From 1b1cfb73650c8c5c1c206987415414c85a9b8512 Mon Sep 17 00:00:00 2001 From: Shivammm Date: Tue, 5 Jan 2021 23:00:48 +0530 Subject: [PATCH 01/18] added verbose plural name for PackageRelatedVulnerability model Signed-off-by: Shivammm --- .gitignore | 3 +++ .../migrations/0002_auto_20210105_1725.py | 17 +++++++++++++++++ vulnerabilities/models.py | 1 + 3 files changed, 21 insertions(+) create mode 100644 vulnerabilities/migrations/0002_auto_20210105_1725.py diff --git a/.gitignore b/.gitignore index da40ab034..9679e5ca8 100644 --- a/.gitignore +++ b/.gitignore @@ -115,7 +115,10 @@ bin include lib64 share +Pipfile +# editor +.vscode/ # pytest .pytest_cache diff --git a/vulnerabilities/migrations/0002_auto_20210105_1725.py b/vulnerabilities/migrations/0002_auto_20210105_1725.py new file mode 100644 index 000000000..c0b5c1b6c --- /dev/null +++ b/vulnerabilities/migrations/0002_auto_20210105_1725.py @@ -0,0 +1,17 @@ +# Generated by Django 3.0.7 on 2021-01-05 17:25 + +from django.db import migrations + + +class Migration(migrations.Migration): + + dependencies = [ + ('vulnerabilities', '0001_initial'), + ] + + operations = [ + migrations.AlterModelOptions( + name='packagerelatedvulnerability', + options={'verbose_name_plural': 'Package related vulnerabilities'}, + ), + ] diff --git a/vulnerabilities/models.py b/vulnerabilities/models.py index fdf2f0000..6e03b76f2 100644 --- a/vulnerabilities/models.py +++ b/vulnerabilities/models.py @@ -146,6 +146,7 @@ class PackageRelatedVulnerability(models.Model): class Meta: unique_together = ("package", "vulnerability") + verbose_name_plural = "Package related vulnerabilities" class ImportProblem(models.Model): From bbb86c6bd0af315c803a3b7abdd134f5b5785f4b Mon Sep 17 00:00:00 2001 From: Shivammm Date: Tue, 5 Jan 2021 23:00:48 +0530 Subject: [PATCH 02/18] added verbose plural name for PackageRelatedVulnerability model Signed-off-by: Shivammm --- .gitignore | 3 +++ .../migrations/0002_auto_20210105_1725.py | 17 +++++++++++++++++ vulnerabilities/models.py | 1 + 3 files changed, 21 insertions(+) create mode 100644 vulnerabilities/migrations/0002_auto_20210105_1725.py diff --git a/.gitignore b/.gitignore index da40ab034..9679e5ca8 100644 --- a/.gitignore +++ b/.gitignore @@ -115,7 +115,10 @@ bin include lib64 share +Pipfile +# editor +.vscode/ # pytest .pytest_cache diff --git a/vulnerabilities/migrations/0002_auto_20210105_1725.py b/vulnerabilities/migrations/0002_auto_20210105_1725.py new file mode 100644 index 000000000..c0b5c1b6c --- /dev/null +++ b/vulnerabilities/migrations/0002_auto_20210105_1725.py @@ -0,0 +1,17 @@ +# Generated by Django 3.0.7 on 2021-01-05 17:25 + +from django.db import migrations + + +class Migration(migrations.Migration): + + dependencies = [ + ('vulnerabilities', '0001_initial'), + ] + + operations = [ + migrations.AlterModelOptions( + name='packagerelatedvulnerability', + options={'verbose_name_plural': 'Package related vulnerabilities'}, + ), + ] diff --git a/vulnerabilities/models.py b/vulnerabilities/models.py index fdf2f0000..6e03b76f2 100644 --- a/vulnerabilities/models.py +++ b/vulnerabilities/models.py @@ -146,6 +146,7 @@ class PackageRelatedVulnerability(models.Model): class Meta: unique_together = ("package", "vulnerability") + verbose_name_plural = "Package related vulnerabilities" class ImportProblem(models.Model): From f7716f8112e64043b66382bfb2ee8fbdad55b120 Mon Sep 17 00:00:00 2001 From: Shivammm Date: Sun, 10 Jan 2021 20:43:42 +0530 Subject: [PATCH 03/18] now ignoring vscode specific directory --- .gitignore | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.gitignore b/.gitignore index 9679e5ca8..e12634454 100644 --- a/.gitignore +++ b/.gitignore @@ -117,7 +117,7 @@ lib64 share Pipfile -# editor +# editors .vscode/ # pytest From 167734ec853c305a0b2c833512f14a95d4a1a281 Mon Sep 17 00:00:00 2001 From: Shivammm Date: Sun, 10 Jan 2021 20:45:25 +0530 Subject: [PATCH 04/18] Verbose plural name for PackageRelatedVulnerabilities --- vulnerabilities/migrations/0001_initial.py | 3 ++- .../migrations/0002_auto_20210105_1725.py | 17 ----------------- vulnerabilities/models.py | 2 +- 3 files changed, 3 insertions(+), 19 deletions(-) delete mode 100644 vulnerabilities/migrations/0002_auto_20210105_1725.py diff --git a/vulnerabilities/migrations/0001_initial.py b/vulnerabilities/migrations/0001_initial.py index a9172f893..c87baee79 100644 --- a/vulnerabilities/migrations/0001_initial.py +++ b/vulnerabilities/migrations/0001_initial.py @@ -1,4 +1,4 @@ -# Generated by Django 3.0.7 on 2020-09-14 06:17 +# Generated by Django 3.0.7 on 2021-01-10 15:11 import django.contrib.postgres.fields.jsonb from django.db import migrations, models @@ -64,6 +64,7 @@ class Migration(migrations.Migration): ('vulnerability', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, to='vulnerabilities.Vulnerability')), ], options={ + 'verbose_name_plural': 'PackageRelatedVulnerabilities', 'unique_together': {('package', 'vulnerability')}, }, ), diff --git a/vulnerabilities/migrations/0002_auto_20210105_1725.py b/vulnerabilities/migrations/0002_auto_20210105_1725.py deleted file mode 100644 index c0b5c1b6c..000000000 --- a/vulnerabilities/migrations/0002_auto_20210105_1725.py +++ /dev/null @@ -1,17 +0,0 @@ -# Generated by Django 3.0.7 on 2021-01-05 17:25 - -from django.db import migrations - - -class Migration(migrations.Migration): - - dependencies = [ - ('vulnerabilities', '0001_initial'), - ] - - operations = [ - migrations.AlterModelOptions( - name='packagerelatedvulnerability', - options={'verbose_name_plural': 'Package related vulnerabilities'}, - ), - ] diff --git a/vulnerabilities/models.py b/vulnerabilities/models.py index 6e03b76f2..d1ac97f0d 100644 --- a/vulnerabilities/models.py +++ b/vulnerabilities/models.py @@ -146,7 +146,7 @@ class PackageRelatedVulnerability(models.Model): class Meta: unique_together = ("package", "vulnerability") - verbose_name_plural = "Package related vulnerabilities" + verbose_name_plural = "PackageRelatedVulnerabilities" class ImportProblem(models.Model): From 7178fe7b4d1cb79d7627a9abc33b3df000a4e239 Mon Sep 17 00:00:00 2001 From: Shivammm Date: Sun, 10 Jan 2021 20:56:26 +0530 Subject: [PATCH 05/18] Verbose plural name for PackageRelatedVulnerabilities --- .vscode/settings.json | 3 + Pipfile | 66 +++++++++ vulnerabilities/importer_yielder.py | 14 +- vulnerabilities/importers/__init__.py | 2 +- vulnerabilities/importers/elixir_security.py | 128 ++++++++++++++++++ .../test_data/elixir_security/test_file.yml | 12 ++ vulnerabilities/tests/test_elixir_security.py | 85 ++++++++++++ 7 files changed, 302 insertions(+), 8 deletions(-) create mode 100644 .vscode/settings.json create mode 100644 Pipfile create mode 100644 vulnerabilities/importers/elixir_security.py create mode 100644 vulnerabilities/tests/test_data/elixir_security/test_file.yml create mode 100644 vulnerabilities/tests/test_elixir_security.py diff --git a/.vscode/settings.json b/.vscode/settings.json new file mode 100644 index 000000000..58b1f27f9 --- /dev/null +++ b/.vscode/settings.json @@ -0,0 +1,3 @@ +{ + "python.pythonPath": "C:\\Users\\Shivam Sharma\\.virtualenvs\\vulnerablecode-MrLwLfAt\\Scripts\\python.exe" +} \ No newline at end of file diff --git a/Pipfile b/Pipfile new file mode 100644 index 000000000..c0022a1de --- /dev/null +++ b/Pipfile @@ -0,0 +1,66 @@ +[[source]] +url = "https://pypi.org/simple" +verify_ssl = true +name = "pypi" + +[packages] +aiohttp = "==3.6.2" +asgiref = "==3.2.7" +attrs = "==19.3.0" +backcall = "==0.1.0" +beautifulsoup4 = "==4.7.1" +cached-property = "==1.5.1" +cffi = "==1.14.0" +contextlib2 = "==0.5.5" +decorator = "==4.4.2" +dephell-specifier = "==0.2.1" +dj-database-url = "==0.4.2" +django = "==3.0.7" +django-filter = "==2.2.0" +djangorestframework = "==3.11.0" +django-widget-tweaks = "==1.4.8" +drf-yasg = "==1.17.1" +gunicorn = "==19.7.1" +importlib-metadata = "==1.3.0" +ipython = "==7.13.0" +ipython-genutils = "==0.2.0" +jedi = "==0.17.0" +lxml = "==4.3.3" +more-itertools = "==8.0.2" +packageurl-python = "==0.9.3" +parso = "==0.7.0" +pexpect = "==4.8.0" +pickleshare = "==0.7.5" +pluggy = "==0.13.1" +prompt-toolkit = "==3.0.5" +psycopg2 = "==2.8.4" +ptyprocess = "==0.6.0" +py = "==1.8.0" +pycodestyle = "==2.5.0" +pycparser = "==2.20" +pygit2 = "==1.2.0" +pygments = "==2.6.1" +pyparsing = "==2.4.5" +pytest = "==5.3.2" +pytest-dependency = "==0.4.0" +pytest-django = "==3.7.0" +pytest-mock = "==1.13.0" +python-dateutil = "==2.8.1" +pytz = "==2019.3" +schema = "==0.7.1" +six = "==1.13.0" +soupsieve = "==1.9.5" +sqlparse = "==0.3.0" +tqdm = "==4.41.1" +traitlets = "==4.3.3" +wcwidth = "==0.1.7" +whitenoise = "==5.0.1" +zipp = "==0.6.0" +requests = "==2.23.0" +toml = "==0.10.2" +pyyaml = "==5.3.1" + +[dev-packages] + +[requires] +python_version = "3.9" diff --git a/vulnerabilities/importer_yielder.py b/vulnerabilities/importer_yielder.py