Refactor all importers to work with VulnerabilityReferenceArgs dataclass

Signed-off-by: Shivam Sandbhor <shivam.sandbhor@gmail.com>

Author: sbs2001

vulnerabilities/importers/alpine_linux.py

@@ -34,6 +34,7 @@
 
 from vulnerabilities.data_source import Advisory
 from vulnerabilities.data_source import GitDataSource
+from  vulnerabilities.data_source import VulnerabilityReferenceUnit
 
 
 def validate_schema(advisory_dict):
@@ -136,12 +137,34 @@ def _load_advisories(
 
             for vuln_ids in fixed_vulns:
                 vuln_ids = vuln_ids.split()
+                references = []
+                for reference_id in vuln_ids[1:]:
+
+                    if reference_id.startswith('XSA'):
+                        xsa_id = reference_id.split('-')[-1]
+                        references.append(VulnerabilityReferenceUnit(
+                            reference_id=reference_id,
+                            url='https://xenbits.xen.org/xsa/advisory-{}.html'.format(xsa_id) 
+                        ))
+                    
+                    elif reference_id.startswith('ZBX'):
+                        references.append(VulnerabilityReferenceUnit(
+                            reference_id=reference_id,
+                            url='https://support.zabbix.com/browse/{}'.format(reference_id) 
+                        ))
+
+                    elif reference_id.startswith('wnpa-sec'):
+                        references.append(VulnerabilityReferenceUnit(
+                            reference_id=reference_id,
+                            url='https://www.wireshark.org/security/{}.html'.format(reference_id) 
+                        ))
+                    
 
                 advisories.append(Advisory(
                     summary='',
                     impacted_package_urls=[],
                     resolved_package_urls=resolved_purls,
-                    reference_ids=vuln_ids[1:],
+                    vuln_references=references,
                     cve_id=vuln_ids[0] if vuln_ids[0] != 'CVE-????-?????' else None,
                 ))
 

vulnerabilities/importers/archlinux.py

@@ -31,7 +31,7 @@
 from packageurl import PackageURL
 from schema import Regex, Schema, Or
 
-from vulnerabilities.data_source import DataSource, DataSourceConfiguration, Advisory
+from vulnerabilities.data_source import DataSource, DataSourceConfiguration, Advisory,VulnerabilityReferenceUnit
 
 
 def validate_schema(advisory_dict):
@@ -101,14 +101,25 @@ def _parse(self, record) -> List[Advisory]:
                         version=record['fixed'],
                     ))
 
-            reference_urls = [f'https://security.archlinux.org/{a}' for a in record['advisories']]
-
+            vuln_references = []
+            vuln_references.append(VulnerabilityReferenceUnit(
+                reference_id=record['name'],
+                url='https://security.archlinux.org/{}'.format(record['name']))
+                )
+             
+            for ref in record['advisories']:
+                vuln_references.append(VulnerabilityReferenceUnit(
+                    reference_id=ref,
+                    url='https://security.archlinux.org/{}'.format(record['name'])))
+            print(vuln_references)
+            
+ 
             advisories.append(Advisory(
                 cve_id=cve_id,
                 summary='',
                 impacted_package_urls=impacted_purls,
                 resolved_package_urls=resolved_purls,
-                reference_urls=reference_urls,
+                vuln_references=vuln_references
             ))
 
         return advisories

vulnerabilities/importers/debian.py

@@ -37,6 +37,7 @@
 from vulnerabilities.data_source import Advisory
 from vulnerabilities.data_source import DataSource
 from vulnerabilities.data_source import DataSourceConfiguration
+from vulnerabilities.data_source import VulnerabilityReferenceUnit
 
 
 def validate_schema(advisory_dict):
@@ -131,18 +132,21 @@ def _parse(self, pkg_name: str, records: Mapping[str, Any]) -> List[Advisory]:
                         qualifiers={'distro': release_name},
                     ))
 
