Replicate false positive (#121)

* Replicate false positive

Signed-off-by: Prabhu Subramanian <prabhu@appthreat.com>

* Improved version comparison for pyyaml like strange version schemes

Signed-off-by: Prabhu Subramanian <prabhu@appthreat.com>

---------

Signed-off-by: Prabhu Subramanian <prabhu@appthreat.com>

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "appthreat-vulnerability-db"
-version = "5.6.4"
+version = "5.6.5"
 description = "AppThreat's vulnerability database and package search library with a built-in file based storage. OSV, CVE, GitHub, npm are the primary sources of vulnerabilities."
 authors = [
     {name = "Team AppThreat", email = "cloud@appthreat.com"},

test/test_utils.py

@@ -4,12 +4,12 @@
 def test_normalise():
     res = utils.normalise_num(100, 3)
     assert res == 100
-
     res = utils.normalise_num(100, 4)
     assert res == 1000
-
     res = utils.normalise_num(100, 2)
     assert res == 100
+    res = utils.normalise_num('5.4b1', 3)
+    assert res == 541
     assert utils.normalise_version_str("2.0.0", 3) == "2.0.0"
     assert utils.normalise_version_str("2.0.10", 4) == "2.0.10.0"
 
@@ -194,6 +194,18 @@ def test_version_parts_compare():
 
 
 def test_version_build_compare():
+    res = utils.version_compare("6.0.1", "3.01", "5.4b2", None, None)
+    assert not res
+    res = utils.version_compare("6.0.1", "5.4", "5.4b2", None, None)
+    assert not res
+    res = utils.version_compare("6.0.1", "5.4b1", "5.4b4", None, None)
+    assert not res
+    res = utils.version_compare("6.0.1", "2.11", "5.8b1", None, None)
+    assert not res
+    res = utils.version_compare("6.0.1", "2.11", "6.8b1", None, None)
+    assert res
+    res = utils.version_compare("6.0.1", "2.11", "6.8.0b1", None, None)
+    assert res
     res = utils.version_compare("1.2.0", "1.2.0-alpha", "1.2.0-beta")
     assert not res
     res = utils.version_compare("1.2.0", "1.1.0-alpha", "1.2.0-beta")

vdb/lib/utils.py

@@ -249,9 +249,8 @@ def normalise_num(version_num, normal_len):
     >>> normalise_num(100, 4)
     1000
     """
-    version_num = str(version_num).replace(".", "")
-    if "-" in version_num:
-        version_num = version_num.split("-")[0]
+    version_num = str(version_num)
+    version_num = re.sub(r"[^\d]+", "", version_num)
     if len(version_num) < normal_len:
         for i in range(len(version_num), normal_len):
             version_num = version_num + "0"
@@ -762,7 +761,6 @@ def version_compare(
     compare_ver_parts = str(compare_ver).split(".")
     min_version_parts = str(min_version).split(".")
     max_version_parts = str(max_version).split(".")
-
     for i in range(0, normal_len):
         if (
             not compare_ver_parts[i].isdigit()