cybersecurity · intermediate · ~15 min · safe pentest lab

Valid CVE id?

Validate a structured identifier.

Challenge

Validate a CVE identifier's format before using it — rejecting garbage avoids bad lookups against a feed.

Task

Implement int is_cve_id(const char *s) that returns 1 if s matches the pattern CVE-<4 digits>-<1 or more digits>, else 0.

Input

  • s: a NUL-terminated candidate identifier the grader passes.

Output

Returns int: 1 if s is exactly CVE-, then 4 digits, then -, then one or more digits (and nothing invalid after); else 0.

Example

is_cve_id("CVE-2021-44228")   ->   1
is_cve_id("CVE-2021-")        ->   0   (no number after the dash)
is_cve_id("CVE-21-1")         ->   0   (year is not 4 digits)

Edge cases

  • The year must be exactly 4 digits.
  • The sequence part needs at least one digit.

Input format

A NUL-terminated candidate identifier string s.

Output format

An int: 1 if s matches CVE-DDDD-D+ exactly, else 0.

Constraints

Prefix CVE-, then 4 digits, then -, then one or more digits.

Starter code

#include <string.h>

int is_cve_id(const char *s) {
    /* TODO */
    return 0;
}

Solve this exercise in the browser editor — compile and run against the test harness, no setup required.