Add firstPatchedVersion in github API

Signed-off-by: Tushar Goel <tushar.goel.dav@gmail.com>

Author: TG1999

vulnerabilities/importers/github.py

@@ -30,6 +30,7 @@
 from dateutil import parser as dateparser
 from django.db.models.query import QuerySet
 from packageurl import PackageURL
+from univers.version_range import RANGE_CLASS_BY_SCHEMES
 from univers.version_range import build_range_from_github_advisory_constraint
 
 from vulnerabilities import severity_systems
@@ -153,6 +154,9 @@
                     severity
                     publishedAt
                 }
+                firstPatchedVersion{
+                    identifier
+                }
                 package {
                     name
                 }
@@ -236,7 +240,6 @@ def process_response(resp: dict, package_type: str) -> Iterable[AdvisoryData]:
         return
 
     for vulnerability in vulnerabilities:
-        affected_packages = []
         aliases = set()
         github_advisory = get_item(vulnerability, "node")
         if not github_advisory:
@@ -249,28 +252,29 @@ def process_response(resp: dict, package_type: str) -> Iterable[AdvisoryData]:
             continue
 
         purl = get_purl(pkg_type=package_type, github_name=name)
-        if not purl:
-            continue
-
         vulnerable_range = get_item(github_advisory, "vulnerableVersionRange")
-        if not vulnerable_range:
-            logger.error(f"No affected range found in {github_advisory!r}")
-            continue
-
+        fixed_version = get_item(github_advisory, "firstPatchedVersion", "identifier")
         affected_range = None
         try:
             affected_range = build_range_from_github_advisory_constraint(
                 package_type, vulnerable_range
             )
-        except InvalidVersionRange:
-            logger.error(f"Could not parse affected range {vulnerable_range!r}")
-            continue
-
-        if affected_range != NotImplementedError:
+        except InvalidVersionRange as e:
+            logger.error(f"Could not parse affected range {vulnerable_range!r} {e!r}")
+            affected_range = None
+        if fixed_version:
+            try:
+                RANGE_CLASS_BY_SCHEMES[package_type].version_class(fixed_version)
+            except Exception as e:
+                logger.error(f"Invalid fixed version {fixed_version!r} {e!r}")
+                fixed_version = None
+        affected_packages = []
+        if purl and (affected_range or fixed_version):
             affected_packages.append(
                 AffectedPackage(
                     package=purl,
                     affected_version_range=affected_range,
+                    fixed_version=fixed_version,
                 )
             )
 

vulnerabilities/tests/test_data/github_api/composer-expected.json

@@ -163,7 +163,7 @@
           "subpath": null
         },
         "affected_version_range": "vers:composer/<22.1.0",
-        "fixed_version": null
+        "fixed_version": "22.1.0"
       }
     ],
     "references": [

vulnerabilities/tests/test_data/github_api/composer.json

@@ -150,6 +150,9 @@
             "package": {
               "name": "librenms/librenms"
             },
+            "firstPatchedVersion": {
+              "identifier" :"22.1.0"
+            },
             "vulnerableVersionRange": "< 22.1.0"
           }
         }

vulnerabilities/tests/test_data/github_api/gem-expected.json

@@ -16,7 +16,7 @@
           "subpath": null
         },
         "affected_version_range": "vers:gem/<=1.3.1",
-        "fixed_version": null
+        "fixed_version": "1.3.2"
       }
     ],
     "references": [

vulnerabilities/tests/test_data/github_api/gem.json

@@ -57,6 +57,9 @@
             "package": {
               "name": "webrick"
             },
+            "firstPatchedVersion": {
+              "identifier" :"1.3.2"
+            },
             "vulnerableVersionRange": "<= 1.3.1"
           }
         },

vulnerabilities/tests/test_data/github_api/golang-expected.json

@@ -16,7 +16,7 @@
           "subpath": null
         },
         "affected_version_range": "vers:golang/<1.3.3",
-        "fixed_version": null
+        "fixed_version": "1.3.3"
       }
     ],
     "references": [

vulnerabilities/tests/test_data/github_api/golang.json

@@ -45,6 +45,9 @@
             "package": {
               "name": "github.com/moby/moby"
             },
+            "firstPatchedVersion": {
+              "identifier" :"1.3.3"
+            },
             "vulnerableVersionRange": "< 1.3.3"
           }
         },

vulnerabilities/tests/test_data/github_api/maven-expected.json

@@ -152,7 +152,7 @@
           "subpath": null
         },
         "affected_version_range": "vers:maven/>=9.0.0|<9.0.31",
-        "fixed_version": null
+        "fixed_version": "9.0.1"
       }
     ],
     "references": [

vulnerabilities/tests/test_data/github_api/maven.json

@@ -139,6 +139,9 @@
             "package": {
               "name": "org.apache.tomcat.embed:tomcat-embed-core"
             },
+            "firstPatchedVersion": {
+              "identifier" :"9.0.1"
+            },
             "vulnerableVersionRange": ">= 9.0.0, < 9.0.31"
           }
         }

vulnerabilities/tests/test_data/github_api/nuget-expected.json

@@ -16,7 +16,7 @@
           "subpath": null
         },
         "affected_version_range": "vers:nuget/<=4.5.1-alpha001",
-        "fixed_version": null
+        "fixed_version": "4.5.1"
       }
     ],
     "references": [