Skip to content

keywordExactMatch being injected in URL as "True" #68

@vladovarga

Description

@vladovarga

Hey there,

when using the keywordExactMatch attribute on the searchCPE method, the URL parameter is translated in the GET requested as "True" which is against what NIST NVD API expects.

Example:

nvdlib.searchCPE(
            keywordSearch="Jetbrains",
            keywordExactMatch=True,
            key="my_sexi_key",
            delay=0.6
        )

generates a URL as https://services.nvd.nist.gov/rest/json/cpes/2.0?keywordExactMatch=True&keywordSearch=Jetbrains

which is not how the keywordExactMatch should be used. It should stay empty (https://nvd.nist.gov/developers/products - Please note, this parameter should be provided without a parameter value.)

The culprit is here https://github.com/vehemont/nvdlib/blob/main/nvdlib/cpe.py#L188C47-L188C64

The code should look more like:

if keywordExactMatch:
        if keywordSearch is not None:
            parameters['keywordExactMatch'] = ""
        else:
            raise SyntaxError('keywordSearch parameter must be passed if keywordExactMatch is set to True.')

Metadata

Metadata

Assignees

Labels

No labels
No labels

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions