command installed: change audited module version range #62
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
When auditing installed modules with command "installed" the audited version range is "$version". This results in false positives for modules having advisories with an affected version range ">=$version_affected" assigned where $version < $version_affected. This commit changes the audited version range to "==$version".
guest20
reviewed
Sep 9, 2024
briandfoy
added
Priority: low
|
If there's a problem, it's probably going to be in CPAN::Audit::Query::advisories for, where I find the comment: But, I still don't understand the problem and could use an example of where it fails to figure out if it's working as designed (which might be different than expectations) or if there's something to fix. |
|
I try to illustrate my case. Suppose you have: Running
(This is actually equivalent to And yields 16 advisories: With the patch it is equivalent to:
And yields 14 advisories: Note this time the following advisories are missing: and I argue that the patched version is more useful and also more in line with what one would expect from a command named (As an aside: It turned out that it is not reflected by the advisory database that some CVEs have been addressed already in maintenance versions of perl v5.24.x.) |
|
Are you using the latest CPAN::Audit? Can you show the output of When I run This is not the same thing as There's a chance that with older data there was some error in the report that forms the basis of the database, and that this error was fixed. Can you also show me the output of |
briandfoy
added a commit
that referenced
this pull request
Sep 10, 2024
|
Took me a while to reach this guess: Are you using the still to be released When using Only by chance it seems the correct version for dist (Hope I am not too wrong here as this analysis happened in a hurry.) As per your request: |
briandfoy
added a commit
that referenced
this pull request
Sep 10, 2024
|
I added the t/cli/dist.t test for this check. It passes GitHub Actions and I've released 20240911.001_01 so CPAN Testers can check it. So far the tests have not seen the same reports that you note in this issue. |
briandfoy
added a commit
to briandfoy/cpan-security-advisory
that referenced
this pull request
Sep 10, 2024
briandfoy
added a commit
to briandfoy/cpan-security-advisory
that referenced
this pull request
Sep 10, 2024
briandfoy
added a commit
to briandfoy/cpan-security-advisory
that referenced
this pull request
Sep 10, 2024
briandfoy
added a commit
to briandfoy/cpan-security-advisory
that referenced
this pull request
Sep 10, 2024
|
Heh, you were right. I had a CPANSA::DB lying around in one version of perl that I was using to test this. And, there was a bug in I think we are seeing the same output here, although I also fixed up several of the perl reports too. There are a couple ways to go with the
|
briandfoy
added
Status: needs docs
|
Regarding the I would rather want to see the first option plus emitting an informational message when a plain |
As I am not a native English speaker this is unclear to me: Are you saying after fixing the CPANSA::DB issue you see CPANSA-perl-2023-47038 and CPANSA-perl-2023-47100 listed in the result of a |
|
One could also make a plain version as argument to the |
|
To me, it seems like saying "version 6.1 please" should just mean version 6.1. Version specs are "greater than or equal to" in dependency lists because defaulting to exact versions would make getting new versions of modules a whole lot more work |
|
I haven't forgotten about this issue. I think in general this is the right solution but I want to look at it carefully to make sure it works. Since I didn't write most of this code, I don't quite understand how all of it plays together. I also need to try it in a clean environment. |
|
A fix for this is in the latest trial release. I plan on releasing a new version next week. If you find anything weird in the trial, let me know: |
|
This is now released as 20241208.001. If you find anything odd, open a new issue please. |
This was referenced Jan 27, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
When auditing installed modules with command "installed" the audited version range is
$version. This results in false positives for modules having advisories with an affected version range>=$version_affectedassigned where$version < $version_affected.This commit changes the audited version range to
==$version.