Ochrona can't parse version_value for tornado

[AdamWRichardson]

Describe the bug
When evaluation tornado the line to get the vuln_specifiers fails because the version value is "-". This raises an InvalidSpecifier error from the packaging module.

To Reproduce
Running orchrona tornado on version 2.0.2

Expected behavior
An error not to be raised and ochrona to detect potential vulnerabilities.

Background (please complete the following information):

• OS: WSL2 Ubuntu 22.04
• Python Version: 3.10.6
• Ochrona Version: 2.0.2
• Ochrona Arguments: tornado
• Debug output:

ochrona tornado --debug

,---.     |                        
|   |,---.|---.,---.,---.,---.,---.
|   ||    |   ||    |   ||   |,---|
`---'`---'`   '`    `---'`   '`---^
                           v. 2.0.2 
                           https://ochrona.dev   
                           
Processing 0 Files... ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━   0% -:--:--
(DEBUG) Discovered dependencies: 
--- tornado
(DEBUG) DB instance found: 2022.07.14
(DEBUG) Found 4 vulnerabilities potentially affecting package: tornado
Traceback (most recent call last):
 File "/home/arichardson/experiments/ochrona-cli/ochrona/eval/vuln/evaluate.py", line 64, in evaluate
   vuln_specifiers &= f"=={versions['version_value']}"
 File "/home/arichardson/experiments/ochrona-cli/.venv/lib/python3.10/site-packages/packaging/specifiers.py", line 778, in __and__
   other = SpecifierSet(other)
 File "/home/arichardson/experiments/ochrona-cli/.venv/lib/python3.10/site-packages/packaging/specifiers.py", line 700, in __init__
   parsed.add(Specifier(specifier))
 File "/home/arichardson/experiments/ochrona-cli/.venv/lib/python3.10/site-packages/packaging/specifiers.py", line 234, in __init__
   raise InvalidSpecifier(f"Invalid specifier: '{spec}'")
packaging.specifiers.InvalidSpecifier: Invalid specifier: '==-'

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
 File "/home/arichardson/experiments/ochrona-cli/.venv/bin/ochrona", line 33, in <module>
   sys.exit(load_entry_point('ochrona', 'console_scripts', 'ochrona')())
 File "/home/arichardson/experiments/ochrona-cli/.venv/lib/python3.10/site-packages/click/core.py", line 1130, in __call__
   return self.main(*args, **kwargs)
 File "/home/arichardson/experiments/ochrona-cli/.venv/lib/python3.10/site-packages/click/core.py", line 1055, in main
   rv = self.invoke(ctx)
 File "/home/arichardson/experiments/ochrona-cli/.venv/lib/python3.10/site-packages/click/core.py", line 1404, in invoke
   return ctx.invoke(self.callback, **ctx.params)
 File "/home/arichardson/experiments/ochrona-cli/.venv/lib/python3.10/site-packages/click/core.py", line 760, in invoke
   return __callback(*args, **kwargs)
 File "/home/arichardson/experiments/ochrona-cli/ochrona/cli/cli.py", line 177, in run
   results.append(resolve(**payload))
 File "/home/arichardson/experiments/ochrona-cli/ochrona/eval/eval.py", line 30, in resolve
   resp.confirmed_vulnerabilities = evaluate(vulns, resp.flat_list)
 File "/home/arichardson/experiments/ochrona-cli/ochrona/eval/vuln/evaluate.py", line 104, in evaluate
   raise Exception("evaluate exception") from ex
Exception: evaluate exception

[julianolf]

This issue also affects parso package.

We've tried different versions (0.8.3 and 0.8.2) and without providing any version, the very same error occurred for all the attempts.

Background:

OS: Mac OS Ventura 13.1
Python Version: 3.9.15
Ochrona Version: 2.0.2
Ochrona Arguments: --debug parso==0.8.3
Debug output:

ochrona --debug parso==0.8.3

,---.     |
|   |,---.|---.,---.,---.,---.,---.
|   ||    |   ||    |   ||   |,---|
`---'`---'`   '`    `---'`   '`---^
                            v. 2.0.2
                            https://ochrona.dev

Processing 0 Files... ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━   0% -:--:--
(DEBUG) Discovered dependencies:
 --- parso==0.8.3
(DEBUG) DB instance found: 2022.07.14
(DEBUG) Found 1 vulnerabilities potentially affecting package: parso
Traceback (most recent call last):
  File "/private/tmp/ochrona/.venv/lib/python3.9/site-packages/ochrona/eval/vuln/evaluate.py", line 64, in evaluate
    vuln_specifiers &= f"=={versions['version_value']}"
  File "/private/tmp/ochrona/.venv/lib/python3.9/site-packages/packaging/specifiers.py", line 789, in __and__
    other = SpecifierSet(other)
  File "/private/tmp/ochrona/.venv/lib/python3.9/site-packages/packaging/specifiers.py", line 711, in __inle "/private/tmp/ochrona/.venv/lib/python3.9/site-packages/packaging/specifiers.py", line 245, in __init__
    raise InvalidSpecifier(f"Invalid specifier: '{spec}'")
packaging.specifiers.InvalidSpecifier: Invalid specifier: '==-'

