refactor(vuls2): drop the RPM-comparison fallback from CPE matching

vendorProductEligible mirrored go-cve-dictionary's match() by re-evaluating
a range with RPM-style comparison when the semver comparator could not parse
the query (e.g. juniper "21.4r3", safari "1.0.0b1"), reporting in-range hits
at VendorProductMatch. Empirically that fallback is neither necessary nor
sufficient:

- Not necessary: with a well-formed query the matcher already reaches every
  affected version at ExactVersionMatch. Normalising juniper's joined form to
  version=21.4 / update=r3 makes the same wildcard range ("< 22.2") evaluate
  as plain semver; detection is byte-identical with the fallback on or off
  (199 CVEs either way). The fallback only compensates for a malformed query
  representation, which is a detect-side normalizer's responsibility.

- Not sufficient: RPM comparison gives no consistent order for NVD's messy
  pre-release strings. "4.0_beta" > "4.0" but "4beta" < "4.0" (the same
  "4 beta" ordered oppositely by NVD spelling), and "1.0.0b1" > "1.0.0". It
  only lands correct when the leading version digits already dominate; near a
  boundary it mis-orders. Vendors like safari, whose NVD version formats are
  inconsistent, cannot be served by any version-comparison heuristic here.

The fallback only ever produced the retired RoughVersionMatch tier (folded
to VendorProductMatch), so removing it leaves ExactVersionMatch untouched;
it drops only the fuzzy in-range VP guesses for non-semver query versions.
Splitting such version strings belongs in a future detect-side query
normalizer (tractable for regular forms like juniper, a known gap for
irregular ones like safari).

Simplify vendorProductEligible to the version-less cases (query ANY/NA, or
criterion NA), delete rangeVendorProductEligible, and drop the now-unused
go-rpm-version and cpecriterion range/criterion imports.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: shino

detector/vuls2/export_test.go

@@ -9,9 +9,8 @@ var (
 	PrunePkgCriteria = prunePkgCriteria
 	Enrich           = enrich
 
-	WalkCPECriteria            = walkCPECriteria
-	RangeVendorProductEligible = rangeVendorProductEligible
-	MergeIntoScannedCves       = mergeIntoScannedCves
+	WalkCPECriteria      = walkCPECriteria
+	MergeIntoScannedCves = mergeIntoScannedCves
 )
 
 type Source source

detector/vuls2/vuls2.go

@@ -19,8 +19,6 @@ import (
 	dataTypes "github.com/MaineK00n/vuls-data-update/pkg/extract/types/data"
 	criteriaTypes "github.com/MaineK00n/vuls-data-update/pkg/extract/types/data/detection/condition/criteria"
 	criterionTypes "github.com/MaineK00n/vuls-data-update/pkg/extract/types/data/detection/condition/criteria/criterion"
-	ccTypes "github.com/MaineK00n/vuls-data-update/pkg/extract/types/data/detection/condition/criteria/criterion/cpecriterion"
-	ccRangeTypes "github.com/MaineK00n/vuls-data-update/pkg/extract/types/data/detection/condition/criteria/criterion/cpecriterion/range"
 	vcAffectedRangeTypes "github.com/MaineK00n/vuls-data-update/pkg/extract/types/data/detection/condition/criteria/criterion/versioncriterion/affected/range"
 	vcFixStatusTypes "github.com/MaineK00n/vuls-data-update/pkg/extract/types/data/detection/condition/criteria/criterion/versioncriterion/fixstatus"
 	vcPackageTypes "github.com/MaineK00n/vuls-data-update/pkg/extract/types/data/detection/condition/criteria/criterion/versioncriterion/package"
@@ -40,7 +38,6 @@ import (
 	"github.com/MaineK00n/vuls2/pkg/version"
 	"github.com/knqyf263/go-cpe/common"
 	"github.com/knqyf263/go-cpe/naming"
-	rpm "github.com/knqyf263/go-rpm-version"
 
 	"github.com/future-architect/vuls/config"
 	"github.com/future-architect/vuls/constant"
@@ -1000,7 +997,7 @@ func walkCPECriteria(ca criteriaTypes.FilteredCriteria, scanned scanTypes.ScanRe
 
 			var m []string
 			for i, qWFN := range qWFNs {
-				if pvpEqual(qWFN, cWFN) && vendorProductEligible(cn.Criterion.CPE, cWFN, qWFN) {
+				if pvpEqual(qWFN, cWFN) && vendorProductEligible(cWFN, qWFN) {
 					m = append(m, scanned.CPE[i])
 				}
 			}
@@ -1051,74 +1048,29 @@ func walkCPECriteria(ca criteriaTypes.FilteredCriteria, scanned scanTypes.ScanRe
 }
 
