Expose Advisory data in API

vulnerabilities/api.py

@@ -24,6 +24,7 @@
 from rest_framework.throttling import AnonRateThrottle
 from rest_framework.throttling import UserRateThrottle
 
+from vulnerabilities.models import Advisory
 from vulnerabilities.models import Alias
 from vulnerabilities.models import Package
 from vulnerabilities.models import Vulnerability
@@ -182,6 +183,19 @@ def to_representation(self, instance):
 
         weaknesses = data.get("weaknesses", [])
         data["weaknesses"] = [weakness for weakness in weaknesses if weakness is not None]
+        alias_queryset = instance.aliases.all()
+        data["advisory"] = []
+        for itr in alias_queryset:
+            advisory_objects = Advisory.objects.filter(aliases=[itr.alias])
+            for advisory_object in advisory_objects:
+                data["advisory"].append(
+                    {
+                        "url": advisory_object.url,
+                        "summary": advisory_object.summary,
+                        "date_collected": advisory_object.date_collected,
+                        "created_by": advisory_object.created_by,
+                    }
+                )
 
         return data
 

vulnerabilities/tests/test_api.py

@@ -7,6 +7,7 @@
 # See https://aboutcode.org for more information about nexB OSS projects.
 #
 
+import datetime
 import json
 import os
 from collections import OrderedDict
@@ -21,6 +22,7 @@
 
 from vulnerabilities.api import MinimalPackageSerializer
 from vulnerabilities.api import PackageSerializer
+from vulnerabilities.models import Advisory
 from vulnerabilities.models import Alias
 from vulnerabilities.models import ApiUser
 from vulnerabilities.models import Package
@@ -193,13 +195,23 @@ def setUp(self):
                 summary=str(i),
             )
         self.vulnerability = Vulnerability.objects.create(summary="test")
+        self.alias = Alias.objects.create(alias="CORE-2010-0121", vulnerability=self.vulnerability)
         self.pkg1 = Package.objects.create(name="flask", type="pypi", version="0.1.2")
         self.pkg2 = Package.objects.create(name="flask", type="deb", version="0.1.2")
         for pkg in [self.pkg1, self.pkg2]:
             PackageRelatedVulnerability.objects.create(
                 package=pkg, vulnerability=self.vulnerability, fix=True
             )
         self.weaknesses = Weakness.objects.create(cwe_id=119)
+        self.advisory = Advisory.objects.create(
+            unique_content_id="6b7d417a552b19f26a5c2267ba7876c2",
+            aliases=["CORE-2010-0121"],
+            summary="Vulnerabilities with Windows 8.3 filename pseudonyms",
+            affected_packages=[],
+            url="https://nginx.org/en/security_advisories.html",
+            date_collected="2024-04-12T00:00:00",
+            created_by="vulnerabilities.importers.nginx.NginxImporter",
+        )
         self.weaknesses.vulnerabilities.add(self.vulnerability)
         self.invalid_weaknesses = Weakness.objects.create(
             cwe_id=10000
@@ -223,7 +235,7 @@ def test_api_with_single_vulnerability(self):
             "url": f"http://testserver/api/vulnerabilities/{self.vulnerability.id}",
             "vulnerability_id": self.vulnerability.vulnerability_id,
             "summary": "test",
-            "aliases": [],
+            "aliases": [OrderedDict([("alias", "CORE-2010-0121")])],
             "resource_url": f"http://testserver/vulnerabilities/{self.vulnerability.vulnerability_id}",
             "fixed_packages": [
                 {
@@ -250,6 +262,16 @@ def test_api_with_single_vulnerability(self):
                     "description": "The software performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.",
                 },
             ],
+            "advisory": [
+                {
+                    "url": "https://nginx.org/en/security_advisories.html",
+                    "summary": "Vulnerabilities with Windows 8.3 filename pseudonyms",
+                    "date_collected": datetime.datetime(
+                        2024, 4, 12, 0, 0, tzinfo=datetime.timezone.utc
+                    ),
+                    "created_by": "vulnerabilities.importers.nginx.NginxImporter",
+                }
+            ],
         }
 
     def test_api_with_single_vulnerability_with_filters(self):
@@ -260,7 +282,7 @@ def test_api_with_single_vulnerability_with_filters(self):
             "url": f"http://testserver/api/vulnerabilities/{self.vulnerability.id}",
             "vulnerability_id": self.vulnerability.vulnerability_id,
             "summary": "test",
-            "aliases": [],
+            "aliases": [OrderedDict([("alias", "CORE-2010-0121")])],
             "resource_url": f"http://testserver/vulnerabilities/{self.vulnerability.vulnerability_id}",
             "fixed_packages": [
                 {
@@ -280,6 +302,16 @@ def test_api_with_single_vulnerability_with_filters(self):
                     "description": "The software performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.",
                 },
             ],
+            "advisory": [
+                {
+                    "url": "https://nginx.org/en/security_advisories.html",
+                    "summary": "Vulnerabilities with Windows 8.3 filename pseudonyms",
+                    "date_collected": datetime.datetime(
+                        2024, 4, 12, 0, 0, tzinfo=datetime.timezone.utc
+                    ),
+                    "created_by": "vulnerabilities.importers.nginx.NginxImporter",
+                }
+            ],
         }