#1628: Support for OS specific CVEs by laert-ll · Pull Request #2370 · devonfw/IDEasy

laert-ll · 2026-08-25T07:19:11Z

This PR fixes #1628

Implemented changes:

security.json CVE model extended so that a single CVE can express affected version ranges that only apply on specific operating systems.

Added an optional conditions map to the Cve model.
CveJsonDeserializer / CveJsonSerializer read and write conditions. It is only written when present, so existing security.json files remain unchanged.
Cve.isAffected(version, os) combines the global versions with the current OS's conditional ranges; Cve.merge(...) also merges the per-OS conditions.
Added CHANGELOG entry.

Testing instructions

Run mvn clean test

Manual (single machine):

For a tool you can install, edit <IDE_ROOT>/urls/<tool>/<edition>/security.json (create if absent) and add a CVE whose global versions do NOT match the version you'll install, but whose conditions for your current OS (windows/linux/mac) do:
```
{ "issues": [ { "id": "CVE-TEST-OS", "severity": 9.0,
  "versions": ["(0,0.0.1)"], "conditions": { "linux": ["[<version>]"] } } ] }
```
Set _VERSION= in ide.properties and run ide install CVE-TEST-OS is reported (matched only via the OS condition).
Change the key to a different OS and re-run the CVE is no longer reported.

Checklist for this PR

Make sure everything is checked before merging this PR. For further info please also see
our DoD.

When running mvn clean test locally all tests pass and build is successful
PR title is of the form #«issue-id»: «brief summary» (e.g. #921: fixed setup.bat and not feature/921 fixed setup.bat). If no issue ID exists, title only.
PR top-level comment summaries what has been done and contains link to addressed issue(s)
PR and issue(s) have suitable labels
Issue is set to In Progress and assigned to you or there is no issue (might happen for very small PRs)
You followed all coding conventions
You have added the issue implemented by your PR in CHANGELOG.adoc unless issue is labelled
with internal
You have not changed any dependency in pom.xml files or otherwise if runtime dependencies changed, you have updated our LICENSE.asciidoc
You have formulated clear instructions on how to test your contribution under "Testing instructions"

coveralls · 2026-08-25T07:24:13Z

Coverage Report for CI Build 33722231185

Coverage increased (+0.07%) to 73.682%

Details

Coverage increased (+0.07%) from the base build.
Patch coverage: No coverable lines changed in this PR.
39 coverage regressions across 3 files.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

39 previously-covered lines in 3 files lost coverage.

File	Lines Losing Coverage	Coverage
com/devonfw/tools/ide/tool/ToolCommandlet.java	35	76.1%
com/devonfw/tools/ide/url/model/file/json/Cve.java	2	92.63%
com/devonfw/tools/ide/url/model/file/json/CveJsonDeserializer.java	2	88.64%

Coverage Stats


Relevant Lines:	18408
Covered Lines:	14177
Line Coverage:	77.02%
Relevant Branches:	8163
Covered Branches:	5401
Branch Coverage:	66.16%
Branches in Coverage %:	Yes
Coverage Strength:	3.29 hits per line

💛 - Coveralls

Ali-Shariati-Najafabadi

Pulled the branch and ran the full test suite locally plus checkstyle. Build is green and the core idea (isAffected/merge/JSON round-trip) works and is tested. Found one actual crash bug and a few smaller things worth looking at before merging, left inline.

hohwille

@laert-ll thanks for your PR. Great work, well done 👍
I actually had to read my own story again to do the review properly.
Only then I remembered why we had to do this so complicated instead of just having an os property with an array of OSes that the CVE applies to. But in reality a CVE can apply versions for all OS but other versions only for particular OS. With this more complex design we can represent all the states we need to express the reality that actually is complex.

I left some review comments which are all small constructive suggestions to make the code cleaner or nicer but nothing I found was wrong in any way.
IMHO we can apply all suggestions and then merge this PR.
Great that you already fixed the merge method so completing the story to also use this new feature in the security updater process is now very easy.

p.s.: You could have passed the SystemInfo instead of just OperatingSystem since then we do not have to refactor anything in the future if we might also need to support CVE versions that are even specific to the combination of OS + architecture. But since this is not needed for now, we can leave that as is and refactor only in case we ever run into such demand.

hohwille · 2026-09-03T16:46:32Z

+    if (this.conditions.isEmpty() && other.isEmpty()) {
+      return Map.of();
+    }


Wouldn't this make more sense here?

