Collect severities at github importer

Signed-off-by: Shivam Sandbhor <shivam.sandbhor@gmail.com>

Author: sbs2001

vulnerabilities/importers/github.py

@@ -38,12 +38,13 @@
 from vulnerabilities.data_source import DataSource
 from vulnerabilities.data_source import DataSourceConfiguration
 from vulnerabilities.data_source import Reference
-
+from vulnerabilities.data_source import VulnerabilitySeverity
 from vulnerabilities.package_managers import MavenVersionAPI
 from vulnerabilities.package_managers import NugetVersionAPI
 from vulnerabilities.package_managers import ComposerVersionAPI
 from vulnerabilities.package_managers import PypiVersionAPI
 from vulnerabilities.package_managers import RubyVersionAPI
+from vulnerabilities.severity_systems import scoring_systems
 
 # set of all possible values of first '%s' = {'MAVEN','COMPOSER', 'NUGET', 'RUBYGEMS', 'PYPI'}
 # second '%s' is interesting, it will have the value '' for the first request,
@@ -63,6 +64,7 @@
                 references {
                     url
                 }
+                severity
                 }
                 package {
                 name
@@ -222,9 +224,24 @@ def process_response(self) -> List[Advisory]:
                     vuln_references = self.extract_references(adv["node"]["advisory"]["references"])
                     vuln_desc = adv["node"]["advisory"]["summary"]
 
-                    for vuln in adv["node"]["advisory"]["identifiers"]:
-                        if vuln["type"] == "CVE":
-                            cve_ids.add(vuln["value"])
+                    for identifier in adv["node"]["advisory"]["identifiers"]:
+                        # collect CVEs
+                        if identifier["type"] == "CVE":
+                            cve_ids.add(identifier["value"])
+
+                        # attach the GHSA with severity score
+                        if identifier["type"] == "GHSA":
+                            for ref in vuln_references:
+                                if ref.reference_id == identifier["value"]:
+                                    ref.severities = [
+                                        VulnerabilitySeverity(
+                                            system=scoring_systems["cvssv3.1_qr"],
+                                            value=adv["node"]["advisory"]["severity"]
+                                        )
+                                    ]
+                                    # Each Node has only one GHSA, hence exit after attaching
+                                    # score to this GHSA
+                                    break
 
                     for cve_id in cve_ids:
                         adv_list.append(
@@ -236,6 +253,7 @@ def process_response(self) -> List[Advisory]:
                                 vuln_references=vuln_references,
                             )
                         )
+                        print(adv_list[-1])
         return adv_list
 
     @staticmethod