Drop OSVDB-derived OSV aliases from the rubygem data sources - #2423
Drop OSVDB-derived OSV aliases from the rubygem data sources#2423MGpromax wants to merge 1 commit into
Conversation
The rubysec advisory data carries references to the defunct OSVDB database in its osvdb field, and both the ruby importer and the v2 ruby importer pipeline turned these into OSV-<number> aliases. These are not public aliases and the prefix collides with the modern OSV.dev namespace. Remove the code that imports them and add a data migration deleting the previously imported ones from both the Alias and AdvisoryAlias tables. Genuine OSV.dev identifiers (OSV-<year>-<number>, with two hyphens) are preserved by the migration regex. Closes aboutcode-org#2421 Signed-off-by: Manoj Gowda <manojgowdabs18@gmail.com>
|
@MGpromax, first of all, we need to identify where the data is coming from and how it is being imported. We can start by searching for the OSV aliases in the VulnerableCode database using SQL and then trace them back to the corresponding importer. Alternatively, we can search in: This should help us identify the original data source and the import pipelines responsible for adding the data to VulnerableCode. Once we identify the relevant importers, we should update them accordingly. Note: We are going to drop the old importers, so please focus on the importers under |
Shriprasad-P
left a comment
There was a problem hiding this comment.
Review
PR: Drop OSVDB-derived OSV aliases from the rubygem data sources
Touched: vulnerabilities/importers/ruby.py, vulnerabilities/migrations/0143_remove_rubygem_osvdb_aliases.py, vulnerabilities/pipelines/v2_importers/ruby_importer.py, vulnerabilities/tests/test_data/ruby/CVE-2010-1330-expected.json
- Addresses a concrete correctness/reliability issue based on the title and diff.
- Includes or touches tests — good for locking the behavior.
- Size looks manageable (+44/-7).
Commenting as a drive-by reviewer after reading the diff. Happy to look again if maintainers want a deeper pass on a specific file.
Closes #2421
The rubysec advisory data references the defunct OSVDB database in its
osvdbfield, and bothvulnerabilities/importers/ruby.pyandvulnerabilities/pipelines/v2_importers/ruby_importer.pyturned these intoOSV-<number>aliases -- not public aliases, and a prefix collision with the modern OSV.dev namespace.This PR:
osvdb->OSV-...alias code from both importers (theOSVDB-*.ymlfiles themselves were already skipped);0143_remove_rubygem_osvdb_aliasesdeleting previously imported ones from both theAlias(v1) andAdvisoryAlias(v2) tables. The regex^OSV-\d+$matches only the OSVDB-derived single-hyphen form, so genuine OSV.dev identifiers (OSV-<year>-<number>) are preserved.Testing: the ruby importer tests pass (
7 passed; the 4 errors intest_ruby_advisories_per_fileareTransactionManagementErrors that occur identically on a clean checkout in my sqlite environment and are unrelated).manage.py migrate --planincludes the new migration cleanly.