-            reference_urls = []
+            references = []
             debianbug = record.get('debianbug')
             if debianbug:
                 bug_url = f'https://bugs.debian.org/cgi-bin/bugreport.cgi?bug={debianbug}'
-                reference_urls.append(bug_url)
+                references.append(VulnerabilityReferenceUnit(
+                    url=bug_url,
+                    reference_id=debianbug
+                ))
 
             advisories.append(Advisory(
                 cve_id=cve_id,
                 summary=record.get('description', ''),
                 impacted_package_urls=impacted_purls,
                 resolved_package_urls=resolved_purls,
-                reference_urls=reference_urls,
+                vuln_references=references,
             ))
 
         return advisories

vulnerabilities/importers/gentoo.py

@@ -28,6 +28,7 @@
 
 from vulnerabilities.data_source import GitDataSource
 from vulnerabilities.data_source import Advisory
+from vulnerabilities.data_source import VulnerabilityReferenceUnit
 
 
 class GentooDataSource(GitDataSource):
@@ -51,6 +52,8 @@ def process_file(self, file):
         xml_data = {}
         xml_root = ET.parse(file).getroot()
         glsa = "GLSA-" + xml_root.attrib["id"]
+        vuln_reference = [VulnerabilityReferenceUnit(reference_id=glsa ,url="https://security.gentoo.org/glsa/{}".format(xml_root.attrib["id"]))]
+
         for child in xml_root:
             if child.tag == "references":
                 xml_data["cves"] = self.cves_from_reference(child)
@@ -73,7 +76,7 @@ def process_file(self, file):
                 summary=xml_data["description"],
                 impacted_package_urls=xml_data["affected_purls"],
                 resolved_package_urls=xml_data["unaffected_purls"],
-                reference_ids=[glsa],
+                vuln_references=vuln_reference
             )
             advisory_list.append(advisory)
         return advisory_list

vulnerabilities/importers/npm.py

@@ -37,6 +37,7 @@
 
 from vulnerabilities.data_source import Advisory
 from vulnerabilities.data_source import DataSource
+from vulnerabilities.data_source import VulnerabilityReferenceUnit
 
 NPM_URL = 'https://registry.npmjs.org{}'
 PAGE = '/-/npm/v1/security/advisories?perPage=100&page=0'
@@ -109,16 +110,19 @@ def _parse(self, records: List[Mapping[str, Any]]) -> List[Advisory]:
 
             impacted_purls = _versions_to_purls(package_name, impacted_versions)
             resolved_purls = _versions_to_purls(package_name, resolved_versions)
+            vuln_reference = [VulnerabilityReferenceUnit(
+                    url=NPM_URL.format(f'/-/npm/v1/advisories/{record["id"]}'),
+                    reference_id=record['id'] 
+                )]
 
             for cve_id in record.get('cves') or ['']:
                 advisories.append(Advisory(
                     summary=record.get('overview', ''),
                     cve_id=cve_id,
                     impacted_package_urls=impacted_purls,
                     resolved_package_urls=resolved_purls,
-                    reference_urls=[NPM_URL.format(f'/-/npm/v1/advisories/{record["id"]}')],
+                    vuln_references=vuln_reference,
                 ))
-
         return advisories
 
     def added_advisories(self) -> Set[Advisory]:

vulnerabilities/importers/openssl.py

@@ -28,6 +28,7 @@
 
 from vulnerabilities.data_source import Advisory
 from vulnerabilities.data_source import DataSource
+from vulnerabilities.data_source import VulnerabilityReferenceUnit
 
 import xml.etree.ElementTree as ET
 
@@ -69,8 +70,8 @@ def to_advisories(xml_response: str) -> Set[Advisory]:
 
                         if info:
                             commit_hash = info[0].attrib['hash']
-                            ref_urls.append("https://github.com/openssl/openssl/commit/"
-                                            + commit_hash)
+                            ref_urls.append(VulnerabilityReferenceUnit(url="https://github.com/openssl/openssl/commit/"
+                                            + commit_hash))
                     if info.tag == 'description':
                         # Description
                         summary = re.sub(r'\s+', ' ', info.text).strip()
@@ -88,7 +89,7 @@ def to_advisories(xml_response: str) -> Set[Advisory]:
                                     summary=summary,
                                     impacted_package_urls=vuln_purls,
                                     resolved_package_urls=safe_purls,
-                                    reference_urls=ref_urls)
+                                    vuln_references=ref_urls)
                 advisories.append(advisory)
 
         return advisories

vulnerabilities/importers/redhat.py

@@ -27,7 +27,7 @@
 from vulnerabilities.data_source import Advisory
 from vulnerabilities.data_source import DataSource
 from vulnerabilities.data_source import DataSourceConfiguration
-
+from vulnerabilities.data_source import VulnerabilityReferenceUnit
 
 class RedhatDataSource(DataSource):
     CONFIG_CLASS = DataSourceConfiguration
@@ -71,12 +71,29 @@ def to_advisory(advisory_data):
             if rpm_to_purl(rpm):
                 affected_purls.append(rpm_to_purl(rpm))
 
