Skip to content

Commit fd15724

Browse files
sbs2001sbs2001
authored
Merge pull request #436 from sbs2001/add-patched-pkg
Add patched package
2 parents 525729b + cc5bbb4 commit fd15724

67 files changed

Lines changed: 6605 additions & 9997 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎requirements.txt‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ cached-property==1.5.1
77
cffi==1.14.0
88
contextlib2==0.5.5
99
decorator==4.4.2
10-
univers==21.4.8
10+
univers==21.4.16.6
1111
dj-database-url==0.4.2
1212
Django==3.0.14
1313
django-filter==2.2.0

‎vulnerabilities/admin.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,7 @@ class PackageAdmin(admin.ModelAdmin):
5151

5252
@admin.register(PackageRelatedVulnerability)
5353
class PackageRelatedVulnerabilityAdmin(admin.ModelAdmin):
54-
list_filter = ("is_vulnerable", "package__type", "package__namespace")
54+
list_filter = ("package__type", "package__namespace")
5555
search_fields = ["vulnerability__vulnerability_id", "package__name"]
5656

5757

‎vulnerabilities/data_source.py‎

Lines changed: 17 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,6 @@
2020
# VulnerableCode is a free software code scanning tool from nexB Inc. and others.
2121
# Visit https://github.com/nexB/vulnerablecode/ for support and download.
2222

23-
import pickle
2423
import dataclasses
2524
import logging
2625
import os
@@ -47,6 +46,8 @@
4746
from vulnerabilities.oval_parser import OvalParser
4847
from vulnerabilities.severity_systems import ScoringSystem
4948
from vulnerabilities.helpers import is_cve
49+
from vulnerabilities.helpers import nearest_patched_package
50+
from vulnerabilities.helpers import AffectedPackage
5051

5152
logger = logging.getLogger(__name__)
5253

@@ -87,17 +88,14 @@ class Advisory:
8788

8889
summary: str
8990
vulnerability_id: Optional[str] = None
90-
impacted_package_urls: Iterable[PackageURL] = dataclasses.field(default_factory=list)
91-
resolved_package_urls: Iterable[PackageURL] = dataclasses.field(default_factory=list)
91+
affected_packages: List[AffectedPackage] = dataclasses.field(default_factory=list)
9292
references: List[Reference] = dataclasses.field(default_factory=list)
9393

9494
def __post_init__(self):
9595
if self.vulnerability_id and not is_cve(self.vulnerability_id):
9696
raise ValueError("CVE expected, found: {}".format(self.vulnerability_id))
9797

9898
def normalized(self):
99-
impacted_package_urls = {package_url for package_url in self.impacted_package_urls}
100-
resolved_package_urls = {package_url for package_url in self.resolved_package_urls}
10199
references = sorted(
102100
self.references, key=lambda reference: (reference.reference_id, reference.url)
103101
)
@@ -107,8 +105,7 @@ def normalized(self):
107105
return Advisory(
108106
summary=self.summary,
109107
vulnerability_id=self.vulnerability_id,
110-
impacted_package_urls=impacted_package_urls,
111-
resolved_package_urls=resolved_package_urls,
108+
affected_packages=sorted(self.affected_packages),
112109
references=references,
113110
)
114111

@@ -531,9 +528,8 @@ def get_data_from_xml_doc(self, xml_doc: ET.ElementTree, pkg_metadata={}) -> Lis
531528
# connected/linked to an OvalDefinition
532529
vuln_id = definition_data["vuln_id"]
533530
description = definition_data["description"]
534-
affected_purls = set()
535-
safe_purls = set()
536531
references = [Reference(url=url) for url in definition_data["reference_urls"]]
532+
affected_packages = []
537533
for test_data in definition_data["test_data"]:
538534
for package_name in test_data["package_list"]:
539535
if package_name and len(package_name) >= 50:
@@ -552,35 +548,31 @@ def get_data_from_xml_doc(self, xml_doc: ET.ElementTree, pkg_metadata={}) -> Lis
552548
# FIXME: we should not drop data this way
553549
# This filter is for filtering out long versions.
554550
# 50 is limit because that's what db permits atm.
555-
all_versions = set(filter(lambda x: len(x) < 50, all_versions))
551+
all_versions = [version for version in all_versions if len(version) < 50]
556552
if not all_versions:
557553
continue
558-
affected_versions = set(
559-
filter(lambda x: version_class(x) in affected_version_range, all_versions)
560-
)
561-
safe_versions = all_versions - affected_versions
562554

