From 0b86d1ac8c2aedbd31299448f055712f1544b239 Mon Sep 17 00:00:00 2001 From: ykodwani01 Date: Sat, 13 Apr 2024 18:48:31 +0530 Subject: [PATCH 1/3] Expose Advisory data in API Signed-off-by: ykodwani01 --- vulnerabilities/api.py | 18 +++++++++++++- vulnerabilities/tests/test_api.py | 40 ++++++++++++++++++++++++++++--- 2 files changed, 54 insertions(+), 4 deletions(-) diff --git a/vulnerabilities/api.py b/vulnerabilities/api.py index f51998b87..33ff13ce8 100644 --- a/vulnerabilities/api.py +++ b/vulnerabilities/api.py @@ -24,6 +24,7 @@ from rest_framework.throttling import AnonRateThrottle from rest_framework.throttling import UserRateThrottle +from vulnerabilities.models import Advisory from vulnerabilities.models import Alias from vulnerabilities.models import Package from vulnerabilities.models import Vulnerability @@ -182,6 +183,21 @@ def to_representation(self, instance): weaknesses = data.get("weaknesses", []) data["weaknesses"] = [weakness for weakness in weaknesses if weakness is not None] + alias_queryset = instance.aliases.all() + data["advisory"] = [] + for itr in alias_queryset: + advisory_objects = Advisory.objects.filter(aliases=[itr.alias]) + for advisory_object in advisory_objects: + data["advisory"].append( + { + "unique_content_id": advisory_object.unique_content_id, + "url": advisory_object.url, + "summary": advisory_object.summary, + "date_collected": advisory_object.date_collected, + "created_by": advisory_object.created_by, + } + ) + return data @@ -625,4 +641,4 @@ class AliasViewSet(viewsets.ReadOnlyModelViewSet): serializer_class = VulnerabilitySerializer filter_backends = (filters.DjangoFilterBackend,) filterset_class = AliasFilterSet - throttle_classes = [StaffUserRateThrottle, AnonRateThrottle] + throttle_classes = [StaffUserRateThrottle, AnonRateThrottle] \ No newline at end of file diff --git a/vulnerabilities/tests/test_api.py b/vulnerabilities/tests/test_api.py index 197707a01..001cbe975 100644 --- a/vulnerabilities/tests/test_api.py +++ b/vulnerabilities/tests/test_api.py @@ -7,6 +7,7 @@ # See https://aboutcode.org for more information about nexB OSS projects. # +import datetime import json import os from collections import OrderedDict @@ -21,6 +22,7 @@ from vulnerabilities.api import MinimalPackageSerializer from vulnerabilities.api import PackageSerializer +from vulnerabilities.models import Advisory from vulnerabilities.models import Alias from vulnerabilities.models import ApiUser from vulnerabilities.models import Package @@ -193,6 +195,7 @@ def setUp(self): summary=str(i), ) self.vulnerability = Vulnerability.objects.create(summary="test") + self.alias = Alias.objects.create(alias="CORE-2010-0121", vulnerability=self.vulnerability) self.pkg1 = Package.objects.create(name="flask", type="pypi", version="0.1.2") self.pkg2 = Package.objects.create(name="flask", type="deb", version="0.1.2") for pkg in [self.pkg1, self.pkg2]: @@ -200,6 +203,15 @@ def setUp(self): package=pkg, vulnerability=self.vulnerability, fix=True ) self.weaknesses = Weakness.objects.create(cwe_id=119) + self.advisory = Advisory.objects.create( + unique_content_id="6b7d417a552b19f26a5c2267ba7876c2", + aliases=["CORE-2010-0121"], + summary="Vulnerabilities with Windows 8.3 filename pseudonyms", + affected_packages=[], + url="https://nginx.org/en/security_advisories.html", + date_collected="2024-04-12T00:00:00", + created_by="vulnerabilities.importers.nginx.NginxImporter", + ) self.weaknesses.vulnerabilities.add(self.vulnerability) self.invalid_weaknesses = Weakness.objects.create( cwe_id=10000 @@ -223,7 +235,7 @@ def test_api_with_single_vulnerability(self): "url": f"http://testserver/api/vulnerabilities/{self.vulnerability.id}", "vulnerability_id": self.vulnerability.vulnerability_id, "summary": "test", - "aliases": [], + "aliases": [OrderedDict([("alias", "CORE-2010-0121")])], "resource_url": f"http://testserver/vulnerabilities/{self.vulnerability.vulnerability_id}", "fixed_packages": [ { @@ -250,6 +262,17 @@ def test_api_with_single_vulnerability(self): "description": "The software performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.", }, ], + "advisory": [ + { + "unique_content_id": "6b7d417a552b19f26a5c2267ba7876c2", + "url": "https://nginx.org/en/security_advisories.html", + "summary": "Vulnerabilities with Windows 8.3 filename pseudonyms", + "date_collected": datetime.datetime( + 2024, 4, 12, 0, 0, tzinfo=datetime.timezone.utc + ), + "created_by": "vulnerabilities.importers.nginx.NginxImporter", + } + ], } def test_api_with_single_vulnerability_with_filters(self): @@ -260,7 +283,7 @@ def test_api_with_single_vulnerability_with_filters(self): "url": f"http://testserver/api/vulnerabilities/{self.vulnerability.id}", "vulnerability_id": self.vulnerability.vulnerability_id, "summary": "test", - "aliases": [], + "aliases": [OrderedDict([("alias", "CORE-2010-0121")])], "resource_url": f"http://testserver/vulnerabilities/{self.vulnerability.vulnerability_id}", "fixed_packages": [ { @@ -280,6 +303,17 @@ def test_api_with_single_vulnerability_with_filters(self): "description": "The software performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.", }, ], + "advisory": [ + { + "unique_content_id": "6b7d417a552b19f26a5c2267ba7876c2", + "url": "https://nginx.org/en/security_advisories.html", + "summary": "Vulnerabilities with Windows 8.3 filename pseudonyms", + "date_collected": datetime.datetime( + 2024, 4, 12, 0, 0, tzinfo=datetime.timezone.utc + ), + "created_by": "vulnerabilities.importers.nginx.NginxImporter", + } + ], } @@ -947,4 +981,4 @@ def test_bulk_lookup_endpoint_failure(self): "message": "A non-empty 'purls' list of PURLs is required.", } - self.assertEqual(response, expected) + self.assertEqual(response, expected) \ No newline at end of file From 41011b187dca4e2f515c20e87c8e6fbc081624a8 Mon Sep 17 00:00:00 2001 From: Yash Kodwani <202101418@daiict.ac.in> Date: Mon, 15 Apr 2024 00:24:32 +0530 Subject: [PATCH 2/3] Updated Code Style Signed-off-by: Yash Kodwani <202101418@daiict.ac.in> --- vulnerabilities/api.py | 3 +-- vulnerabilities/tests/test_api.py | 2 +- 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/vulnerabilities/api.py b/vulnerabilities/api.py index 33ff13ce8..568e3241f 100644 --- a/vulnerabilities/api.py +++ b/vulnerabilities/api.py @@ -197,7 +197,6 @@ def to_representation(self, instance): "created_by": advisory_object.created_by, } ) - return data @@ -641,4 +640,4 @@ class AliasViewSet(viewsets.ReadOnlyModelViewSet): serializer_class = VulnerabilitySerializer filter_backends = (filters.DjangoFilterBackend,) filterset_class = AliasFilterSet - throttle_classes = [StaffUserRateThrottle, AnonRateThrottle] \ No newline at end of file + throttle_classes = [StaffUserRateThrottle, AnonRateThrottle] diff --git a/vulnerabilities/tests/test_api.py b/vulnerabilities/tests/test_api.py index 001cbe975..c58f205db 100644 --- a/vulnerabilities/tests/test_api.py +++ b/vulnerabilities/tests/test_api.py @@ -981,4 +981,4 @@ def test_bulk_lookup_endpoint_failure(self): "message": "A non-empty 'purls' list of PURLs is required.", } - self.assertEqual(response, expected) \ No newline at end of file + self.assertEqual(response, expected) From ebb25c4a09cc89f66f3e976068e5deca1ddccad0 Mon Sep 17 00:00:00 2001 From: Yash Kodwani <202101418@daiict.ac.in> Date: Tue, 16 Apr 2024 01:02:38 +0530 Subject: [PATCH 3/3] Removed unique content id from advisory details api Signed-off-by: Yash Kodwani <202101418@daiict.ac.in> --- vulnerabilities/api.py | 1 - vulnerabilities/tests/test_api.py | 2 -- 2 files changed, 3 deletions(-) diff --git a/vulnerabilities/api.py b/vulnerabilities/api.py index 568e3241f..f030abef8 100644 --- a/vulnerabilities/api.py +++ b/vulnerabilities/api.py @@ -190,7 +190,6 @@ def to_representation(self, instance): for advisory_object in advisory_objects: data["advisory"].append( { - "unique_content_id": advisory_object.unique_content_id, "url": advisory_object.url, "summary": advisory_object.summary, "date_collected": advisory_object.date_collected, diff --git a/vulnerabilities/tests/test_api.py b/vulnerabilities/tests/test_api.py index c58f205db..f3036b2cb 100644 --- a/vulnerabilities/tests/test_api.py +++ b/vulnerabilities/tests/test_api.py @@ -264,7 +264,6 @@ def test_api_with_single_vulnerability(self): ], "advisory": [ { - "unique_content_id": "6b7d417a552b19f26a5c2267ba7876c2", "url": "https://nginx.org/en/security_advisories.html", "summary": "Vulnerabilities with Windows 8.3 filename pseudonyms", "date_collected": datetime.datetime( @@ -305,7 +304,6 @@ def test_api_with_single_vulnerability_with_filters(self): ], "advisory": [ { - "unique_content_id": "6b7d417a552b19f26a5c2267ba7876c2", "url": "https://nginx.org/en/security_advisories.html", "summary": "Vulnerabilities with Windows 8.3 filename pseudonyms", "date_collected": datetime.datetime(