Yield advisory only with aliases

Signed-off-by: Tushar Goel <tushar.goel.dav@gmail.com>

Author: TG1999

vulnerabilities/importers/npm.py

@@ -106,14 +106,6 @@ def to_advisory_data(self, file: Path) -> List[AdvisoryData]:
                 aliases=[alias],
             )
 
-        if not advsisory_aliases:
-            yield AdvisoryData(
-                summary=build_description(summary=summary, description=description),
-                references=references,
-                date_published=date_published,
-                affected_packages=affected_packages,
-            )
-
     def get_affected_package(self, data, package_name):
         vulnerable_range = data.get("vulnerable_versions") or ""
 

vulnerabilities/tests/test_npm.py

@@ -10,8 +10,15 @@
 
 import os
 
+from packageurl import PackageURL
+from univers.version_constraint import VersionConstraint
+from univers.version_range import NpmVersionRange
+from univers.versions import SemverVersion
+
+from vulnerabilities.importer import AffectedPackage
 from vulnerabilities.importers.npm import NpmImporter
 from vulnerabilities.tests import util_tests
+from vulnerabilities.utils import load_json
 
 BASE_DIR = os.path.dirname(os.path.abspath(__file__))
 TEST_DATA = os.path.join(BASE_DIR, "test_data/")
@@ -22,3 +29,17 @@ def test_npm_importer():
     result = [adv.to_dict() for adv in NpmImporter().to_advisory_data(file=file)]
     expected_file = os.path.join(TEST_DATA, f"parse-advisory-npm-expected.json")
     util_tests.check_results_against_json(result, expected_file)
+
+
+def test_get_affected_package():
+    file = os.path.join(TEST_DATA, "npm_sample.json")
+    data = load_json(file)
+    assert AffectedPackage(
+        package=PackageURL(
+            type="npm", namespace=None, name="npm", version=None, qualifiers={}, subpath=None
+        ),
+        affected_version_range=NpmVersionRange(
+            constraints=(VersionConstraint(comparator="<", version=SemverVersion(string="1.3.3")),)
+        ),
+        fixed_version=SemverVersion(string="1.3.3"),
+    ) == NpmImporter().get_affected_package(data, "npm")