Add calculate_version_rank on Package

Signed-off-by: Tushar Goel <tushar.goel.dav@gmail.com>

Author: TG1999

vulnerabilities/migrations/0085_alter_package_version_rank.py

@@ -0,0 +1,21 @@
+# Generated by Django 4.2.16 on 2024-12-05 09:37
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("vulnerabilities", "0084_alter_package_options_package_version_rank"),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name="package",
+            name="version_rank",
+            field=models.FloatField(
+                default=0,
+                help_text="Rank of the version to support ordering by version. Rank zero means the rank has not been defined yet",
+            ),
+        ),
+    ]

vulnerabilities/models.py

@@ -705,7 +705,7 @@ class Package(PackageURLMixin):
         "indicate greater vulnerability risk for the package.",
     )
 
-    version_rank = models.IntegerField(
+    version_rank = models.FloatField(
         help_text="Rank of the version to support ordering by version. Rank "
         "zero means the rank has not been defined yet",
         default=0,
@@ -749,6 +749,65 @@ class Meta:
     def __str__(self):
         return self.package_url
 
+    @property
+    def calculate_version_rank(self):
+        """
+        Calculate and return the `version_rank` for a package that does not have one.
+        If this package already has a `version_rank`, return it.
+
+        The calculated rank will be interpolated between two packages that have
+        `version_rank` values and are closest to this package in terms of version order.
+        """
+
+        if self.version_rank > 0:
+            return self.version_rank
+
+        # Determine the version_class for this package's type
+        version_class = RANGE_CLASS_BY_SCHEMES.get(self.type).version_class
+        if not version_class:
+            raise ValueError(f"No version_class defined for package type {self.type}")
+
+        group_packages = Package.objects.filter(
+            type=self.type,
+            namespace=self.namespace,
+            name=self.name,
+        )
+
+        # if all packages have version rank 0
+
+        if all(p.version_rank == 0 for p in group_packages):
+            sorted_packages = sorted(group_packages, key=lambda p: version_class(p.version))
+            for rank, package in enumerate(sorted_packages):
+                package.version_rank = rank
+            Package.objects.bulk_update(sorted_packages, fields=["version_rank"])
+            return self.version_rank
+
+        group_packages = group_packages.exclude(version_rank=0)
+        sorted_packages = sorted(group_packages, key=lambda p: version_class(p.version))
+        current_version = version_class(self.version)
+
+        lower_package, higher_package = None, None
+        for package in sorted_packages:
+            package_version = version_class(package.version)
+            if package_version < current_version:
+                lower_package = package
+            elif package_version > current_version:
+                higher_package = package
+                break
+
+        if lower_package and higher_package:
+            # Interpolate rank between neighbors
+            return (lower_package.version_rank + higher_package.version_rank) / 2
+        elif lower_package:
+            # If only lower neighbor exists, assign a rank slightly higher than the lower neighbor
+            return lower_package.version_rank + 1
+        elif higher_package:
+            # If only higher neighbor exists, assign a rank slightly lower than the higher neighbor
+            return higher_package.version_rank - 1
+        else:
+            # No neighbors with version_rank; return default rank (e.g., 0)
+            return 0
+
     @property
     def affected_by(self):
         """
@@ -795,14 +854,6 @@ def get_details_url(self, request):
 
         return reverse("package_details", kwargs={"purl": self.purl}, request=request)
 
-    def sort_by_version(self, packages):
-        """
-        Return a sequence of `packages` sorted by version.
-        """
-        if not packages:
-            return []
-        return sorted(packages, key=lambda x: self.version_class(x.version))
-
     @cached_property
     def version_class(self):
         range_class = RANGE_CLASS_BY_SCHEMES.get(self.type)
@@ -837,19 +888,21 @@ def get_non_vulnerable_versions(self):
         Return a tuple of the next and latest non-vulnerable versions as Package instance.
         Return a tuple of (None, None) if there is no non-vulnerable version.
         """
+        if self.version_rank == 0:
+            self.calculate_version_rank
         non_vulnerable_versions = Package.objects.get_fixed_by_package_versions(
             self, fix=False
         ).only_non_vulnerable()
-        sorted_versions = self.sort_by_version(non_vulnerable_versions)
+        sorted_versions = non_vulnerable_versions
 
