|
39 | 39 | from univers.version_range import NugetVersionRange |
40 | 40 | from univers.version_range import PypiVersionRange |
41 | 41 | from univers.version_range import VersionRange |
42 | | -from univers.versions import version_class_by_package_type |
43 | 42 |
|
44 | 43 | from vulnerabilities.importer import AdvisoryData |
45 | 44 | from vulnerabilities.importer import AffectedPackage |
@@ -360,51 +359,52 @@ def get_inferences(self, advisory_data: AdvisoryData) -> Iterable[Inference]: |
360 | 359 | name = process_name_namespace(ecosystem, pkg_name, pkg_namespace) |
361 | 360 | if hasattr(self.version_api, "module_name_by_package_name"): |
362 | 361 | pkg_name = self.version_api.module_name_by_package_name.get(name, pkg_name) |
363 | | - aff_vers, unaff_vers = categorize_versions( |
364 | | - pkg_type, |
365 | | - affected_version_ranges, |
366 | | - self.version_api.get(name, until=advisory_data.date_published).valid_versions, |
367 | | - ) |
368 | | - affected_purls = [ |
369 | | - PackageURL(name=pkg_name, namespace=pkg_namespace, version=version, type=pkg_type) |
370 | | - for version in aff_vers |
371 | | - ] |
372 | | - |
373 | | - unaffected_purls = [ |
374 | | - PackageURL(name=purl.name, namespace=purl.namespace, version=version, type=purl.type) |
375 | | - for version in unaff_vers |
376 | | - ] |
377 | | - |
378 | | - for fixed_purl in unaffected_purls: |
379 | | - yield Inference.from_advisory_data( |
380 | | - advisory_data, |
381 | | - confidence=90, |
382 | | - affected_purls=affected_purls, |
383 | | - fixed_purl=fixed_purl, |
| 362 | + for affected_version_range in affected_version_ranges: |
| 363 | + aff_vers, unaff_vers = categorize_versions( |
| 364 | + ecosystem, |
| 365 | + affected_version_range, |
| 366 | + self.version_api.get(name, until=advisory_data.date_published).valid_versions, |
384 | 367 | ) |
| 368 | + affected_purls = [ |
| 369 | + PackageURL(name=pkg_name, namespace=pkg_namespace, version=version, type=pkg_type) |
| 370 | + for version in aff_vers |
| 371 | + ] |
| 372 | + |
| 373 | + unaffected_purls = [ |
| 374 | + PackageURL(name=purl.name, namespace=purl.namespace, version=version, type=purl.type) |
| 375 | + for version in unaff_vers |
| 376 | + ] |
| 377 | + |
| 378 | + for fixed_purl in unaffected_purls: |
| 379 | + yield Inference.from_advisory_data( |
| 380 | + advisory_data, |
| 381 | + confidence=90, |
| 382 | + affected_purls=affected_purls, |
| 383 | + fixed_purl=fixed_purl, |
| 384 | + ) |
385 | 385 |
|
386 | 386 | def set_api(self, ecosystem, name): |
387 | 387 | self.version_api = get_version_api(ecosystem) |
388 | 388 | asyncio.run(self.version_api.load_api([name])) |
389 | 389 |
|
390 | 390 |
|
391 | 391 | def categorize_versions( |
392 | | - package_type: str, version_range: str, all_versions: Set[str] |
| 392 | + ecosystem: str, version_range: VersionRange, all_versions: Set[str] |
393 | 393 | ) -> Tuple[List[str], List[str]]: |
394 | 394 | """ |
395 | 395 | Return `affected_versions` and `unaffected_versions` |
396 | 396 | iterate on `all_versions` and if the version is affected by `version_range` |
397 | 397 | append it in `affected_versions` |
398 | 398 | else append it in `unaffected_versions` |
399 | 399 | """ |
400 | | - version_class = version_class_by_package_type[package_type] |
| 400 | + version_class: VersionRange = ECOSYSTEM_VERSION_RANGE_MAPPING.get(ecosystem) |
401 | 401 | affected_versions = [] |
402 | 402 | unaffected_versions = [] |
403 | 403 | for version in all_versions: |
404 | 404 | if version in IGNORE_VERSIONS: |
405 | 405 | continue |
406 | 406 |
|
407 | | - if version_class(version) in version_range: |
| 407 | + if version in version_class.from_string(version_range.to_string()): |
408 | 408 | affected_versions.append(version) |
409 | 409 | else: |
410 | 410 | unaffected_versions.append(version) |
|
0 commit comments