563-
for version in affected_versions:
555+
affected_purls = []
556+
safe_purls = []
557+
for version in all_versions:
564558
purl = self.create_purl(
565559
pkg_name=package_name,
566560
pkg_version=version,
567561
pkg_data=pkg_metadata,
568562
)
569-
affected_purls.add(purl)
563+
if version_class(version) in affected_version_range:
564+
affected_purls.append(purl)
565+
else:
566+
safe_purls.append(purl)
570567

571-
for version in safe_versions:
572-
purl = self.create_purl(
573-
pkg_name=package_name,
574-
pkg_version=version,
575-
pkg_data=pkg_metadata,
576-
)
577-
safe_purls.add(purl)
568+
affected_packages.extend(
569+
nearest_patched_package(affected_purls, safe_purls),
570+
)
578571

579572
all_adv.append(
580573
Advisory(
581574
summary=description,
582-
impacted_package_urls=affected_purls,
583-
resolved_package_urls=safe_purls,
575+
affected_packages=affected_packages,
584576
vulnerability_id=vuln_id,
585577
references=references,
586578
)

‎vulnerabilities/fixtures/debian.json‎

Lines changed: 87 additions & 108 deletions
Original file line numberDiff line numberDiff line change
@@ -1,110 +1,89 @@
11
[
2-
{
3-
"model": "vulnerabilities.vulnerability",
4-
"pk": 1,
5-
"fields": {
6-
"vulnerability_id": "CVE-2014-8242",
7-
"summary": ""
8-
2+
{
3+
"model": "vulnerabilities.vulnerability",
4+
"pk": 1,
5+
"fields": {
6+
"vulnerability_id": "CVE-2014-8242",
7+
"old_vulnerability_id": null,
8+
"summary": ""
9+
}
10+
},
11+
{
12+
"model": "vulnerabilities.vulnerability",
13+
"pk": 2,
14+
"fields": {
15+
"vulnerability_id": "CVE-2009-1382",
16+
"old_vulnerability_id": null,
17+
"summary": ""
18+
}
19+
},
20+
{
21+
"model": "vulnerabilities.vulnerability",
22+
"pk": 3,
23+
"fields": {
24+
"vulnerability_id": "CVE-2009-2459",
25+
"old_vulnerability_id": null,
26+
"summary": ""
27+
}
28+
},
29+
{
30+
"model": "vulnerabilities.package",
31+
"pk": 1,
32+
"fields": {
33+
"type": "deb",
34+
"namespace": "debian",
35+
"name": "librsync",
36+
"version": "0.9.7-10",
37+
"subpath": "",
38+
"qualifiers": {
39+
"distro": "jessie"
40+
}
41+
}
42+
},
43+
{
44+
"model": "vulnerabilities.package",
45+
"pk": 2,
46+
"fields": {
47+
"type": "deb",
48+
"namespace": "debian",
49+
"name": "mimetex",
50+
"version": "1.74-1",
51+
"subpath": "",
52+
"qualifiers": {
53+
"distro": "jessie"
54+
}
55+
}
56+
},
57+
{
58+
"model": "vulnerabilities.package",
59+
"pk": 3,
60+
"fields": {
61+
"type": "deb",
62+
"namespace": "debian",
63+
"name": "mimetex",
64+
"version": "1.50-1.1",
65+
"subpath": "",
66+
"qualifiers": {
67+
"distro": "jessie"
68+
}
69+
}
70+
},
71+
{
72+
"model": "vulnerabilities.packagerelatedvulnerability",
73+
"pk": 1,
74+
"fields": {
75+
"package": 1,
76+
"vulnerability": 1,
77+
"patched_package": null
78+
}
79+
},
80+
{
81+
"model": "vulnerabilities.packagerelatedvulnerability",
82+
"pk": 4,
83+
"fields": {
84+
"package": 3,
85+
"vulnerability": 3,
86+
"patched_package": 2
87+
}
988
}
10-
},
11-
{
12-
"model": "vulnerabilities.vulnerability",
13-
"pk": 2,
14-
"fields": {
15-
"vulnerability_id": "CVE-2009-1382",
16-
"summary": ""
17-
18-
}
19-
},
20-
{
21-
"model": "vulnerabilities.vulnerability",
22-
"pk": 3,
23-
"fields": {
24-
"vulnerability_id": "CVE-2009-2459",
25-
"summary": ""
26-
27-
}
28-
},
29-
{
30-
"model": "vulnerabilities.package",
31-
"pk": 1,
32-
"fields": {
33-
"type": "deb",
34-
"namespace": "debian",
35-
"name": "librsync",
36-
"version": "0.9.7-10",
37-
"qualifiers": {"distro":"jessie"},
38-
"subpath": ""
39-
}
40-
},
41-
{
42-
"model": "vulnerabilities.package",
43-
"pk": 2,
44-
"fields": {
45-
"type": "deb",
46-
"namespace": "debian",
47-
"name": "mimetex",
48-
"version": "1.74-1",
49-
"qualifiers": {"distro":"jessie"},
50-
"subpath": ""
51-
}
52-
},
53-
{
54-
"model": "vulnerabilities.package",
55-
"pk": 3,
56-
"fields": {
57-
"type": "deb",
58-
"namespace": "debian",
59-
"name": "mimetex",
60-
"version": "1.50-1.1",
61-
"qualifiers": {"distro":"jessie"},
62-
"subpath": ""
63-
}
64-
},
65-
{
66-
"model": "vulnerabilities.packagerelatedvulnerability",
67-
"pk": 1,
68-
"fields": {
69-
"vulnerability": 1,
70-
"package": 1,
71-
"is_vulnerable": true
72-
}
73-
},
74-
{
75-
"model": "vulnerabilities.packagerelatedvulnerability",
76-
"pk": 10,
77-
"fields": {
78-
"vulnerability": 2,
79-
"package": 2,
80-
"is_vulnerable": false
81-
}
82-
},
83-
{
84-
"model": "vulnerabilities.packagerelatedvulnerability",
85-
"pk": 2,
86-
"fields": {
87-
"vulnerability": 2,
88-
"package": 3,
89-
"is_vulnerable": false
90-
}
91-
},
92-
{
93-
"model": "vulnerabilities.packagerelatedvulnerability",
94-
"pk": 3,
95-
"fields": {
96-
"vulnerability": 3,
97-
"package": 2,
98-
"is_vulnerable": false
99-
}
100-
},
101-
{
102-
"model": "vulnerabilities.packagerelatedvulnerability",
103-
"pk": 4,
104-
"fields": {
105-
"vulnerability": 3,
106-
"package": 3,
107-
"is_vulnerable": false
108-
}
109-
}
110-
]
89+
]

‎vulnerabilities/fixtures/github.json‎

Lines changed: 2 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -74,22 +74,13 @@
7474
"qualifiers": {}
7575
}
7676
},
77-
{
78-
"model": "vulnerabilities.packagerelatedvulnerability",
79-
"pk": 3844,
80-
"fields": {
81-
"package": 3469,
82-
"vulnerability": 60,
83-
"is_vulnerable": false
84-
}
85-
},
8677
{
8778
"model": "vulnerabilities.packagerelatedvulnerability",
8879
"pk": 3845,
8980
"fields": {
9081
"package": 3467,
9182
"vulnerability": 60,
92-
"is_vulnerable": true
83+
"patched_package": 3469
9384
}
9485
},
9586
{
@@ -98,7 +89,7 @@
9889
"fields": {
9990
"package": 3468,
10091
"vulnerability": 60,
101-
"is_vulnerable": true
92+
"patched_package": 3469
10293
}
10394
},
10495
{

0 commit comments

Comments
 (0)