Try to fix bug in vulnerability dependency

Signed-off-by: ziad hany <ziadhany2016@gmail.com>

Author: ziadhany

scanpipe/pipelines/analyze_symbols_reachability.py

@@ -72,7 +72,10 @@ def steps(cls):
     def get_vulnerabilities_patches(self):
         """Get unique patch for all vulnerabilities."""
         patches = {}
-        for vulnerability in self.project.package_vulnerabilities:
+        for vulnerability in (
+            self.project.package_vulnerabilities
+            + self.project.dependency_vulnerabilities
+        ):
             advisory_uid = vulnerability.get("advisory_uid")
             for patch in vulnerability.get("fixed_in_patches", []):
                 vcs_url = patch.get("vcs_url")

scanpipe/pipes/reachability.py

@@ -479,13 +479,6 @@ def match(self, patch_symbols_metadata):
         for metadata in patch_symbols_metadata.values():
             qualified_name = metadata["qualified_name"]
             fingerprint = metadata["fingerprint"]
-
-            short_name = (
-                qualified_name.rsplit(self.separator, 1)[-1]
-                if self.separator in qualified_name
-                else qualified_name
-            )
-
             defined = qualified_name in self.definitions
             fingerprint_hit = bool(fingerprint and fingerprint in self.fingerprints)
 
@@ -494,9 +487,7 @@ def match(self, patch_symbols_metadata):
                 or qualified_name in self.imports.values()
             )
 
-            callers = set()
-            callers.update(self.callers_of.get(short_name, set()))
-            callers.update(self.callers_of.get(qualified_name, set()))
+            callers = set(self.callers_of.get(qualified_name, set()))
             called = bool(callers)
 
             if not (defined or fingerprint_hit or called or imported):

scanpipe/tests/data/reachability/python/app.py

@@ -32,6 +32,10 @@ def build_file_path(filename):
     return "Error: File not found"
 
 
+def handle_request(req):
+    return serve_report(req)
+
+
 def unrelated_top_level_function():
     """Test AST node boundaries."""
     return "I am just here to add AST complexity."

scanpipe/tests/data/reachability/python/fixed-app.py

@@ -38,6 +38,10 @@ def build_file_path(filename):
     return "Error: File not found"
 
 
+def handle_request(req):
+    return serve_report(req)
+
+
 def unrelated_top_level_function():
     """Test AST node boundaries."""
     return "I am just here to add AST complexity."

scanpipe/tests/data/reachability/python/vuln-app.py

@@ -32,6 +32,10 @@ def build_file_path(filename):
     return "Error: File not found"
 
 
+def handle_request(req):
+    return serve_report(req)
+
+
 def unrelated_top_level_function():
     """Test AST node boundaries."""
     return "I am just here to add AST complexity."

scanpipe/tests/pipes/test_symbols_reachability.py

@@ -407,22 +407,22 @@ def test_python_get_symbol_reachability_results(
                         "reachable_from": [],
                     },
                     {
-                        "called": True,
+                        "called": False,
                         "defined": True,
                         "imported": False,
                         "fingerprint": "762e4f7d03b1bf4359c3ca364"
                         "e558140239913bfabcc5aa77156460c2eb0a355",
                         "symbol_name": "serve_report.build_file_path",
-                        "reachable_from": ["serve_report"],
+                        "reachable_from": [],
                     },
                     {
-                        "called": False,
+                        "called": True,
                         "defined": True,
                         "imported": False,
                         "fingerprint": "d7675efb263896da2a3c0067951183"
                         "3553907e7e6ea619115a6dfc8625c3457e",
                         "symbol_name": "serve_report",
-                        "reachable_from": [],
+                        "reachable_from": ["handle_request"],
                     },
                 ],
                 "fixed_symbols": [
@@ -474,40 +474,39 @@ def test_java_get_symbol_reachability_results(
                 "advisory_uids": [],
                 "evidence": [
                     {
+                        "symbol_name": "App",
                         "called": False,
                         "defined": True,
                         "imported": False,
                         "fingerprint": None,
-                        "symbol_name": "App",
                         "reachable_from": [],
                     },
                     {
+                        "symbol_name": "App.serveReport",
                         "called": False,
                         "defined": True,
                         "imported": False,
-                        "fingerprint": "b161e24e9575b655e84c7f249709e5d4d0"
-                        "a1e6f19e2c4baa421a6cc996fda154",
-                        "symbol_name": "App.serveReport",
-                        "reachable_from": [],
+                        "fingerprint": "b161e24e9575b655e84c7f249709e5d4d0a1e6f19e2c4baa421a6cc996fda154",
+                        "reachable_from": []
                     },
                     {
-                        "called": True,
+                        "symbol_name": "App.buildFilePath",
+                        "called": False,
                         "defined": True,
                         "imported": False,
                         "fingerprint": None,
-                        "symbol_name": "App.buildFilePath",
-                        "reachable_from": ["App.serveReport"],
-                    },
+                        "reachable_from": []
+                    }
                 ],
                 "fixed_symbols": [
                     "App",
                     "App.buildFilePath",
-                    "App.serveReport",
+                    "App.serveReport"
                 ],
                 "vulnerable_symbols": [
                     "App",
                     "App.buildFilePath",
-                    "App.serveReport",
+                    "App.serveReport"
                 ],
                 "reachability_status": ReachabilityStatus.REACHABLE.value,
             }