 // vendorProductEligible reports whether a scanned CPE that already matched a
-// criterion on part:vendor:product may be reported as VendorProductMatch. It
-// mirrors go-cve-dictionary's match() (db/db.go): VendorProductMatch is
-// reserved for "no version information" cases — a query without a concrete
-// version, or a criterion whose version is NA — and a range that cannot be
-// evaluated falls back to RPM-style comparison (with its documented
-// false-positive tolerance) rather than reporting unconditionally. A
-// comparison that confirms the query is OUTSIDE the range, or a concrete
-// criterion version differing from the query, is a definite miss and is not
-// reported at all.
-func vendorProductEligible(cr *ccTypes.Criterion, cWFN, qWFN common.WellFormedName) bool {
-	qv := qWFN.GetString(common.AttributeVersion)
-	switch qv {
+// criterion on part:vendor:product may be reported as VendorProductMatch even
+// though the criterion did not accept. Mirroring go-cve-dictionary's match(),
+// this is reserved for the "no version information to compare" cases: a query
+// without a concrete version (ANY/NA), or a criterion whose version is NA.
+//
+// A wildcard (ANY) or concrete criterion that did not accept is a genuine
+// version mismatch, not a vendor:product hit. go-cve-dictionary kept some of
+// those via a non-semver RPM-comparison fallback, but that fallback only
+// compensates for a malformed query representation rather than rescuing any
+// NVD-known affected version: given a correctly formed query the matcher
+// reaches every affected version at ExactVersionMatch on its own. The juniper
+// case is illustrative — a scan of "21.4r3" cannot be range-compared, but the
+// well-formed CPE (version "21.4", update "r3") evaluates "21.4 < 22.2" as
+// plain semver and matches at Exact. Splitting such joined version strings is
+// a detect-side query-normalizer responsibility, not the matcher's; the fuzzy
+// RPM fallback (which only ever produced the retired RoughVersionMatch tier)
+// is therefore omitted here.
+func vendorProductEligible(cWFN, qWFN common.WellFormedName) bool {
+	switch qWFN.GetString(common.AttributeVersion) {
 	case "ANY", "NA":
-		// Query carries no concrete version to compare.
-		return true
-	}
-
-	switch cv := cWFN.GetString(common.AttributeVersion); cv {
-	case "NA":
-		// Criterion explicitly says "no version" (e.g. junos:-).
 		return true
-	case "ANY":
-		// Wildcard criterion: judged by its Range below.
-	default:
-		// Concrete criterion version differing from the query (an equal one
-		// would have been accepted on the exact path) — definite miss.
-		return false
-	}
-
-	if cr.Range == nil {
-		// CPEMatches-only criterion (a no-narrowing one would have been
-		// accepted): the query is absent from the enumerated concrete
-		// forms — definite miss.
-		return false
-	}
-
-	// WFN attribute values are quoted (21\.4r3); compare on the raw form
-	// like go-cve-dictionary does.
-	return rangeVendorProductEligible(cr.Range, strings.ReplaceAll(qv, "\\", ""))
-}
-
-// rangeVendorProductEligible evaluates the range bounds against the query
-// version: a bound the comparator cannot evaluate (e.g. semver vs "21.4r3")
-// is re-tried with RPM-style comparison — go-cve-dictionary's matchRpmVer
-// fallback — and a bound that confirms out-of-range rejects the criterion.
-func rangeVendorProductEligible(r *ccRangeTypes.Range, qv string) bool {
-	bounds := []struct {
-		s      string
-		reject func(int) bool
-	}{
-		{r.GreaterEqual, func(n int) bool { return n > 0 }}, // need bound <= v
-		{r.GreaterThan, func(n int) bool { return n >= 0 }}, // need bound <  v
-		{r.LessEqual, func(n int) bool { return n < 0 }},    // need bound >= v
-		{r.LessThan, func(n int) bool { return n <= 0 }},    // need bound >  v
-	}
-	for _, b := range bounds {
-		if b.s == "" {
-			continue
-		}
-		n, err := r.Type.Compare(b.s, qv)
-		if err != nil {
-			n = rpm.NewVersion(b.s).Compare(rpm.NewVersion(qv))
-		}
-		if b.reject(n) {
-			return false
-		}
 	}
-	return true
+	return cWFN.GetString(common.AttributeVersion) == "NA"
 }
 
 // prunePkgCriteria drops unaffected branches from a FilteredCriteria tree.

