Allow searching by CPE and provide CPE information

Cargo.toml

@@ -96,7 +96,8 @@ packageurl = "0.3.0"
 parking_lot = "0.12"
 peak_alloc = "0.2.0"
 pem = "3"
-petgraph = { version = "0.6.5", features = ["serde-1"] }
+percent-encoding = "2.3.1"
+petgraph = { version = "0.7.1", features = ["serde-1"] }
 prometheus = "0.13.3"
 quick-xml = "0.37.0"
 rand = "0.8.5"

common/Cargo.toml

@@ -23,6 +23,7 @@ log = { workspace = true }
 native-tls = { workspace = true }
 packageurl = { workspace = true }
 pem = { workspace = true }
+percent-encoding = { workspace = true }
 postgresql_embedded = { workspace = true, features = ["blocking", "tokio"] }
 regex = { workspace = true }
 reqwest = { workspace = true, features = ["native-tls"] }

common/src/cpe.rs

@@ -2,21 +2,82 @@ use cpe::{
     cpe::Cpe as _,
     uri::{OwnedUri, Uri},
 };
-use std::fmt::{Debug, Display, Formatter};
-use std::str::FromStr;
+use serde::{
+    de::{Error, Visitor},
+    Deserialize, Deserializer, Serialize, Serializer,
+};
+use std::{
+    borrow::Cow,
+    fmt::{Debug, Display, Formatter},
+    str::FromStr,
+};
+use utoipa::{
+    openapi::{KnownFormat, ObjectBuilder, RefOr, Schema, SchemaFormat, Type},
+    PartialSchema, ToSchema,
+};
 use uuid::Uuid;
 
 #[derive(Clone, Hash, Eq, PartialEq)]
 pub struct Cpe {
     uri: OwnedUri,
 }
 
+impl ToSchema for Cpe {
+    fn name() -> Cow<'static, str> {
+        "Cpe".into()
+    }
+}
+
+impl PartialSchema for Cpe {
+    fn schema() -> RefOr<Schema> {
+        ObjectBuilder::new()
+            .schema_type(Type::String)
+            .format(Some(SchemaFormat::KnownFormat(KnownFormat::Uri)))
+            .into()
+    }
+}
+
 impl Display for Cpe {
     fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
         Display::fmt(&self.uri, f)
     }
 }
 
+impl Serialize for Cpe {
+    fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
+    where
+        S: Serializer,
+    {
+        serializer.serialize_str(self.to_string().as_str())
+    }
+}
+
+impl<'de> Deserialize<'de> for Cpe {
+    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
+    where
+        D: Deserializer<'de>,
+    {
+        deserializer.deserialize_str(CpeVisitor)
+    }
+}
+
+struct CpeVisitor;
+
+impl Visitor<'_> for CpeVisitor {
+    type Value = Cpe;
+
+    fn expecting(&self, formatter: &mut Formatter) -> std::fmt::Result {
+        formatter.write_str("a CPE")
+    }
+
+    fn visit_str<E>(self, v: &str) -> Result<Self::Value, E>
+    where
+        E: Error,
+    {
+        v.try_into().map_err(Error::custom)
+    }
+}
+
 const NAMESPACE: Uuid = Uuid::from_bytes([
     0x1b, 0xf1, 0x2a, 0xd5, 0x0d, 0x67, 0x41, 0x18, 0xa1, 0x38, 0xb8, 0x9f, 0x19, 0x35, 0xe0, 0xa7,
 ]);
@@ -172,6 +233,22 @@ impl FromStr for Cpe {
     }
 }
 
+impl TryFrom<&str> for Cpe {
+    type Error = <OwnedUri as FromStr>::Err;
+    fn try_from(value: &str) -> Result<Self, Self::Error> {
+        Ok(Self {
+            uri: OwnedUri::from_str(value)?,
+        })
+    }
+}
+
+impl TryFrom<String> for Cpe {
+    type Error = <OwnedUri as FromStr>::Err;
+    fn try_from(value: String) -> Result<Self, Self::Error> {
+        value.as_str().try_into()
+    }
+}
+
 pub trait CpeCompare: cpe::cpe::Cpe {
     fn is_superset<O: CpeCompare>(&self, other: &O) -> bool {
         self.compare(other).superset()

common/src/purl.rs

@@ -1,4 +1,5 @@
 use packageurl::PackageUrl;
+use percent_encoding::{utf8_percent_encode, AsciiSet, CONTROLS};
 use serde::{
     de::{Error, Visitor},
     Deserialize, Deserializer, Serialize, Serializer,
@@ -115,6 +116,7 @@ impl FromStr for Purl {
             .map_err(PurlErr::Package)
     }
 }
+
 impl<'de> Deserialize<'de> for Purl {
     fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
     where
@@ -141,6 +143,35 @@ impl Visitor<'_> for PurlVisitor {
     }
 }
 
+const QUERY_ENCODE_SET: &AsciiSet = &CONTROLS
+    .add(b' ') // Space must be encoded as %20 or +.
+    .add(b'"') // Double quote
+    .add(b'#') // Fragment identifier
+    .add(b'<') // Less than
+    .add(b'>') // Greater than
+    .add(b'[') // Left square bracket
+    .add(b']') // Right square bracket
+    .add(b'{') // Left curly brace
+    .add(b'}') // Right curly brace
+    .add(b'|') // Pipe
+    .add(b'\\') // Backslash
+    .add(b'^') // Caret
+    .add(b'`') // Backtick
+    .add(b'~') // Tilde
+    .add(b'@') // At sign
+    .add(b'!') // Exclamation mark
+    .add(b'$') // Dollar sign
+    .add(b'&') // Ampersand
+    .add(b'\'') // Single quote
+    .add(b'(') // Left parenthesis
+    .add(b')') // Right parenthesis
+    .add(b'*') // Asterisk
+    .add(b'+') // Plus
+    .add(b',') // Comma
+    .add(b';') // Semicolon
+    .add(b'=') // Equals
+    .add(b'%'); // Percent itself.
+
 impl Display for Purl {
     fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
         let ns = if let Some(ns) = &self.namespace {
@@ -156,7 +187,7 @@ impl Display for Purl {
                 "?{}",
                 self.qualifiers
                     .iter()
-                    .map(|(k, v)| format!("{}={}", k, v))
+                    .map(|(k, v)| format!("{}={}", k, utf8_percent_encode(v, QUERY_ENCODE_SET)))
                     .collect::<Vec<_>>()
                     .join("&")
             )