Collect vulnerabilities from GitHub

[pombredanne]

There are a few levels to consider:

1. GH provides some security feeds for their own GHE appliances
2. the projects hosted can publish their own feeds
3. a project dependencies can have vulnerabilities reported by GH

[pombredanne]

See GHSA-4cwg-f7qc-6r95 for an example

[sbs2001]

GitHub provides a GraphQL based API for these, we could collect this data from this API. As this API requires OAuth token, we need some mechanism to allow the user to specify the token (environmental variable).

An example query at https://developer.github.com/v4/explorer/ to obtain this data would be :

query MyQuery {
  securityVulnerabilities(first: 10) {
    nodes {
      package {
        ecosystem
        name
      }
      vulnerableVersionRange
      advisory {
        description
        ghsaId
      }
    }
  }
}

[sbs2001]

After some research, here are my findings:

Github provides vulnerabilities for the ecosystems composer, maven, nuget, pip, npm, rubygems. Of which pip, npm, rubygems are already covered by our existing importers.

So just importing GHSAs of composer, maven, nuget is enough, this also help us to keep the requests made to the GitHub API under limit.

Btw composer, maven, nuget all provide a version API, so no problem there :)

[sbs2001]

Fixed by #204