Collected vulnerabilities from arch linux

Signed-off-by: Ayush Lohani <lohani.ayush01@gmail.com>

Author: lohani2280

vulnerabilities/data_dump.py

@@ -68,3 +68,25 @@ def ubuntu_dump(html):
             vulnerability=vulnerability,
             package=package
         )
+
+
+def archlinux_dump(extract_data):
+    """
+    Save data scraped from arch linux' security tracker.
+    """
+    for data in extract_data:
+        vulnerability = Vulnerability.objects.create(
+            summary='',
+        )
+        VulnerabilityReference.objects.create(
+            vulnerability=vulnerability,
+            reference_id=data.get('vulnerability_id', ''),
+        )
+        package = Package.objects.create(
+            name=data.get('package_name', ''),
+            version=data.get('fixed_version', ''),
+        )
+        ImpactedPackage.objects.create(
+            vulnerability=vulnerability,
+            package=package
+        )

vulnerabilities/scraper/archlinux.py

@@ -0,0 +1,59 @@
+#
+# Copyright (c) 2017 nexB Inc. and others. All rights reserved.
+# http://nexb.com and https://github.com/nexB/vulnerablecode/
+# The VulnerableCode software is licensed under the Apache License version 2.0.
+# Data generated with VulnerableCode require an acknowledgment.
+#
+# You may not use this software except in compliance with the License.
+# You may obtain a copy of the License at: http://apache.org/licenses/LICENSE-2.0
+# Unless required by applicable law or agreed to in writing, software distributed
+# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
+# CONDITIONS OF ANY KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations under the License.
+#
+# When you publish or redistribute any data created with VulnerableCode or any VulnerableCode
+# derivative work, you must accompany this data with the following acknowledgment:
+#
+#  Generated with VulnerableCode and provided on an "AS IS" BASIS, WITHOUT WARRANTIES
+#  OR CONDITIONS OF ANY KIND, either express or implied. No content created from
+#  VulnerableCode should be considered or used as legal advice. Consult an Attorney
+#  for any legal advice.
+#  VulnerableCode is a free software code scanning tool from nexB Inc. and others.
+#  Visit https://github.com/nexB/vulnerablecode/ for support and download.
+
+import json
+from urllib.request import urlopen
+
+
+ARCHLINUX_TRACKER_URL = 'https://security.archlinux.org/json'
+
+
+def extract_vulnerabilities(arch_data):
+    """
+    Return a sequence of mappings for each existing combination of
+    package and vulnerability from a mapping of arch linux vulnerabilities
+    data.
+    """
+    package_vulnerabilities = []
+
+    for item in arch_data:
+        if not item["name"] or not item["packages"][0]:
+            continue
+
+        package_vulnerabilities.append({
+                'package_name': item["packages"][0],
+                'vulnerability_id': item["name"],
+                'status': item["status"],
+                'severity': item["severity"],
+                'affected_version': item["affected"],
+                'fixed_version': item["fixed"]
+            })
+    return package_vulnerabilities
+
+
+def scrape_vulnerabilities():
+    """
+    Scrape arch linux' security tracker.
+    """
+    json_content = urlopen(ARCHLINUX_TRACKER_URL).read()
+    return extract_vulnerabilities(json.loads(json_content))