Skip to content

fix: check for 'patched_versions' key - #155

Merged
haikoschol merged 4 commits into
aboutcode-org:developfrom
EslamHiko:fix-key-error
Mar 5, 2020
Merged

fix: check for 'patched_versions' key#155
haikoschol merged 4 commits into
aboutcode-org:developfrom
EslamHiko:fix-key-error

Conversation

@EslamHiko

Copy link
Copy Markdown
Contributor

This is a PR to solve this issue : #154

Signed-off-by: Islam ElHakmi <eslam.elhakmey3@gmail.com>
Signed-off-by: Islam ElHakmi <eslam.elhakmey3@gmail.com>
@sbs2001

sbs2001 commented Mar 5, 2020

Copy link
Copy Markdown
Collaborator

Thank you for the PR! , the code will fix the key error but that's not enough . We need to make some changes to the rust-sec importer to adopt to their changed schema. The files with absence of patched_versions field have adopted a new way to denote patched versions, we have to collect that data. So simply checking for the patched_versions field wont fix the problem completely.

Signed-off-by: Islam ElHakmi <eslam.elhakmey3@gmail.com>
@EslamHiko

EslamHiko commented Mar 5, 2020

Copy link
Copy Markdown
Contributor Author

@sbs2001 this is the new Schema

{'advisory': 
{
'id': 'RUSTSEC-2019-0016',
 'package': 'chttp',
 'date': '2019-09-01', 
'title': 'Use-after-free in buffer conversion implementation',
'description': 'The From<Buffer> implementation for Vec<u8> was not properly implemented,\nreturning a vector backed by freed memory. This could lead to memory corruption\nor be exploited to cause undefined behavior.\n \nA fix was published in version 0.1.3.\n',
'url': 'https://github.com/sagebind/isahc/issues/2',
'keywords': ['memory-management', 'memory-corruption']
},
 'versions': {'patched': ['>= 0.1.3'], 'unaffected': ['< 0.1.1']}
}

I've updated my PR to work with the new schema:

unaffected_version_range_list = advisory['versions'].get(
            'unaffected', [])
patched_version_range_list = advisory['versions']['patched']

Signed-off-by: Islam ElHakmi <eslam.elhakmey3@gmail.com>
@sbs2001

sbs2001 commented Mar 5, 2020

Copy link
Copy Markdown
Collaborator

LGMT ! @EslamHiko thank you ++ .
@haikoschol please review and merge.

@haikoschol

Copy link
Copy Markdown
Collaborator

@EslamHiko @sbs2001 thank you!

@haikoschol
haikoschol merged commit 193e953 into aboutcode-org:develop Mar 5, 2020
@EslamHiko
EslamHiko deleted the fix-key-error branch March 5, 2020 13:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants