diff --git a/vulnerabilities/import_runner.py b/vulnerabilities/import_runner.py index 9b049fd3d..e54aadd0b 100644 --- a/vulnerabilities/import_runner.py +++ b/vulnerabilities/import_runner.py @@ -258,7 +258,7 @@ def _insert_vulnerabilities_and_references(batch: Set[Advisory]) -> Set[models.V if advisory.cve_id: vuln, created = models.Vulnerability.objects.get_or_create(cve_id=advisory.cve_id) - if created and vuln.summary: + if created and advisory.summary: vuln.summary = advisory.summary vuln.save() else: diff --git a/vulnerabilities/tests/test_import_runner.py b/vulnerabilities/tests/test_import_runner.py index ce5572c8b..2c999b9ba 100644 --- a/vulnerabilities/tests/test_import_runner.py +++ b/vulnerabilities/tests/test_import_runner.py @@ -29,6 +29,7 @@ from vulnerabilities.data_source import DataSource from vulnerabilities.data_source import PackageURL from vulnerabilities.import_runner import ImportRunner +from vulnerabilities.import_runner import _insert_vulnerabilities_and_references class MockDataSource(DataSource): @@ -197,12 +198,12 @@ def test_ImportRunner_new_package_version_affected_by_existing_vulnerability(db) assert impacted_package.vulnerability.cve_id == 'MOCK-CVE-2020-1337' -def test_ImportRunner_assumed_fixed_package_is_updated_as_impacted(db): - """ - A version of a package existing in the database that was assumed to be fixed was found to still - be affected by a vulnerability that also already existed in the database (i.e. the previously - stored data was corrected). - """ +# def test_ImportRunner_assumed_fixed_package_is_updated_as_impacted(db): +# """ +# A version of a package existing in the database that was assumed to be fixed was found to +# still be affected by a vulnerability that also already existed in the database (i.e. the +# previously stored data was corrected). +# """ # FIXME This case is not supported due to cascading deletes. When the ResolvedPackage is # FIXME deleted, the referenced Package and Vulnerability are also deleted. # @@ -317,3 +318,16 @@ def test_ImportRunner_updated_vulnerability(db): vuln_refs = models.VulnerabilityReference.objects.filter(vulnerability=vuln) assert vuln_refs.count() == 1 assert vuln_refs[0].url == 'https://example.com/with/more/info/MOCK-CVE-2020-1337' + + +def test_insert_vulnerabilities_and_references_stores_summary(db): + advisory = Advisory( + summary='vulnerability description here', + cve_id='MOCK-CVE-2020-1337', + impacted_package_urls=[PackageURL(name='mock-webserver', type='pypi', version='1.2.33a')], + ) + + _insert_vulnerabilities_and_references({advisory}) + + vuln = models.Vulnerability.objects.get(cve_id=advisory.cve_id) + assert vuln.summary == advisory.summary