index 5b9fdc641..c15e58a46 100644 --- a/vulnerabilities/importer_yielder.py +++ b/vulnerabilities/importer_yielder.py @@ -227,13 +227,13 @@ 'data_source_cfg': {}, }, { - 'name': 'apache_tomcat', - 'license': '', - 'last_run': None, - 'data_source': 'ApacheTomcatDataSource', - 'data_source_cfg': { - "etags": {} - }, + 'name': 'elixir_security', + 'license': '', + 'last_run': None, + 'data_source': 'ElixirSecurityDataSource', + 'data_source_cfg': { + 'repository_url': 'https://github.com/dependabot/elixir-security-advisories' + }, }, ] diff --git a/vulnerabilities/importers/__init__.py b/vulnerabilities/importers/__init__.py index 73b081ce2..12a610a72 100644 --- a/vulnerabilities/importers/__init__.py +++ b/vulnerabilities/importers/__init__.py @@ -43,4 +43,4 @@ from vulnerabilities.importers.kaybee import KaybeeDataSource from vulnerabilities.importers.nginx import NginxDataSource from vulnerabilities.importers.postgresql import PostgreSQLDataSource -from vulnerabilities.importers.apache_tomcat import ApacheTomcatDataSource +from vulnerabilities.importers.elixir_security import ElixirSecurityDataSource diff --git a/vulnerabilities/importers/elixir_security.py b/vulnerabilities/importers/elixir_security.py new file mode 100644 index 000000000..f603fd0c9 --- /dev/null +++ b/vulnerabilities/importers/elixir_security.py @@ -0,0 +1,128 @@ +# Copyright (c) 2017 nexB Inc. and others. All rights reserved. +# http://nexb.com and https://github.com/nexB/vulnerablecode/ +# The VulnerableCode software is licensed under the Apache License version 2.0. +# Data generated with VulnerableCode require an acknowledgment. +# +# You may not use this software except in compliance with the License. +# You may obtain a copy of the License at: http://apache.org/licenses/LICENSE-2.0 +# Unless required by applicable law or agreed to in writing, software distributed +# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR +# CONDITIONS OF ANY KIND, either express or implied. See the License for the +# specific language governing permissions and limitations under the License. +# +# When you publish or redistribute any data created with VulnerableCode or any VulnerableCode +# derivative work, you must accompany this data with the following acknowledgment: +# +# Generated with VulnerableCode and provided on an "AS IS" BASIS, WITHOUT WARRANTIES +# OR CONDITIONS OF ANY KIND, either express or implied. No content created from +# VulnerableCode should be considered or used as legal advice. Consult an Attorney +# for any legal advice. +# VulnerableCode is a free software code scanning tool from nexB Inc. and others. +# Visit https://github.com/nexB/vulnerablecode/ for support and download. + +import yaml +import re +import json +import requests +from typing import Set +from typing import List + +from packageurl import PackageURL + +from vulnerabilities.data_source import GitDataSource +from vulnerabilities.data_source import GitDataSourceConfiguration +from vulnerabilities.data_source import Advisory +from vulnerabilities.data_source import Reference + + +class ElixirSecurityDataSource(GitDataSource): + def __enter__(self): + super(ElixirSecurityDataSource, self).__enter__() + + if not getattr(self, "_added_files", None): + self._added_files, self._updated_files = self.file_changes( + recursive=True, file_ext="yml", subdir="./packages" + ) + + def updated_advisories(self) -> Set[Advisory]: + files = self._updated_files + advisories = [] + for f in files: + processed_data = self.process_file(f) + if processed_data: + advisories.append(processed_data) + return self.batch_advisories(advisories) + + def added_advisories(self) -> Set[Advisory]: + files = self._added_files + advisories = [] + for f in files: + processed_data = self.process_file(f) + if processed_data: + advisories.append(processed_data) + return self.batch_advisories(advisories) + + @staticmethod + def generate_all_versions_list(pkg_name): + resp = requests.get(f"https://hex.pm/api/packages/{pkg_name}") + resp = resp.content + json_resp = json.loads(resp) + versions_list = [] + for release in json_resp["releases"]: + versions_list.append(release["version"]) + return versions_list + + def get_pkg_from_range(self, versions_list, pkg_name): + pkg_versions = [] + all_versions_list = self.generate_all_versions_list(pkg_name) + if versions_list is None: + return + for version in versions_list: + if re.match("^>=", version): + index = all_versions_list.index(version[3:]) + pkg_versions = pkg_versions + all_versions_list[0: index + 1] + elif re.match("^>", version): + index = all_versions_list.index(version[2:]) + pkg_versions = pkg_versions + all_versions_list[0:index] + elif re.match("^<", version): + index = all_versions_list.index(version[2:]) + pkg_versions = pkg_versions + all_versions_list[index + 1: -1] + else: + pkg_versions.append(version[3:]) + return pkg_versions + + def process_file(self, path): + with open(path) as f: + yaml_file = yaml.safe_load(f) + pkg_name = yaml_file["package"] + safe_pkg_versions = [] + if yaml_file.get("unaffected_versions"): + safe_pkg_versions = self.get_pkg_from_range( + yaml_file["patched_versions"] + yaml_file["unaffected_versions"], + pkg_name, + ) + else: + safe_pkg_versions = self.get_pkg_from_range( + yaml_file["patched_versions"], pkg_name + ) + cve_id = yaml_file["cve"] + safe_purls = [] + if safe_pkg_versions is not None: + safe_purls = { + PackageURL(name=pkg_name, type="hex", version=version) + for version in safe_pkg_versions + } + + vuln_reference = [ + Reference( + url=yaml_file["link"], + ) + ] + + return Advisory( + summary=yaml_file["description"], + impacted_package_urls=[], + resolved_package_urls=safe_purls, + cve_id=cve_id, + vuln_references=vuln_reference, + ) diff --git a/vulnerabilities/tests/test_data/elixir_security/test_file.yml b/vulnerabilities/tests/test_data/elixir_security/test_file.yml new file mode 100644 index 000000000..519cc60f9 --- /dev/null +++ b/vulnerabilities/tests/test_data/elixir_security/test_file.yml @@ -0,0 +1,12 @@ +--- +id: 2aae6e3a-24a3-4d5f-86ff-b964eaf7c6d1 +package: coherence +disclosure_date: 2017-08-02 +cve: 2018-20301 +link: https://github.com/smpallen99/coherence/issues/270 +title: | + Permissive parameters and privilege escalation +description: | + The Coherence library has "Mass Assignment"-like vulnerabilities. +patched_versions: + - ">= 0.5.2" \ No newline at end of file diff --git a/vulnerabilities/tests/test_elixir_security.py b/vulnerabilities/tests/test_elixir_security.py new file mode 100644 index 000000000..e4125968e --- /dev/null +++ b/vulnerabilities/tests/test_elixir_security.py @@ -0,0 +1,85 @@ +# Copyright (c) 2017 nexB Inc. and others. All rights reserved. +# http://nexb.com and https://github.com/nexB/vulnerablecode/ +# The VulnerableCode software is licensed under the Apache License version 2.0. +# Data generated with VulnerableCode require an acknowledgment. +# +# You may not use this software except in compliance with the License. +# You may obtain a copy of the License at: http://apache.org/licenses/LICENSE-2.0 +# Unless required by applicable law or agreed to in writing, software distributed +# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR +# CONDITIONS OF ANY KIND, either express or implied. See the License for the +# specific language governing permissions and limitations under the License. +# +# When you publish or redistribute any data created with VulnerableCode or any VulnerableCode +# derivative work, you must accompany this data with the following acknowledgment: +# +# Generated with VulnerableCode and provided on an "AS IS" BASIS, WITHOUT WARRANTIES +# OR CONDITIONS OF ANY KIND, either express or implied. No content created from +# VulnerableCode should be considered or used as legal advice. Consult an Attorney +# for any legal advice. +# VulnerableCode is a free software code scanning tool from nexB Inc. and others. +# Visit https://github.com/nexB/vulnerablecode/ for support and download. + +import os +from unittest import TestCase +from collections import OrderedDict + +from vulnerabilities.data_source import Reference +from packageurl import PackageURL + +from vulnerabilities.importers.elixir_security import ElixirSecurityDataSource +from vulnerabilities.data_source import Advisory + +BASE_DIR = os.path.dirname(os.path.abspath(__file__)) + + +class TestElixirSecurityDataSource(TestCase): + @classmethod + def setUpClass(cls): + data_source_cfg = { + "repository_url": "https://test.net", + } + cls.data_src = ElixirSecurityDataSource(1, config=data_source_cfg) + + def test_generate_all_versions_list(self): + package = "coherence" + actual_list = self.data_src.generate_all_versions_list(package) + expected_list = [ + "0.5.2", + "0.5.1", + "0.5.0", + "0.4.0", + "0.3.1", + "0.3.0", + "0.2.0", + "0.1.3", + "0.1.2", + "0.1.1", + "0.1.0", + ] + assert actual_list == expected_list + + def test_process_file(self): + + path = os.path.join(BASE_DIR, "test_data/elixir_security/test_file.yml") + expected_data = Advisory( + summary=( + 'The Coherence library has "Mass Assignment"-like vulnerabilities.