Fixed false positive CVE for Nextcloud Desktop

[getvictor]

Related issue: Resolves #38911

• Fixed false positive CVE for Nextcloud Desktop.
• Fixed rare CPE error when software name sanitizes to empty (e.g. only special characters)

Checklist for submitter

• Changes file added for user-visible changes in changes/, orbit/changes/ or ee/fleetd-chrome/changes.

Testing

• Added/updated automated tests
• QA'd all new/changed functionality manually

Summary by CodeRabbit

• Bug Fixes
  • Fixed false positive vulnerability detection for Nextcloud Desktop
  • Resolved error occurring when software names contain only special characters and sanitize to empty

[getvictor]

@coderabbitai full review

[coderabbitai]

✅ Actions performed

Full review triggered.

[coderabbitai]

Walkthrough

This PR fixes a false positive CVE issue where Nextcloud Desktop Client was incorrectly matched to server vulnerabilities, and addresses a rare error when software names sanitize to empty strings. Changes include conditional full-text search in CPE lookup logic, an edge-case test, and a translation entry for the Nextcloud desktop client.

Changes

Cohort / File(s)	Summary
Changelog changes/38911-nextcloud-cve	Added two changelog entries documenting fixes for Nextcloud Desktop CVE false positive and rare CPE error when software name sanitizes to empty string.
CPE Logic server/vulnerabilities/nvd/cpe.go, server/vulnerabilities/nvd/cpe_test.go	Modified full-text search to conditionally execute only when sanitized name contains non-whitespace content; added test case for edge-case handling of names that sanitize to empty strings.
CPE Configuration server/vulnerabilities/nvd/cpe_translations.json	Added translation entry mapping Nextcloud Desktop Client bundle identifier com.nextcloud.desktopclient to product desktop and vendor nextcloud.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

• Fixed unnecessary error logging when no CPE match is found #38754: Modifies server/vulnerabilities/nvd/cpe.go with related CPE lookup logic adjustments for handling edge cases in database queries.

Suggested reviewers

• ksykulev
• mostlikelee

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately describes the main change - fixing a false positive CVE for Nextcloud Desktop, which directly matches the primary objective in linked issue #38911.
Description check	✅ Passed	The description includes the related issue reference (#38911), addresses both objectives (false positive CVE fix and CPE error fix), confirms a changes file was added, and indicates tests were added and manual QA performed.
Linked Issues check	✅ Passed	The changes directly address all coding requirements from issue #38911: added CPE translation mapping for Nextcloud Desktop client [cpe_translations.json], fixed CPE generation logic to handle empty sanitized names [cpe.go], added test coverage for edge case [cpe_test.go], and created changelog entry.
Out of Scope Changes check	✅ Passed	All changes are directly related to the linked issue: CPE translation addition, CPE generation logic fix, test coverage expansion, and changelog entry are all within the scope of resolving the Nextcloud Desktop CPE issue.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

• 📝 Generate docstrings

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch victor/38911-nextcloud-cve

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 64.35%. Comparing base (fa4b742) to head (984abbf).
⚠️ Report is 52 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #39360      +/-   ##
==========================================
- Coverage   66.20%   64.35%   -1.85%     
==========================================
  Files        2428     2396      -32     
  Lines      194435   187203    -7232     
  Branches     8462     8462              
==========================================
- Hits       128722   120479    -8243     
- Misses      54010    55813    +1803     
+ Partials    11703    10911     -792     

Flag	Coverage Δ
backend	65.90% <100.00%> (-2.07%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.