-        later_non_vulnerable_versions = [
-            non_vuln_ver
-            for non_vuln_ver in sorted_versions
-            if self.version_class(non_vuln_ver.version) > self.current_version
-        ]
+        later_non_vulnerable_versions = non_vulnerable_versions.filter(
+            version_rank__gt=self.version_rank
+        )
+
+        later_non_vulnerable_versions = list(later_non_vulnerable_versions)
 
         if later_non_vulnerable_versions:
-            sorted_versions = self.sort_by_version(later_non_vulnerable_versions)
+            sorted_versions = later_non_vulnerable_versions
             next_non_vulnerable = sorted_versions[0]
             latest_non_vulnerable = sorted_versions[-1]
             return next_non_vulnerable, latest_non_vulnerable
@@ -878,6 +931,8 @@ def get_affecting_vulnerabilities(self):
         Return a list of vulnerabilities that affect this package together with information regarding
         the versions that fix the vulnerabilities.
         """
+        if self.version_rank == 0:
+            self.calculate_version_rank
         package_details_vulns = []
 
         fixed_by_packages = Package.objects.get_fixed_by_package_versions(self, fix=True)
@@ -901,12 +956,13 @@ def get_affecting_vulnerabilities(self):
                 if fixed_version > self.current_version:
                     later_fixed_packages.append(fixed_pkg)
 
-            next_fixed_package = None
             next_fixed_package_vulns = []
 
             sort_fixed_by_packages_by_version = []
             if later_fixed_packages:
-                sort_fixed_by_packages_by_version = self.sort_by_version(later_fixed_packages)
+                sort_fixed_by_packages_by_version = sorted(
+                    later_fixed_packages, key=lambda p: p.version_rank
+                )
 
             fixed_by_pkgs = []
 
@@ -936,6 +992,7 @@ def fixing_vulnerabilities(self):
         """
         Return a queryset of Vulnerabilities that are fixed by this package.
         """
+        print("A")
         return self.fixed_by_vulnerabilities.all()
 
     @property

vulnerabilities/tests/test_api.py

@@ -489,6 +489,7 @@ def setUp(self):
         self.pkg_2_14_0_rc1 = from_purl(
             "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.0-rc1"
         )
+        self.pkg_2_12_6.calculate_version_rank
 
         set_as_fixing(package=self.pkg_2_12_6, vulnerability=self.vul3)
 
@@ -526,14 +527,14 @@ def test_api_packages_single_with_purl_in_query_num_queries(self):
             self.csrf_client.get(f"/api/packages/?purl={self.pkg_2_14_0_rc1.purl}", format="json")
 
     def test_api_packages_single_with_purl_no_version_in_query_num_queries(self):
-        with self.assertNumQueries(64):
+        with self.assertNumQueries(68):
             self.csrf_client.get(
                 f"/api/packages/?purl=pkg:maven/com.fasterxml.jackson.core/jackson-databind",
                 format="json",
             )
 
     def test_api_packages_bulk_search(self):
-        with self.assertNumQueries(45):
+        with self.assertNumQueries(49):
             packages = [self.pkg_2_12_6, self.pkg_2_12_6_1, self.pkg_2_13_1]
             purls = [p.purl for p in packages]
 
@@ -546,7 +547,7 @@ def test_api_packages_bulk_search(self):
             ).json()
 
     def test_api_packages_with_lookup(self):
-        with self.assertNumQueries(14):
+        with self.assertNumQueries(18):
             data = {"purl": self.pkg_2_12_6.purl}
 
             resp = self.csrf_client.post(
@@ -556,7 +557,7 @@ def test_api_packages_with_lookup(self):
             ).json()
 
     def test_api_packages_bulk_lookup(self):
-        with self.assertNumQueries(45):
+        with self.assertNumQueries(49):
             packages = [self.pkg_2_12_6, self.pkg_2_12_6_1, self.pkg_2_13_1]
             purls = [p.purl for p in packages]
 

vulnerabilities/tests/test_models.py

@@ -423,8 +423,11 @@ def test_sort_by_version(self):
             version="3.0.0",
         )
 
-        sorted_pkgs = requesting_package.sort_by_version(vuln_pkg_list)
-        first_sorted_item = sorted_pkgs[0]
+        requesting_package.calculate_version_rank
+
+        sorted_pkgs = Package.objects.filter(package_url__in=list_to_sort)
+
+        sorted_pkgs = list(sorted_pkgs)
 
         assert sorted_pkgs[0].purl == "pkg:npm/sequelize@3.9.1"
         assert sorted_pkgs[-1].purl == "pkg:npm/sequelize@3.40.1"