\n' + ), + impacted_package_urls=[], + resolved_package_urls={ + PackageURL( + type="hex", + name="coherence", + version="0.5.2", + ), + }, + vuln_references=[ + Reference(url="https://github.com/smpallen99/coherence/issues/270") + ], + cve_id="2018-20301", + ) + + found_data = self.data_src.process_file(path) + + assert expected_data == found_data From 7d6b5671266d68b5d178895a179a2fa04ff950cd Mon Sep 17 00:00:00 2001 From: Tushar912 Date: Wed, 9 Dec 2020 15:21:19 +0530 Subject: [PATCH 06/18] use dephell_specifier for version ranges and sort imports Signed-off-by: Tushar912 Signed-off-by: Shivammm --- vulnerabilities/importers/__init__.py | 28 +++++++-------- vulnerabilities/importers/elixir_security.py | 34 +++++++------------ vulnerabilities/tests/test_elixir_security.py | 6 ++-- 3 files changed, 30 insertions(+), 38 deletions(-) diff --git a/vulnerabilities/importers/__init__.py b/vulnerabilities/importers/__init__.py index 12a610a72..249caa48e 100644 --- a/vulnerabilities/importers/__init__.py +++ b/vulnerabilities/importers/__init__.py @@ -22,25 +22,25 @@ from vulnerabilities.importers.alpine_linux import AlpineDataSource +from vulnerabilities.importers.apache_httpd import ApacheHTTPDDataSource from vulnerabilities.importers.archlinux import ArchlinuxDataSource from vulnerabilities.importers.debian import DebianDataSource -from vulnerabilities.importers.npm import NpmDataSource -from vulnerabilities.importers.rust import RustDataSource -from vulnerabilities.importers.safety_db import SafetyDbDataSource -from vulnerabilities.importers.ruby import RubyDataSource -from vulnerabilities.importers.ubuntu import UbuntuDataSource -from vulnerabilities.importers.retiredotnet import RetireDotnetDataSource -from vulnerabilities.importers.suse_backports import SUSEBackportsDataSource from vulnerabilities.importers.debian_oval import DebianOvalDataSource -from vulnerabilities.importers.redhat import RedhatDataSource +from vulnerabilities.importers.elixir_security import ElixirSecurityDataSource from vulnerabilities.importers.gentoo import GentooDataSource -from vulnerabilities.importers.openssl import OpenSSLDataSource -from vulnerabilities.importers.ubuntu_usn import UbuntuUSNDataSource from vulnerabilities.importers.github import GitHubAPIDataSource -from vulnerabilities.importers.nvd import NVDDataSource -from vulnerabilities.importers.project_kb_msr2019 import ProjectKBMSRDataSource -from vulnerabilities.importers.apache_httpd import ApacheHTTPDDataSource from vulnerabilities.importers.kaybee import KaybeeDataSource from vulnerabilities.importers.nginx import NginxDataSource +from vulnerabilities.importers.npm import NpmDataSource +from vulnerabilities.importers.nvd import NVDDataSource +from vulnerabilities.importers.openssl import OpenSSLDataSource from vulnerabilities.importers.postgresql import PostgreSQLDataSource -from vulnerabilities.importers.elixir_security import ElixirSecurityDataSource +from vulnerabilities.importers.project_kb_msr2019 import ProjectKBMSRDataSource +from vulnerabilities.importers.redhat import RedhatDataSource +from vulnerabilities.importers.retiredotnet import RetireDotnetDataSource +from vulnerabilities.importers.ruby import RubyDataSource +from vulnerabilities.importers.rust import RustDataSource +from vulnerabilities.importers.safety_db import SafetyDbDataSource +from vulnerabilities.importers.suse_backports import SUSEBackportsDataSource +from vulnerabilities.importers.ubuntu import UbuntuDataSource +from vulnerabilities.importers.ubuntu_usn import UbuntuUSNDataSource diff --git a/vulnerabilities/importers/elixir_security.py b/vulnerabilities/importers/elixir_security.py index f603fd0c9..425e66fa1 100644 --- a/vulnerabilities/importers/elixir_security.py +++ b/vulnerabilities/importers/elixir_security.py @@ -1,4 +1,4 @@ -# Copyright (c) 2017 nexB Inc. and others. All rights reserved. +# Copyright (c) nexB Inc. and others. All rights reserved. # http://nexb.com and https://github.com/nexB/vulnerablecode/ # The VulnerableCode software is licensed under the Apache License version 2.0. # Data generated with VulnerableCode require an acknowledgment. @@ -26,7 +26,7 @@ import requests from typing import Set from typing import List - +from dephell_specifier import RangeSpecifier from packageurl import PackageURL from vulnerabilities.data_source import GitDataSource @@ -63,32 +63,24 @@ def added_advisories(self) -> Set[Advisory]: return self.batch_advisories(advisories) @staticmethod - def generate_all_versions_list(pkg_name): + def generate_all_version_list(pkg_name): resp = requests.get(f"https://hex.pm/api/packages/{pkg_name}") resp = resp.content json_resp = json.loads(resp) - versions_list = [] + version_list = [] for release in json_resp["releases"]: - versions_list.append(release["version"]) - return versions_list + version_list.append(release["version"]) + return version_list - def get_pkg_from_range(self, versions_list, pkg_name): + def get_pkg_from_range(self, version_list, pkg_name): pkg_versions = [] - all_versions_list = self.generate_all_versions_list(pkg_name) - if versions_list is None: + all_version_list = self.generate_all_version_list(pkg_name) + if version_list is None: return - for version in versions_list: - if re.match("^>=", version): - index = all_versions_list.index(version[3:]) - pkg_versions = pkg_versions + all_versions_list[0: index + 1] - elif re.match("^>", version): - index = all_versions_list.index(version[2:]) - pkg_versions = pkg_versions + all_versions_list[0:index] - elif re.match("^<", version): - index = all_versions_list.index(version[2:]) - pkg_versions = pkg_versions + all_versions_list[index + 1: -1] - else: - pkg_versions.append(version[3:]) + version_ranges = {RangeSpecifier(r) for r in version_list} + for version in all_version_list: + if any([version in v for v in version_ranges]): + pkg_versions.append(version) return pkg_versions def process_file(self, path): diff --git a/vulnerabilities/tests/test_elixir_security.py b/vulnerabilities/tests/test_elixir_security.py index e4125968e..e1bcc95cc 100644 --- a/vulnerabilities/tests/test_elixir_security.py +++ b/vulnerabilities/tests/test_elixir_security.py @@ -1,4 +1,4 @@ -# Copyright (c) 2017 nexB Inc. and others. All rights reserved. +# Copyright (c) nexB Inc. and others. All rights reserved. # http://nexb.com and https://github.com/nexB/vulnerablecode/ # The VulnerableCode software is licensed under the Apache License version 2.0. # Data generated with VulnerableCode require an acknowledgment. @@ -41,9 +41,9 @@ def setUpClass(cls): } cls.data_src = ElixirSecurityDataSource(1, config=data_source_cfg) - def test_generate_all_versions_list(self): + def test_generate_all_version_list(self): package = "coherence" - actual_list = self.data_src.generate_all_versions_list(package) + actual_list = self.data_src.generate_all_version_list(package) expected_list = [ "0.5.2", "0.5.1", From 1e8e50d200636d23396bfeb74c5689df88153519 Mon Sep 17 00:00:00 2001 From: Tushar912 Date: Sat, 12 Dec 2020 13:13:48 +0530 Subject: [PATCH 07/18] added HexVersionAPI and mock test it Signed-off-by: Tushar912 Signed-off-by: Shivammm --- vulnerabilities/importers/elixir_security.py | 45 ++++++++++++------ vulnerabilities/package_managers.py | 21 +++++++++ vulnerabilities/tests/test_elixir_security.py | 46 ++++++++++++++++--- 3 files changed, 91 insertions(+), 21 deletions(-) diff --git a/vulnerabilities/importers/elixir_security.py b/vulnerabilities/importers/elixir_security.py index 425e66fa1..b6015e530 100644 --- a/vulnerabilities/importers/elixir_security.py +++ b/vulnerabilities/importers/elixir_security.py @@ -20,12 +20,14 @@ # VulnerableCode is a free software code scanning tool from nexB Inc. and others. # Visit https://github.com/nexB/vulnerablecode/ for support and download. +import asyncio import yaml -import re import json import requests +import re from typing import Set from typing import List + from dephell_specifier import RangeSpecifier from packageurl import PackageURL @@ -33,7 +35,7 @@ from vulnerabilities.data_source import GitDataSourceConfiguration from vulnerabilities.data_source import Advisory from vulnerabilities.data_source import Reference - +from vulnerabilities.package_managers import HexVersionAPI class ElixirSecurityDataSource(GitDataSource): def __enter__(self): @@ -43,6 +45,11 @@ def __enter__(self): self._added_files, self._updated_files = self.file_changes( recursive=True, file_ext="yml", subdir="./packages" ) + self.pkg_manager_api = HexVersionAPI() + self.set_api(self.collect_packages()) + + def