From 73ebb85ec34a1c28d0937c55d29b965df5bdd351 Mon Sep 17 00:00:00 2001
From: Piotr Smyrak <smyru@FreeBSD.org>
Date: Fri, 19 Jun 2026 15:31:28 +0200
Subject: [PATCH] security/vuxml: refuse non CVE vuln IDs in validate target

PR:		295994
Approved by:	0mp (mentor)
Reviewed by:	0mp, fernape, philip
Differential Revision:	https://reviews.freebsd.org/D57539
---
 security/vuxml/Makefile | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/security/vuxml/Makefile b/security/vuxml/Makefile
index 0f00f3364b0b..bd8a42b95f9b 100644
--- a/security/vuxml/Makefile
+++ b/security/vuxml/Makefile
@@ -82,6 +82,17 @@ validate: tidy check-portepoch
 		${ECHO_CMD} Consider using ${VUXML_FILE}.unexpanded for final commit; \
 		return 1; \
 	fi
+	@${ECHO_MSG} Checking CVE IDs...
+	@(NON_CANONICAL_CVE="`cd ${.CURDIR} && ${GREP} -Fn '<cvename>' vuln/*.xml | ${EGREP} -v '(CAN|CVE)-'`"; \
+	if [ -z "$${NON_CANONICAL_CVE}" ]; \
+	then \
+		${ECHO_MSG} ... seems okay; \
+	else \
+		${ECHO_MSG} Only CVE IDs are allowed within cvename tags. These lines are wrong:; \
+		printf "%s\n" $${NON_CANONICAL_CVE}; \
+		return 1; \
+	fi)
+
 	${PYTHON_CMD} ${FILESDIR}/extra-validation.py ${VUXML_FLAT_FILE}
 	@${ECHO_CMD}
 	@${ECHO_CMD} 'Be sure to get versioning right for PORTEPOCH and remember possible linux-* ports!'