Address review comment

Author: hvitved

go/ql/lib/semmle/go/dependencies/SemVer.qll

@@ -5,6 +5,7 @@ overlay[local?]
 module;
 
 import semmle.go.dependencies.Dependencies
+private import codeql.util.SemVer
 
 /**
  * A SemVer-formatted version string in a dependency.
@@ -17,63 +18,42 @@ class DependencySemVer extends string {
 
   DependencySemVer() {
     this = dep.getDepVersion() and
-    normalized = normalizeSemver(this)
+    normalized = normalizeSemVer(this)
   }
 
   /**
    * Holds if this version may be before `last`.
    */
   bindingset[last]
-  predicate maybeBefore(string last) { normalized < normalizeSemver(last) }
+  predicate maybeBefore(string last) { normalized < normalizeSemVer(last) }
 
   /**
    * Holds if this version may be after `first`.
    */
   bindingset[first]
-  predicate maybeAfter(string first) { normalizeSemver(first) < normalized }
+  predicate maybeAfter(string first) { normalizeSemVer(first) < normalized }
 
   /**
    * Holds if this version may be between `first` (inclusive) and `last` (exclusive).
    */
   bindingset[first, last]
   predicate maybeBetween(string first, string last) {
-    normalizeSemver(first) <= normalized and
-    normalized < normalizeSemver(last)
+    normalizeSemVer(first) <= normalized and
+    normalized < normalizeSemVer(last)
   }
 
   /**
    * Holds if this version is equivalent to `other`.
    */
   bindingset[other]
-  predicate is(string other) { normalized = normalizeSemver(other) }
+  predicate is(string other) { normalized = normalizeSemVer(other) }
 
   /**
    * Gets the dependency that uses this string.
    */
   Dependency getDependency() { result = dep }
 }
 
-bindingset[str]
-private string leftPad(string str) { result = ("000" + str).suffix(str.length()) }
-
-/**
- * Normalizes a SemVer string such that the lexicographical ordering
- * of two normalized strings is consistent with the SemVer ordering.
- *
- * Pre-release information and build metadata is not yet supported.
- */
-bindingset[orig]
-private string normalizeSemver(string orig) {
-  exists(string pattern, string major, string minor, string patch |
-    pattern = "v?(\\d+)\\.(\\d+)\\.(\\d+)(\\D.*)?" and
-    major = orig.regexpCapture(pattern, 1) and
-    minor = orig.regexpCapture(pattern, 2) and
-    patch = orig.regexpCapture(pattern, 3)
-  |
-    result = leftPad(major) + "." + leftPad(minor) + "." + leftPad(patch)
-  )
-}
-
 /**
  * A version string in a dependency that has a SemVer, but also contains a git commit SHA.
  *

javascript/ql/lib/semmle/javascript/dependencies/SemVer.qll

@@ -3,6 +3,7 @@
  */
 
 import semmle.javascript.dependencies.Dependencies
+private import codeql.util.SemVer
 
 /**
  * A SemVer-formatted version string in a dependency.
@@ -15,59 +16,38 @@ class DependencySemVer extends string {
 
   DependencySemVer() {
     dep.info(_, this) and
-    normalized = normalizeSemver(this)
+    normalized = normalizeSemVer(this)
   }
 
   /**
    * Holds if this version may be before `last`.
    */
   bindingset[last]
-  predicate maybeBefore(string last) { normalized < normalizeSemver(last) }
+  predicate maybeBefore(string last) { normalized < normalizeSemVer(last) }
 
   /**
    * Holds if this version may be after `first`.
    */
   bindingset[first]
-  predicate maybeAfter(string first) { normalizeSemver(first) < normalized }
+  predicate maybeAfter(string first) { normalizeSemVer(first) < normalized }
 
   /**
    * Holds if this version may be between `first` (inclusive) and `last` (exclusive).
    */
   bindingset[first, last]
   predicate maybeBetween(string first, string last) {
-    normalizeSemver(first) <= normalized and
-    normalized < normalizeSemver(last)
+    normalizeSemVer(first) <= normalized and
+    normalized < normalizeSemVer(last)
   }
 
   /**
    * Holds if this version is equivalent to `other`.
    */
   bindingset[other]
-  predicate is(string other) { normalized = normalizeSemver(other) }
+  predicate is(string other) { normalized = normalizeSemVer(other) }
 
   /**
    * Gets the dependency that uses this string.
    */
   Dependency getDependency() { result = dep }
 }
-
-bindingset[str]
-private string leftPad(string str) { result = ("000" + str).suffix(str.length()) }
-
-/**
- * Normalizes a SemVer string such that the lexicographical ordering
- * of two normalized strings is consistent with the SemVer ordering.
- *
- * Pre-release information and build metadata is not yet supported.
- */
-bindingset[orig]
-private string normalizeSemver(string orig) {
-  exists(string pattern, string major, string minor, string patch |
-    pattern = "(\\d+)\\.(\\d+)\\.(\\d+)" and
-    major = orig.regexpCapture(pattern, 1) and
-    minor = orig.regexpCapture(pattern, 2) and
-    patch = orig.regexpCapture(pattern, 3)
-  |
-    result = leftPad(major) + "." + leftPad(minor) + "." + leftPad(patch)
-  )
-}

rust/ql/lib/codeql/rust/internal/PathResolution.qll

@@ -48,6 +48,7 @@ private import codeql.rust.elements.internal.CallExprImpl::Impl as CallExprImpl
 private import codeql.rust.internal.CachedStages
 private import codeql.rust.frameworks.stdlib.Builtins as Builtins
 private import codeql.util.Option
+private import codeql.util.SemVer
 
 private newtype TNamespace =
   TTypeNamespace() or
@@ -572,7 +573,7 @@ class CrateItemNode extends NamedItemNode instanceof Crate {
   predicate isLatestVersion(string name) {
     this =
       max(CrateItemNode c, string ver |
-        name = c.getName() and ver = c.(Crate).getVersion()
+        name = c.getName() and ver = normalizeSemVer(c.(Crate).getVersion())
       |
         c order by ver
       )

shared/util/codeql/util/SemVer.qll

@@ -0,0 +1,23 @@
+/**
+ * Provides logic for working SemVer (Semantic Versioning).
+ */
+bindingset[str]
+private string leftPad(string str) { result = ("000" + str).suffix(str.length()) }
+
+/**
+ * Normalizes a SemVer string such that the lexicographical ordering
+ * of two normalized strings is consistent with the SemVer ordering.
+ *
+ * Pre-release information and build metadata is not yet supported.
+ */
+bindingset[orig]
+string normalizeSemVer(string orig) {
+  exists(string pattern, string major, string minor, string patch |
+    pattern = "v?(\\d+)\\.(\\d+)\\.(\\d+)(\\D.*)?" and
+    major = orig.regexpCapture(pattern, 1) and
+    minor = orig.regexpCapture(pattern, 2) and
+    patch = orig.regexpCapture(pattern, 3)
+  |
+    result = leftPad(major) + "." + leftPad(minor) + "." + leftPad(patch)
+  )
+}