set_api(self, packages): + asyncio.run(self.pkg_manager_api.load_api(packages)) def updated_advisories(self) -> Set[Advisory]: files = self._updated_files @@ -62,17 +69,25 @@ def added_advisories(self) -> Set[Advisory]: advisories.append(processed_data) return self.batch_advisories(advisories) - @staticmethod - def generate_all_version_list(pkg_name): - resp = requests.get(f"https://hex.pm/api/packages/{pkg_name}") - resp = resp.content - json_resp = json.loads(resp) - version_list = [] - for release in json_resp["releases"]: - version_list.append(release["version"]) + def collect_packages(self): + packages = set() + files = self._updated_files.union(self._added_files) + for f in files: + with open(f) as file: + data = yaml.safe_load(file) + if data.get("package"): + packages.add(data["package"]) + + return packages + + def generate_all_version_list(self,pkg_name): + if not getattr(self, 'pkg_manager_api', None): + self.pkg_manager_api = HexVersionAPI() + version_list = self.pkg_manager_api.get( + pkg_name) return version_list - def get_pkg_from_range(self, version_list, pkg_name): + def get_versions_from_range(self, version_list, pkg_name): pkg_versions = [] all_version_list = self.generate_all_version_list(pkg_name) if version_list is None: @@ -89,15 +104,16 @@ def process_file(self, path): pkg_name = yaml_file["package"] safe_pkg_versions = [] if yaml_file.get("unaffected_versions"): - safe_pkg_versions = self.get_pkg_from_range( + safe_pkg_versions = self.get_versions_from_range( yaml_file["patched_versions"] + yaml_file["unaffected_versions"], pkg_name, ) else: - safe_pkg_versions = self.get_pkg_from_range( + safe_pkg_versions = self.get_versions_from_range( yaml_file["patched_versions"], pkg_name ) - cve_id = yaml_file["cve"] + + cve_id = "CVE-"+str(yaml_file["cve"]) safe_purls = [] if safe_pkg_versions is not None: safe_purls = { @@ -107,6 +123,7 @@ def process_file(self, path): vuln_reference = [ Reference( + reference_id=yaml_file["id"], url=yaml_file["link"], ) ] diff --git a/vulnerabilities/package_managers.py b/vulnerabilities/package_managers.py index e8edc09bc..63629dfce 100644 --- a/vulnerabilities/package_managers.py +++ b/vulnerabilities/package_managers.py @@ -351,3 +351,24 @@ async def fetch(self, owner_repo: str, session) -> None: resp = await session.request(method="GET", url=endpoint) resp = await resp.json() self.cache[owner_repo] = [release["ref"].split("/")[-1] for release in resp] + +class HexVersionAPI(VersionAPI): + async def load_api(self, pkg_set): + async with ClientSession(raise_for_status=True) as session: + await asyncio.gather( + *[self.fetch(pkg, session) for pkg in pkg_set if pkg not in self.cache] + ) + + async def fetch(self, pkg, session): + url = f"https://hex.pm/api/packages/{pkg}" + versions = set() + try: + response = await session.request(method="GET", url=url) + response = await response.json() + for release in response["releases"]: + versions.add(release["version"]) + except (ClientResponseError, JSONDecodeError): + pass + + self.cache[pkg] = versions + \ No newline at end of file diff --git a/vulnerabilities/tests/test_elixir_security.py b/vulnerabilities/tests/test_elixir_security.py index e1bcc95cc..b1b14693d 100644 --- a/vulnerabilities/tests/test_elixir_security.py +++ b/vulnerabilities/tests/test_elixir_security.py @@ -22,13 +22,16 @@ import os from unittest import TestCase +from unittest.mock import patch from collections import OrderedDict from vulnerabilities.data_source import Reference from packageurl import PackageURL -from vulnerabilities.importers.elixir_security import ElixirSecurityDataSource from vulnerabilities.data_source import Advisory +from vulnerabilities.importers.elixir_security import ElixirSecurityDataSource +from vulnerabilities.package_managers import HexVersionAPI + BASE_DIR = os.path.dirname(os.path.abspath(__file__)) @@ -37,11 +40,26 @@ class TestElixirSecurityDataSource(TestCase): @classmethod def setUpClass(cls): data_source_cfg = { - "repository_url": "https://test.net", + "repository_url": 'https://github.com/dependabot/elixir-security-advisories', } cls.data_src = ElixirSecurityDataSource(1, config=data_source_cfg) + cls.data_src.pkg_manager_api = HexVersionAPI() - def test_generate_all_version_list(self): + @patch('vulnerabilities.package_managers.HexVersionAPI.get', + return_value=[ + "0.5.2", + "0.5.1", + "0.5.0", + "0.4.0", + "0.3.1", + "0.3.0", + "0.2.0", + "0.1.3", + "0.1.2", + "0.1.1", + "0.1.0", + ]) + def test_generate_all_version_list(self,mock_write): package = "coherence" actual_list = self.data_src.generate_all_version_list(package) expected_list = [ @@ -58,8 +76,21 @@ def test_generate_all_version_list(self): "0.1.0", ] assert actual_list == expected_list - - def test_process_file(self): + @patch('vulnerabilities.package_managers.HexVersionAPI.get', + return_value=[ + "0.5.2", + "0.5.1", + "0.5.0", + "0.4.0", + "0.3.1", + "0.3.0", + "0.2.0", + "0.1.3", + "0.1.2", + "0.1.1", + "0.1.0", + ]) + def test_process_file(self,mock_write): path = os.path.join(BASE_DIR, "test_data/elixir_security/test_file.yml") expected_data = Advisory( @@ -75,9 +106,10 @@ def test_process_file(self): ), }, vuln_references=[ - Reference(url="https://github.com/smpallen99/coherence/issues/270") + Reference(reference_id='2aae6e3a-24a3-4d5f-86ff-b964eaf7c6d1', + url="https://github.com/smpallen99/coherence/issues/270") ], - cve_id="2018-20301", + cve_id="CVE-2018-20301", ) found_data = self.data_src.process_file(path) From 0731cb950f92d70b6be4b4bda5ad23232dcef9a3 Mon Sep 17 00:00:00 2001 From: Tushar912 Date: Sat, 12 Dec 2020 13:25:59 +0530 Subject: [PATCH 08/18] fixed code style Signed-off-by: Tushar912 Signed-off-by: Shivammm --- vulnerabilities/importers/elixir_security.py | 10 ++++++---- vulnerabilities/package_managers.py | 2 +- vulnerabilities/tests/test_elixir_security.py | 11 ++++++----- 3 files changed, 13 insertions(+), 10 deletions(-) diff --git a/vulnerabilities/importers/elixir_security.py b/vulnerabilities/importers/elixir_security.py index b6015e530..ea1e11bd9 100644 --- a/vulnerabilities/importers/elixir_security.py +++ b/vulnerabilities/importers/elixir_security.py @@ -37,6 +37,7 @@ from vulnerabilities.data_source import Reference from vulnerabilities.package_managers import HexVersionAPI + class ElixirSecurityDataSource(GitDataSource): def __enter__(self): super(ElixirSecurityDataSource, self).__enter__() @@ -79,8 +80,8 @@ def collect_packages(self): packages.add(data["package"]) return packages - - def generate_all_version_list(self,pkg_name): + + def generate_all_version_list(self, pkg_name): if not getattr(self, 'pkg_manager_api', None): self.pkg_manager_api = HexVersionAPI() version_list = self.pkg_manager_api.get( @@ -105,14 +106,15 @@ def process_file(self, path): safe_pkg_versions = [] if yaml_file.get("unaffected_versions"): safe_pkg_versions = self.get_versions_from_range( - yaml_file["patched_versions"] + yaml_file["unaffected_versions"], + yaml_file["patched_versions"] + + yaml_file["unaffected_versions"], pkg_name, ) else: safe_pkg_versions = self.get_versions_from_range( yaml_file["patched_versions"], pkg_name ) - + cve_id = "CVE-"+str(yaml_file["cve"]) safe_purls = [] if safe_pkg_versions is not None: diff --git a/vulnerabilities/package_managers.py b/vulnerabilities/package_managers.py index 63629dfce..44ad6d367 100644 --- a/vulnerabilities/package_managers.py +++ b/vulnerabilities/package_managers.py @@ -352,6 +352,7 @@ async def fetch(self, owner_repo: str, session) -> None: resp = await resp.json() self.cache[owner_repo] = [release["ref"].split("/")[-1] for release in resp] + class HexVersionAPI(VersionAPI): async def load_api(self, pkg_set): async with ClientSession(raise_for_status=True) as session: @@ -371,4 +372,3 @@ async def fetch(self, pkg, session): pass self.cache[pkg] = versions - \ No newline at end of file diff --git a/vulnerabilities/tests/test_elixir_security.py b/vulnerabilities/tests/test_elixir_security.py index b1b14693d..0d74e4426 100644 --- a/vulnerabilities/tests/test_elixir_security.py +++ b/vulnerabilities/tests/test_elixir_security.py @@ -58,8 +58,8 @@ def setUpClass(cls): "0.1.2", "0.1.1", "0.1.0", - ]) - def test_generate_all_version_list(self,mock_write): + ]) + def test_generate_all_version_list(self, mock_write): package = "coherence" actual_list = self.data_src.generate_all_version_list(package) expected_list = [ @@ -76,6 +76,7 @@ def test_generate_all_version_list(self,mock_write): "0.1.0", ] assert actual_list == expected_list + @patch('vulnerabilities.package_managers.HexVersionAPI.get', return_value=[ "0.5.2", @@ -89,8 +90,8 @@ def test_generate_all_version_list(self,mock_write): "0.1.2", "0.1.1", "0.1.0", - ]) - def test_process_file(self,mock_write): + ]) + def test_process_file(self, mock_write): path = os.path.join(BASE_DIR, "test_data/elixir_security/test_file.yml") expected_data = Advisory( @@ -107,7 +108,7 @@ def test_process_file(self,mock_write): }, vuln_references=[ Reference(reference_id='2aae6e3a-24a3-4d5f-86ff-b964eaf7c6d1', - url="https://github.com/smpallen99/coherence/issues/270") + url="https://github.com/smpallen99/coherence/issues/270") ], cve_id="CVE-2018-20301", ) From 71fa4e2d1d278e23df068446db8ffcb1041d2ec9 Mon Sep 17 00:00:00 2001 From: Tushar912 Date: Fri, 18 Dec 2020 21:15:27 +0530 Subject: [PATCH 09/18] initialize hexapi with cache and sort imports Signed-off-by: Tushar912 Signed-off-by: Shivammm --- vulnerabilities/importers/elixir_security.py | 108 +++++++++--------- vulnerabilities/tests/test_elixir_security.py | 51 ++------- 2 files changed, 62 insertions(+), 97 deletions(-) diff --git a/vulnerabilities/importers/elixir_security.py b/vulnerabilities/importers/elixir_security.py index ea1e11bd9..1292349d6 100644 --- a/vulnerabilities/importers/elixir_security.py +++ b/vulnerabilities/importers/elixir_security.py @@ -17,17 +17,13 @@ # OR CONDITIONS OF ANY KIND, either express or implied. No content created from # VulnerableCode should be considered or used as legal advice. Consult an Attorney # for any legal advice. -# VulnerableCode is a free software code scanning tool from nexB Inc. and others. +# VulnerableCode is a free software tool from nexB Inc. and others. # Visit https://github.com/nexB/vulnerablecode/ for support and download. import asyncio -import yaml -import json -import requests -import re -from typing import Set -from typing import List +from typing import List, Set +import yaml from dephell_specifier import RangeSpecifier from packageurl import PackageURL @@ -74,23 +70,18 @@ def collect_packages(self): packages = set() files = self._updated_files.union(self._added_files) for f in files: - with open(f) as file: - data = yaml.safe_load(file) - if data.get("package"): - packages.add(data["package"]) + data = load_yaml(f) + if data.get("package"): + packages.add(data["package"]) return packages - def generate_all_version_list(self, pkg_name): + def get_versions_from_range(self, version_list, pkg_name): + pkg_versions = [] if not getattr(self, 'pkg_manager_api', None): self.pkg_manager_api = HexVersionAPI() - version_list = self.pkg_manager_api.get( + all_version_list = self.pkg_manager_api.get( pkg_name) - return version_list - - def get_versions_from_range(self, version_list, pkg_name): - pkg_versions = [] - all_version_list = self.generate_all_version_list(pkg_name) if version_list is None: return version_ranges = {RangeSpecifier(r) for r in version_list} @@ -100,40 +91,49 @@ def get_versions_from_range(self, version_list, pkg_name): return pkg_versions def process_file(self, path): - with open(path) as f: - yaml_file = yaml.safe_load(f) - pkg_name = yaml_file["package"] - safe_pkg_versions = [] - if yaml_file.get("unaffected_versions"): - safe_pkg_versions = self.get_versions_from_range( - yaml_file["patched_versions"] + - yaml_file["unaffected_versions"], - pkg_name, - ) - else: - safe_pkg_versions = self.get_versions_from_range( - yaml_file["patched_versions"], pkg_name - ) - - cve_id = "CVE-"+str(yaml_file["cve"]) - safe_purls = [] - if safe_pkg_versions is not None: - safe_purls = { - PackageURL(name=pkg_name, type="hex", version=version) - for version in safe_pkg_versions - } - - vuln_reference = [ - Reference( - reference_id=yaml_file["id"], - url=yaml_file["link"], - ) - ] - - return Advisory( - summary=yaml_file["description"], - impacted_package_urls=[], - resolved_package_urls=safe_purls, - cve_id=cve_id, - vuln_references=vuln_reference, + yaml_file = load_yaml(path) + pkg_name = yaml_file["package"] + safe_pkg_versions = [] + if yaml_file.get("unaffected_versions"): + safe_pkg_versions = self.get_versions_from_range( + yaml_file["patched_versions"] + + yaml_file["unaffected_versions"], + pkg_name, + ) + else: + safe_pkg_versions = self.get_versions_from_range( + yaml_file["patched_versions"], pkg_name + ) + if yaml_file.get('cve'): + cve_id = "CVE-" + yaml_file["cve"] + else: + cve_id = "" + + safe_purls = [] + if safe_pkg_versions is not None: + safe_purls = { + PackageURL(name=pkg_name, type="hex", version=version) + for version in safe_pkg_versions + } + + vuln_reference = [ + Reference( + reference_id=yaml_file["id"], + ), + Reference( + url=yaml_file["link"], ) + ] + + return Advisory( + summary=yaml_file["description"], + impacted_package_urls=[], + resolved_package_urls=safe_purls, + cve_id=cve_id, + vuln_references=vuln_reference, + ) + + +def load_yaml(path): + with open(path) as f: + return yaml.safe_load(f) diff --git a/vulnerabilities/tests/test_elixir_security.py b/vulnerabilities/tests/test_elixir_security.py index 0d74e4426..ede63c50a 100644 --- a/vulnerabilities/tests/test_elixir_security.py +++ b/vulnerabilities/tests/test_elixir_security.py @@ -17,22 +17,20 @@ # OR CONDITIONS OF ANY KIND, either express or implied. No content created from # VulnerableCode should be considered or used as legal advice. Consult an Attorney # for any legal advice. -# VulnerableCode is a free software code scanning tool from nexB Inc. and others. +# VulnerableCode is a free software tool from nexB Inc. and others. # Visit https://github.com/nexB/vulnerablecode/ for support and download. import os -from unittest import TestCase -from unittest.mock import patch from collections import OrderedDict +from unittest import TestCase -from vulnerabilities.data_source import Reference from packageurl import PackageURL from vulnerabilities.data_source import Advisory +from vulnerabilities.data_source import Reference from vulnerabilities.importers.elixir_security import ElixirSecurityDataSource from vulnerabilities.package_managers import HexVersionAPI - BASE_DIR = os.path.dirname(os.path.abspath(__file__)) @@ -43,26 +41,7 @@ def setUpClass(cls): "repository_url": 'https://github.com/dependabot/elixir-security-advisories', } cls.data_src = ElixirSecurityDataSource(1, config=data_source_cfg) - cls.data_src.pkg_manager_api = HexVersionAPI() - - @patch('vulnerabilities.package_managers.HexVersionAPI.get', - return_value=[ - "0.5.2", - "0.5.1", - "0.5.0", - "0.4.0", - "0.3.1", - "0.3.0", - "0.2.0", - "0.1.3", - "0.1.2", - "0.1.1", - "0.1.0", - ]) - def test_generate_all_version_list(self, mock_write): - package = "coherence" - actual_list = self.data_src.generate_all_version_list(package) - expected_list = [ + cls.data_src.pkg_manager_api = HexVersionAPI({'coherence': [ "0.5.2", "0.5.1", "0.5.0", @@ -74,24 +53,9 @@ def test_generate_all_version_list(self, mock_write): "0.1.2", "0.1.1", "0.1.0", - ] - assert actual_list == expected_list + ]}) - @patch('vulnerabilities.package_managers.HexVersionAPI.get', - return_value=[ - "0.5.2", - "0.5.1", - "0.5.0", - "0.4.0", - "0.3.1", - "0.3.0", - "0.2.0", - "0.1.3", - "0.1.2", - "0.1.1", - "0.1.0", - ]) - def test_process_file(self, mock_write): + def test_process_file(self): path = os.path.join(BASE_DIR, "test_data/elixir_security/test_file.yml") expected_data = Advisory( @@ -108,7 +72,8 @@ def test_process_file(self, mock_write): }, vuln_references=[ Reference(reference_id='2aae6e3a-24a3-4d5f-86ff-b964eaf7c6d1', - url="https://github.com/smpallen99/coherence/issues/270") + ), + Reference(url='https://github.com/smpallen99/coherence/issues/270') ], cve_id="CVE-2018-20301", ) From 42decdd18fa7a6f315228ad804b8fbd237e75e9a Mon Sep 17 00:00:00 2001 From: Shivam Sandbhor Date: Fri, 18 Dec 2020 16:20:20 +0530 Subject: [PATCH 10/18] Add tests for nginx importers Signed-off-by: Shivam Sandbhor Signed-off-by: Shivammm --- vulnerabilities/importers/nginx.py | 2 +- .../test_data/nginx/security_advisories.html | 28 +++ vulnerabilities/tests/test_nginx.py | 187 ++++++++++++++++++ 3 files changed, 216 insertions(+), 1 deletion(-) create mode 100644 vulnerabilities/tests/test_data/nginx/security_advisories.html create mode 100644 vulnerabilities/tests/test_nginx.py diff --git a/vulnerabilities/importers/nginx.py b/vulnerabilities/importers/nginx.py index 0cc1cb7ed..0907b8854 100644 --- a/vulnerabilities/importers/nginx.py +++ b/vulnerabilities/importers/nginx.py @@ -51,7 +51,7 @@ def set_api(self): self.version_api = GitHubTagsAPI() asyncio.run(self.version_api.load_api(["nginx/nginx"])) - # For some reason nginx tags it's releases in the form of `release-1.2.3` + # For some reason nginx tags it's releases are in the form of `release-1.2.3` # Chop off the `release-` part here. for index, version in enumerate(self.version_api.cache["nginx/nginx"]): self.version_api.cache["nginx/nginx"][index] = version.replace("release-", "") diff --git a/vulnerabilities/tests/test_data/nginx/security_advisories.html b/vulnerabilities/tests/test_data/nginx/security_advisories.html new file mode 100644 index 000000000..58f76f064 --- /dev/null +++ b/vulnerabilities/tests/test_data/nginx/security_advisories.html @@ -0,0 +1,28 @@ + + +