Suggested change

if (this.conditions.isEmpty() && other.isEmpty()) {

return Map.of();

}

if (this.conditions.isEmpty()) {

return other;

}

hohwille · 2026-09-03T16:48:29Z

+      List<VersionRange> newRanges = newConditions.computeIfAbsent(os, key -> new ArrayList<>());
+      ranges.forEach(range -> mergeVersionRage(newRanges, range));
+    });
+    return newConditions;


This Cve is a record and should stay immutable:

Suggested change

return newConditions;

return Map.copyOf(newConditions);

hohwille · 2026-09-03T16:49:34Z

+    Map<String, List<VersionRange>> newConditions = new TreeMap<>();
+    this.conditions.forEach((os, ranges) -> newConditions.put(os, new ArrayList<>(ranges)));


Can be simplified and made more efficient:

Suggested change

Map<String, List<VersionRange>> newConditions = new TreeMap<>();

this.conditions.forEach((os, ranges) -> newConditions.put(os, new ArrayList<>(ranges)));

Map<String, List<VersionRange>> newConditions = new TreeMap<>(this.conditions);

github-project-automation Bot added this to IDEasy board Aug 25, 2026

github-project-automation Bot moved this to 🆕 New in IDEasy board Aug 25, 2026

github-actions Bot assigned laert-ll Aug 25, 2026

laert-ll moved this from 🆕 New to 🏗 In progress in IDEasy board Aug 26, 2026

laert-ll force-pushed the feature/1628-support-for-os-specific-cves branch from c5309e2 to e394226 Compare August 27, 2026 08:20

laert-ll marked this pull request as ready for review August 27, 2026 08:22

laert-ll moved this from 🏗 In progress to Team Review in IDEasy board Aug 27, 2026

Ali-Shariati-Najafabadi self-assigned this Aug 27, 2026

laert-ll added enhancement New feature or request security CVEs or other vulnerabilities labels Aug 27, 2026

Ali-Shariati-Najafabadi suggested changes Aug 31, 2026

View reviewed changes

devonfw#1628: Initial implementation

832df30

laert-ll force-pushed the feature/1628-support-for-os-specific-cves branch from 1fbec9a to 832df30 Compare August 31, 2026 15:10

laert-ll added 4 commits September 3, 2026 07:57

devonfw#1628: Fix crash when CVE condition has no versions

b64ebf5

devonfw#1628: Fail on invalid conditions in security.json

aee1143

devonfw#1628: Add test for merging OS specific CVE conditions

4765aff

devonfw#1628: match os in security.json ignoring case

e926035

laert-ll moved this from Team Review to 👀 In review in IDEasy board Sep 3, 2026

hohwille approved these changes Sep 3, 2026

View reviewed changes

hohwille added this to the release:2026.09.002 milestone Sep 3, 2026

Navigation Menu

Uh oh!

#1628: Support for OS specific CVEs - #2370

#1628: Support for OS specific CVEs#2370
laert-ll wants to merge 5 commits into
devonfw:mainfrom
laert-ll:feature/1628-support-for-os-specific-cves

laert-ll commented Aug 25, 2026 •

edited

Loading

Uh oh!

coveralls commented Aug 25, 2026 •

edited

Loading

Uh oh!

Ali-Shariati-Najafabadi left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

hohwille left a comment

Uh oh!

hohwille Sep 3, 2026

Uh oh!

hohwille Sep 3, 2026

Uh oh!

hohwille Sep 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

		Map<String, List<VersionRange>> newConditions = new TreeMap<>();
		this.conditions.forEach((os, ranges) -> newConditions.put(os, new ArrayList<>(ranges)));

Uh oh!

Conversation

laert-ll commented Aug 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

This PR fixes #1628

Implemented changes:

Testing instructions

Checklist for this PR

Uh oh!

coveralls commented Aug 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Coverage Report for CI Build 33722231185

Coverage increased (+0.07%) to 73.682%

Details

Uncovered Changes

Coverage Regressions

Coverage Stats

💛 - Coveralls

Uh oh!

Ali-Shariati-Najafabadi left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

hohwille left a comment

Choose a reason for hiding this comment

Uh oh!

hohwille Sep 3, 2026

Choose a reason for hiding this comment

Uh oh!

hohwille Sep 3, 2026

Choose a reason for hiding this comment

Uh oh!

hohwille Sep 3, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

laert-ll commented Aug 25, 2026 •

edited

Loading

coveralls commented Aug 25, 2026 •

edited

Loading