+    references = []
+    if advisory_data.get('bugzilla'):
+        bugzilla =  advisory_data.get('bugzilla')
+        references.append(VulnerabilityReferenceUnit(
+            url='https://bugzilla.redhat.com/show_bug.cgi?id={}'.format(bugzilla),
+            reference_id=bugzilla
+        ))
+
+    for rhsa in advisory_data['advisories']:
+        references.append(VulnerabilityReferenceUnit(
+            url='https://access.redhat.com/errata/{}'.format(rhsa),
+            reference_id=rhsa,
+        ))
+
+    references.append(VulnerabilityReferenceUnit(
+        url=advisory_data['resource_url']
+    ))
+
     return Advisory(
         summary=advisory_data['bugzilla_description'],
         cve_id=advisory_data['CVE'],
-        reference_ids=advisory_data['advisories'],
         impacted_package_urls=affected_purls,
-        reference_urls=[advisory_data['resource_url']],
+        vuln_references=references,
     )
 
 

vulnerabilities/importers/retiredotnet.py

@@ -30,6 +30,7 @@
 from vulnerabilities.data_source import GitDataSource
 from vulnerabilities.data_source import GitDataSourceConfiguration
 from vulnerabilities.data_source import Advisory
+from vulnerabilities.data_source import VulnerabilityReferenceUnit
 
 
 class RetireDotnetDataSource(GitDataSource):
@@ -90,9 +91,13 @@ def process_file(self, path) -> List[Advisory]:
                     version=pkg['fix'],
                     type='nuget'))
 
+            vuln_reference = [VulnerabilityReferenceUnit(
+                url=json_doc['link'],
+            )]
+
             return Advisory(
                 summary=json_doc['description'],
                 impacted_package_urls=affected_purls,
                 resolved_package_urls=fixed_purls,
-                reference_urls=[json_doc['link']],
-                cve_id=vuln_id)
+                cve_id=vuln_id,
+                vuln_references=vuln_reference)

vulnerabilities/importers/ruby.py

@@ -32,6 +32,7 @@
 
 from vulnerabilities.data_source import Advisory
 from vulnerabilities.data_source import GitDataSource
+from vulnerabilities.data_source import VulnerabilityReferenceUnit
 
 
 class RubyDataSource(GitDataSource):
@@ -104,11 +105,17 @@ def process_file(self, path) -> List[Advisory]:
                     version=version,
                 ) for version in safe_versions}
 
+            references = []
+            if record.get('url'):
+                references.append(
+                    VulnerabilityReferenceUnit(url=record.get('url'))
+                )
+
             return Advisory(
                 summary=record.get('description', ''),
                 impacted_package_urls=impacted_purls,
                 resolved_package_urls=resolved_purls,
-                reference_urls=[record.get('url', '')],
+                vuln_references=references,
                 cve_id=cve_id
             )
 

vulnerabilities/importers/rust.py

@@ -34,6 +34,7 @@
 
 from vulnerabilities.data_source import Advisory
 from vulnerabilities.data_source import GitDataSource
+from vulnerabilities.data_source import VulnerabilityReferenceUnit
 
 
 class RustDataSource(GitDataSource):
@@ -79,8 +80,13 @@ def _load_advisory(self, path: str) -> Optional[Advisory]:
             record = toml.load(f)
             advisory = record.get('advisory', {})
 
+        references = []
         crate_name = advisory['package']
-        reference_url = advisory.get('url', '')
+        if advisory.get('url'):
+            references.append(VulnerabilityReferenceUnit(
+                url=advisory['url']
+            ))
+
         all_versions = self.crates_api.get(crate_name)
 
         affected_ranges = {RangeSpecifier(r) for r
@@ -104,14 +110,20 @@ def _load_advisory(self, path: str) -> Optional[Advisory]:
                 if alias.startswith('CVE-'):
                     cve_id = alias
                     break
+        
+
+        references.append(VulnerabilityReferenceUnit(
+                reference_id=advisory['id'],
+                url='https://rustsec.org/advisories/{}.html'.format(advisory['id'])
+            )
+        )
 
         return Advisory(
             summary=advisory.get('description', ''),
             impacted_package_urls=impacted_purls,
             resolved_package_urls=resolved_purls,
-            reference_urls=[reference_url] if reference_url else [],
-            reference_ids=[advisory['id']],
             cve_id=cve_id,
+            vuln_references=references
         )