detector/vuls2/vuls2_test.go

@@ -9683,12 +9683,14 @@ func Test_postConvert(t *testing.T) {
 			},
 		},
 		{
-			// The scanned version (21.4r3, the juniper joined form) cannot
-			// be compared by the range's semver comparator; mirroring
-			// go-cve-dictionary's matchRpmVer fallback, the bound is
-			// re-evaluated RPM-style (21.4r3 < 22.2 holds) and the CVE is
-			// reported at VendorProductMatch instead of disappearing.
-			name: "cpe vendor:product fallback, range incomparable -> rpm fallback",
+			// The scanned version (21.4r3, the juniper joined form) cannot be
+			// compared by the range's semver comparator and is not in the
+			// criterion's CPEMatches, so it is not detected — the RPM
+			// fallback (which only produced the retired RoughVersionMatch) is
+			// gone. A detect-side query normalizer that splits the joined form
+			// into version "21.4" / update "r3" is the intended fix; the
+			// well-formed query would match "21.4 < 22.2" at Exact instead.
+			name: "cpe non-semver query against a range -> not detected",
 			args: args{
 				scanned: scanTypes.ScanResult{
 					CPE: []string{
@@ -9759,29 +9761,7 @@ func Test_postConvert(t *testing.T) {
 					},
 				},
 			},
-			want: models.VulnInfos{
-				"CVE-2025-0005": {
-					CveID:       "CVE-2025-0005",
-					Confidences: models.Confidences{models.NvdVendorProductMatch},
-					CpeURIs:     []string{"cpe:/o:vendor:product:21.4r3"},
-					CveContents: models.CveContents{
-						models.Nvd: []models.CveContent{
-							{
-								Type:         models.Nvd,
-								CveID:        "CVE-2025-0005",
-								Title:        "title",
-								Summary:      "description",
-								SourceLink:   "https://nvd.nist.gov/vuln/detail/CVE-2025-0005",
-								Published:    time.Date(2025, 1, 1, 0, 0, 0, 0, time.UTC),
-								LastModified: time.Date(1000, time.January, 1, 0, 0, 0, 0, time.UTC),
-								Optional: map[string]string{
-									"vuls2-sources": "[{\"root_id\":\"CVE-2025-0005\",\"source_id\":\"nvd-api-cve\",\"segment\":{\"ecosystem\":\"cpe\"}}]",
-								},
-							},
-						},
-					},
-				},
-			},
+			want: models.VulnInfos{},
 		},
 	}
 	for _, tt := range tests {
@@ -10605,31 +10585,6 @@ func Test_walkCPECriteria(t *testing.T) {
 			},
 			wantVP: []string{"cpe:2.3:a:vendor:product:9.9.9:*:*:*:*:*:*:*"},
 		},
-		{
-			name: "no accept, range incomparable but RPM-in-range (junos 21.4r3 < 22.2) -> vendor:product",
-			args: args{
-				criteria: criteriaTypes.FilteredCriteria{
-					Operator: criteriaTypes.CriteriaOperatorTypeOR,
-					Criterions: []criterionTypes.FilteredCriterion{
-						{
-							Criterion: criterionTypes.Criterion{
-								Type: criterionTypes.CriterionTypeCPE,
-								CPE: new(ccTypes.Criterion{
-									Vulnerable: true,
-									CPE:        ccTypes.CPE("cpe:2.3:o:vendor:product:*:*:*:*:*:*:*:*"),
-									Range: new(ccRangeTypes.Range{
-										Type:     ccRangeTypes.RangeTypeSEMVER,
-										LessThan: "22.2",
-									}),
-								}),
-							},
-						},
-					},
-				},
-				scanned: []string{"cpe:2.3:o:vendor:product:21.4r3:*:*:*:*:*:*:*"},
-			},
-			wantVP: []string{"cpe:2.3:o:vendor:product:21.4r3:*:*:*:*:*:*:*"},
-		},
 		// --- definitive misses: report nothing ---
 		{
 			name: "no accept, concrete version mismatch -> nothing",
@@ -10676,7 +10631,13 @@ func Test_walkCPECriteria(t *testing.T) {
 			},
 		},
 		{
-			name: "no accept, range incomparable and RPM-out-of-range -> nothing",
+			// A non-semver query (the juniper joined form "21.4r3") cannot be
+			// range-compared, so it is a miss regardless of where the bound
+			// sits — no RPM-comparison fallback. The well-formed query
+			// (version "21.4", update "r3") would evaluate "21.4 < 22.2" as
+			// plain semver and match at Exact; splitting it is the detect-side
+			// query normalizer's job, not this matcher's.
+			name: "no accept, non-semver query against a range -> nothing",
 			args: args{
 				criteria: criteriaTypes.FilteredCriteria{
 					Operator: criteriaTypes.CriteriaOperatorTypeOR,
@@ -10689,7 +10650,7 @@ func Test_walkCPECriteria(t *testing.T) {
 									CPE:        ccTypes.CPE("cpe:2.3:o:vendor:product:*:*:*:*:*:*:*:*"),
 									Range: new(ccRangeTypes.Range{
 										Type:     ccRangeTypes.RangeTypeSEMVER,
-										LessThan: "21.0",
+										LessThan: "22.2",
 									}),
 								}),
 							},
@@ -10992,143 +10953,6 @@ func Test_walkCPECriteria(t *testing.T) {
 	}
 }
 
