Skip to content

Commit f16f680

Browse files
tushar912tushar912
committed
Add docstrings and add test for get_data_from_md.
Also add github as package type Signed-off-by: Tushar912 <tushar.912u@gmail.com>
1 parent 02fa5c4 commit f16f680

3 files changed

Lines changed: 118 additions & 20 deletions

File tree

‎vulnerabilities/importers/istio.py‎

Lines changed: 56 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -22,12 +22,14 @@
2222

2323
import asyncio
2424
from typing import List, Set
25-
import yaml
2625

26+
import yaml
2727
from dephell_specifier import RangeSpecifier
2828
from packageurl import PackageURL
2929

30-
from vulnerabilities.data_source import Advisory, GitDataSource, Reference
30+
from vulnerabilities.data_source import Advisory
31+
from vulnerabilities.data_source import GitDataSource
32+
from vulnerabilities.data_source import Reference
3133
from vulnerabilities.package_managers import GitHubTagsAPI
3234

3335

@@ -64,28 +66,52 @@ def added_advisories(self) -> Set[Advisory]:
6466
return self.batch_advisories(advisories)
6567

6668
def get_versions_for_pkg_from_range_list(self, version_range_list):
67-
# Takes a list of version ranges(affected) of a package
68-
# as parameter and returns a tuple of safe package versions and
69-
# vulnerable package versions
69+
"""Takes a list of version ranges(affected) of a package
70+
as parameter and returns a tuple of safe package versions and
71+
vulnerable package versions"""
7072

7173
safe_pkg_versions = []
7274
vuln_pkg_versions = []
73-
all_version_list = self.version_api.get("istio/istio")
75+
all_version = self.version_api.get("istio/istio")
7476
if not version_range_list:
75-
return all_version_list, []
77+
return all_version, []
7678
version_ranges = {RangeSpecifier(r) for r in version_range_list}
77-
for version in all_version_list:
79+
for version in all_version:
7880
if any([version in v for v in version_ranges]):
7981
vuln_pkg_versions.append(version)
8082

81-
safe_pkg_versions = set(all_version_list) - set(vuln_pkg_versions)
83+
safe_pkg_versions = set(all_version) - set(vuln_pkg_versions)
8284
return safe_pkg_versions, vuln_pkg_versions
8385

8486
def get_data_from_yaml_lines(self, yaml_lines):
87+
"""Return a mapping of data from a iterable of yaml_lines
88+
for example :
89+
['title: ISTIO-SECURITY-2019-001',
90+
'description: Incorrect access control.','cves: [CVE-2019-12243]']
91+
92+
would give {'title':'ISTIO-SECURITY-2019-001',
93+
'description': 'Incorrect access control.',
94+
'cves': '[CVE-2019-12243]'}
95+
"""
8596

8697
return yaml.safe_load("\n".join(yaml_lines))
8798

8899
def get_yaml_lines(self, lines):
100+
"""The istio advisory file contains lines similar to yaml format .
101+
This function extracts those lines and return an iterable of lines
102+
103+
for example :
104+
lines =
105+
---
106+
title: ISTIO-SECURITY-2019-001
107+
description: Incorrect access control.
108+
cves: [CVE-2019-12243]
109+
---
110+
111+
get_yaml_lines(lines) would return
112+
['title: ISTIO-SECURITY-2019-001','description: Incorrect access control.'
113+
,'cves: [CVE-2019-12243]']
114+
"""
89115

90116
for line in lines:
91117
line = line.strip()
@@ -129,24 +155,35 @@ def process_file(self, path):
129155
data["releases"] = []
130156

131157
safe_pkg_versions, vuln_pkg_versions = self.get_versions_for_pkg_from_range_list(
132-
data["releases"]
133-
)
158+
data["releases"])
134159

135160
safe_purls = []
136161
vuln_purls = []
137162

138163
cve_id = cve_id
139164

140-
safe_purls = {
141-
PackageURL(name="istio", type="golang", version=version)
165+
safe_purls_golang = {
166+
PackageURL(type="golang", name="istio", version=version)
142167
for version in safe_pkg_versions
143168
}
144169

145-
vuln_purls = {
146-
PackageURL(name="istio", type="golang", version=version)
170+
safe_purls_github = {
171+
PackageURL(type="github", name="istio", version=version)
172+
for version in safe_pkg_versions
173+
}
174+
safe_purls = safe_purls_github | safe_purls_golang
175+
176+
vuln_purls_golang = {
177+
PackageURL(type="golang", name="istio", version=version)
147178
for version in vuln_pkg_versions
148179
}
149180

