Make code review changes at PR #278

Signed-off-by: Shivam Sandbhor <shivam.sandbhor@gmail.com>

Author: sbs2001

vulnerabilities/helpers.py

@@ -43,6 +43,14 @@ def load_toml(path):
 
 
 def create_etag(data_src, url, etag_key):
+    """
+    Etags are like hashes of web responses. For a data source `data_src`,
+    we maintain (url, etag) mappings in the DB.  `create_etag`  creates
+    (`url`, etag) pair. If a (`url`, etag) already exists then the code
+    skips processing the response further to avoid duplicate work.
+
+    `etag_key` is the name of header which contains the etag for the url.
+    """
     etag = requests.head(url).headers.get(etag_key)
     if not etag:
         return True

vulnerabilities/importers/debian_oval.py

@@ -57,11 +57,9 @@ def __init__(self, *args, **kwargs):
         self.pkg_manager_api = DebianVersionAPI()
 
     def _fetch(self):
-        base_url = "https://www.debian.org/security/oval/"
-        file_name = "oval-definitions-{}.xml"
         releases = self.config.releases
         for release in releases:
-            file_url = base_url + file_name.format(release)
+            file_url = f"https://www.debian.org/security/oval/oval-definitions-{release}.xml"
             if not create_etag(data_src=self, url=file_url, etag_key="ETag"):
                 continue
 

vulnerabilities/importers/project_kb_msr2019.py

@@ -49,10 +49,6 @@ class ProjectKBMSRDataSource(DataSource):
     url = "https://raw.githubusercontent.com/SAP/project-kb/master/MSR2019/dataset/vulas_db_msr2019_release.csv"  # nopep8
 
     def updated_advisories(self):
-        # etag are like hashes of web responses. We maintain
-        # (url, etag) mappings in the DB. `create_etag`  creates
-        # (url, etag) pair. If a (url, etag) already exists then the code
-        # skips processing the response further to avoid duplicate work
         if create_etag(data_src=self, url=self.url, etag_key="ETag"):
             raw_data = self.fetch()
             advisories = self.to_advisories(raw_data)

vulnerabilities/importers/safety_db.py

@@ -31,12 +31,10 @@
 from typing import Mapping
 from typing import Set
 from typing import Tuple
-from urllib.error import HTTPError
-from urllib.request import urlopen
-import requests
 
 from dephell_specifier import RangeSpecifier
 from packageurl import PackageURL
+import requests
 from schema import Or
 from schema import Regex
 from schema import Schema
@@ -94,8 +92,7 @@ def set_api(self, packages):
 
     def _fetch(self) -> Mapping[str, Any]:
         if create_etag(data_src=self, url=self.config.url, etag_key="ETag"):
-            with urlopen(self.config.url) as response:
-                return json.load(response)
+            return requests.get(self.config.url).json()
 
         return []
 
@@ -142,13 +139,13 @@ def updated_advisories(self) -> Set[Advisory]:
 def categorize_versions(
     package_name: str,
     all_versions: Set[str],
-    version_specs: Iterable[str],
+    version_ranges: Iterable[str],
 ) -> Tuple[Set[PackageURL], Set[PackageURL]]:
     """
     :return: impacted, resolved purls
     """
     impacted_versions, impacted_purls = set(), set()
-    ranges = [RangeSpecifier(s) for s in version_specs]
+    ranges = [RangeSpecifier(s) for s in version_ranges]
 
     for version in all_versions:
         if any([version in r for r in ranges]):

vulnerabilities/importers/ubuntu.py

@@ -58,11 +58,9 @@ def __init__(self, *args, **kwargs):
         self.pkg_manager_api = LaunchpadVersionAPI()
 
     def _fetch(self):
-        base_url = "https://people.canonical.com/~ubuntu-security/oval/"
-        file_name = "com.ubuntu.{}.cve.oval.xml.bz2"
         releases = self.config.releases
         for release in releases:
-            file_url = base_url + file_name.format(release)
+            file_url = f"https://people.canonical.com/~ubuntu-security/oval/com.ubuntu.{release}.cve.oval.xml.bz2"  # nopep8
             if not create_etag(data_src=self, url=file_url, etag_key="ETag"):
                 continue
             resp = requests.get(file_url)