Refactor safetydb wrt new models and simplify tests

Signed-off-by: Shivam Sandbhor <shivam.sandbhor@gmail.com>

Author: sbs2001

vulnerabilities/importers/safety_db.py

@@ -46,6 +46,7 @@
 from vulnerabilities.data_source import DataSourceConfiguration
 from vulnerabilities.data_source import Reference
 from vulnerabilities.package_managers import PypiVersionAPI
+from vulnerabilities.helpers import nearest_patched_package
 
 logger = logging.getLogger(__name__)
 
@@ -75,11 +76,8 @@ class SafetyDbDataSource(DataSource):
 
     CONFIG_CLASS = SafetyDbConfiguration
 
-    def __init__(self, *args, **kwargs):
-        super().__init__(*args, **kwargs)
-        self._api_response = self._fetch()
-
     def __enter__(self):
+        self._api_response = self._fetch()
         self._versions = PypiVersionAPI()
         self.set_api(self.collect_packages())
 
@@ -138,13 +136,15 @@ def updated_advisories(self) -> Set[Advisory]:
                             vulnerability_id=cve_id,
                             summary=advisory["advisory"],
                             references=reference,
-                            impacted_package_urls=impacted_purls,
-                            resolved_package_urls=resolved_purls,
+                            affected_packages_with_patched_package=nearest_patched_package(
+                                impacted_purls, resolved_purls
+                            ),
                         )
                     )
 
-        return self.batch_advisories(advisories)
+        return advisories
 
+    # FIXME: This is duplicate code. Use the the helper instead.
     def create_etag(self, url):
         etag = requests.head(url).headers.get("ETag")
         if not etag:
@@ -158,6 +158,7 @@ def create_etag(self, url):
         return True
 
 
+# FIXME: This function is horribly named incorretly.
 def categorize_versions(
     package_name: str,
     all_versions: Set[str],
@@ -166,9 +167,7 @@ def categorize_versions(
     """
     :return: impacted, resolved purls
     """
-    impacted_versions, impacted_purls = set(), set()
-    # vurl_spec = f"pypi:{ ','.join(version_specs) }"
-    # vurl_spec = VersionSpecifier.from_version_spec_string(vurl_spec)
+    impacted_versions, impacted_purls = set(), []
     vurl_specs = []
     for version_spec in version_specs:
         vurl_specs.append(VersionSpecifier.from_scheme_version_spec_string("pypi", version_spec))
@@ -181,15 +180,15 @@ def categorize_versions(
 
         if any([version_object in vurl_spec for vurl_spec in vurl_specs]):
             impacted_versions.add(version)
-            impacted_purls.add(
+            impacted_purls.append(
                 PackageURL(
                     name=package_name,
                     type="pypi",
                     version=version,
                 )
             )
 
-    resolved_purls = set()
+    resolved_purls = []
     for version in all_versions - impacted_versions:
-        resolved_purls.add(PackageURL(name=package_name, type="pypi", version=version))
+        resolved_purls.append(PackageURL(name=package_name, type="pypi", version=version))
     return impacted_purls, resolved_purls

vulnerabilities/tests/test_data/safety_db/insecure_full.json

@@ -1,15 +1,4 @@
 {
-    "ampache": [
-        {
-            "advisory": "ampache 4.0.0:\r\n* Resolves CVE-2019-12385 for the SQL Injection\r\n* Resolves CVE-2019-12386 for the persistent XSS\r\n* Resolves NS-18-046 Multiple Reflected Cross-site Scripting Vulnerabilities in Ampache 3.9.0",
-            "cve": "CVE-2019-12385, CVE-2019-12386",
-            "id": "pyup.io-37863",
-            "specs": [
-                "<4.0.0"
-            ],
-            "v": "<4.0.0"
-        }
-    ],
     "django": [
         {
             "advisory": "The utils.http.is_safe_url function in Django before 1.4.20, 1.5.x, 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1 does not properly validate URLs, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a control character in a URL, as demonstrated by a \\x08javascript: URL.",
@@ -35,34 +24,5 @@
             ],
             "v": ">=1.9,<1.9.8,==1.8.14,>=1.10,<1.10.2"
         }
-    ],
-    "zulip": [
-        {
-            "advisory": "Zulip 2.1.0 improves default nginx TLS settings for stronger security.",
-            "cve": null,
-            "id": "pyup.io-38115",
-            "specs": [
-                "<2.1.0"
-            ],
-            "v": "<2.1.0"
-        },
-        {
-            "advisory": "Zulip 2.1.2 includes a corrected fix for CVE-2019-19775 (the original fix was affected by an unfixed security bug in Python's urllib, CVE-2015-2104). It also adds authentication for redis and memcached even in configurations where these are running on localhost, for add hardening against attacks from malicious processes running on the Zulip server.",
-            "cve": "CVE-2019-19775,CVE-2015-2104",
-            "id": "pyup.io-38114",
-            "specs": [
-                "<2.1.2"
-            ],
-            "v": "<2.1.2"
-        },
-        {
-            "advisory": "Zulip 2.1.3 includes fixes for:\r\n- CVE-2020-9444: Prevent reverse tabnapping attacks.                                                 \r\n- CVE-2020-9445: Remove unused and insecure modal_link feature.                                      \r\n- CVE-2020-10935: Fix XSS vulnerability in local link rewriting.",
-            "cve": "CVE-2020-9444,CVE-2020-10935",
-            "id": "pyup.io-38200",
-            "specs": [
-                "<2.1.3"
-            ],
-            "v": "<2.1.3"
-        }
     ]
 }

vulnerabilities/tests/test_npm.py

@@ -90,13 +90,7 @@ def test_import(self, _):
         assert models.VulnerabilityReference.objects.count() == 3
         assert models.PackageRelatedVulnerability.objects.all().count() == 4
 
-        expected_package_count = (
-            models.PackageRelatedVulnerability.objects.all().count()
-            + models.PackageRelatedVulnerability.objects.filter(
-                patched_package__isnull=False
-            ).count()
-        )
-        assert models.Package.objects.count() == expected_package_count
+        assert models.Package.objects.count() == 8
 
         self.assert_for_package(
             "jquery", {"3.4.0"}, {"3.8.0"}, "1518", vulnerability_id="CVE-2020-11022"