fix get_or_create_from_data

Signed-off-by: tdruez <tdruez@aboutcode.org>

Author: tdruez

Makefile

@@ -27,9 +27,10 @@ shell:
 	# Open a bash session in a standalone container (no stack required)
 	docker run -it $(IMAGE_NAME) bash
 
+# make test              - full suite
+# make test k=<pattern>  - filter by name, e.g. make test k=test_name
 test:
-	@echo "-> Run the test suite"
-	${MANAGE} test --noinput --parallel auto
+	${MANAGE} test --noinput --parallel auto $(if $(k),-k $(k),)
 
 migrations:
 	@echo "-> Creates new database migrations"

vulnerabilities/models.py

@@ -232,9 +232,14 @@ def get_or_create_from_data(cls, dataspace, data, validate=False):
         """Get or create a Vulnerability from provided ``data``."""
         vulnerability_qs = Vulnerability.objects.scope(dataspace)
 
-        # Support for CycloneDX data structure
         data = data.copy()
-        advisory_uid = data.get("advisory_uid") or data.pop("id", None)
+        # CycloneDX uses "id" where we expect advisory_id and advisory_uid.
+        if "id" in data:
+            cyclonedx_id = data.pop("id")
+            data.setdefault("advisory_id", cyclonedx_id)
+            data.setdefault("advisory_uid", cyclonedx_id)
+
+        advisory_uid = data.get("advisory_uid")
         if not advisory_uid:
             return
 

vulnerabilities/tests/__init__.py

@@ -17,7 +17,7 @@ def make_vulnerability(dataspace, affecting=None, **data):
         data["advisory_id"] = f"ID-0000-{make_string(4)}"
 
     if "advisory_uid" not in data:
-        data["advisory_uid"] = f'importer/{data["advisory_id"]}'
+        data["advisory_uid"] = f"importer/{data['advisory_id']}"
 
     vulnerability = Vulnerability.objects.create(
         dataspace=dataspace,

vulnerabilities/tests/test_models.py

@@ -249,18 +249,19 @@ def test_vulnerability_model_create_from_data(self):
 
     def test_vulnerability_model_get_or_create_from_data(self):
         vulnerability_data = {
-            "id": "VCID-q4q6-yfng-aaag",
+            "id": "ID-q4q6-yfng-aaag",
             "summary": "In Django 3.2 before 3.2.25, 4.2 before 4.2.11, and 5.0.",
         }
 
         vulnerability1 = Vulnerability.get_or_create_from_data(
             dataspace=self.dataspace,
             data=vulnerability_data,
         )
+        self.assertEqual(vulnerability_data["id"], vulnerability1.advisory_uid)
         self.assertEqual(vulnerability_data["id"], vulnerability1.advisory_id)
         self.assertEqual(vulnerability_data["summary"], vulnerability1.summary)
 
-        vulnerability_data["advisory_uid"] = vulnerability_data["id"]
+        vulnerability_data["advisory_uid"] = vulnerability1.advisory_uid
         vulnerability2 = Vulnerability.get_or_create_from_data(
             dataspace=self.dataspace,
             data=vulnerability_data,