owasp-depscan 5.2.15__py3-none-any.whl → 5.3.1__py3-none-any.whl

depscan/lib/analysis.py

@@ -225,6 +225,24 @@ def pkg_sub_tree(
     )
 
 
+def is_lang_sw_edition(package_issue):
+    """Check if the specified sw_edition belongs to any application package type"""
+    if package_issue and package_issue["affected_location"].get("cpe_uri"):
+        all_parts = CPE_FULL_REGEX.match(
+            package_issue["affected_location"].get("cpe_uri")
+        )
+        if not all_parts or all_parts.group("sw_edition") in ("*", "-"):
+            return True
+        if (
+            config.LANG_PKG_TYPES.get(all_parts.group("sw_edition"))
+            or all_parts.group("sw_edition")
+            in config.LANG_PKG_TYPES.values()
+        ):
+            return True
+        return False
+    return True
+
+
 def is_os_target_sw(package_issue):
     """
     Since we rely on NVD, we filter those target_sw that definitely belong to a language
@@ -235,9 +253,9 @@ def is_os_target_sw(package_issue):
         )
         if (
             all_parts
-            and all_parts.group("target_sw") != "*"
+            and all_parts.group("target_sw") not in ("*", "-")
             and (
-                all_parts.group("target_sw") in config.LANG_PKG_TYPES.keys()
+                config.LANG_PKG_TYPES.get(all_parts.group("target_sw"))
                 or all_parts.group("target_sw")
                 in config.LANG_PKG_TYPES.values()
             )
@@ -367,7 +385,7 @@ def prepare_vdr(options: PrepareVdrOptions):
             if options.project_type in config.OS_PKG_TYPES:
                 if vendor and (
                     vendor in config.LANG_PKG_TYPES.values()
-                    or vendor in config.LANG_PKG_TYPES.keys()
+                    or config.LANG_PKG_TYPES.get(vendor)
                 ):
                     fp_count += 1
                     continue
@@ -382,17 +400,21 @@ def prepare_vdr(options: PrepareVdrOptions):
                 version_used = purl_obj.get("version")
                 package_type = purl_obj.get("type")
                 qualifiers = purl_obj.get("qualifiers", {})
+                # Filter application CVEs from distros
+                if (config.LANG_PKG_TYPES.get(package_type) or package_type in config.LANG_PKG_TYPES.values()) and ((vendor and vendor in config.OS_PKG_TYPES) or not is_lang_sw_edition(package_issue)):
+                    fp_count += 1
+                    continue
                 if package_type in config.OS_PKG_TYPES:
                     # Bug #208 - do not report application CVEs
                     if vendor and (
                         vendor in config.LANG_PKG_TYPES.values()
-                        or vendor in config.LANG_PKG_TYPES.keys()
+                        or config.LANG_PKG_TYPES.get(vendor)
                     ):
                         fp_count += 1
                         continue
                     if package_type and (
                         package_type in config.LANG_PKG_TYPES.values()
-                        or package_type in config.LANG_PKG_TYPES.keys()
+                        or config.LANG_PKG_TYPES.get(package_type)
                     ):
                         fp_count += 1
                         continue
@@ -1224,6 +1246,7 @@ def analyse_pkg_risks(
         if risk_metrics.get("risk_score") and (
             risk_metrics.get("risk_score") > config.pkg_max_risk_score
             or risk_metrics.get("pkg_private_on_public_registry_risk")
+            or risk_metrics.get("pkg_deprecated_risk")
         ):
             risk_score = f"""{round(risk_metrics.get("risk_score"), 2)}"""
             data = [

depscan/lib/config.py

@@ -156,6 +156,7 @@ package_alias = {
     "Microsoft.IdentityModel.Clients.ActiveDirectory": "active_directory_authentication_library",
     "starkbank_ecdsa": "ecdsa-elixir",
     "php-pear": "pear-core-minimal",
+    "Selenium.WebDriver": "selenium"
 }
 
