diff mbox series

[2/4] cve_check: do not break old CVE_PRODUCT with escaped +

Message ID 20260410-fix-cpe-escaping-v1-2-ed63c2477f46@bootlin.com
State Under Review
Headers show
Series cve: Fix escaping of CPE | expand

Commit Message

Benjamin Robin April 10, 2026, 1:10 p.m. UTC 
For now, until all layer are fixed, replace already escaped plus (+)
with a simple + before doing the escaping.

Signed-off-by: Benjamin Robin <benjamin.robin@bootlin.com>
---
 meta/lib/oe/cve_check.py | 3 +++
 1 file changed, 3 insertions(+)
diff mbox series

Patch

diff --git a/meta/lib/oe/cve_check.py b/meta/lib/oe/cve_check.py
index 22b5062c977c..e6104a279d5e 100644
--- a/meta/lib/oe/cve_check.py
+++ b/meta/lib/oe/cve_check.py
@@ -227,6 +227,9 @@  def cpe_escape(value):
     if not value:
         return value
 
+    # Do not break compatibility
+    value = value.replace("\\+", "+")
+
     return value.translate(_CPE23_ENCODE_TRANS_TABLE)