpe\\:2\\.3\\:o\\:vendor\\:product\\:1.0\\:2\\:33\\:en\\:inside\\:Vista\\:x86\\:other/", FuzzyVulnerableSoftwareSearchManager.getLuceneCpeRegexp(os.toCpe23FS()));
+        Assertions.assertEquals("cpe23:/cpe\\:2\\.3\\:o\\:vendor\\:product\\:1.0\\:2\\:33\\:en\\:inside\\:vista\\:x86\\:other/", FuzzyVulnerableSoftwareSearchManager.getLuceneCpeRegexp(os.toCpe23FS()));
         Assertions.assertEquals("cpe22:/cpe\\:\\/o\\:vendor\\:product\\:1.0\\:2\\:33\\:en/", FuzzyVulnerableSoftwareSearchManager.getLuceneCpeRegexp(os.toCpe22Uri()));
     }
 
diff --git a/src/test/java/org/dependencytrack/tasks/scanners/InternalAnalysisTaskCpeMatchingTest.java b/src/test/java/org/dependencytrack/tasks/scanners/InternalAnalysisTaskCpeMatchingTest.java
@@ -353,7 +353,7 @@ public static Collection<Arguments> parameters() {
                 // Note:      CPEs with uppercase "part" are considered invalid by the cpe-parser library.
                 // TODO:      This should match, but can't currently support this as it would require an function index on UPPER("PART"),
                 //            UPPER("VENDOR"), and UPPER("PRODUCT"), which we cannot add through JDO annotations.
-                Arguments.of("cpe:2.3:o:lInUx:lInUx_KeRnEl:5.15.37:*:*:*:*:*:*:*", WITHOUT_RANGE, DOES_NOT_MATCH, "cpe:2.3:o:LiNuX:LiNuX_kErNeL:5.15.37:*:*:*:*:*:*:*"),
+                Arguments.of("cpe:2.3:o:lInUx:lInUx_KeRnEl:5.15.37:*:*:*:*:*:*:*", WITHOUT_RANGE, MATCHES, "cpe:2.3:o:LiNuX:LiNuX_kErNeL:5.15.37:*:*:*:*:*:*:*"),
                 // ---
                 // Issue:     https://github.com/DependencyTrack/dependency-track/issues/2988
                 // Scenario:  "other" attribute of source is NA, "other" attribute of target is ANY -> SUBSET.

Original file line number	Diff line number	Diff line change
`@@ -262,23 +262,23 @@ public String getPart() {`
`262`	`262`	`}`
`263`	`263`
`264`	`264`	`public void setPart(String part) {`
`265`		`- this.part = part;`
	`265`	`+ this.part = part == null ? null : part.toLowerCase();`
`266`	`266`	`}`
`267`	`267`
`268`	`268`	`public String getVendor() {`
`269`	`269`	`return vendor;`
`270`	`270`	`}`
`271`	`271`
`272`	`272`	`public void setVendor(String vendor) {`
`273`		`- this.vendor = vendor;`
	`273`	`+ this.vendor = vendor == null ? null : vendor.toLowerCase();`
`274`	`274`	`}`
`275`	`275`
`276`	`276`	`public String getProduct() {`
`277`	`277`	`return product;`
`278`	`278`	`}`
`279`	`279`
`280`	`280`	`public void setProduct(String product) {`
`281`		`- this.product = product;`
	`281`	`+ this.product = product == null ? null : product.toLowerCase();`
`282`	`282`	`}`
`283`	`283`
`284`	`284`	`public String getVersion() {`
Original file line number	Diff line number	Diff line change
`@@ -45,7 +45,6 @@`
`45`	`45`	`import us.springett.parsers.cpe.values.Part;`
`46`	`46`
`47`	`47`	`import java.io.IOException;`
`48`		`-`
`49`	`48`	`import java.util.ArrayList;`
`50`	`49`	`import java.util.Collections;`
`51`	`50`	`import java.util.HashMap;`
`@@ -262,7 +261,7 @@ public static String getLuceneCpeRegexp(String cpeString) {`
`262`	`261`
`263`	`262`	`private static String getComponentRegex(String component) {`
`264`	`263`	`if (component != null) {`
`265`		`- return component.replace("", ".");`
	`264`	`+ return component.replace("", ".").toLowerCase();`
`266`	`265`	`} else {`
`267`	`266`	`return ".*";`
`268`	`267`	`}`