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
  File "/private/tmp/ochrona/.venv/bin/ochrona", line 8, in <module>
    sys.exit(run())
  File "/private/tmp/ochrona/.venv/lib/python3.9/site-packages/click/core.py", line 1130, in __call__
    return self.main(*args, **kwargs)
  File "/private/tmp/ochrona/.venv/lib/python3.9/site-packages/click/core.py", line 1055, in main
    rv = self.invoke(ctx)
  File "/private/tmp/ochrona/.venv/lib/python3.9/site-packages/click/core.py", line 1404, in invoke
    return ctx.invoke(self.callback, **ctx.params)
  File "/private/tmp/ochrona/.venv/lib/python3.9/site-packages/click/core.py", line 760, in invoke
    return __callback(*args, **kwargs)
  File "/private/tmp/ochrona/ython3.9/site-packages/ochrona/cli/cli.py", line 177, in run
    results.append(resolve(**payload))
  File "/private/tmp/ochrona/.venv/lib/python3.9/site-packages/ochrona/eval/eval.py", line 30, in resolve
    resp.confirmed_vulnerabilities = evaluate(vulns, resp.flat_list)
  File "/private/tmp/ochrona/.venv/lib/python3.9/site-packages/ochrona/eval/vuln/evaluate.py", line 104, in evaluate
    raise Exception("evaluate exception") from ex
Exception: evaluate exception

The problem seems to be the database files.

Looking at parso-CVE-2019-12760.json the version_value inside affected_versions has the value - and this is probably causing the error.

[mdhaber]

Similar error with jupyterlab:

>>> ochrona --debug jupyterlab==4.4.5

,---.     |                        
|   |,---.|---.,---.,---.,---.,---.
|   ||    |   ||    |   ||   |,---|
`---'`---'`   '`    `---'`   '`---^
                            v. 2.0.2 
                            https://ochrona.dev   
                            
Processing 0 Files... ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━   0% -:--:--
(DEBUG) Discovered dependencies: 
 --- jupyterlab==4.4.5
(DEBUG) DB instance found: 2022.07.14
(DEBUG) Found 1 vulnerabilities potentially affecting package: jupyterlab
Traceback (most recent call last):
  File "/Users/matthaberland/Desktop/deltakit-oss/.pixi/envs/default/lib/python3.13/site-packages/ochrona/eval/vuln/evaluate.py", line 66, in evaluate
    vuln_specifiers &= (
        f"{versions['operator']}{versions['version_value']}"
    )
  File "/Users/matthaberland/Desktop/deltakit-oss/.pixi/envs/default/lib/python3.13/site-packages/packaging/specifiers.py", line 804, in __and__
    other = SpecifierSet(other)
  File "/Users/matthaberland/Desktop/deltakit-oss/.pixi/envs/default/lib/python3.13/site-packages/packaging/specifiers.py", line 726, in __init__
    self._specs = frozenset(map(Specifier, split_specifiers))
                  ~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/matthaberland/Desktop/deltakit-oss/.pixi/envs/default/lib/python3.13/site-packages/packaging/specifiers.py", line 237, in __init__
    raise InvalidSpecifier(f"Invalid specifier: {spec!r}")
packaging.specifiers.InvalidSpecifier: Invalid specifier: '--'

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
  File "/Users/matthaberland/Desktop/deltakit-oss/.pixi/envs/default/bin/ochrona", line 10, in <module>
    sys.exit(run())
             ~~~^^
  File "/Users/matthaberland/Desktop/deltakit-oss/.pixi/envs/default/lib/python3.13/site-packages/click/core.py", line 1161, in __call__
    return self.main(*args, **kwargs)
           ~~~~~~~~~^^^^^^^^^^^^^^^^^
  File "/Users/matthaberland/Desktop/deltakit-oss/.pixi/envs/default/lib/python3.13/site-packages/click/core.py", line 1082, in main
    rv = self.invoke(ctx)
  File "/Users/matthaberland/Desktop/deltakit-oss/.pixi/envs/default/lib/python3.13/site-packages/click/core.py", line 1443, in invoke
    return ctx.invoke(self.callback, **ctx.params)
           ~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/matthaberland/Desktop/deltakit-oss/.pixi/envs/default/lib/python3.13/site-packages/click/core.py", line 788, in invoke
    return __callback(*args, **kwargs)
  File "/Users/matthaberland/Desktop/deltakit-oss/.pixi/envs/default/lib/python3.13/site-packages/ochrona/cli/cli.py", line 177, in run
    results.append(resolve(**payload))
                   ~~~~~~~^^^^^^^^^^^
  File "/Users/matthaberland/Desktop/deltakit-oss/.pixi/envs/default/lib/python3.13/site-packages/ochrona/eval/eval.py", line 30, in resolve
    resp.confirmed_vulnerabilities = evaluate(vulns, resp.flat_list)
                                     ~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/matthaberland/Desktop/deltakit-oss/.pixi/envs/default/lib/python3.13/site-packages/ochrona/eval/vuln/evaluate.py", line 104, in evaluate
    raise Exception("evaluate exception") from ex
Exception: evaluate exception