From 6d2471d5e5307254fa08d4923f6e96c2c2743c03 Mon Sep 17 00:00:00 2001
From: Tim Lee <timlee@fleetdm.com>
Date: Thu, 13 Jun 2024 11:03:53 -0400
Subject: [PATCH] vscode false positivies (#19508)

#18733

Added a rule for the affected CVEs and made a change to the `IfIgnore`
func. Manually tested CVE removals with `/tools/nvd/nvdvuln`. Existing
test coverage ensures the rule doesn't cause false negatives on vscode
extensions.

- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://fleetdm.com/docs/contributing/committing-changes#changes-files)
for more information.
- [] Added/updated tests
- [X] Manual QA for all new/changed functionality
---
 changes/18733-vscode-false-pos                   |  1 +
 server/vulnerabilities/nvd/cpe_matching_rule.go  |  8 ++++++--
 server/vulnerabilities/nvd/cpe_matching_rules.go | 12 ++++++++++++
 tools/nvd/nvdvuln/nvdvuln.go                     |  8 ++++++++
 4 files changed, 27 insertions(+), 2 deletions(-)
 create mode 100644 changes/18733-vscode-false-pos

diff --git a/changes/18733-vscode-false-pos b/changes/18733-vscode-false-pos
new file mode 100644
index 0000000000..a4189b4c62
--- /dev/null
+++ b/changes/18733-vscode-false-pos
@@ -0,0 +1 @@
+removed vscode false positive vulnerabilities
\ No newline at end of file
diff --git a/server/vulnerabilities/nvd/cpe_matching_rule.go b/server/vulnerabilities/nvd/cpe_matching_rule.go
index 32b331d4f3..9bd8a9b751 100644
--- a/server/vulnerabilities/nvd/cpe_matching_rule.go
+++ b/server/vulnerabilities/nvd/cpe_matching_rule.go
@@ -42,6 +42,7 @@ type CPEMatchingRule struct {
 	// IgnoreAll will cause all CPEs to not match hence ignoring a CVE.
 	IgnoreAll bool
 	// IgnoreIf is a function that can determine if a CPE matching rule should be ignored or not.
+	// If IgnoreIf is set, CPESpecs will not be evaluated.
 	IgnoreIf func(cpeMeta *wfn.Attributes) bool
 }
 
@@ -55,8 +56,11 @@ func (rule CPEMatchingRule) CPEMatches(cpeMeta *wfn.Attributes) bool {
 		return false
 	}
 
-	if rule.IgnoreIf != nil && rule.IgnoreIf(cpeMeta) {
-		return false
+	if rule.IgnoreIf != nil {
+		if rule.IgnoreIf(cpeMeta) {
+			return false
+		}
+		return true
 	}
 
 	ver, err := semver.NewVersion(wfn.StripSlashes(cpeMeta.Version))
diff --git a/server/vulnerabilities/nvd/cpe_matching_rules.go b/server/vulnerabilities/nvd/cpe_matching_rules.go
index f745f97ec0..01fa401bb2 100644
--- a/server/vulnerabilities/nvd/cpe_matching_rules.go
+++ b/server/vulnerabilities/nvd/cpe_matching_rules.go
@@ -197,6 +197,18 @@ func GetKnownNVDBugRules() (CPEMatchingRules, error) {
 				return cpeMeta.TargetSW == "visual_studio_code"
 			},
 		},
+		// Issue #18733 incorrect CPEs that should be matching
+		// visual studio code extensions
+		CPEMatchingRule{
+			CVEs: map[string]struct{}{
+				"CVE-2021-28967": {},
+				"CVE-2020-1192":  {},
+				"CVE-2020-1171":  {},
+			},
+			IgnoreIf: func(cpeMeta *wfn.Attributes) bool {
+				return cpeMeta.Product == "visual_studio_code" && cpeMeta.TargetSW == wfn.Any
+			},
+		},
 	}
 
 	for i, rule := range rules {
diff --git a/tools/nvd/nvdvuln/nvdvuln.go b/tools/nvd/nvdvuln/nvdvuln.go
index b2f2f565da..5ba23209b7 100644
--- a/tools/nvd/nvdvuln/nvdvuln.go
+++ b/tools/nvd/nvdvuln/nvdvuln.go
@@ -184,6 +184,14 @@ func main() {
 		return nil
 	}
 
+	ds.ListOperatingSystemsForPlatformFunc = func(ctx context.Context, platform string) ([]fleet.OperatingSystem, error) {
+		return nil, nil
+	}
+
+	ds.DeleteOutOfDateOSVulnerabilitiesFunc = func(ctx context.Context, source fleet.VulnerabilitySource, duration time.Duration) error {
+		return nil
+	}
+
 	printf("Translating software to CPE...\n")
 	err := nvd.TranslateSoftwareToCPE(ctx, ds, *dbDir, logger)
 	if err != nil {