rubysec / ruby-advisory-db

A database of vulnerable Ruby Gems

Home Page:https://rubysec.com

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Normalize `~> X.Y.Z.W` versions into `>= X.Y.Z.W, < X+1.0.0` or `>= X.Y.Z.W, < X.Y+1.0`

postmodern opened this issue · comments

Normalize ~> X.Y.Z.W versions into >= X.Y.Z.W, < X+1.0.0 or >= X.Y.Z.W, < X.Y+1.0 so that it matches the full version family. ~> X.Y.Z.W will only match X.Y.Z.W, X.Y.Z.W+1, ..., X.Y.Z.W+n, but not X.Y.Z+1.

Upon closer inspection, many of the four-part version ranges are intentional and represent when a patch was backported to a previous version (ex: 1.2.3) and thus another number as appended to that version (ex: 1.1.2.3.1) instead of bumping the version to the next patch-number.