`@@ -274,7 +273,7 @@ private static String escapeLuceneQuery(final String input) {`
`274`	`273`	`} else if (input.equals(".*")) {`
`275`	`274`	`return input;`
`276`	`275`	`}`
`277`		`- return QueryParser.escape(input);`
	`276`	`+ return QueryParser.escape(input.toLowerCase());`
`278`	`277`	`}`
`279`	`278`
`280`	`279`	`}`
Original file line number	Diff line number	Diff line change
`@@ -65,16 +65,20 @@ protected void analyzeVersionRange(final QueryManager qm, final List<VulnerableS`
`65`	`65`	`}`
`66`	`66`	`}`
`67`	`67`	`}`
	`68`	`+`
	`69`	`+ private static String toLowerCaseNullable(final String string) {`
	`70`	`+ return string == null ? null : string.toLowerCase();`
	`71`	`+ }`
`68`	`72`
`69`	`73`	`private Boolean maybeMatchCpe(final VulnerableSoftware vs, final Cpe targetCpe, final String targetVersion) {`
`70`	`74`	`if (targetCpe == null \|\| vs.getCpe23() == null) {`
`71`	`75`	`return null;`
`72`	`76`	`}`
`73`	`77`
`74`	`78`	`final List<Relation> relations = List.of(`
`75`		`- Cpe.compareAttribute(vs.getPart(), targetCpe.getPart().getAbbreviation()),`
`76`		`- Cpe.compareAttribute(vs.getVendor(), targetCpe.getVendor()),`
`77`		`- Cpe.compareAttribute(vs.getProduct(), targetCpe.getProduct()),`
	`79`	`+ Cpe.compareAttribute(vs.getPart(), toLowerCaseNullable(targetCpe.getPart().getAbbreviation())),`
	`80`	`+ Cpe.compareAttribute(vs.getVendor(), toLowerCaseNullable(targetCpe.getVendor())),`
	`81`	`+ Cpe.compareAttribute(vs.getProduct(), toLowerCaseNullable(targetCpe.getProduct())),`
`78`	`82`	`Cpe.compareAttribute(vs.getVersion(), targetVersion),`
`79`	`83`	`Cpe.compareAttribute(vs.getUpdate(), targetCpe.getUpdate()),`
`80`	`84`	`Cpe.compareAttribute(vs.getEdition(), targetCpe.getEdition()),`
Original file line number	Diff line number	Diff line change
`@@ -45,6 +45,7 @@ class UpgradeItems {`
`45`	`45`	`UPGRADE_ITEMS.add(org.dependencytrack.upgrade.v4130.v4130Updater.class);`
`46`	`46`	`UPGRADE_ITEMS.add(org.dependencytrack.upgrade.v4130.v4130_1Updater.class);`
`47`	`47`	`UPGRADE_ITEMS.add(org.dependencytrack.upgrade.v4131.v4131Updater.class);`
	`48`	`+ UPGRADE_ITEMS.add(org.dependencytrack.upgrade.v4135.v4135Updater.class);`
`48`	`49`	`}`
`49`	`50`
`50`	`51`	`static List<Class<? extends UpgradeItem>> getUpgradeItems() {`
Original file line number	Diff line number	Diff line change
`@@ -101,7 +101,7 @@ void getLuceneCpeRegexp() throws CpeValidationException, CpeEncodingException {`
`101`	`101`	`us.springett.parsers.cpe.Cpe os = new us.springett.parsers.cpe.Cpe( Part.OPERATING_SYSTEM, "vendor", "product", "1\\.0", "2", "33","en", "inside", "Vista", "x86", "other");`
`102`	`102`
`103`	`103`	`Assertions.assertEquals("cpe23:/cpe\\:2\\.3\\:a\\:.\\:.\\:.\\:.\\:.\\:.\\:.\\:.\\:.\\:./", FuzzyVulnerableSoftwareSearchManager.getLuceneCpeRegexp("cpe:2.3:a::::::::::"));`
`104`		`- Assertions.assertEquals("cpe23:/cpe\\:2\\.3\\:o\\:vendor\\:product\\:1.0\\:2\\:33\\:en\\:inside\\:Vista\\:x86\\:other/", FuzzyVulnerableSoftwareSearchManager.getLuceneCpeRegexp(os.toCpe23FS()));`
	`104`	`+ Assertions.assertEquals("cpe23:/cpe\\:2\\.3\\:o\\:vendor\\:product\\:1.0\\:2\\:33\\:en\\:inside\\:vista\\:x86\\:other/", FuzzyVulnerableSoftwareSearchManager.getLuceneCpeRegexp(os.toCpe23FS()));`
`105`	`105`	`Assertions.assertEquals("cpe22:/cpe\\:\\/o\\:vendor\\:product\\:1.0\\:2\\:33\\:en/", FuzzyVulnerableSoftwareSearchManager.getLuceneCpeRegexp(os.toCpe22Uri()));`
`106`	`106`	`}`
`107`	`107`