add-curl-advisories-importer - #1402
Conversation
TG1999
left a comment
TG1999
left a comment
There was a problem hiding this comment.
@ambuj-1211 thanks ++ for your contribution, I have added some comments for your consideration. Also run make valid command for fixing formatting errors.
| importer_name = "Curl Importer" | ||
| api_url = "https://curl.se/docs/vuln.json" | ||
|
|
||
| def get_response(self): |
There was a problem hiding this comment.
Please check utils.py and import fetch_response the function from there
| for data in raw_data: | ||
| cve_id = data["aliases"] | ||
| if not cve_id.startswith("CVE"): | ||
| logger.error(f"Invalid CVE ID: {cve_id} in package {data['database_specific']['package']}") |
There was a problem hiding this comment.
Use get method to extract data from dictionary
| # add range of raw data accordingly as f string using first and last value of the list. | ||
| affected_version_range = NginxVersionRange.from_native(raw_data["vulnerable"]) | ||
|
|
||
| fixed_version = SemverVersion(raw_data["affected"][0]["ranges"][0]["events"][1]["fixed"]) |
There was a problem hiding this comment.
| fixed_version = SemverVersion(raw_data["affected"][0]["ranges"][0]["events"][1]["fixed"]) | |
| fixed_version = SemverVersion(raw_data["affected"][0]["ranges"][0]["events"][1]["fixed"]) |
Check get_item method in utils.py and before accessing any index check the length of list
|
@ambuj-1211 additionally please sign-off your commits |
Signed-off-by: ambuj <kulshreshthaak.12@gmail.com>
|
@TG1999 Apologies for the late response, I was stuck in my end sem exams. Done some changes as mentioned. I also want to know what to do for pURL, as in what should be the type, package name, and other components of the purl and also the version range for curl is not defined in univers what to do for that? |
|
type-generic namespace-domain name i.e curl.se name - name of the tool (curl, tiny-curl), version - as specified, download_url as qualifiers, so https://curl.se/download/curl-8.6.0.tar.gz this will be |
|
@ambuj-1211 try to collect all the versions of curl and commit a test to check with univers if all versions are effectively Semver Version |
|
@TG1999 check if it needs any more changes. Completed the curl.py file and the test_curl.py file. |
Signed-off-by: ambuj <kulshreshthaak.12@gmail.com>
…uj-1211/vulnerablecode into add-curl-advisories-importer
|
@TG1999 done the changes please review the commits |
|
@ambuj-1211 hey, you are not planning to complete this after all? |
|
@pombredanne I made a new pr regarding this issue therefore I closed this one, because there were some problems with this branch which I was not able to resolve. |
3 participants
This PR fixes #1166.
The test file is a dummy and will be completed once the curl.py importer is completed.