Continue importing from github on InvalidVersion

Author: kipz

vulnerabilities/importers/github.py

@@ -23,7 +23,9 @@
 import asyncio
 import os
 import dataclasses
-import json
+import traceback
+import logging
+
 from typing import Set
 from typing import Tuple
 from typing import List
@@ -33,7 +35,7 @@
 import requests
 from packageurl import PackageURL
 from univers.version_specifier import VersionSpecifier
-from univers.versions import version_class_by_package_type
+from univers.versions import version_class_by_package_type, InvalidVersion
 
 from vulnerabilities.data_source import Advisory
 from vulnerabilities.data_source import DataSource
@@ -48,6 +50,8 @@
 from vulnerabilities.severity_systems import scoring_systems
 from vulnerabilities.helpers import nearest_patched_package
 
+logger = logging.getLogger(__name__)
+
 # set of all possible values of first '%s' = {'MAVEN','COMPOSER', 'NUGET', 'RUBYGEMS', 'PYPI'}
 # second '%s' is interesting, it will have the value '' for the first request,
 # since we don't have any value for endCursor at the beginning
@@ -265,9 +269,14 @@ def categorize_versions(
         affected_versions = []
         unaffected_versions = []
         for version in all_versions:
-            if version_class(version) in version_range:
-                affected_versions.append(version)
-            else:
-                unaffected_versions.append(version)
+            try:
+                if version_class(version) in version_range:
+                    affected_versions.append(version)
+                else:
+                    unaffected_versions.append(version)
+            except InvalidVersion:
+                logger.error (
+                    f"Failed to parse version: {version!r}:\n" + traceback.format_exc()
+                )
 
         return (affected_versions, unaffected_versions)

vulnerabilities/tests/test_github.py

@@ -63,7 +63,7 @@ def tearDown(self):
 
     def test_categorize_versions(self):
         eg_version_range = ">= 3.3.0, < 3.3.5"
-        eg_versions = ["3.3.6", "3.3.0", "3.3.4", "3.2.0"]
+        eg_versions = ["3.3.6", "3.3.0", "3.3.4", "3.2.0", "0.1-charmander"]
 
         aff_vers, safe_vers = self.data_src.categorize_versions(
             "pypi", eg_version_range, eg_versions