fix(cve_scanner): fix canonical_convert

[Molkree]

• fixes TypeError when scanning #1518

Regression was introduced in 6cd49cf, first if clause returns a tuple of two strings instead of special Version objects. This only happens when product_info.version is an empty string.

Note that this also affects #1517 (user report). With the proposed fix scanning completes successfully and just detects empty version for xml2:

           INFO     cve_bin_tool - Known CVEs in ('busybox', '1.30.1'), ('curl', '7.66.0'), ('hostapd', '2.9'), ('libcurl', '7.66.0'), ('libxml2', ''), ('lighttpd', '1.4.48'), ('lua', '5.1.5'),      cli.py:565
                    ('openssl', '1.1.1d'), ('openvpn', '2.5.0'), ('sqlite', '3.31.1'), ('wpa_supplicant', '2.9'):

P.S. I can't seem to pass all tests in CI in my fork due to NVD returning 403.

[codecov-commenter]

Codecov Report

Merging #1519 (117ad88) into main (8c1f773) will decrease coverage by 0.08%.
The diff coverage is 100.00%.

@@            Coverage Diff             @@
##             main    #1519      +/-   ##
==========================================
- Coverage   81.63%   81.54%   -0.09%     
==========================================
  Files         281      281              
  Lines        5537     5539       +2     
  Branches      905      905              
==========================================
- Hits         4520     4517       -3     
- Misses        823      828       +5     
  Partials      194      194              

Flag	Coverage Δ
longtests	81.54% <100.00%> (-0.09%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Impacted Files	Coverage Δ
cve_bin_tool/cve_scanner.py	85.10% <100.00%> (+0.21%)	⬆️
cve_bin_tool/nvd_api.py	82.65% <0.00%> (-5.11%)	⬇️

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 8c1f773...117ad88. Read the comment docs.

[terriko]

Good catch. @anthonyharrison you might want to rebase #1524 after this merges in main and see if it resolves your problem.