mbox series

[0/4] cve: Fix escaping of CPE

Message ID 20260410-fix-cpe-escaping-v1-0-ed63c2477f46@bootlin.com
Headers show
Series cve: Fix escaping of CPE | expand

Message

Benjamin Robin April 10, 2026, 1:10 p.m. UTC 
This series tries to fix the regression introduced by commit
9dd9c0038907 ("cve_check: Escape special characters in CPE 2.3 strings")

CVE_PRODUCT was already escaped. Now it no longer needs to be escaped,
otherwise double escaping is realized.

Also add a patch in this series that try to handle the transition between
the previous behavior and the new one.

Signed-off-by: Benjamin Robin <benjamin.robin@bootlin.com>
---
Benjamin Robin (4):
      cve_check: Improve escaping of special characters in CPE 2.3
      cve_check: do not break old CVE_PRODUCT with escaped +
      gtk+: Remove escaping of the plus sign in `CVE_PRODUCT`
      webkitgtk: Remove escaping of the plus sign in `CVE_PRODUCT`

 meta/lib/oe/cve_check.py                     | 29 ++++++++++++++--------------
 meta/recipes-gnome/gtk+/gtk+3_3.24.51.bb     |  2 +-
 meta/recipes-sato/webkit/webkitgtk_2.50.6.bb |  2 +-
 3 files changed, 16 insertions(+), 17 deletions(-)
---
base-commit: 853baa702e3275fc8b4dc492a93d9a00c8cf5c0f
change-id: 20260410-fix-cpe-escaping-5bc9a67a8d13

Best regards,
--  
Benjamin Robin <benjamin.robin@bootlin.com>