 # Default ignore list

depscan/lib/normalize.py

@@ -106,7 +106,8 @@ def create_pkg_variations(pkg_dict):
         ):
             tmpA = vendor.split(".")
             # Automatically add short vendor forms
-            if len(tmpA) > 1 and len(tmpA[1]) > 3:
+            # Increase to 6 to reduce false positives when the package name is core
+            if len(tmpA) > 1 and len(tmpA[1]) > 6:
                 if tmpA[1] != name:
                     vendor_aliases.add(tmpA[1])
     # Add some common vendor aliases
@@ -208,7 +209,8 @@ def create_pkg_variations(pkg_dict):
     else:
         # Filter vendor aliases that are also name aliases for non pypi packages
         # This is needed for numpy which has the vendor name numpy
-        if not purl.startswith("pkg:pypi"):
+        # Also needed for nuget. Eg: selenium:selenium
+        if not purl.startswith("pkg:pypi") and not purl.startswith("pkg:nuget"):
             vendor_aliases = [
                 x for x in vendor_aliases if x not in name_aliases or x == vendor
             ]

depscan/lib/pkg_query.py

@@ -319,6 +319,11 @@ def pypi_pkg_risk(pkg_metadata, is_private_pkg, scope):
     versions_dict = pkg_metadata.get("releases", {})
     versions = [ver[0] for k, ver in versions_dict.items() if ver]
     is_deprecated = info.get("yanked") and info.get("yanked_reason")
+    # Some packages like pypi:azure only mention deprecated in the description
+    # without yanking the package
+    pkg_description = info.get("description", "").lower()
+    if not is_deprecated and ("is deprecated" in pkg_description or "no longer maintained" in pkg_description):
+        is_deprecated = True
     latest_deprecated = False
     first_version = None
     latest_version = None

{owasp_depscan-5.2.15.dist-info → owasp_depscan-5.3.1.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: owasp-depscan
-Version: 5.2.15
+Version: 5.3.1
 Summary: Fully open-source security audit for project dependencies based on known vulnerabilities and advisories.
 Author-email: Team AppThreat <cloud@appthreat.com>
 License: MIT
@@ -20,7 +20,7 @@ Classifier: Topic :: Utilities
 Requires-Python: >=3.8
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: appthreat-vulnerability-db ==5.6.6
+Requires-Dist: appthreat-vulnerability-db ==5.6.7
 Requires-Dist: defusedxml
 Requires-Dist: oras ~=0.1.26
 Requires-Dist: PyYAML

