Skip to content

Commit 47f6ae6

Browse files
TG1999TG1999
authored
Merge pull request #693 from TG1999/fix/default_improver
Allow default improver to improve without affected packages
2 parents d1f2198 + bc94910 commit 47f6ae6

10 files changed

Lines changed: 519 additions & 44 deletions

File tree

‎vulnerabilities/importers/alpine_linux.py‎

Lines changed: 0 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -245,21 +245,3 @@ def load_advisories(
245245
affected_packages=affected_packages,
246246
aliases=aliases,
247247
)
248-
249-
250-
class AlpineBasicImprover(Improver):
251-
@property
252-
def interesting_advisories(self) -> QuerySet:
253-
return Advisory.objects.filter(created_by=AlpineImporter.qualified_name)
254-
255-
def get_inferences(self, advisory_data: AdvisoryData) -> Iterable[Inference]:
256-
"""
257-
Generate and return Inferences for the given advisory data
258-
"""
259-
for affected_package in advisory_data.affected_packages:
260-
fixed_purl = affected_package.get_fixed_purl()
261-
yield Inference.from_advisory_data(
262-
advisory_data,
263-
confidence=MAX_CONFIDENCE,
264-
fixed_purl=fixed_purl,
265-
)

‎vulnerabilities/importers/nvd.py‎

Lines changed: 0 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -195,14 +195,3 @@ def extract_severity_scores(cve_item):
195195
system=severity_systems.CVSSV2_VECTOR,
196196
value=str(cvss_v2.get("vectorString") or ""),
197197
)
198-
199-
200-
class NVDBasicImprover(Improver):
201-
@property
202-
def interesting_advisories(self) -> QuerySet:
203-
return Advisory.objects.filter(created_by=NVDImporter.qualified_name)
204-
205-
def get_inferences(self, advisory_data: AdvisoryData) -> Iterable[Inference]:
206-
yield Inference.from_advisory_data(
207-
advisory_data=advisory_data, confidence=100, fixed_purl=None
208-
)

‎vulnerabilities/improver.py‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -67,12 +67,14 @@ def to_dict(self):
6767
"""
6868
return {
6969
"vulnerability_id": self.vulnerability_id,
70-
"aliases": [alias for alias in self.aliases],
70+
"aliases": [alias for alias in self.aliases or []],
7171
"confidence": self.confidence,
7272
"summary": self.summary,
73-
"affected_purls": [affected_purl.to_dict() for affected_purl in self.affected_purls],
74-
"fixed_purl": self.fixed_purl.to_dict(),
75-
"references": [ref.to_dict() for ref in self.references],
73+
"affected_purls": [
74+
affected_purl.to_dict() for affected_purl in self.affected_purls or []
75+
],
76+
"fixed_purl": self.fixed_purl.to_dict() if self.fixed_purl else None,
77+
"references": [ref.to_dict() for ref in self.references or []],
7678
}
7779

7880
@classmethod

‎vulnerabilities/improvers/__init__.py‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,9 +27,7 @@
2727
IMPROVERS_REGISTRY = [
2828
default.DefaultImprover,
2929
importers.nginx.NginxBasicImprover,
30-
importers.alpine_linux.AlpineBasicImprover,
3130
importers.github.GitHubBasicImprover,
32-
importers.nvd.NVDBasicImprover,
3331
]
3432

3533
IMPROVERS_REGISTRY = {x.qualified_name: x for x in IMPROVERS_REGISTRY}

‎vulnerabilities/improvers/default.py‎

Lines changed: 19 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -50,15 +50,25 @@ def interesting_advisories(self) -> QuerySet:
5050
return Advisory.objects.all()
5151

5252
def get_inferences(self, advisory_data: AdvisoryData) -> Iterable[Inference]:
53-
for affected_package in advisory_data.affected_packages:
54-
affected_purls, fixed_purl = get_exact_purls(affected_package)
55-
yield Inference(
56-
aliases=advisory_data.aliases,
57-
confidence=MAX_CONFIDENCE,
58-
summary=advisory_data.summary,
59-
affected_purls=affected_purls,
60-
fixed_purl=fixed_purl,
61-
references=advisory_data.references,
53+
54+
if not advisory_data:
55+
return None
56+
57+
if advisory_data.affected_packages:
58+
for affected_package in advisory_data.affected_packages:
59+
affected_purls, fixed_purl = get_exact_purls(affected_package)
60+
yield Inference(
61+
aliases=advisory_data.aliases,
62+
confidence=MAX_CONFIDENCE,
63+
summary=advisory_data.summary,
64+
affected_purls=affected_purls,
65+
fixed_purl=fixed_purl,
66+
references=advisory_data.references,
67+
)
68+
69+
else:
70+
yield Inference.from_advisory_data(
71+
advisory_data, confidence=MAX_CONFIDENCE, fixed_purl=None
6272
)
6373

