Filter packages that do not have unfurled advisories

Signed-off-by: Tushar Goel <tushar.goel.dav@gmail.com>

Author: TG1999

vulnerabilities/api_v3.py

@@ -10,8 +10,11 @@
 from collections import defaultdict
 from urllib.parse import urlencode
 
+from django.db.models import Exists
 from django.db.models import Max
+from django.db.models import OuterRef
 from django.db.models import Prefetch
+from django.db.models import Q
 from django_filters import rest_framework as filters
 from drf_spectacular.utils import extend_schema
 from packageurl import PackageURL
@@ -30,6 +33,7 @@
 from vulnerabilities.models import AdvisoryWeakness
 from vulnerabilities.models import GroupedAdvisory
 from vulnerabilities.models import ImpactedPackageAffecting
+from vulnerabilities.models import ImpactedPackageFixedBy
 from vulnerabilities.models import PackageV2
 from vulnerabilities.throttling import PermissionBasedUserRateThrottle
 from vulnerabilities.utils import TYPES_WITH_MULTIPLE_IMPORTERS
@@ -467,7 +471,20 @@ def create(self, request, *args, **kwargs):
                 for p in map(PackageURL.from_string, purls)
             ]
 
+        affecting_exists = ImpactedPackageAffecting.objects.filter(
+            package_id=OuterRef("pk"),
+            impacted_package__advisory___all_impacts_unfurled=True,
+            impacted_package__advisory__is_latest=True,
+        )
+
+        fixed_by_exists = ImpactedPackageFixedBy.objects.filter(
+            package_id=OuterRef("pk"),
+            impacted_package__advisory___all_impacts_unfurled=True,
+            impacted_package__advisory__is_latest=True,
+        )
+
         if not details:
+            # Return back vulnerable PURLs only
             if ignore_qualifiers_subpath:
                 query = (
                     PackageV2.objects.filter_plain_purls(plain_purls)
@@ -481,6 +498,10 @@ def create(self, request, *args, **kwargs):
                     .values_list("package_url", flat=True)
                 )
 
+            query = query.annotate(
+                is_vulnerable=Exists(affecting_exists),
+            ).filter(is_vulnerable=True)
+
             page = self.paginate_queryset(query)
             return self.get_paginated_response(page)
 
@@ -489,6 +510,11 @@ def create(self, request, *args, **kwargs):
         else:
             query = PackageV2.objects.filter_purls(purls).order_by("package_url")
 
+        # Return all vulnerable and non vulnerable purls with details
+        query = query.annotate(
+            is_vulnerable=Exists(affecting_exists),
+            is_fixing=Exists(fixed_by_exists),
+        ).filter(Q(is_vulnerable=True) | Q(is_fixing=True))
         page = self.paginate_queryset(query)
         affected_advisory_map = get_affected_advisories_bulk(page)
         fixing_advisory_map = get_fixing_advisories_bulk(page)

vulnerabilities/models.py

@@ -3594,13 +3594,13 @@ def with_is_vulnerable(self):
         )
 
     def all_vulnerable(self):
-        latest_impacts = ImpactedPackageAffecting.objects.filter(
+        latest_unfurled_impacts = ImpactedPackageAffecting.objects.filter(
             package_id=OuterRef("pk"),
             impacted_package__advisory__is_latest=True,
             impacted_package__advisory___all_impacts_unfurled=True,
         )
 
-        query = PackageV2.objects.filter(Exists(latest_impacts))
+        query = PackageV2.objects.filter(Exists(latest_unfurled_impacts))
         return query
 
     def all_vulnerable_purls(self):