+Patches are signed using one of the +PGP public keys. +

    + + +

  • Stack-based buffer overflow with specially crafted request
    Severity: major
    Advisory
    CVE-2013-2028
    Not vulnerable: 1.5.0+, 1.4.1+
    Vulnerable: 1.3.9-1.4.0
    The patch  pgp

    • + + +

  • Vulnerabilities with Windows directory aliases
    Severity: medium
    Advisory
    CVE-2011-4963
    Not vulnerable: 1.3.1+, 1.2.1+
    Vulnerable: nginx/Windows 0.7.52-1.3.0

    • + + + +

  • Vulnerabilities with invalid UTF-8 sequence on Windows
    Severity: major
    CVE-2010-2266
    Not vulnerable: 0.8.41+, 0.7.67+
    Vulnerable: nginx/Windows 0.7.52-0.8.40

    • + + + +

  • An error log data are not sanitized
    Severity: none
    CVE-2009-4487
    Not vulnerable: none
    Vulnerable: all

    • + + +

  • The renegotiation vulnerability in SSL protocol
    Severity: major
    VU#120541  CVE-2009-3555
    Not vulnerable: 0.8.23+, 0.7.64+
    Vulnerable: 0.1.0-0.8.22
    The patch  pgp

    • + +

  • Directory traversal vulnerability
    Severity: minor
    CVE-2009-3898
    Not vulnerable: 0.8.17+, 0.7.63+
    Vulnerable: 0.1.0-0.8.16

    • +/patch.null.pointer.txt">The patch  pgp

    + +
diff --git a/vulnerabilities/tests/test_nginx.py b/vulnerabilities/tests/test_nginx.py new file mode 100644 index 000000000..91efb9f2f --- /dev/null +++ b/vulnerabilities/tests/test_nginx.py @@ -0,0 +1,187 @@ +# Copyright (c) nexB Inc. and others. All rights reserved. +# http://nexb.com and https://github.com/nexB/vulnerablecode/ +# The VulnerableCode software is licensed under the Apache License version 2.0. +# Data generated with VulnerableCode require an acknowledgment. +# +# You may not use this software except in compliance with the License. +# You may obtain a copy of the License at: http://apache.org/licenses/LICENSE-2.0 +# Unless required by applicable law or agreed to in writing, software distributed +# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR +# CONDITIONS OF ANY KIND, either express or implied. See the License for the +# specific language governing permissions and limitations under the License. +# +# When you publish or redistribute any data created with VulnerableCode or any VulnerableCode +# derivative work, you must accompany this data with the following acknowledgment: +# +# Generated with VulnerableCode and provided on an "AS IS" BASIS, WITHOUT WARRANTIES +# OR CONDITIONS OF ANY KIND, either express or implied. No content created from +# VulnerableCode should be considered or used as legal advice. Consult an Attorney +# for any legal advice. +# VulnerableCode is a free software tool from nexB Inc. and others. +# Visit https://github.com/nexB/vulnerablecode/ for support and download. + +import os +from unittest import TestCase +from unittest.mock import patch + +from packageurl import PackageURL + +from vulnerabilities.data_source import Advisory +from vulnerabilities.data_source import Reference +from vulnerabilities.importers.nginx import NginxDataSource +from vulnerabilities.package_managers import GitHubTagsAPI + +BASE_DIR = os.path.dirname(os.path.abspath(__file__)) +TEST_DATA = os.path.join(BASE_DIR, "test_data/nginx", "security_advisories.html") + + +class TestNginxDataSource(TestCase): + @classmethod + def setUpClass(cls): + with open(TEST_DATA) as f: + cls.data = f.read() + data_source_cfg = {"etags": {}} + cls.data_src = NginxDataSource(1, config=data_source_cfg) + cls.data_src.version_api = GitHubTagsAPI( + cache={"nginx/nginx": {"1.2.3", "1.7.0", "1.3.9", "0.7.52"}} + ) + + def test_to_advisories(self): + expected_data = sorted( + [ + Advisory( + summary="Stack-based buffer overflow with specially crafted request", + impacted_package_urls={ + PackageURL( + type="generic", + namespace=None, + name="nginx", + version="1.3.9", + qualifiers={}, + subpath=None, + ) + }, + resolved_package_urls={ + PackageURL( + type="generic", + namespace=None, + name="nginx", + version="1.7.0", + qualifiers={}, + subpath=None, + ) + }, + vuln_references=[], + cve_id="CVE-2013-2028", + ), + Advisory( + summary="Vulnerabilities with Windows directory aliases", + impacted_package_urls={ + PackageURL( + type="generic", + namespace=None, + name="nginx", + version="0.7.52", + qualifiers={"os": "windows"}, + subpath=None, + ), + PackageURL( + type="generic", + namespace=None, + name="nginx", + version="1.2.3", + qualifiers={"os": "windows"}, + subpath=None, + ), + }, + resolved_package_urls={ + PackageURL( + type="generic", + namespace=None, + name="nginx", + version="1.2.3", + qualifiers={}, + subpath=None, + ), + PackageURL( + type="generic", + namespace=None, + name="nginx", + version="1.3.9", + qualifiers={}, + subpath=None, + ), + PackageURL( + type="generic", + namespace=None, + name="nginx", + version="1.7.0", + qualifiers={}, + subpath=None, + ), + }, + vuln_references=[], + cve_id="CVE-2011-4963", + ), + Advisory( + summary="Vulnerabilities with invalid UTF-8 sequence on Windows", + impacted_package_urls={ + PackageURL( + type="generic", + namespace=None, + name="nginx", + version="0.7.52", + qualifiers={"os": "windows"}, + subpath=None, + ) + }, + resolved_package_urls=set(), + vuln_references=[], + cve_id="CVE-2010-2266", + ), + Advisory( + summary="An error log data are not sanitized", + impacted_package_urls=set(), + resolved_package_urls={}, + vuln_references=[], + cve_id="CVE-2009-4487", + ), + Advisory( + summary="The renegotiation vulnerability in SSL protocol", + impacted_package_urls={ + PackageURL( + type="generic", + namespace=None, + name="nginx", + version="0.7.52", + qualifiers={}, + subpath=None, + ) + }, + resolved_package_urls=set(), + vuln_references=[], + cve_id="CVE-2009-3555", + ), + Advisory( + summary="Directory traversal vulnerability", + impacted_package_urls={ + PackageURL( + type="generic", + namespace=None, + name="nginx", + version="0.7.52", + qualifiers={}, + subpath=None, + ) + }, + resolved_package_urls=set(), + vuln_references=[], + cve_id="CVE-2009-3898", + ), + ], + key=lambda adv: adv.cve_id, + ) + + found_data = sorted(self.data_src.to_advisories(self.data), key=lambda adv: adv.cve_id) + + assert expected_data == found_data From 720e3833ce80f55c1b602449061c47125a6214d2 Mon Sep 17 00:00:00 2001 From: Shivam Sandbhor Date: Fri, 18 Dec 2020 16:49:35 +0530 Subject: [PATCH 11/18] Add tests for postgresql importer Signed-off-by: Shivam Sandbhor Signed-off-by: Shivammm --- .../test_data/postgresql/advisories.html | 231 ++++++++++++++++++ vulnerabilities/tests/test_postgresql.py | 124 ++++++++++ 2 files changed, 355 insertions(+) create mode 100644 vulnerabilities/tests/test_data/postgresql/advisories.html create mode 100644 vulnerabilities/tests/test_postgresql.py diff --git a/vulnerabilities/tests/test_data/postgresql/advisories.html b/vulnerabilities/tests/test_data/postgresql/advisories.html new file mode 100644 index 000000000..3c2a109cc --- /dev/null +++ b/vulnerabilities/tests/test_data/postgresql/advisories.html @@ -0,0 +1,231 @@ + + + + PostgreSQL: Security Information + + + +
+
+
12th November 2020: + PostgreSQL 13.1, 12.5, 11.10, 10.15, 9.6.20, & 9.5.24 Released! + +
+
+
+ +
+
+
+
+ +
+

Quick Links

+ + + +
+ +
+
+
+
+ + +

Security Information

+ +

+If you wish to report a new security vulnerability in PostgreSQL, please +send an email to +security@postgresql.org. +For reporting non-security bugs, please see the Report a Bug page. +

+ + +

Known security issues in all supported versions

+

+You can filter the view of patches to show just patches for version:
+ +13 - + +12 - + +11 - + +10 - + +9.6 - + +9.5 + +- all +

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
ReferenceAffectedFixedComponent & CVSS v3 Base ScoreDescription
+ CVE-2020-10733
+ Announcement
+ 		9.59.5.22packaging
+ 6.7
AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H + 		Windows installer runs executables from uncontrolled directories
+ CVE-2020-1720
+ Announcement
+ 		11, 12core server
+ 3.1
AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N + 		ALTER ... DEPENDS ON EXTENSION is missing authorization checks.
+ +

Unsupported versions

+

+ You can also view archived security patches for unsupported versions. Note that no further + security patches are made available for these versions as they are end of life.
+ +9.4 - + +9.3 - + +9.2 - + +9.1 - + +9.0 - + +8.4 - + +8.3 - + +8.2 - + +8.1 - + +8.0 - + +7.4 - + +7.3 + +

