Properly parse Snyk fixed versions

Signed-off-by: Keshav Priyadarshi <git@keshav.space>
Signed-off-by: Michael Ehab Mikhail <michael.ehab@hotmail.com>

Author: keshav-space

vulntotal/datasources/snyk.py

@@ -8,6 +8,7 @@
 #
 
 import logging
+import re
 from typing import Iterable
 from urllib.parse import quote
 from urllib.parse import unquote_plus
@@ -23,6 +24,8 @@
 
 logger = logging.getLogger(__name__)
 
+fixed_version_pattern = re.compile(r"\b\d[\w.-]*\b")
+
 
 class SnykDataSource(DataSource):
     spdx_license_expression = "TODO"
@@ -272,19 +275,16 @@ def parse_html_advisory(advisory_html, snyk_id, affected, purl) -> VendorData:
     advisory_soup = BeautifulSoup(advisory_html, "html.parser")
     cve_span = advisory_soup.find("span", class_="cve")
     if cve_span:
-        cve_anchor = cve_span.find("a", class_="vue--anchor")
-        if cve_anchor:
+        if cve_anchor := cve_span.find("a", class_="vue--anchor"):
             aliases.append(cve_anchor.get("id"))
 
     how_to_fix = advisory_soup.find(
         "div", class_="vue--block vuln-page__instruction-block vue--block--instruction"
     )
-    if how_to_fix:
-        fixed = how_to_fix.find("p").text.split(" ")
-        if "Upgrade" in fixed:
-            lower = fixed.index("version") if "version" in fixed else fixed.index("versions")
-            upper = fixed.index("or")
-            fixed_versions = "".join(fixed[lower + 1 : upper]).split(",")
+
+    if how_to_fix and (fixed := how_to_fix.find("p").text):
+        fixed_versions = fixed_version_pattern.findall(fixed)
+
     aliases.append(snyk_id)
     return VendorData(
         purl=PackageURL(purl.type, purl.namespace, purl.name),

vulntotal/vulntotal_utils.py

@@ -13,10 +13,9 @@
 
 class GenericVersion:
     def __init__(self, version):
-        self.value = version.replace(" ", "").lstrip("v")
-
+        self.value = version
         self.decomposed = tuple(
-            [int(com) if com.isnumeric() else com for com in self.value.split(".")]
+            [com for com in self.value.replace(" ", "").lstrip("vV").split(".")]
         )
 
     def __str__(self):
@@ -25,17 +24,28 @@ def __str__(self):
     def __eq__(self, other):
         if not isinstance(other, self.__class__):
             return NotImplemented
-        return self.value.__eq__(other.value)
+        for i, j in zip(self.decomposed, other.decomposed):
+            if i.isnumeric() and j.isnumeric():
+                i = int(i)
+                j = int(j)
+            if not i.__eq__(j):
+                return False
+        return True
 
     def __lt__(self, other):
         if not isinstance(other, self.__class__):
             return NotImplemented
         for i, j in zip(self.decomposed, other.decomposed):
-            if not isinstance(i, type(j)):
+            if i.isnumeric() and j.isnumeric():
+                i = int(i)
+                j = int(j)
+            if i.__eq__(j):
                 continue
+            if i.__lt__(j):
+                return True
             if i.__gt__(j):
                 return False
-        return True
+        return False
 
     def __le__(self, other):
         if not isinstance(other, self.__class__):
@@ -57,8 +67,8 @@ def compare(version, package_comparator, package_version):
         "(": operator.gt,
         "[": operator.ge,
     }
-    compare = operator_comparator[package_comparator]
-    return compare(version, package_version)
+    compare_v = operator_comparator[package_comparator]
+    return compare_v(version, package_version)
 
 
 def parse_constraint(constraint):