renovate/lib/util/vulnerability/utils.ts

import type { DatasourceName } from '../../datasource-list.generated.ts';

/**
 * Ecosystems/datasources that use Maven-style inclusive ranges for fixed versions: `[version,)`
 */
const mavenStyleFixedEcosystems = new Set<DatasourceName>(['maven', 'nuget']);

/**
 * Ecosystems/datasources that use Maven-style exclusive ranges for last-affected versions: `(version,)`
 */
const mavenStyleLastAffectedEcosystems = new Set<DatasourceName>(['maven']);

/**
 * Formats a fixed version as an allowed-version constraint appropriate for the ecosystem.
 *
 * @param fixedVersion - The first version that contains the fix
 * @param ecosystem - Ecosystem or datasource name (e.g., 'maven', 'npm', 'nuget'). Checked in a case-insensitive manner.
 */
export function getFixedVersionConstraint(
  fixedVersion: string,
  ecosystem: string,
): string {
  if (
    mavenStyleFixedEcosystems.has(ecosystem.toLowerCase() as DatasourceName)
  ) {
    return `[${fixedVersion},)`;
  }
  return `>= ${fixedVersion}`;
}

/**
 * Formats a last-affected version as an allowed-version constraint appropriate for the ecosystem.
 *
 * @param lastAffected - The last version known to be affected
 * @param ecosystem - Ecosystem or datasource name. Checked in a case-insensitive manner.
 */
export function getLastAffectedVersionConstraint(
  lastAffected: string,
  ecosystem: string,
): string {
  if (
    mavenStyleLastAffectedEcosystems.has(
      ecosystem.toLowerCase() as DatasourceName,
    )
  ) {
    return `(${lastAffected},)`;
  }
  return `> ${lastAffected}`;
}

const severityOrder: Record<string, number> = {
  LOW: 1,
  MEDIUM: 2,
  MODERATE: 2,
  HIGH: 3,
  CRITICAL: 4,
  UNKNOWN: 5,
};

export function getHighestVulnerabilitySeverity<
  T extends Record<string, any>,
  TChild extends Record<string, any> | undefined,
>(parent: T, child: TChild): string {
  const parentVulSeverity = parent.vulnerabilitySeverity?.toUpperCase();
  const childVulSeverity = child?.vulnerabilitySeverity?.toUpperCase();

  if (childVulSeverity === undefined) {
    return parentVulSeverity;
  }

  if (parentVulSeverity === undefined) {
    return childVulSeverity;
  }

  return severityOrder[parentVulSeverity] >= severityOrder[childVulSeverity]
    ? parentVulSeverity
    : childVulSeverity;
}