+ + + +

Components

+

+The following component references are used in the above table: +

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
ComponentDescription
core serverThis vulnerability exists in the core server product.
clientThis vulnerability exists in a client library or client application only.
contrib moduleThis vulnerability exists in a contrib module. Contrib modules are not installed by default when PostgreSQL is installed from source. They may be installed by binary packages.
client contrib moduleThis vulnerability exists in a contrib module used on the client only.
packagingThis vulnerability exists in PostgreSQL binary packaging, e.g. an installer or RPM.
+ + + +
+
+
+
+ + + + + diff --git a/vulnerabilities/tests/test_postgresql.py b/vulnerabilities/tests/test_postgresql.py new file mode 100644 index 000000000..b8df2aca0 --- /dev/null +++ b/vulnerabilities/tests/test_postgresql.py @@ -0,0 +1,124 @@ +# Copyright (c) nexB Inc. and others. All rights reserved. +# http://nexb.com and https://github.com/nexB/vulnerablecode/ +# The VulnerableCode software is licensed under the Apache License version 2.0. +# Data generated with VulnerableCode require an acknowledgment. +# +# You may not use this software except in compliance with the License. +# You may obtain a copy of the License at: http://apache.org/licenses/LICENSE-2.0 +# Unless required by applicable law or agreed to in writing, software distributed +# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR +# CONDITIONS OF ANY KIND, either express or implied. See the License for the +# specific language governing permissions and limitations under the License. +# +# When you publish or redistribute any data created with VulnerableCode or any VulnerableCode +# derivative work, you must accompany this data with the following acknowledgment: +# +# Generated with VulnerableCode and provided on an "AS IS" BASIS, WITHOUT WARRANTIES +# OR CONDITIONS OF ANY KIND, either express or implied. No content created from +# VulnerableCode should be considered or used as legal advice. Consult an Attorney +# for any legal advice. +# VulnerableCode is a free software tool from nexB Inc. and others. +# Visit https://github.com/nexB/vulnerablecode/ for support and download. + +import os +from unittest import TestCase +from unittest.mock import patch + +from packageurl import PackageURL + +from vulnerabilities.data_source import Advisory +from vulnerabilities.data_source import Reference +from vulnerabilities.importers.postgresql import to_advisories + + +BASE_DIR = os.path.dirname(os.path.abspath(__file__)) +TEST_DATA = os.path.join(BASE_DIR, "test_data/postgresql", "advisories.html") + + +class TestPostgreSQLDataSource(TestCase): + def test_to_advisories(self): + + with open(TEST_DATA) as f: + raw_data = f.read() + + expected_data = sorted( + [ + Advisory( + summary="Windows installer runs executables from uncontrolled directories", + impacted_package_urls=[ + PackageURL( + type="generic", + namespace=None, + name="postgresql", + version="9.5", + qualifiers={"os": "windows"}, + subpath=None, + ) + ], + resolved_package_urls=[ + PackageURL( + type="generic", + namespace=None, + name="postgresql", + version="9.5.22", + qualifiers={"os": "windows"}, + subpath=None, + ) + ], + vuln_references=[ + Reference( + url="https://www.postgresql.org/about/news/postgresql-123-118-1013-9618-and-9522-released-2038/", # nopep8 + reference_id="", + ) + ], + cve_id="CVE-2020-10733", + ), + Advisory( + summary="ALTER ... DEPENDS ON EXTENSION is missing authorization checks.", + impacted_package_urls=[ + PackageURL( + type="generic", + namespace=None, + name="postgresql", + version="11", + qualifiers={}, + subpath=None, + ), + PackageURL( + type="generic", + namespace=None, + name="postgresql", + version="12", + qualifiers={}, + subpath=None, + ), + ], + resolved_package_urls=[ + PackageURL( + type="generic", + namespace=None, + name="postgresql", + version=None, + qualifiers={}, + subpath=None, + ) + ], + vuln_references=[ + Reference( + url="https://access.redhat.com/security/cve/CVE-2020-1720", + reference_id="", + ), + Reference( + url="https://www.postgresql.org/about/news/postgresql-122-117-1012-9617-9521-and-9426-released-2011/", # nopep8 + reference_id="", + ), + ], + cve_id="CVE-2020-1720", + ), + ], + key=lambda adv: adv.cve_id, + ) + + found_data = sorted(to_advisories(raw_data), key=lambda adv: adv.cve_id) + + assert expected_data == found_data From fb4740db39e6610c47db4716683c1b966a1edc99 Mon Sep 17 00:00:00 2001 From: Tushar912 Date: Mon, 21 Dec 2020 18:34:32 +0530 Subject: [PATCH 12/18] add license and categorize left versions as vuln Signed-off-by: Tushar912 --- vulnerabilities/importers/elixir_security.py | 62 ++++++------ vulnerabilities/tests/test_elixir_security.py | 96 +++++++++++++++---- 2 files changed, 108 insertions(+), 50 deletions(-) diff --git a/vulnerabilities/importers/elixir_security.py b/vulnerabilities/importers/elixir_security.py index 1292349d6..797773804 100644 --- a/vulnerabilities/importers/elixir_security.py +++ b/vulnerabilities/importers/elixir_security.py @@ -77,60 +77,64 @@ def collect_packages(self): return packages def get_versions_from_range(self, version_list, pkg_name): - pkg_versions = [] - if not getattr(self, 'pkg_manager_api', None): - self.pkg_manager_api = HexVersionAPI() - all_version_list = self.pkg_manager_api.get( - pkg_name) - if version_list is None: - return + safe_pkg_versions = [] + vuln_pkg_versions = [] + all_version_list = self.pkg_manager_api.get(pkg_name) + if not version_list: + return [], all_version_list version_ranges = {RangeSpecifier(r) for r in version_list} for version in all_version_list: if any([version in v for v in version_ranges]): - pkg_versions.append(version) - return pkg_versions + safe_pkg_versions.append(version) + + vuln_pkg_versions = set(all_version_list) - set(safe_pkg_versions) + return safe_pkg_versions, vuln_pkg_versions def process_file(self, path): yaml_file = load_yaml(path) pkg_name = yaml_file["package"] safe_pkg_versions = [] - if yaml_file.get("unaffected_versions"): - safe_pkg_versions = self.get_versions_from_range( - yaml_file["patched_versions"] + - yaml_file["unaffected_versions"], - pkg_name, - ) - else: - safe_pkg_versions = self.get_versions_from_range( - yaml_file["patched_versions"], pkg_name - ) - if yaml_file.get('cve'): + vuln_pkg_versions = [] + if not yaml_file.get("patched_versions"): + yaml_file["patched_versions"] = [] + if not yaml_file.get("unaffected_versions"): + yaml_file["unaffected_versions"] = [] + safe_pkg_versions, vuln_pkg_versions = self.get_versions_from_range( + yaml_file.get("patched_versions", []) + yaml_file.get("unaffected_versions", []), + pkg_name, + ) + + if yaml_file.get("cve"): cve_id = "CVE-" + yaml_file["cve"] else: cve_id = "" safe_purls = [] - if safe_pkg_versions is not None: - safe_purls = { - PackageURL(name=pkg_name, type="hex", version=version) - for version in safe_pkg_versions - } + vuln_purls = [] + + safe_purls = { + PackageURL(name=pkg_name, type="hex", version=version) for version in safe_pkg_versions + } + + vuln_purls = { + PackageURL(name=pkg_name, type="hex", version=version) for version in vuln_pkg_versions + } - vuln_reference = [ + vuln_references = [ Reference( reference_id=yaml_file["id"], ), Reference( url=yaml_file["link"], - ) + ), ] return Advisory( summary=yaml_file["description"], - impacted_package_urls=[], + impacted_package_urls=vuln_purls, resolved_package_urls=safe_purls, cve_id=cve_id, - vuln_references=vuln_reference, + vuln_references=vuln_references, ) diff --git a/vulnerabilities/tests/test_elixir_security.py b/vulnerabilities/tests/test_elixir_security.py index ede63c50a..717189c98 100644 --- a/vulnerabilities/tests/test_elixir_security.py +++ b/vulnerabilities/tests/test_elixir_security.py @@ -38,31 +38,84 @@ class TestElixirSecurityDataSource(TestCase): @classmethod def setUpClass(cls): data_source_cfg = { - "repository_url": 'https://github.com/dependabot/elixir-security-advisories', + "repository_url": "https://github.com/dependabot/elixir-security-advisories", } cls.data_src = ElixirSecurityDataSource(1, config=data_source_cfg) - cls.data_src.pkg_manager_api = HexVersionAPI({'coherence': [ - "0.5.2", - "0.5.1", - "0.5.0", - "0.4.0", - "0.3.1", - "0.3.0", - "0.2.0", - "0.1.3", - "0.1.2", - "0.1.1", - "0.1.0", - ]}) + cls.data_src.pkg_manager_api = HexVersionAPI( + { + "coherence": [ + "0.5.2", + "0.5.1", + "0.5.0", + "0.4.0", + "0.3.1", + "0.3.0", + "0.2.0", + "0.1.3", + "0.1.2", + "0.1.1", + "0.1.0", + ] + } + ) def test_process_file(self): path = os.path.join(BASE_DIR, "test_data/elixir_security/test_file.yml") expected_data = Advisory( - summary=( - 'The Coherence library has "Mass Assignment"-like vulnerabilities.\n' - ), - impacted_package_urls=[], + summary=('The Coherence library has "Mass Assignment"-like vulnerabilities.