From 136e5f8a6eb04182304a13efe78cd59867216a2c Mon Sep 17 00:00:00 2001
From: Ian Littman <iansltx@gmail.com>
Date: Wed, 5 Feb 2025 17:07:34 -0600
Subject: [PATCH] Add CPE translation mapping for IntelliJ CE for Windows
 (#25971)

Won't solve the false positive issues due to version number mismatches,
but will fix the false negative where CE wasn't matching at all, and
this is a full fix for IJ CE installed via JetBrains Toolbox.

For #25662.

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

<!-- Note that API documentation changes are now addressed by the
product design team. -->

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#changes-files)
for more information.
- [x] Added/updated automated tests
- [x] A detailed QA plan exists on the associated ticket (if it isn't
there, work with the product group's QA engineer to add it)
- [x] Manual QA for all new/changed functionality
---
 changes/25662-ij-windows                         |  1 +
 server/vulnerabilities/nvd/cpe_test.go           |  9 +++++++++
 server/vulnerabilities/nvd/cpe_translations.json | 10 ++++++++++
 3 files changed, 20 insertions(+)
 create mode 100644 changes/25662-ij-windows

diff --git a/changes/25662-ij-windows b/changes/25662-ij-windows
new file mode 100644
index 0000000000..54c732efbe
--- /dev/null
+++ b/changes/25662-ij-windows
@@ -0,0 +1 @@
+* Resolved false negatives on vulnerabilities for IntelliJ IDEA Community Edition on Windows.
diff --git a/server/vulnerabilities/nvd/cpe_test.go b/server/vulnerabilities/nvd/cpe_test.go
index 380aa89c48..9b686d2575 100644
--- a/server/vulnerabilities/nvd/cpe_test.go
+++ b/server/vulnerabilities/nvd/cpe_test.go
@@ -1341,6 +1341,15 @@ func TestCPEFromSoftwareIntegration(t *testing.T) {
 			},
 			cpe: "cpe:2.3:a:jetbrains:goland:2022.3.99.123.456:*:*:*:*:macos:*:*",
 		},
+		{
+			software: fleet.Software{
+				Name:    "IntelliJ IDEA Community Edition 2022.3.2",
+				Source:  "programs",
+				Version: "223.8617.56",
+				Vendor:  "",
+			},
+			cpe: "cpe:2.3:a:jetbrains:intellij_idea:223.8617.56:*:*:*:*:windows:*:*",
+		},
 		{
 			software: fleet.Software{
 				Name:             "IntelliJ IDEA.app",
diff --git a/server/vulnerabilities/nvd/cpe_translations.json b/server/vulnerabilities/nvd/cpe_translations.json
index ee81548e5c..9bd18519d3 100644
--- a/server/vulnerabilities/nvd/cpe_translations.json
+++ b/server/vulnerabilities/nvd/cpe_translations.json
@@ -169,6 +169,16 @@
       "vendor": ["jetbrains"]
     }
   },
+  {
+    "software": {
+      "name": ["/^IntelliJ IDEA Community Edition/"],
+      "source": ["programs"]
+    },
+    "filter": {
+      "product": ["intellij_idea"],
+      "vendor": ["jetbrains"]
+    }
+  },
   {
     "software": {
       "bundle_identifier": ["/^com\\.jetbrains\\.pycharm/"],