|
22 | 22 |
|
23 | 23 | import asyncio |
24 | 24 | import re |
25 | | -from typing import List, Set |
26 | | -import yaml |
| 25 | +from typing import Set |
27 | 26 |
|
| 27 | +import yaml |
| 28 | +from packageurl import PackageURL |
28 | 29 | from univers.version_specifier import VersionSpecifier |
29 | 30 | from univers.versions import SemverVersion |
30 | | -from packageurl import PackageURL |
31 | 31 |
|
32 | | -from vulnerabilities.data_source import Advisory, GitDataSource, Reference |
| 32 | +from vulnerabilities.data_source import Advisory |
| 33 | +from vulnerabilities.data_source import GitDataSource |
| 34 | +from vulnerabilities.helpers import split_markdown_front_matter |
33 | 35 | from vulnerabilities.package_managers import GitHubTagsAPI |
34 | 36 | from vulnerabilities.helpers import nearest_patched_package |
35 | 37 |
|
@@ -78,45 +80,6 @@ def get_pkg_versions_from_ranges(self, version_range_list): |
78 | 80 | safe_pkg_versions = set(all_version) - set(vuln_pkg_versions) |
79 | 81 | return safe_pkg_versions, vuln_pkg_versions |
80 | 82 |
|
81 | | - def get_data_from_yaml_lines(self, yaml_lines): |
82 | | - """Return a mapping of data from a iterable of yaml_lines |
83 | | - for example : |
84 | | - ['title: ISTIO-SECURITY-2019-001', |
85 | | - 'description: Incorrect access control.','cves: [CVE-2019-12243]'] |
86 | | -
|
87 | | - would give {'title':'ISTIO-SECURITY-2019-001', |
88 | | - 'description': 'Incorrect access control.', |
89 | | - 'cves': '[CVE-2019-12243]'} |
90 | | - """ |
91 | | - |
92 | | - return yaml.safe_load("\n".join(yaml_lines)) |
93 | | - |
94 | | - def get_yaml_lines(self, lines): |
95 | | - """The istio advisory file contains lines similar to yaml format . |
96 | | - This function extracts those lines and return an iterable of lines |
97 | | -
|
98 | | - for example : |
99 | | - lines = |
100 | | - --- |
101 | | - title: ISTIO-SECURITY-2019-001 |
102 | | - description: Incorrect access control. |
103 | | - cves: [CVE-2019-12243] |
104 | | - --- |
105 | | -
|
106 | | - get_yaml_lines(lines) would return |
107 | | - ['title: ISTIO-SECURITY-2019-001','description: Incorrect access control.' |
108 | | - ,'cves: [CVE-2019-12243]'] |
109 | | - """ |
110 | | - |
111 | | - for index, line in enumerate(lines): |
112 | | - line = line.strip() |
113 | | - if line.startswith("---") and index == 0: |
114 | | - continue |
115 | | - elif line.endswith("---"): |
116 | | - break |
117 | | - else: |
118 | | - yield line |
119 | | - |
120 | 83 | def process_file(self, path): |
121 | 84 |
|
122 | 85 | advisories = [] |
@@ -199,10 +162,10 @@ def process_file(self, path): |
199 | 162 | return advisories |
200 | 163 |
|
201 | 164 | def get_data_from_md(self, path): |
202 | | - """Return a mapping of vulnerability data from istio . The data is |
203 | | - in the form of yaml_lines inside a .md file. |
| 165 | + """Return a mapping of vulnerability data from istio. The data is |
| 166 | + in the form of yaml objects found inside front matter of the .md file. |
204 | 167 | """ |
205 | 168 |
|
206 | 169 | with open(path) as f: |
207 | | - yaml_lines = self.get_yaml_lines(f) |
208 | | - return self.get_data_from_yaml_lines(yaml_lines) |
| 170 | + yaml_lines, _ = split_markdown_front_matter(f.read()) |
| 171 | + return yaml.safe_load(yaml_lines) |
0 commit comments