Specify affected functions versions instead of "*"#2198
Conversation
When including information about affected functions in advisory metadata, I have used `"*"` in a few advisories when the bounds were no narrower than the bounds for the vulnerability. But specific are still needed or preferred in that situation. This replaces `"*"` in those advisories with more specific bounds. (For rustsec#2193, this has already been done in rustsec#2195.) See discussion in: rustsec#2193 (review)
|
Apparently that works fine with our current tooling, so I guess it's just a matter of format specification. We used to stick to explicitly specifying the inverse of affected versions, but now that I think of it, it's probably not a good way to do it and we should just change it to something simpler. Maybe allowing |
|
Is |
|
I'm not aware of any tools using this metadata currently. There has been some experimentation in osv-scanner, but with Rust not even having a stable, machine-readable function specification syntax, I don't think they ever deployed it. |
|
In that case, I think I don't really have an opinion on whether this PR should be merged. By the way, I did figure out what had led me to use |
|
I'll go ahead and close this, since based on the discussion, it seems like it would not necessarily be an improvement. If it turns out to be useful for me to reopen it or make a new PR along these lines, please let me know. |
2 participants
When including information about affected functions in advisory metadata, I have used
"*"in a few advisories when the bounds were no narrower than the bounds for the vulnerability. But specific are still needed or preferred in that situation, as discussed in #2193 (review).This replaces
"*"in those advisories with more specific bounds.(For #2193 itself, this has already been done in #2195.)