Drop go support from gitlab and github

Signed-off-by: Tushar Goel <tushar.goel.dav@gmail.com>

Author: TG1999

vulnerabilities/importer.py

@@ -48,6 +48,8 @@
 from vulnerabilities.severity_systems import ScoringSystem
 from vulnerabilities.utils import classproperty
 from vulnerabilities.utils import evolve_purl
+from vulnerabilities.utils import get_reference_id
+from vulnerabilities.utils import is_cve
 from vulnerabilities.utils import nearest_patched_package
 
 logger = logging.getLogger(__name__)

vulnerabilities/importers/github.py

@@ -46,11 +46,12 @@
 from vulnerabilities.package_managers import VERSION_API_CLASSES_BY_PACKAGE_TYPE
 from vulnerabilities.package_managers import GoproxyVersionAPI
 from vulnerabilities.package_managers import VersionAPI
-from vulnerabilities.utils import AffectedPackage as LegacyAffectedPackage, resolve_version_range
+from vulnerabilities.package_managers import get_api_package_name
+from vulnerabilities.utils import AffectedPackage as LegacyAffectedPackage
 from vulnerabilities.utils import get_affected_packages_by_patched_package
 from vulnerabilities.utils import get_item
 from vulnerabilities.utils import nearest_patched_package
-from vulnerabilities.package_managers import get_api_package_name
+from vulnerabilities.utils import resolve_version_range
 
 logger = logging.getLogger(__name__)
 
@@ -124,7 +125,7 @@
     "COMPOSER": "composer",
     "PIP": "pypi",
     "RUBYGEMS": "gem",
-    "GO": "golang",
+    # "GO": "golang",
 }
 
 GITHUB_ECOSYSTEM_BY_PACKAGE_TYPE = {
@@ -207,8 +208,7 @@ def get_purl(pkg_type: str, github_name: str) -> Optional[PackageURL]:
 
     if pkg_type == "composer":
         if "/" not in github_name:
-            logger.error(f"get_purl: Invalid composer package name {github_name}")
-            return
+            return PackageURL(type=pkg_type, name=github_name)
         vendor, _, name = github_name.partition("/")
         return PackageURL(type=pkg_type, namespace=vendor, name=name)
 

vulnerabilities/importers/gitlab.py

@@ -40,10 +40,6 @@
 from univers.version_range import from_gitlab_native
 from univers.versions import Version
 
-from vulnerabilities.helpers import AffectedPackage as LegacyAffectedPackage
-from vulnerabilities.helpers import get_affected_packages_by_patched_package
-from vulnerabilities.helpers import nearest_patched_package
-from vulnerabilities.helpers import resolve_version_range
 from vulnerabilities.importer import AdvisoryData
 from vulnerabilities.importer import AffectedPackage
 from vulnerabilities.importer import Importer
@@ -56,19 +52,25 @@
 from vulnerabilities.package_managers import GoproxyVersionAPI
 from vulnerabilities.package_managers import VersionAPI
 from vulnerabilities.package_managers import get_api_package_name
+from vulnerabilities.utils import AffectedPackage as LegacyAffectedPackage
+from vulnerabilities.utils import build_description
+from vulnerabilities.utils import get_affected_packages_by_patched_package
+from vulnerabilities.utils import nearest_patched_package
+from vulnerabilities.utils import resolve_version_range
 
 logger = logging.getLogger(__name__)
 
 
 PURL_TYPE_BY_GITLAB_SCHEME = {
+    # "conan": "conan",
     "gem": "gem",
-    "go": "golang",
+    # Entering issue to parse go package names https://github.com/nexB/vulnerablecode/issues/742
+    # "go": "golang",
     "maven": "maven",
     "npm": "npm",
     "nuget": "nuget",
-    "pypi": "pypi",
     "packagist": "composer",
-    # "conan": "conan",
+    "pypi": "pypi",
 }
 
 
@@ -125,7 +127,7 @@ def get_purl(package_slug):
         name = parts[1]
         return PackageURL(type=purl_type, name=name)
     # if package slug is of the form:
-    # "nuget/github/user/abc/NuGet.Core"
+    # "nuget/github.com/beego/beego/v2/nuget"
     if len(parts) >= 3:
         name = parts[-1]
         namespace = "/".join(parts[1:-1])
@@ -187,11 +189,11 @@ def parse_gitlab_advisory(file):
 
     # refer to schema here https://gitlab.com/gitlab-org/advisories-community/-/blob/main/ci/schema/schema.json
     aliases = gitlab_advisory.get("identifiers")
-    summary = ". ".join([gitlab_advisory.get("title"), gitlab_advisory.get("description")])
+    summary = build_description(gitlab_advisory.get("title"), gitlab_advisory.get("description"))
     urls = gitlab_advisory.get("urls")
     references = [Reference.from_url(u) for u in urls]
     date_published = dateparser.parse(gitlab_advisory.get("pubdate"))
-    date_published = pytz.utc.localize(date_published)
+    date_published = date_published.replace(tzinfo=pytz.UTC)
     package_slug = gitlab_advisory.get("package_slug")
     purl: PackageURL = get_purl(package_slug=package_slug)
     if not purl:

vulnerabilities/package_managers.py

@@ -710,13 +710,13 @@ def get_api_package_name(purl: PackageURL) -> str:
     >>> get_api_package_name(PackageURL(type="composer", namespace="foo", name="bar"))
     'foo/bar'
     """
+    if not purl.name:
+        return None
+    if purl.type in ("nuget", "pypi", "gem") or not purl.namespace:
+        return purl.name
     if purl.type == "maven":
         return f"{purl.namespace}:{purl.name}"
-
-    if purl.type == "composer":
+    if purl.type in ("composer", "golang", "npm"):
         return f"{purl.namespace}/{purl.name}"
 
