vulnfeeds: Add some more common phrases when extracting versions from CVE description

[westonsteimel]

Current logic is here

Here are a few I've seen from examining some of my recent manual triages:

• x.x.x up to and including x.x.x
• x.x.x and earlier
• x.x.x or older
• x.x.x and below
• up to and including x.x.x
• prior to x.x.x
• below x.x.x

[github-actions]

This issue has not had any activity for 60 days and will be automatically closed in two weeks

[andrewpollock]

osv.dev/vulnfeeds/cves/versions.go

Lines 725 to 783 in c5c3e96

	func extractVersionsFromDescription(validVersions []string, description string) ([]AffectedVersion, []string) {
	// Match:
	// - x.x.x before x.x.x
	// - x.x.x through x.x.x
	// - through x.x.x
	// - before x.x.x
	pattern := regexp.MustCompile(`(?i)([\w.+\-]+)?\s+(through|before)\s+(?:version\s+)?([\w.+\-]+)`)
	matches := pattern.FindAllStringSubmatch(description, -1)
	if matches == nil {
	return nil, []string{"Failed to parse versions from description"}
	}
	var notes []string
	var versions []AffectedVersion
	for _, match := range matches {
	// Trim periods that are part of sentences.
	introduced := processExtractedVersion(match[1])
	fixed := processExtractedVersion(match[3])
	lastaffected := ""
	if match[2] == "through" {
	// "Through" implies inclusive range, so the fixed version is the one that comes after.
	var err error
	fixed, err = nextVersion(validVersions, fixed)
	if err != nil {
	notes = append(notes, err.Error())
	// if that inference failed, we know this version was definitely still vulnerable.
	lastaffected = cleanVersion(match[3])
	notes = append(notes, fmt.Sprintf("Using %s as last_affected version instead", cleanVersion(match[3])))
	}
	}
	if introduced == "" && fixed == "" && lastaffected == "" {
	notes = append(notes, "Failed to match version range from description")
	continue
	}
	if introduced != "" && !hasVersion(validVersions, introduced) {
	notes = append(notes, fmt.Sprintf("Extracted introduced version %s is not a valid version", introduced))
	}
	if fixed != "" && !hasVersion(validVersions, fixed) {
	notes = append(notes, fmt.Sprintf("Extracted fixed version %s is not a valid version", fixed))
	}
	if lastaffected != "" && !hasVersion(validVersions, lastaffected) {
	notes = append(notes, fmt.Sprintf("Extracted last_affected version %s is not a valid version", lastaffected))
	}
	// Favour fixed over last_affected for schema compliance.
	if fixed != "" && lastaffected != "" {
	lastaffected = ""
	}
	versions = append(versions, AffectedVersion{
	Introduced: introduced,
	Fixed: fixed,
	LastAffected: lastaffected,
	})
	}
	return versions, notes
	}

[andrewpollock]

This regex might do the trick:

(?i)([\w.+\-]+)?\s+(through|before|up to and including|prior to|below|(?:(?:and|or)\s+(?:earlier|older|below)))\s+(?:version\s+)?([\w.+\-]+)

[github-actions]

This issue has not had any activity for 60 days and will be automatically closed in two weeks

See https://github.com/google/osv.dev/blob/master/CONTRIBUTING.md for how to contribute a PR if you're interested in helping out.