Merge pull request #331 from sbs2001/github-refs

Collect references from github  importer

Author: sbs2001

vulnerabilities/importer_yielder.py

@@ -179,7 +179,7 @@
         'data_source': 'GitHubAPIDataSource',
         'data_source_cfg': {
             'endpoint': 'https://api.github.com/graphql',
-            'ecosystems': ['MAVEN', 'NUGET', 'COMPOSER', 'PIP', 'RUBYGEMS']
+            'ecosystems': ['PIP']
         }
     },
     {

vulnerabilities/importers/github.py

@@ -60,6 +60,9 @@
                     value
                 }
                 summary
+                references {
+                    url
+                }
                 }
                 package {
                 name
@@ -158,6 +161,24 @@ def process_name(ecosystem: str, pkg_name: str) -> Optional[Tuple[Optional[str],
         if ecosystem == "NUGET" or ecosystem == "PIP" or ecosystem == "RUBYGEMS":
             return None, pkg_name
 
+    @staticmethod
+    def extract_references(reference_data):
+        references = []
+        for ref in reference_data:
+            url = ref["url"]
+            if "GHSA-" in url.upper():
+                reference = Reference(
+                    url=url,
+                    reference_id=url.split("/")[-1]
+                )
+            else:
+                reference = Reference(
+                    url=url
+                )
+            references.append(reference)
+
+        return references
+
     def collect_packages(self, ecosystem):
         packages = set()
         for page in self.advisories[ecosystem]:
@@ -194,22 +215,13 @@ def process_response(self) -> List[Advisory]:
                         unaffected_purls = set()
 
                     cve_ids = set()
-                    vuln_references = []
+                    vuln_references = self.extract_references(adv["node"]["advisory"]["references"])
                     vuln_desc = adv["node"]["advisory"]["summary"]
 
                     for vuln in adv["node"]["advisory"]["identifiers"]:
                         if vuln["type"] == "CVE":
                             cve_ids.add(vuln["value"])
 
-                        elif vuln["type"] == "GHSA":
-                            ghsa = vuln["value"]
-                            vuln_references.append(
-                                Reference(
-                                    reference_id=ghsa,
-                                    url="https://github.com/advisories/{}".format(ghsa),
-                                )
-                            )
-
                     for cve_id in cve_ids:
                         adv_list.append(
                             Advisory(

vulnerabilities/tests/test_data/github_api/response.json

@@ -15,7 +15,12 @@
                   "value": "CVE-2019-0199"
                 }
               ],
-              "summary": "Denial of Service in Tomcat"
+              "summary": "Denial of Service in Tomcat",
+              "references":[
+                {
+                  "url":"https://github.com/advisories/GHSA-qcxh-w3j9-58qr"
+                }
+              ]
             },
             "package": {
               "name": "org.apache.tomcat.embed:tomcat-embed-core"
@@ -36,7 +41,12 @@
                   "value": "CVE-2019-0199"
                 }
               ],
-              "summary": "Denial of Service in Tomcat"
+              "summary": "Denial of Service in Tomcat",
+              "references":[
+                {
+                  "url":"https://github.com/advisories/GHSA-qcxh-w3j9-58qr"
+                }
+              ]
             },
             "package": {
               "name": "org.apache.tomcat.embed:tomcat-embed-core"
@@ -57,7 +67,12 @@
                   "value": "CVE-2020-1938"
                 }
               ],
-              "summary": "Improper Input Validation in Tomcat"
+              "summary": "Improper Input Validation in Tomcat",
+              "references":[
+                {
+                  "url":"https://github.com/advisories/GHSA-c9hw-wf7x-jp9j"
+                }
+              ]
             },
             "package": {
               "name": "org.apache.tomcat.embed:tomcat-embed-core"
@@ -78,7 +93,12 @@
                   "value": "CVE-2020-1938"
                 }
               ],
-              "summary": "Improper Input Validation in Tomcat"
+              "summary": "Improper Input Validation in Tomcat",
+              "references":[
+                {
+                  "url":"https://github.com/advisories/GHSA-c9hw-wf7x-jp9j"
+                }
+              ]
             },
             "package": {
               "name": "org.apache.tomcat.embed:tomcat-embed-core"
@@ -99,7 +119,12 @@
                   "value": "CVE-2020-1938"
                 }
               ],
-              "summary": "Improper Input Validation in Tomcat"
+              "summary": "Improper Input Validation in Tomcat",
+              "references":[
+                {
+                  "url":"https://github.com/advisories/GHSA-c9hw-wf7x-jp9j"
+                }
+              ]
             },
             "package": {
               "name": "org.apache.tomcat.embed:tomcat-embed-core"