owasp-depscan 5.4.4__tar.gz → 5.4.6__tar.gz

{owasp_depscan-5.4.4/owasp_depscan.egg-info → owasp_depscan-5.4.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: owasp-depscan
-Version: 5.4.4
+Version: 5.4.6
 Summary: Fully open-source security audit for project dependencies based on known vulnerabilities and advisories.
 Author-email: Team AppThreat <cloud@appthreat.com>
 License: MIT

{owasp_depscan-5.4.4 → owasp_depscan-5.4.6}/depscan/lib/analysis.py

@@ -601,7 +601,7 @@ def prepare_vdr(options: PrepareVdrOptions):
             has_poc_count += 1
             if pkg_severity in ("CRITICAL", "HIGH"):
                 pkg_requires_attn = True
-        if clinks.get("vendor") and package_type not in config.OS_PKG_TYPES:
+        if (clinks.get("vendor") and package_type not in config.OS_PKG_TYPES) or reached_purls.get(purl):
             if reached_purls.get(purl):
                 # If it has a poc, an insight might have gotten added above
                 if not pkg_requires_attn:

{owasp_depscan-5.4.4 → owasp_depscan-5.4.6}/depscan/lib/normalize.py

@@ -101,18 +101,6 @@ def create_pkg_variations(pkg_dict):
         vendor_aliases.add(vendor)
         vendor_aliases.add(vendor.lower())
         vendor_aliases.add(vendor.lstrip("@"))
-        if (
-            vendor.startswith("org.")
-            or vendor.startswith("io.")
-            or vendor.startswith("com.")
-            or vendor.startswith("net.")
-        ):
-            tmpA = vendor.split(".")
-            # Automatically add short vendor forms
-            # Increase to 6 to reduce false positives when the package name is core
-            if len(tmpA) > 1 and len(tmpA[1]) > 6:
-                if tmpA[1] != name:
-                    vendor_aliases.add(tmpA[1])
     # Add some common vendor aliases
     if purl.startswith("pkg:golang") and not name.startswith("go"):
         vendor_aliases.add("go")
@@ -149,7 +137,8 @@ def create_pkg_variations(pkg_dict):
             # Issue #262
             # Eg: cpe:2.3:a:microsoft:azure_storage_blobs:*:*:*:*:*:python:*:*
             # pypi name is pkg:pypi/azure-storage-blob@12.8.0
-            if not name.endswith("s"):
+            # Issue #341 - do not change colorama to coloramas
+            if not name.endswith("s") and "-" in name:
                 name_aliases.add(name.replace("-", "_") + "s")
         vendor_aliases.add("pip")
         vendor_aliases.add("pypi")

{owasp_depscan-5.4.4 → owasp_depscan-5.4.6/owasp_depscan.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: owasp-depscan
-Version: 5.4.4
+Version: 5.4.6
 Summary: Fully open-source security audit for project dependencies based on known vulnerabilities and advisories.
 Author-email: Team AppThreat <cloud@appthreat.com>
 License: MIT

{owasp_depscan-5.4.4 → owasp_depscan-5.4.6}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "owasp-depscan"
-version = "5.4.4"
+version = "5.4.6"
 description = "Fully open-source security audit for project dependencies based on known vulnerabilities and advisories."
 authors = [
     {name = "Team AppThreat", email = "cloud@appthreat.com"},

{owasp_depscan-5.4.4 → owasp_depscan-5.4.6}/test/test_norm.py

@@ -21,7 +21,7 @@ def test_pkg_variations():
     pkg_list = create_pkg_variations(
         {"vendor": "org.eclipse.foo", "name": "bar", "version": "1.0.0"}
     )
-    assert len(pkg_list) > 1
+    assert len(pkg_list) == 1
     pkg_list = create_pkg_variations(
         {
             "vendor": "com.fasterxml.jackson.core",