Skip to content

Feat/implement findcpes cpe search#3937

Open
melbiialy wants to merge 2 commits intoeclipse-sw360:mainfrom
melbiialy:feat/implement-findcpes-cpe-search
Open

Feat/implement findcpes cpe search#3937
melbiialy wants to merge 2 commits intoeclipse-sw360:mainfrom
melbiialy:feat/implement-findcpes-cpe-search

Conversation

@melbiialy
Copy link
Contributor

Summary

Implements findCpes in the CveSearch Thrift service to search CPEs by vendor, product and version.

Changes

  • Thrift API: Implement findCpes(1: string vendor, 2: string product, 3: string version) in CveSearchService in cvesearch.thrift with Javadoc.
  • Implementation: Implement findCpes in CveSearchHandler that:
    • Calls CveSearchWrapper.search(vendor, product) to query the CVE Search API and obtain List<CveSearchData>.
    • Extracts CPE strings from CveSearchData.getVulnerable_configuration() (map keys).
    • Filters by version when provided; empty or "*" version returns all CPEs.
    • Parses CPE 2.3 format via getVersionFromCpe() (version at index 5).
  • Input handling:
    • Null or empty vendor/product returns an empty set.
    • Null version returns an empty set.
    • Trims vendor, product, and version; normalizes version to lowercase.
  • Error handling: Wraps IOException from the CVE Search API in TException with cause.
  • Documentation: Add Javadoc for findCpes and getVersionFromCpe, and Thrift docstring for the method.

Example usage

  • findCpes("apache", "httpd", "2.4") → Set of CPEs like cpe:2.3:a:apache:httpd:2.4:...
  • findCpes("apache", "httpd", "*") → Set of all Apache httpd CPEs
  • findCpes("apache", "httpd", "") → Set of all Apache httpd CPEs

Dependencies

No new dependencies.

Issue: #3936

Suggest Reviewer

@GMishx @deo002

…ersion

Implement findCpes in CveSearchHandler to query CVE Search API and return matching CPE strings. Filter by version when provided; empty or "*" version returns all CPEs. Handle null/empty inputs and wrap IOException in TException.

Signed-off-by: melbiialy <mahmoudelbialy109@gmail.com>
Signed-off-by: melbiialy <mahmoudelbialy109@gmail.com>
@GMishx GMishx added needs code review needs general test This is general testing, meaning that there is no org specific issue to check for labels Mar 23, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

needs code review needs general test This is general testing, meaning that there is no org specific issue to check for

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants