Add Apache Log4j Advisories - #1744
Conversation
Signed-off-by: NucleonGodX <racerpro41@gmail.com>
Signed-off-by: NucleonGodX <racerpro41@gmail.com>
|
@NucleonGodX thanks for your contributions, can you please use pipeline structure. https://github.com/aboutcode-org/vulnerablecode/blob/main/vulnerabilities/pipelines/nvd_importer.py check this for example |
pombredanne
left a comment
pombredanne
left a comment
There was a problem hiding this comment.
Thanks! In addition to use the new pipelines, here are a few comments for your consideration. We also need some tests.
| @@ -0,0 +1,252 @@ | |||
| import logging | |||
There was a problem hiding this comment.
Use the same header as in other files
| @@ -0,0 +1,252 @@ | |||
| import logging | |||
| import xml.etree.ElementTree as ET | |||
There was a problem hiding this comment.
Consider using the cyclonedx python library to parse this, and not parsing XML yourself
| Parse the XML content and create AdvisoryData objects. | ||
| """ | ||
| advisories = [] | ||
| version_mapping = [ |
There was a problem hiding this comment.
Why use mapping? are you positively sure that these are forever all the known versions of log4j? Also this would not be a mapping, rather just a set of some versions?
There was a problem hiding this comment.
I added them from https://www.cvedetails.com/version-list/45/37215/1/Apache-Log4j.html?order=0.
| "2.17.1", | ||
| ] | ||
|
|
||
| try: |
| ] | ||
|
|
||
| try: | ||
| root = ET.fromstring(xml_content) |
|
|
||
| class Log4jImprover(ValidVersionImprover): | ||
| importer = ApacheLog4jImporter | ||
| ignorable_versions = [] |
There was a problem hiding this comment.
We likely need some improver to get and expand the list of known versions
Signed-off-by: NucleonGodX <racerpro41@gmail.com>
Signed-off-by: NucleonGodX <racerpro41@gmail.com>
| unique_versions = sorted(set(versions), key=lambda x: MavenVersion(x)) | ||
| version_range_str = f"vers:maven/{('|'.join(unique_versions))}" |
There was a problem hiding this comment.
Why not use MavenVersionRange instead?
There was a problem hiding this comment.
oh yeah, I'll try to use that.
4 participants
This pull request addresses issue #586 by adding an importer for Apache Log4j advisories
