VEX validation error for rocket about dep-scan HOT 2 CLOSED

@prabhu I think the version_used is None due to the parse_purl method in vdb.utils. In trying to replicate this issue, I am noticing that if the purl is used to set fields and it is malformed or incomplete, there is no default value to fall back on.

Under normal circumstances, a dictionary with a length of 6 is returned from parse_purl. In this example, the first attempt to set field values fails, and we parse the string again but only set namespace.

Example:

input purl string: 'pkg:swid/{AppUp.IntelGraphicsExperience_1.100.5185.0_x64__8j3eq9eme6ctt?ms-resource-//AppUp.IntelGraphicsExperience/Resources/System_Item_Title_IntelGraphicsControlPanel'

returns: {'namespace': 'Resources'} when it should also have entries for type, name, version, qualifiers, subpath.

result: The program subsequently errors out when name is assigned a value of None and we then try to call name.lower(). Since we wouldn't call lower() on version,, we can end up with None for versions in vex files as the program will not error out.

I'll make changes to set a default value of "" to avoid this eventuality, and see if there are any improvements I can make to on reparsing the data.

from dep-scan.

AppThreat/vulnerability-db#67

from dep-scan.