Support incomplete versions for a valid purl in search

Signed-off-by: Tushar Goel <[email protected]>

CHANGELOG.rst

@@ -2,6 +2,14 @@ Release notes
 =============
 
 
+Version v31.1.1
+----------------
+
+- We now support incomplete versions for a valid purl in search. For example,
+  you can now search for ``pkg:nginx/nginx@1`` and get all versions of nginx
+  starting with ``1``.
+
+
 Version v31.1.0
 ----------------
 

vulnerabilities/models.py

@@ -417,7 +417,9 @@ def search(self, query=None):
         try:
             # if it's a valid purl, use it as is
             purl = PackageURL.from_string(query)
-            return self.for_purl(purl, with_qualifiers_and_subpath=False)
+            if purl.qualifiers or purl.subpath:
+                return self.for_purl(purl, with_qualifiers_and_subpath=False)
+            return qs.filter(package_url__istartswith=query)
         except ValueError:
             return qs.filter(package_url__icontains=query)
 

vulnerabilities/tests/test_view.py

@@ -34,6 +34,7 @@ def setUp(self):
             "pkg:nginx/[email protected]",
             "pkg:nginx/[email protected]",
             "pkg:nginx/[email protected]",
+            "pkg:pypi/foo@1",
         ]
         self.packages = packages
         for package in packages:
@@ -63,6 +64,65 @@ def test_package_view_with_purl_fragment(self):
         self.assertEqual(len(pkgs), 1)
         self.assertEqual(pkgs[0].purl, "pkg:nginx/[email protected]")
 
+    def test_package_view_with_purl_fragment(self):
+        qs = PackageSearch().get_queryset(query="nginx/nginx")
+        pkgs = list(qs)
+        pkgs = [p.purl for p in pkgs]
+        assert pkgs == [
+            "pkg:nginx/[email protected]",
+            "pkg:nginx/[email protected]",
+            "pkg:nginx/[email protected]",
+            "pkg:nginx/[email protected]",
+            "pkg:nginx/[email protected]",
+            "pkg:nginx/[email protected]",
+            "pkg:nginx/[email protected]",
+            "pkg:nginx/[email protected]",
+            "pkg:nginx/[email protected]",
+            "pkg:nginx/[email protected]",
+            "pkg:nginx/[email protected]",
+            "pkg:nginx/[email protected]",
+            "pkg:nginx/[email protected]",
+        ]
+
+    def test_package_view_with_valid_purl_without_version(self):
+        qs = PackageSearch().get_queryset(query="pkg:nginx/nginx")
+        pkgs = list(qs)
+        pkgs = [p.purl for p in pkgs]
+        assert pkgs == [
+            "pkg:nginx/[email protected]",
+            "pkg:nginx/[email protected]",
+            "pkg:nginx/[email protected]",
+            "pkg:nginx/[email protected]",
+            "pkg:nginx/[email protected]",
+            "pkg:nginx/[email protected]",
+            "pkg:nginx/[email protected]",
+            "pkg:nginx/[email protected]",
+            "pkg:nginx/[email protected]",
+            "pkg:nginx/[email protected]",
+            "pkg:nginx/[email protected]",
+            "pkg:nginx/[email protected]",
+            "pkg:nginx/[email protected]",
+        ]
+
+    def test_package_view_with_valid_purl_and_incomplete_version(self):
+        qs = PackageSearch().get_queryset(query="pkg:nginx/nginx@1")
+        pkgs = list(qs)
+        pkgs = [p.purl for p in pkgs]
+        assert pkgs == [
+            "pkg:nginx/[email protected]",
+            "pkg:nginx/[email protected]",
+            "pkg:nginx/[email protected]",
+            "pkg:nginx/[email protected]",
+            "pkg:nginx/[email protected]",
+            "pkg:nginx/[email protected]",
+            "pkg:nginx/[email protected]",
+            "pkg:nginx/[email protected]",
+            "pkg:nginx/[email protected]",
+            "pkg:nginx/[email protected]",
+            "pkg:nginx/[email protected]",
+            "pkg:nginx/[email protected]",
+        ]
+
 
 class VulnerabilitySearchTestCase(TestCase):
     def setUp(self):