181+
vuln_purls_github = {
182+
PackageURL(type="github", name="istio", version=version)
183+
for version in vuln_pkg_versions
184+
}
185+
vuln_purls = vuln_purls_github | vuln_purls_golang
186+
150187
advisories.append(
151188
Advisory(
152189
summary=data["description"],
@@ -159,6 +196,10 @@ def process_file(self, path):
159196
return advisories
160197

161198
def get_data_from_md(self, path):
199+
"""Return a mapping of vulnerability data from istio . The data is
200+
in the form of yaml_lines inside a .md file.
201+
"""
202+
162203
with open(path) as f:
163204
yaml_lines = self.get_yaml_lines(f)
164205
return self.get_data_from_yaml_lines(yaml_lines)

‎vulnerabilities/tests/test_data/istio/test_file.md‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -7,9 +7,4 @@ cvss: "8.9"
77
vector: "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N/E:H/RL:O/RC:C"
88
releases: ["1.1 to 1.1.15", "1.2 to 1.2.6", "1.3 to 1.3.1"]
99
publishdate: 2019-05-28
10-
keywords: [CVE]
11-
skip_seealso: true
12-
aliases:
13-
- /blog/2019/cve-2019-12243
14-
- /news/2019/cve-2019-12243
1510
---

‎vulnerabilities/tests/test_istio.py‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@
2020
# VulnerableCode is a free software tool from nexB Inc. and others.
2121
# Visit https://github.com/nexB/vulnerablecode/ for support and download.
2222

23+
import datetime
2324
import os
2425
from collections import OrderedDict
2526
from unittest import TestCase
@@ -56,6 +57,22 @@ def setUpClass(cls):
5657
}
5758
)
5859

60+
def test_get_data_from_md(self):
61+
path = os.path.join(BASE_DIR, "test_data/istio/test_file.md")
62+
actual_data = self.data_src.get_data_from_md(path)
63+
expected_data = {
64+
"title": "ISTIO-SECURITY-2019-001",
65+
"subtitle": "Security Bulletin",
66+
"description": "Incorrect access control.",
67+
"cves": ["CVE-2019-12243"],
68+
"cvss": "8.9",
69+
"vector": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N/E:H/RL:O/RC:C",
70+
"releases": ["1.1 to 1.1.15", "1.2 to 1.2.6", "1.3 to 1.3.1"],
71+
"publishdate": datetime.date(2019, 5, 28),
72+
}
73+
74+
assert expected_data == actual_data
75+
5976
def test_process_file(self):
6077

6178
path = os.path.join(BASE_DIR, "test_data/istio/test_file.md")
@@ -73,6 +90,16 @@ def test_process_file(self):
7390
name="istio",
7491
version="1.1.0-snapshot.3",
7592
),
93+
PackageURL(
94+
type="github",
95+
name="istio",
96+
version="1.1.0-snapshot.2",
97+
),
98+
PackageURL(
99+
type="github",
100+
name="istio",
101+
version="1.1.0-snapshot.3",
102+
),
76103
},
77104
resolved_package_urls={
78105
PackageURL(
@@ -110,6 +137,41 @@ def test_process_file(self):
110137
name="istio",
111138
version="1.1.0-rc.6",
112139
),
140+
PackageURL(
141+
type="github",
142+
name="istio",
143+
version="1.1.0-rc.2",
144+
),
145+
PackageURL(
146+
type="github",
147+
name="istio",
148+
version="1.1.0-rc.4",
149+
),
150+
PackageURL(
151+
type="github",
152+
name="istio",
153+
version="1.1.0-rc.3",
154+
),
155+
PackageURL(
156+
type="github",
157+
name="istio",
158+
version="1.1.0-rc.0",
159+
),
160+
PackageURL(
161+
type="github",
162+
name="istio",
163+
version="1.1.0-rc.5",
164+
),
165+
PackageURL(
166+
type="github",
167+
name="istio",
168+
version="1.1.0-rc.1",
169+
),
170+
PackageURL(
171+
type="github",
172+
name="istio",
173+
version="1.1.0-rc.6",
174+
),
113175
},
114176
cve_id="CVE-2019-12243",
115177
)

0 commit comments

Comments
 (0)