diff --git a/vulnerabilities/importers/github.py b/vulnerabilities/importers/github.py index 9e45c93dc..642bfe723 100644 --- a/vulnerabilities/importers/github.py +++ b/vulnerabilities/importers/github.py @@ -23,7 +23,9 @@ import asyncio import os import dataclasses -import json +import traceback +import logging + from typing import Set from typing import Tuple from typing import List @@ -33,7 +35,7 @@ import requests from packageurl import PackageURL from univers.version_specifier import VersionSpecifier -from univers.versions import version_class_by_package_type +from univers.versions import version_class_by_package_type, InvalidVersion from vulnerabilities.data_source import Advisory from vulnerabilities.data_source import DataSource @@ -48,6 +50,8 @@ from vulnerabilities.severity_systems import scoring_systems from vulnerabilities.helpers import nearest_patched_package +logger = logging.getLogger(__name__) + # set of all possible values of first '%s' = {'MAVEN','COMPOSER', 'NUGET', 'RUBYGEMS', 'PYPI'} # second '%s' is interesting, it will have the value '' for the first request, # since we don't have any value for endCursor at the beginning @@ -265,9 +269,12 @@ def categorize_versions( affected_versions = [] unaffected_versions = [] for version in all_versions: - if version_class(version) in version_range: - affected_versions.append(version) - else: - unaffected_versions.append(version) + try: + if version_class(version) in version_range: + affected_versions.append(version) + else: + unaffected_versions.append(version) + except InvalidVersion: + logger.error(f"Failed to parse version: {version!r}:\n" + traceback.format_exc()) return (affected_versions, unaffected_versions) diff --git a/vulnerabilities/tests/test_github.py b/vulnerabilities/tests/test_github.py index 3306b75a5..90e069fcf 100644 --- a/vulnerabilities/tests/test_github.py +++ b/vulnerabilities/tests/test_github.py @@ -63,7 +63,7 @@ def tearDown(self): def test_categorize_versions(self): eg_version_range = ">= 3.3.0, < 3.3.5" - eg_versions = ["3.3.6", "3.3.0", "3.3.4", "3.2.0"] + eg_versions = ["3.3.6", "3.3.0", "3.3.4", "3.2.0", "0.1-charmander"] aff_vers, safe_vers = self.data_src.categorize_versions( "pypi", eg_version_range, eg_versions