-// Test_rangeVendorProductEligible pins the bound-by-bound behaviour: a bound
-// the range's comparator can evaluate rejects on a confirmed out-of-range,
-// and an incomparable pair falls back to RPM-style comparison —
-// go-cve-dictionary's matchRpmVer fallback, false-positive tolerance
-// included.
-func Test_rangeVendorProductEligible(t *testing.T) {
-	type args struct {
-		r  ccRangeTypes.Range
-		qv string
-	}
-	tests := []struct {
-		name string
-		args args
-		want bool
-	}{
-		{
-			name: "lt: inside",
-			args: args{
-				r: ccRangeTypes.Range{
-					Type:     ccRangeTypes.RangeTypeSEMVER,
-					LessThan: "10.0",
-				},
-				qv: "9.9.9",
-			},
-			want: true,
-		},
-		{
-			name: "lt: outside",
-			args: args{
-				r: ccRangeTypes.Range{
-					Type:     ccRangeTypes.RangeTypeSEMVER,
-					LessThan: "5.0",
-				},
-				qv: "9.9.9",
-			},
-			want: false,
-		},
-		{
-			name: "le: boundary inside",
-			args: args{
-				r: ccRangeTypes.Range{
-					Type:      ccRangeTypes.RangeTypeSEMVER,
-					LessEqual: "9.9.9",
-				},
-				qv: "9.9.9",
-			},
-			want: true,
-		},
-		{
-			name: "lt: boundary outside",
-			args: args{
-				r: ccRangeTypes.Range{
-					Type:     ccRangeTypes.RangeTypeSEMVER,
-					LessThan: "9.9.9",
-				},
-				qv: "9.9.9",
-			},
-			want: false,
-		},
-		{
-			name: "ge: inside",
-			args: args{
-				r: ccRangeTypes.Range{
-					Type:         ccRangeTypes.RangeTypeSEMVER,
-					GreaterEqual: "9.9.9",
-				},
-				qv: "9.9.9",
-			},
-			want: true,
-		},
-		{
-			name: "gt: boundary outside",
-			args: args{
-				r: ccRangeTypes.Range{
-					Type:        ccRangeTypes.RangeTypeSEMVER,
-					GreaterThan: "9.9.9",
-				},
-				qv: "9.9.9",
-			},
-			want: false,
-		},
-		{
-			name: "ge+lt window: inside",
-			args: args{
-				r: ccRangeTypes.Range{
-					Type:         ccRangeTypes.RangeTypeSEMVER,
-					GreaterEqual: "5.0",
-					LessThan:     "10.0",
-				},
-				qv: "9.9.9",
-			},
-			want: true,
-		},
-		{
-			name: "ge+lt window: below",
-			args: args{
-				r: ccRangeTypes.Range{
-					Type:         ccRangeTypes.RangeTypeSEMVER,
-					GreaterEqual: "5.0",
-					LessThan:     "10.0",
-				},
-				qv: "1.0",
-			},
-			want: false,
-		},
-		{
-			name: "incomparable query, RPM fallback in-range (21.4r3 < 22.2)",
-			args: args{
-				r: ccRangeTypes.Range{
-					Type:     ccRangeTypes.RangeTypeSEMVER,
-					LessThan: "22.2",
-				},
-				qv: "21.4r3",
-			},
-			want: true,
-		},
-		{
-			name: "incomparable query, RPM fallback out-of-range (21.4r3 >= 21.0)",
-			args: args{
-				r: ccRangeTypes.Range{
-					Type:     ccRangeTypes.RangeTypeSEMVER,
-					LessThan: "21.0",
-				},
-				qv: "21.4r3",
-			},
-			want: false,
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			if got := vuls2.RangeVendorProductEligible(&tt.args.r, tt.args.qv); got != tt.want {
-				t.Errorf("rangeVendorProductEligible() = %v, want %v", got, tt.want)
-			}
-		})
-	}
-}
-
 func Test_enrich(t *testing.T) {
 	type args struct {
 		vim models.VulnInfos