-    if purl.type in ("nuget", "pypi", "gem", "golang", "npm"):
-        return purl.name
-
     logger.error(f"get_api_package_name: Unknown PURL {purl!r}")

vulnerabilities/tests/test_data/gitlab/composer-expected.json

@@ -2,7 +2,7 @@
   "aliases": [
     "GMS-2018-26"
   ],
-  "summary": "Incorrect header injection check. amphp/http isn't properly protected against HTTP header injection.",
+  "summary": "Incorrect header injection check\namphp/http isn't properly protected against HTTP header injection.",
   "affected_packages": [
     {
       "package": {

vulnerabilities/tests/test_data/gitlab/composer-improver-expected.json

@@ -5,7 +5,7 @@
       "GMS-2018-26"
     ],
     "confidence": 100,
-    "summary": "Incorrect header injection check. amphp/http isn't properly protected against HTTP header injection.",
+    "summary": "Incorrect header injection check\namphp/http isn't properly protected against HTTP header injection.",
     "affected_purls": [],
     "fixed_purl": {
       "type": "composer",

vulnerabilities/tests/test_data/gitlab/gem-expected.json

@@ -2,7 +2,7 @@
   "aliases": [
     "OSVDB-112347"
   ],
-  "summary": "Object Injection. A flaw in Active Job that can allow string arguments to be deserialized as if they were Global IDs. This may allow a remote attacker to inject arbitrary objects.",
+  "summary": "Object Injection\nA flaw in Active Job that can allow string arguments to be deserialized as if they were Global IDs. This may allow a remote attacker to inject arbitrary objects.",
   "affected_packages": [
     {
       "package": {

vulnerabilities/tests/test_data/gitlab/gem-improver-expected.json

@@ -5,7 +5,7 @@
       "OSVDB-112347"
     ],
     "confidence": 100,
-    "summary": "Object Injection. A flaw in Active Job that can allow string arguments to be deserialized as if they were Global IDs. This may allow a remote attacker to inject arbitrary objects.",
+    "summary": "Object Injection\nA flaw in Active Job that can allow string arguments to be deserialized as if they were Global IDs. This may allow a remote attacker to inject arbitrary objects.",
     "affected_purls": [
       {
         "type": "gem",
@@ -38,7 +38,7 @@
       "OSVDB-112347"
     ],
     "confidence": 100,
-    "summary": "Object Injection. A flaw in Active Job that can allow string arguments to be deserialized as if they were Global IDs. This may allow a remote attacker to inject arbitrary objects.",
+    "summary": "Object Injection\nA flaw in Active Job that can allow string arguments to be deserialized as if they were Global IDs. This may allow a remote attacker to inject arbitrary objects.",
     "affected_purls": [
       {
         "type": "gem",

vulnerabilities/tests/test_data/gitlab/maven-expected.json

@@ -3,7 +3,7 @@
     "CVE-2021-41269",
     "GHSA-p9m8-27x8-rg87"
   ],
-  "summary": "Improper Control of Generation of Code ('Code Injection'). cron-utils is a Java library to define, parse, validate, migrate crons as well as get human readable descriptions for them. leading to unauthenticated Remote Code Execution (RCE) vulnerability. Versions up to are susceptible to this vulnerability.",
+  "summary": "Improper Control of Generation of Code ('Code Injection')\ncron-utils is a Java library to define, parse, validate, migrate crons as well as get human readable descriptions for them. leading to unauthenticated Remote Code Execution (RCE) vulnerability. Versions up to are susceptible to this vulnerability.",
   "affected_packages": [
     {
       "package": {

vulnerabilities/tests/test_data/gitlab/maven-improver-expected.json

@@ -6,7 +6,7 @@
       "GHSA-p9m8-27x8-rg87"
     ],
     "confidence": 100,
-    "summary": "Improper Control of Generation of Code ('Code Injection'). cron-utils is a Java library to define, parse, validate, migrate crons as well as get human readable descriptions for them. leading to unauthenticated Remote Code Execution (RCE) vulnerability. Versions up to are susceptible to this vulnerability.",
+    "summary": "Improper Control of Generation of Code ('Code Injection')\ncron-utils is a Java library to define, parse, validate, migrate crons as well as get human readable descriptions for them. leading to unauthenticated Remote Code Execution (RCE) vulnerability. Versions up to are susceptible to this vulnerability.",
     "affected_purls": [
       {
         "type": "maven",
@@ -108,7 +108,7 @@
       "GHSA-p9m8-27x8-rg87"
     ],
     "confidence": 100,
-    "summary": "Improper Control of Generation of Code ('Code Injection'). cron-utils is a Java library to define, parse, validate, migrate crons as well as get human readable descriptions for them. leading to unauthenticated Remote Code Execution (RCE) vulnerability. Versions up to are susceptible to this vulnerability.",
+    "summary": "Improper Control of Generation of Code ('Code Injection')\ncron-utils is a Java library to define, parse, validate, migrate crons as well as get human readable descriptions for them. leading to unauthenticated Remote Code Execution (RCE) vulnerability. Versions up to are susceptible to this vulnerability.",
     "affected_purls": [],
     "fixed_purl": {
       "type": "maven",