{owasp_depscan-5.2.15.dist-info → owasp_depscan-5.3.1.dist-info}/RECORD

@@ -1,18 +1,18 @@
 depscan/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 depscan/cli.py,sha256=fS9CoM1mWNqavUqfGA40LMf_-9OQMzFIYvIle3O2TrA,38835
 depscan/lib/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-depscan/lib/analysis.py,sha256=w1d3GsefGXxosLqMr9SosdHhMin4EfeA1atE1M2PC9o,58157
+depscan/lib/analysis.py,sha256=Zlm_BhmassmosM0yYazXUXNflhSgsrVvNTQtAoVIChU,59180
 depscan/lib/audit.py,sha256=wpmIowFLaoFs0agZN3FUFxPumty5Gr6YRfcjXGsuNcI,1497
 depscan/lib/bom.py,sha256=AdwzWpgnxaq2CKngfiSC-6dKJMnSv0ZD0h6jj4vxW1w,16718
-depscan/lib/config.py,sha256=5up5ukTvTg1JhQmJD75i8iS3SZvB-QkSlJ-XChNwywk,14540
+depscan/lib/config.py,sha256=wYYQrpc7IR8uVVjTtcWOpxuszoC0Yq2m_H4JVibMF68,14577
 depscan/lib/csaf.py,sha256=j9J5E_22nm--MOKy-g-agVnqtlkD84K93AyzOxIh-Rs,81781
 depscan/lib/explainer.py,sha256=gSBNMxwyr1s_2v0GY-k3Ds5B92LMeCrqJF5P9nsW934,9966
 depscan/lib/github.py,sha256=h6e_12xLwspXJbt_7lW6vuHaqgJQgyFSRCLrfUndCH4,1697
 depscan/lib/license.py,sha256=y4-WZuD2MOunKaLd2EJGcSYP6s3Lp_dgssdzhcl9eEM,2332
 depscan/lib/logger.py,sha256=TZkxVN2a5g2g0nOlrIodJWaDhTFT6JLtR1vR4fPSMgs,1605
-depscan/lib/normalize.py,sha256=ymn4IaHouVWg1bdXYzoLhXDDSf7JIwg0Gay4D9JVVtM,12443
+depscan/lib/normalize.py,sha256=YyUUIbdZlSHzODW1c7daGOYuuR2lggiv_DlVOZWz7nI,12619
 depscan/lib/orasclient.py,sha256=l8Diieh0I2thTova4ozUkMblgyhRsttAkarnkRemsn0,4960
-depscan/lib/pkg_query.py,sha256=Hlf3LypsL7EF309HevcfhdjAOPDZbN1XRQOmjQpnxlI,20082
+depscan/lib/pkg_query.py,sha256=6_bsKSRA2kY5_2HAWV4izEm4qm97fxQeBojkRjX_bVk,20394
 depscan/lib/utils.py,sha256=saC5-ySoyZSgJzATi8gIJtMm3mE57Z1ZuQFV4gG_KN4,14763
 vendor/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 vendor/choosealicense.com/_data/fields.yml,sha256=ydNsITXFUuADzGPM-jcUcJnN0r_qSGgH51oV27nX3Qs,819
@@ -64,9 +64,9 @@ vendor/choosealicense.com/_licenses/vim.txt,sha256=d5GQjXB328L8EBkhKgxcjk344D3K7
 vendor/choosealicense.com/_licenses/wtfpl.txt,sha256=BxXeubkvQm32MDmlZsBcbzJzBpR5kWgw0JxSR9d7f3k,948
 vendor/choosealicense.com/_licenses/zlib.txt,sha256=e6dfCeLhxD3NCnIkY4cVIagRaWdRvencjNhHZ1APvpc,1678
 vendor/spdx/json/licenses.json,sha256=_Vz_aACEg-giVk08ZBQLqB5Z3AnSWZmdD9I22ID3QNs,275192
-owasp_depscan-5.2.15.dist-info/LICENSE,sha256=oQnCbnZtJ_NLDdOLc-rVY1D1N0RNWLHPpYXcc77xzSo,1073
-owasp_depscan-5.2.15.dist-info/METADATA,sha256=vPg4NCoybcsL3ZCiqDSzqv4xpMDB-xAttFZYflRQZj8,28092
-owasp_depscan-5.2.15.dist-info/WHEEL,sha256=GJ7t_kWBFywbagK5eo9IoUwLW6oyOeTKmQ-9iHFVNxQ,92
-owasp_depscan-5.2.15.dist-info/entry_points.txt,sha256=FxQKHFWZTfKU2eBxHPFRxwhSNexntYygYhquykS8zxA,69
-owasp_depscan-5.2.15.dist-info/top_level.txt,sha256=qbHOZvNU2dXANv946hMdP2vOi0ESQB5t2ZY5ktKtXvQ,15
-owasp_depscan-5.2.15.dist-info/RECORD,,
+owasp_depscan-5.3.1.dist-info/LICENSE,sha256=oQnCbnZtJ_NLDdOLc-rVY1D1N0RNWLHPpYXcc77xzSo,1073
+owasp_depscan-5.3.1.dist-info/METADATA,sha256=ZhH0ayPF_KnHB_jRhEPCA35EekpSp3VdV-Um209XdPc,28091
+owasp_depscan-5.3.1.dist-info/WHEEL,sha256=GJ7t_kWBFywbagK5eo9IoUwLW6oyOeTKmQ-9iHFVNxQ,92
+owasp_depscan-5.3.1.dist-info/entry_points.txt,sha256=FxQKHFWZTfKU2eBxHPFRxwhSNexntYygYhquykS8zxA,69
+owasp_depscan-5.3.1.dist-info/top_level.txt,sha256=qbHOZvNU2dXANv946hMdP2vOi0ESQB5t2ZY5ktKtXvQ,15
+owasp_depscan-5.3.1.dist-info/RECORD,,