add parsing for spdx license expression make affected version range optional

Signed-off-by: Tushar Goel <tushar.goel.dav@gmail.com>

Author: TG1999

vulnerabilities/importer.py

@@ -41,6 +41,7 @@
 from packageurl import PackageURL
 from univers.version_range import VersionRange
 from univers.versions import Version
+from license_expression import Licensing
 
 from vulnerabilities.helpers import classproperty
 from vulnerabilities.helpers import nearest_patched_package
@@ -117,22 +118,24 @@ class AffectedPackage:
     """
     Contains a range of affected versions and a fixed version of a given package
     The PackageURL supplied must *not* have a version
+    It must contain either `affected_version_range` or `fixed_version`
     """
 
     package: PackageURL
-    affected_version_range: VersionRange
+    affected_version_range: Optional[VersionRange]
     fixed_version: Optional[Version] = None
 
     def __post_init__(self):
-        if self.package.version:
+        if self.package.version or not (self.affected_version_range or self.fixed_version):
             raise ValueError
 
     def get_fixed_purl(self):
         """
         Return PackageURL corresponding to object's fixed_version
         """
-        fixed_version = self.fixed_version
-        fixed_purl = self.package._replace(version=str(fixed_version))
+        if not self.fixed_version:
+            raise ValueError
+        fixed_purl = self.package._replace(version=str(self.fixed_version))
         return fixed_purl
 
     @classmethod
@@ -228,6 +231,13 @@ class Importer:
     def __init__(self):
         if not self.spdx_license_expression:
             raise Exception(f"Cannot run importer {self!r} without a license")
+        licensing = Licensing()
+        try:
+            licensing.parse(self.spdx_license_expression)
+        except:
+            raise Exception(
+                f"{self.spdx_license_expression} is not a valid spdx license expression"
+            )
 
     @classproperty
     def qualified_name(cls):

vulnerabilities/importers/alpine_linux.py

@@ -28,18 +28,24 @@
 
 import requests
 from bs4 import BeautifulSoup
+from packageurl import PackageURL
+from univers.versions import AlpineLinuxVersion
 
 from vulnerabilities.helpers import is_cve
 from vulnerabilities.importer import AdvisoryData
+from vulnerabilities.importer import AffectedPackage
 from vulnerabilities.importer import Importer
 from vulnerabilities.importer import Reference
 
 
 class AlpineImporter(Importer):
+    spdx_license_expression = "CC-BY-SA-4.0"
+
     def advisory_data(self) -> Iterable[AdvisoryData]:
+        advisories = []
         advisory_links = fetch_advisory_links()
         for link in advisory_links:
-            yield (process_link(link))
+            advisories.extend(process_link(link))
 
 
 def fetch_advisory_links():
@@ -74,26 +80,39 @@ def process_link(link) -> List[AdvisoryData]:
         return advisories
 
     for package in record["packages"]:
+        assert isinstance(record["archs"], Iterable[str])
+        assert isinstance(record["reponame"], str)
+        assert isinstance(record["distroversion"], str)
         advisories.extend(
             load_advisories(
                 package["pkg"],
+                record["distroversion"],
+                record["reponame"],
+                record["archs"],
             )
         )
     return advisories
 
 
 def load_advisories(
     pkg_infos: Mapping[str, Any],
+    distroversion: str,
+    reponame: str,
+    archs: Iterable[str],
 ) -> Iterable[AdvisoryData]:
 
+    if not (pkg_infos.get("name") and isinstance(pkg_infos["name"], str)):
+        return []
+
     assert isinstance(pkg_infos["secfixes"], Mapping[str, List])
 
-    for fixed_vulns in pkg_infos["secfixes"].values():
+    for version, fixed_vulns in pkg_infos["secfixes"].items():
 
         if fixed_vulns is None:
             continue
 
         for vuln_ids in fixed_vulns:
+            assert isinstance(vuln_ids, str)
             vuln_ids = vuln_ids.split()
             references = []
             for reference_id in vuln_ids[1:]:
@@ -127,6 +146,20 @@ def load_advisories(
             yield AdvisoryData(
                 summary="",
                 references=references,
-                affected_packages=[],
+                affected_packages=[
+                    AffectedPackage(
+                        package=PackageURL(
+                            type="alpine",
+                            name=pkg_infos["name"],
+                            qualifiers={
+                                "arch": arch,
+                                "distroversion": distroversion,
+                                "reponame": reponame,
+                            },
+                        ),
+                        fixed_version=AlpineLinuxVersion(version),
+                    )
+                    for arch in archs
+                ],
                 aliases=[vuln_ids[0] if is_cve(vuln_ids[0]) else ""],
             )