6474

‎vulnerabilities/tests/test_data/default_improver/alpine-expected.json‎

Lines changed: 184 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,184 @@
1+
[
2+
{
3+
"vulnerability_id": null,
4+
"aliases": [],
5+
"confidence": 100,
6+
"summary": null,
7+
"affected_purls": [],
8+
"fixed_purl": {
9+
"type": "alpine",
10+
"namespace": null,
11+
"name": "xen",
12+
"version": "4.10.0-r1",
13+
"qualifiers": {
14+
"arch": "aarch64",
15+
"distroversion": "v3.11",
16+
"reponame": "main"
17+
},
18+
"subpath": null
19+
},
20+
"references": [
21+
{
22+
"reference_id": "XSA-248",
23+
"url": "https://xenbits.xen.org/xsa/advisory-248.html",
24+
"severities": []
25+
}
26+
]
27+
},
28+
{
29+
"vulnerability_id": null,
30+
"aliases": [],
31+
"confidence": 100,
32+
"summary": null,
33+
"affected_purls": [],
34+
"fixed_purl": {
35+
"type": "alpine",
36+
"namespace": null,
37+
"name": "xen",
38+
"version": "4.10.0-r1",
39+
"qualifiers": {
40+
"arch": "armhf",
41+
"distroversion": "v3.11",
42+
"reponame": "main"
43+
},
44+
"subpath": null
45+
},
46+
"references": [
47+
{
48+
"reference_id": "XSA-248",
49+
"url": "https://xenbits.xen.org/xsa/advisory-248.html",
50+
"severities": []
51+
}
52+
]
53+
},
54+
{
55+
"vulnerability_id": null,
56+
"aliases": [],
57+
"confidence": 100,
58+
"summary": null,
59+
"affected_purls": [],
60+
"fixed_purl": {
61+
"type": "alpine",
62+
"namespace": null,
63+
"name": "xen",
64+
"version": "4.10.0-r1",
65+
"qualifiers": {
66+
"arch": "armv7",
67+
"distroversion": "v3.11",
68+
"reponame": "main"
69+
},
70+
"subpath": null
71+
},
72+
"references": [
73+
{
74+
"reference_id": "XSA-248",
75+
"url": "https://xenbits.xen.org/xsa/advisory-248.html",
76+
"severities": []
77+
}
78+
]
79+
},
80+
{
81+
"vulnerability_id": null,
82+
"aliases": [],
83+
"confidence": 100,
84+
"summary": null,
85+
"affected_purls": [],
86+
"fixed_purl": {
87+
"type": "alpine",
88+
"namespace": null,
89+
"name": "xen",
90+
"version": "4.10.0-r1",
91+
"qualifiers": {
92+
"arch": "ppc64le",
93+
"distroversion": "v3.11",
94+
"reponame": "main"
95+
},
96+
"subpath": null
97+
},
98+
"references": [
99+
{
100+
"reference_id": "XSA-248",
101+
"url": "https://xenbits.xen.org/xsa/advisory-248.html",
102+
"severities": []
103+
}
104+
]
105+
},
106+
{
107+
"vulnerability_id": null,
108+
"aliases": [],
109+
"confidence": 100,
110+
"summary": null,
111+
"affected_purls": [],
112+
"fixed_purl": {
113+
"type": "alpine",
114+
"namespace": null,
115+
"name": "xen",
116+
"version": "4.10.0-r1",
117+
"qualifiers": {
118+
"arch": "s390x",
119+
"distroversion": "v3.11",
120+
"reponame": "main"
121+
},
122+
"subpath": null
123+
},
124+
"references": [
125+
{
126+
"reference_id": "XSA-248",
127+
"url": "https://xenbits.xen.org/xsa/advisory-248.html",
128+
"severities": []
129+
}
130+
]
131+
},
132+
{
133+
"vulnerability_id": null,
134+
"aliases": [],
135+
"confidence": 100,
136+
"summary": null,
137+
"affected_purls": [],
138+
"fixed_purl": {
139+
"type": "alpine",
140+
"namespace": null,
141+
"name": "xen",
142+
"version": "4.10.0-r1",
143+
"qualifiers": {
144+
"arch": "x86",
145+
"distroversion": "v3.11",
146+
"reponame": "main"
147+
},
148+
"subpath": null
149+
},
150+
"references": [
151+
{
152+
"reference_id": "XSA-248",
153+
"url": "https://xenbits.xen.org/xsa/advisory-248.html",
154+
"severities": []
155+
}
156+
]
157+
},
158+
{
159+
"vulnerability_id": null,
160+
"aliases": [],
161+
"confidence": 100,
162+
"summary": null,
163+
"affected_purls": [],
164+
"fixed_purl": {
165+
"type": "alpine",
166+
"namespace": null,
167+
"name": "xen",
168+
"version": "4.10.0-r1",
169+
"qualifiers": {
170+
"arch": "x86_64",
171+
"distroversion": "v3.11",
172+
"reponame": "main"
173+
},
174+
"subpath": null
175+
},
176+
"references": [
177+
{
178+
"reference_id": "XSA-248",
179+
"url": "https://xenbits.xen.org/xsa/advisory-248.html",
180+
"severities": []
181+
}
182+
]
183+
}
184+
]

0 commit comments

Comments
 (0)