add support for all osv ecosystems

Signed-off-by: ziadhany <ziadhany2016@gmail.com>

Author: ziadhany

vulnerabilities/importers/osv.py

@@ -64,7 +64,9 @@ def parse_advisory_data(raw_data: dict, supported_ecosystem) -> Optional[Advisor
         )
 
         for fixed_range in affected_pkg.get("ranges") or []:
-            fixed_version = get_fixed_versions(fixed_range=fixed_range, raw_id=raw_id)
+            fixed_version = get_fixed_versions(
+                fixed_range=fixed_range, raw_id=raw_id, supported_ecosystem=supported_ecosystem
+            )
 
             for version in fixed_version:
                 affected_packages.append(
@@ -199,18 +201,19 @@ def get_affected_version_range(affected_pkg, raw_id, supported_ecosystem):
             )
 
 
-def get_fixed_versions(fixed_range, raw_id) -> List[Version]:
+def get_fixed_versions(fixed_range, raw_id, supported_ecosystem) -> List[Version]:
     """
     Return a list of unique fixed univers Versions given a ``fixed_range``
     univers VersionRange and a ``raw_id``.
 
     For example::
 
-    >>> get_fixed_versions(fixed_range={}, raw_id="GHSA-j3f7-7rmc-6wqj")
+    >>> get_fixed_versions(fixed_range={}, raw_id="GHSA-j3f7-7rmc-6wqj", supported_ecosystem="pypi",)
     []
     >>> get_fixed_versions(
     ...   fixed_range={"type": "ECOSYSTEM", "events": [{"fixed": "1.7.0"}]},
-    ...   raw_id="GHSA-j3f7-7rmc-6wqj"
+    ...   raw_id="GHSA-j3f7-7rmc-6wqj",
+    ...   supported_ecosystem="pypi",
     ... )
     [PypiVersion(string='1.7.0')]
     """
@@ -221,21 +224,32 @@ def get_fixed_versions(fixed_range, raw_id) -> List[Version]:
 
     fixed_range_type = fixed_range["type"]
 
-    for version in extract_fixed_versions(fixed_range):
+    version_class = None
+    try:
+        version_class = RANGE_CLASS_BY_SCHEMES[supported_ecosystem].version_class
+    except KeyError:
+        logger.error(
+            f"Unknown version range for ecosystem {supported_ecosystem} for OSV id: {raw_id!r}"
+        )
 
-        # FIXME: ECOSYSTEM does not imply PyPI!!!!
+    for version in extract_fixed_versions(fixed_range):
         if fixed_range_type == "ECOSYSTEM":
             try:
-                fixed_versions.append(PypiVersion(version))
+                if not version_class:
+                    raise InvalidVersion(
+                        f"Unsupported version for ecosystem: {supported_ecosystem}"
+                    )
+                fixed_versions.append(version_class(version))
             except InvalidVersion:
-                logger.error(f"Invalid PypiVersion: {version!r} for OSV id: {raw_id!r}")
+                logger.error(
+                    f"Invalid version class: {version_class} - {version!r} for OSV id: {raw_id!r}"
+                )
 
         elif fixed_range_type == "SEMVER":
             try:
                 fixed_versions.append(SemverVersion(version))
             except InvalidVersion:
                 logger.error(f"Invalid SemverVersion: {version!r} for OSV id: {raw_id!r}")
-
         else:
             logger.error(f"Unsupported fixed version type: {version!r} for OSV id: {raw_id!r}")
 

vulnerabilities/tests/test_osv.py

@@ -13,6 +13,7 @@
 from univers.version_constraint import VersionConstraint
 from univers.version_range import PypiVersionRange
 from univers.versions import PypiVersion
+from univers.versions import SemverVersion
 
 from vulnerabilities.importer import Reference
 from vulnerabilities.importer import VulnerabilitySeverity
@@ -349,12 +350,18 @@ def test_get_affected_version_range(self):
         assert results == expected
 
     def test_get_fixed_versions1(self):
-        assert get_fixed_versions(fixed_range={}, raw_id="GHSA-j3f7-7rmc-6wqj") == []
+        assert (
+            get_fixed_versions(
+                fixed_range={}, raw_id="GHSA-j3f7-7rmc-6wqj", supported_ecosystem="pypi"
+            )
+            == []
+        )
 
     def test_get_fixed_versions2(self):
         results = get_fixed_versions(
             fixed_range={"type": "ECOSYSTEM", "events": [{"introduced": "0"}, {"fixed": "1.7.0"}]},
             raw_id="GHSA-j3f7-7rmc-6wqj",
+            supported_ecosystem="pypi",
         )
         assert results == [PypiVersion("1.7.0")]
 
@@ -370,6 +377,19 @@ def test_get_fixed_versions3(self):
                 ],
             },
             raw_id="GHSA-j3f7-7rmc-6wqj",
+            supported_ecosystem="pypi",
         )
 
         assert results == [PypiVersion("9.0.0"), PypiVersion("9.0.1")]
+
+    def test_get_fixed_versions4(self):
+        results = get_fixed_versions(
+            fixed_range={
+                "type": "ECOSYSTEM",
+                "events": [{"introduced": "0"}, {"fixed": "6.5.4"}],
+            },
+            raw_id="GHSA-r9p9-mrjm-926w",
+            supported_ecosystem="npm",
+        )
+
+        assert results == [SemverVersion("6.5.4")]