CPE fuzzy matching fails when strings contain valid escaped colons

[andrewjmaguire]

Current Behavior

I am using the docker-compose script to run a local latest Dependency
Track.

I am using CPAN Perl modules where their CPE string requires escaped
colons in some of the fields, e.g.

cpe:2.3:a:xml::libxml_project:xml::libxml:2.0134:::::perl::

But in Dependency track with all fuzzy CPE matching enabled, the
following error appears in the logs:

track-apiserver_1 |
org.apache.lucene.queryparser.classic.ParseException: Cannot parse
'product:xml::libxml~0.88 AND
cpe23:/cpe:2.3:a:.:.:.:.:.:.:.:.
:.:./': Encountered " ":" ": "" at line 1, column 11.

Proposed Behavior

Handle CPE strings that contain escaped characters especially escaped colons :

Perhaps a regexp is not the best thing to use for fuzzy matching
the parts of a CPE string?

Checklist

• I have read and understand the contributing guidelines
• I have checked the existing issues for whether this enhancement was already requested

[dipeshsingh253]

Hi @andrewjmaguire . I would love to contribute to this. Can you please assign it to me?

[msymons]

@dipeshsingh253, the issue is now assigned to you. Happy Hacktoberfest!

[dipeshsingh253]

Hi @andrewjmaguire , how can I reproduce this error locally?

[andrewjmaguire]

Create an SBOM, with the following cpe value:

"cpe" : "cpe:2.3:a:sys\:\:hostname_product:sys\:\:hostname:1.23:::::::*",