\n'), + impacted_package_urls={ + PackageURL( + type="hex", + name="coherence", + version="0.5.1", + ), + PackageURL( + type="hex", + name="coherence", + version="0.5.0", + ), + PackageURL( + type="hex", + name="coherence", + version="0.4.0", + ), + PackageURL( + type="hex", + name="coherence", + version="0.3.1", + ), + PackageURL( + type="hex", + name="coherence", + version="0.3.0", + ), + PackageURL( + type="hex", + name="coherence", + version="0.2.0", + ), + PackageURL( + type="hex", + name="coherence", + version="0.1.3", + ), + PackageURL( + type="hex", + name="coherence", + version="0.1.2", + ), + PackageURL( + type="hex", + name="coherence", + version="0.1.1", + ), + PackageURL( + type="hex", + name="coherence", + version="0.1.0", + ), + }, resolved_package_urls={ PackageURL( type="hex", @@ -71,9 +124,10 @@ def test_process_file(self): ), }, vuln_references=[ - Reference(reference_id='2aae6e3a-24a3-4d5f-86ff-b964eaf7c6d1', - ), - Reference(url='https://github.com/smpallen99/coherence/issues/270') + Reference( + reference_id="2aae6e3a-24a3-4d5f-86ff-b964eaf7c6d1", + ), + Reference(url="https://github.com/smpallen99/coherence/issues/270"), ], cve_id="CVE-2018-20301", ) From 0859216c15122db516a3c72340c778fc4d438649 Mon Sep 17 00:00:00 2001 From: Tushar912 Date: Wed, 23 Dec 2020 02:49:54 +0530 Subject: [PATCH 13/18] change name of function get_version_from range and add comments in it Signed-off-by: Tushar912 Signed-off-by: Shivammm --- vulnerabilities/importers/elixir_security.py | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/vulnerabilities/importers/elixir_security.py b/vulnerabilities/importers/elixir_security.py index 797773804..161478823 100644 --- a/vulnerabilities/importers/elixir_security.py +++ b/vulnerabilities/importers/elixir_security.py @@ -76,13 +76,17 @@ def collect_packages(self): return packages - def get_versions_from_range(self, version_list, pkg_name): + def get_versions_for_pkg_from_range_list(self, version_range_list, pkg_name): + # Takes a list of version ranges(pathced and unaffected) of a package + # as parameter and returns a tuple of safe package versions and + # vulnerable package versions + safe_pkg_versions = [] vuln_pkg_versions = [] all_version_list = self.pkg_manager_api.get(pkg_name) - if not version_list: + if not version_range_list: return [], all_version_list - version_ranges = {RangeSpecifier(r) for r in version_list} + version_ranges = {RangeSpecifier(r) for r in version_range_list} for version in all_version_list: if any([version in v for v in version_ranges]): safe_pkg_versions.append(version) @@ -97,10 +101,12 @@ def process_file(self, path): vuln_pkg_versions = [] if not yaml_file.get("patched_versions"): yaml_file["patched_versions"] = [] + if not yaml_file.get("unaffected_versions"): yaml_file["unaffected_versions"] = [] - safe_pkg_versions, vuln_pkg_versions = self.get_versions_from_range( - yaml_file.get("patched_versions", []) + yaml_file.get("unaffected_versions", []), + + safe_pkg_versions, vuln_pkg_versions = self.get_versions_for_pkg_from_range_list( + yaml_file.get("patched_versions") + yaml_file.get("unaffected_versions"), pkg_name, ) From fcfb6944b51834c6de2f7bb8ddb9b1b6cc33b7a5 Mon Sep 17 00:00:00 2001 From: Tushar912 Date: Fri, 25 Dec 2020 18:17:56 +0530 Subject: [PATCH 14/18] remove unused import and add name to authors and add importer to sources Signed-off-by: Tushar912 remove single quote at end of url Signed-off-by: Tushar912 Signed-off-by: Shivammm --- AUTHORS.rst | 3 ++- SOURCES.rst | 2 ++ vulnerabilities/importers/elixir_security.py | 3 +-- 3 files changed, 5 insertions(+), 3 deletions(-) diff --git a/AUTHORS.rst b/AUTHORS.rst index a7fe33387..039459f93 100644 --- a/AUTHORS.rst +++ b/AUTHORS.rst @@ -10,4 +10,5 @@ The following organizations or individuals have contributed to this repo: - Ayush Lohani @lohani2280 - Islam Elhakmi @EslamHiko - Edoardo Lanzini @elanzini -- Navonil Das @NavonilDas \ No newline at end of file +- Navonil Das @NavonilDas +- Tushar Upadhyay @tushar912 \ No newline at end of file diff --git a/SOURCES.rst b/SOURCES.rst index 02b2ff6fd..4bba04be2 100644 --- a/SOURCES.rst +++ b/SOURCES.rst @@ -43,3 +43,5 @@ +----------------+------------------------------------------------------------------------------------------------------+----------------------------------------------------+ |postgresql | https://www.postgresql.org/support/security/ |postgresql | +----------------+------------------------------------------------------------------------------------------------------+----------------------------------------------------+ +|elixir_security | https://github.com/dependabot/elixir-security-advisories |hex packages | ++----------------+------------------------------------------------------------------------------------------------------+----------------------------------------------------+ diff --git a/vulnerabilities/importers/elixir_security.py b/vulnerabilities/importers/elixir_security.py index 161478823..5c99de6f7 100644 --- a/vulnerabilities/importers/elixir_security.py +++ b/vulnerabilities/importers/elixir_security.py @@ -28,7 +28,6 @@ from packageurl import PackageURL from vulnerabilities.data_source import GitDataSource -from vulnerabilities.data_source import GitDataSourceConfiguration from vulnerabilities.data_source import Advisory from vulnerabilities.data_source import Reference from vulnerabilities.package_managers import HexVersionAPI @@ -106,7 +105,7 @@ def process_file(self, path): yaml_file["unaffected_versions"] = [] safe_pkg_versions, vuln_pkg_versions = self.get_versions_for_pkg_from_range_list( - yaml_file.get("patched_versions") + yaml_file.get("unaffected_versions"), + yaml_file["patched_versions"] + yaml_file["unaffected_versions"], pkg_name, ) From 49965459fbb2865c7d26ed20ded676e5e69b905f Mon Sep 17 00:00:00 2001 From: Shivammm Date: Tue, 5 Jan 2021 23:00:48 +0530 Subject: [PATCH 15/18] added verbose plural name for PackageRelatedVulnerability model Signed-off-by: Shivammm --- .gitignore | 3 +++ .../migrations/0002_auto_20210105_1725.py | 17 +++++++++++++++++ vulnerabilities/models.py | 1 + 3 files changed, 21 insertions(+) create mode 100644 vulnerabilities/migrations/0002_auto_20210105_1725.py diff --git a/.gitignore b/.gitignore index da40ab034..9679e5ca8 100644 --- a/.gitignore +++ b/.gitignore @@ -115,7 +115,10 @@ bin include lib64 share +Pipfile +# editor +.vscode/ # pytest .pytest_cache diff --git a/vulnerabilities/migrations/0002_auto_20210105_1725.py b/vulnerabilities/migrations/0002_auto_20210105_1725.py new file mode 100644 index 000000000..c0b5c1b6c --- /dev/null +++ b/vulnerabilities/migrations/0002_auto_20210105_1725.py @@ -0,0 +1,17 @@ +# Generated by Django 3.0.7 on 2021-01-05 17:25 + +from django.db import migrations + + +class Migration(migrations.Migration): + + dependencies = [ + ('vulnerabilities', '0001_initial'), + ] + + operations = [ + migrations.AlterModelOptions( + name='packagerelatedvulnerability', + options={'verbose_name_plural': 'Package related vulnerabilities'}, + ), + ] diff --git a/vulnerabilities/models.py b/vulnerabilities/models.py index fdf2f0000..6e03b76f2 100644 --- a/vulnerabilities/models.py +++ b/vulnerabilities/models.py @@ -146,6 +146,7 @@ class PackageRelatedVulnerability(models.Model): class Meta: unique_together = ("package", "vulnerability") + verbose_name_plural = "Package related vulnerabilities" class ImportProblem(models.Model): From 952fe38432066143a50c2bff36e56048c4a5d3e5 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 7 Jan 2021 22:20:54 +0000 Subject: [PATCH 16/18] Bump lxml from 4.3.3 to 4.6.2 Bumps [lxml](https://github.com/lxml/lxml) from 4.3.3 to 4.6.2. - [Release notes](https://github.com/lxml/lxml/releases) - [Changelog](https://github.com/lxml/lxml/blob/master/CHANGES.txt) - [Commits](https://github.com/lxml/lxml/compare/lxml-4.3.3...lxml-4.6.2) Signed-off-by: dependabot[bot] Signed-off-by: Shivammm --- requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/requirements.txt b/requirements.txt index 2a337c5d4..2c821b9eb 100644 --- a/requirements.txt +++ b/requirements.txt @@ -19,7 +19,7 @@ importlib-metadata==1.3.0 ipython==7.13.0 ipython-genutils==0.2.0 jedi==0.17.0 -lxml==4.3.3 +lxml==4.6.2 more-itertools==8.0.2 packageurl-python==0.9.3 packaging==19.2 From 68d200eaac5ea8768eab4f71aeee96ce415c26d0 Mon Sep 17 00:00:00 2001 From: Shivammm Date: Sun, 10 Jan 2021 20:43:42 +0530 Subject: [PATCH 17/18] now ignoring vscode specific directory Signed-off-by: Shivammm --- .gitignore | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.gitignore b/.gitignore index 9679e5ca8..e12634454 100644 --- a/.gitignore +++ b/.gitignore @@ -117,7 +117,7 @@ lib64 share Pipfile -# editor +# editors .vscode/ # pytest From d8656114c32864a99dd6b68b1d231b4d384755e5 Mon Sep 17 00:00:00 2001 From: Shivammm Date: Sun, 10 Jan 2021 20:45:25 +0530 Subject: [PATCH 18/18] Verbose plural name for PackageRelatedVulnerabilities Signed-off-by: Shivammm --- vulnerabilities/migrations/0001_initial.py | 3 ++- .../migrations/0002_auto_20210105_1725.py | 17 ----------------- vulnerabilities/models.py | 2 +- 3 files changed, 3 insertions(+), 19 deletions(-) delete mode 100644 vulnerabilities/migrations/0002_auto_20210105_1725.py diff --git a/vulnerabilities/migrations/0001_initial.py b/vulnerabilities/migrations/0001_initial.py index a9172f893..c87baee79 100644 --- a/vulnerabilities/migrations/0001_initial.py +++ b/vulnerabilities/migrations/0001_initial.py @@ -1,4 +1,4 @@ -# Generated by Django 3.0.7 on 2020-09-14 06:17 +# Generated by Django 3.0.7 on 2021-01-10 15:11 import django.contrib.postgres.fields.jsonb from django.db import migrations, models @@ -64,6 +64,7 @@ class Migration(migrations.Migration): ('vulnerability', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, to='vulnerabilities.Vulnerability')), ], options={ + 'verbose_name_plural': 'PackageRelatedVulnerabilities', 'unique_together': {('package', 'vulnerability')}, }, ), diff --git a/vulnerabilities/migrations/0002_auto_20210105_1725.py b/vulnerabilities/migrations/0002_auto_20210105_1725.py deleted file mode 100644 index c0b5c1b6c..000000000 --- a/vulnerabilities/migrations/0002_auto_20210105_1725.py +++ /dev/null @@ -1,17 +0,0 @@ -# Generated by Django 3.0.7 on 2021-01-05 17:25 - -from django.db import migrations - - -class Migration(migrations.Migration): - - dependencies = [ - ('vulnerabilities', '0001_initial'), - ] - - operations = [ - migrations.AlterModelOptions( - name='packagerelatedvulnerability', - options={'verbose_name_plural': 'Package related vulnerabilities'}, - ), - ] diff --git a/vulnerabilities/models.py b/vulnerabilities/models.py index 6e03b76f2..d1ac97f0d 100644 --- a/vulnerabilities/models.py +++ b/vulnerabilities/models.py @@ -146,7 +146,7 @@ class PackageRelatedVulnerability(models.Model): class Meta: unique_together = ("package", "vulnerability") - verbose_name_plural = "Package related vulnerabilities" + verbose_name_plural = "PackageRelatedVulnerabilities" class ImportProblem(models.Model):