diff --git a/vulnerabilities/api.py b/vulnerabilities/api.py index f51998b87..2a802cb20 100644 --- a/vulnerabilities/api.py +++ b/vulnerabilities/api.py @@ -24,6 +24,7 @@ from rest_framework.throttling import AnonRateThrottle from rest_framework.throttling import UserRateThrottle +from vulnerabilities.models import Advisory from vulnerabilities.models import Alias from vulnerabilities.models import Package from vulnerabilities.models import Vulnerability @@ -182,6 +183,21 @@ def to_representation(self, instance): weaknesses = data.get("weaknesses", []) data["weaknesses"] = [weakness for weakness in weaknesses if weakness is not None] + alias_queryset = instance.aliases.all() + data["advisory"] = [] + for itr in alias_queryset: + advisory_objects = Advisory.objects.filter(aliases=[itr.alias]) + for advisory_object in advisory_objects: + data["advisory"].append( + { + "unique_content_id": advisory_object.unique_content_id, + "url": advisory_object.url, + "summary": advisory_object.summary, + "date_collected": advisory_object.date_collected, + "created_by": advisory_object.created_by, + } + ) + return data diff --git a/vulnerabilities/tests/test_api.py b/vulnerabilities/tests/test_api.py index 197707a01..c58f205db 100644 --- a/vulnerabilities/tests/test_api.py +++ b/vulnerabilities/tests/test_api.py @@ -7,6 +7,7 @@ # See https://aboutcode.org for more information about nexB OSS projects. # +import datetime import json import os from collections import OrderedDict @@ -21,6 +22,7 @@ from vulnerabilities.api import MinimalPackageSerializer from vulnerabilities.api import PackageSerializer +from vulnerabilities.models import Advisory from vulnerabilities.models import Alias from vulnerabilities.models import ApiUser from vulnerabilities.models import Package @@ -193,6 +195,7 @@ def setUp(self): summary=str(i), ) self.vulnerability = Vulnerability.objects.create(summary="test") + self.alias = Alias.objects.create(alias="CORE-2010-0121", vulnerability=self.vulnerability) self.pkg1 = Package.objects.create(name="flask", type="pypi", version="0.1.2") self.pkg2 = Package.objects.create(name="flask", type="deb", version="0.1.2") for pkg in [self.pkg1, self.pkg2]: @@ -200,6 +203,15 @@ def setUp(self): package=pkg, vulnerability=self.vulnerability, fix=True ) self.weaknesses = Weakness.objects.create(cwe_id=119) + self.advisory = Advisory.objects.create( + unique_content_id="6b7d417a552b19f26a5c2267ba7876c2", + aliases=["CORE-2010-0121"], + summary="Vulnerabilities with Windows 8.3 filename pseudonyms", + affected_packages=[], + url="https://nginx.org/en/security_advisories.html", + date_collected="2024-04-12T00:00:00", + created_by="vulnerabilities.importers.nginx.NginxImporter", + ) self.weaknesses.vulnerabilities.add(self.vulnerability) self.invalid_weaknesses = Weakness.objects.create( cwe_id=10000 @@ -223,7 +235,7 @@ def test_api_with_single_vulnerability(self): "url": f"http://testserver/api/vulnerabilities/{self.vulnerability.id}", "vulnerability_id": self.vulnerability.vulnerability_id, "summary": "test", - "aliases": [], + "aliases": [OrderedDict([("alias", "CORE-2010-0121")])], "resource_url": f"http://testserver/vulnerabilities/{self.vulnerability.vulnerability_id}", "fixed_packages": [ { @@ -250,6 +262,17 @@ def test_api_with_single_vulnerability(self): "description": "The software performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.", }, ], + "advisory": [ + { + "unique_content_id": "6b7d417a552b19f26a5c2267ba7876c2", + "url": "https://nginx.org/en/security_advisories.html", + "summary": "Vulnerabilities with Windows 8.3 filename pseudonyms", + "date_collected": datetime.datetime( + 2024, 4, 12, 0, 0, tzinfo=datetime.timezone.utc + ), + "created_by": "vulnerabilities.importers.nginx.NginxImporter", + } + ], } def test_api_with_single_vulnerability_with_filters(self): @@ -260,7 +283,7 @@ def test_api_with_single_vulnerability_with_filters(self): "url": f"http://testserver/api/vulnerabilities/{self.vulnerability.id}", "vulnerability_id": self.vulnerability.vulnerability_id, "summary": "test", - "aliases": [], + "aliases": [OrderedDict([("alias", "CORE-2010-0121")])], "resource_url": f"http://testserver/vulnerabilities/{self.vulnerability.vulnerability_id}", "fixed_packages": [ { @@ -280,6 +303,17 @@ def test_api_with_single_vulnerability_with_filters(self): "description": "The software performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.", }, ], + "advisory": [ + { + "unique_content_id": "6b7d417a552b19f26a5c2267ba7876c2", + "url": "https://nginx.org/en/security_advisories.html", + "summary": "Vulnerabilities with Windows 8.3 filename pseudonyms", + "date_collected": datetime.datetime( + 2024, 4, 12, 0, 0, tzinfo=datetime.timezone.utc + ), + "created_by": "vulnerabilities.importers.nginx.NginxImporter", + } + ], }