Feature: Semver Function

[nullifysecurity]

Feature Description

This pull request implements a new semver function which adds support for parsing and comparison of semantic version strings.

With the uptick of supply chain compromises we're seeing recently, this gives investigators the ability to parse and compare semantic versions from package management files such as package.json to scan and detect potentially vulnerable or compromised package versions.

The semantic version parsing and comparison is provided by the github.com/Masterminds/semver/v3 package which Velociraptor is already utilising, removing the need for any additional dependencies.

The function itself extracts the major, minor, patch, and pre-release values from the provided semantic version string and allows comparison against other semver outputs and semantic version strings (similar to the timestamp functionality). It supports the greater than, less than and equal comparisons.

semver

Parse a semantic version string.

Arg	Description	Type
version	A string to convert to a semantic version	string (required)

Examples

The following are some examples of semver function usage,

-- Semver output
SELECT semver(version="v1.2.5-dev") AS Version FROM scope()

{
"Major":1
"Minor":2
"Patch":5
"Prerelease":"dev"
"Version":"1.2.5-dev"
}

-- Comparison against version strings
SELECT semver(version="1.0.0") = "1.0.0" FROM scope() -- True
SELECT semver(version="1.0.0") = "2.0.0" FROM scope() -- False
SELECT semver(version="1.0.0") <= "2.0.0" FROM scope() -- True
SELECT semver(version="1.0.0") >= "2.0.0" FROM scope() -- False
SELECT semver(version="2.0.0") AS Version FROM scope() WHERE Version > "1.0.0" -- True

-- Comparison against semver functions
SELECT semver(version="1.0.0") = semver(version="2.0.0") FROM scope() -- False
SELECT semver(version="1.0.0") < semver(version="1.1.0") FROM scope() -- True
SELECT semver(version="1.0.0") > semver(version="0.1.0") FROM scope() -- True
SELECT semver(version="1.0.0") > semver(version="v0.1.0-dev") FROM scope() -- True
SELECT "2.0.0" AS Version FROM scope() WHERE semver(version="1.0.0") < Version -- True

Please let me know if any improvements can be made to make this better match Velociraptor's code style and design.

[scudette]

Let also add the example you have in the PR description to a test here

https://github.com/Velocidex/velociraptor/blob/master/artifacts/testdata/server/testcases/

[nullifysecurity]

Thanks @scudette, have made those improvements and added some tests as well. 😄