Allow default improver to improve without affected packages

vulnerabilities/importers/alpine_linux.py

@@ -245,21 +245,3 @@ def load_advisories(
                 affected_packages=affected_packages,
                 aliases=aliases,
             )
-
-
-class AlpineBasicImprover(Improver):
-    @property
-    def interesting_advisories(self) -> QuerySet:
-        return Advisory.objects.filter(created_by=AlpineImporter.qualified_name)
-
-    def get_inferences(self, advisory_data: AdvisoryData) -> Iterable[Inference]:
-        """
-        Generate and return Inferences for the given advisory data
-        """
-        for affected_package in advisory_data.affected_packages:
-            fixed_purl = affected_package.get_fixed_purl()
-            yield Inference.from_advisory_data(
-                advisory_data,
-                confidence=MAX_CONFIDENCE,
-                fixed_purl=fixed_purl,
-            )

vulnerabilities/importers/nvd.py

@@ -195,14 +195,3 @@ def extract_severity_scores(cve_item):
             system=severity_systems.CVSSV2_VECTOR,
             value=str(cvss_v2.get("vectorString") or ""),
         )
-
-
-class NVDBasicImprover(Improver):
-    @property
-    def interesting_advisories(self) -> QuerySet:
-        return Advisory.objects.filter(created_by=NVDImporter.qualified_name)
-
-    def get_inferences(self, advisory_data: AdvisoryData) -> Iterable[Inference]:
-        yield Inference.from_advisory_data(
-            advisory_data=advisory_data, confidence=100, fixed_purl=None
-        )

vulnerabilities/improver.py

@@ -67,12 +67,14 @@ def to_dict(self):
         """
         return {
             "vulnerability_id": self.vulnerability_id,
-            "aliases": [alias for alias in self.aliases],
+            "aliases": [alias for alias in self.aliases or []],
             "confidence": self.confidence,
             "summary": self.summary,
-            "affected_purls": [affected_purl.to_dict() for affected_purl in self.affected_purls],
-            "fixed_purl": self.fixed_purl.to_dict(),
-            "references": [ref.to_dict() for ref in self.references],
+            "affected_purls": [
+                affected_purl.to_dict() for affected_purl in self.affected_purls or []
+            ],
+            "fixed_purl": self.fixed_purl.to_dict() if self.fixed_purl else None,
+            "references": [ref.to_dict() for ref in self.references or []],
         }
 
     @classmethod

vulnerabilities/improvers/__init__.py

@@ -27,9 +27,7 @@
 IMPROVERS_REGISTRY = [
     default.DefaultImprover,
     importers.nginx.NginxBasicImprover,
-    importers.alpine_linux.AlpineBasicImprover,
     importers.github.GitHubBasicImprover,
-    importers.nvd.NVDBasicImprover,
 ]
 
 IMPROVERS_REGISTRY = {x.qualified_name: x for x in IMPROVERS_REGISTRY}

vulnerabilities/improvers/default.py

@@ -50,15 +50,25 @@ def interesting_advisories(self) -> QuerySet:
         return Advisory.objects.all()
 
     def get_inferences(self, advisory_data: AdvisoryData) -> Iterable[Inference]:
-        for affected_package in advisory_data.affected_packages:
-            affected_purls, fixed_purl = get_exact_purls(affected_package)
-            yield Inference(
-                aliases=advisory_data.aliases,
-                confidence=MAX_CONFIDENCE,
-                summary=advisory_data.summary,
-                affected_purls=affected_purls,
-                fixed_purl=fixed_purl,
-                references=advisory_data.references,
+
+        if not advisory_data:
+            return None
+
+        if advisory_data.affected_packages:
+            for affected_package in advisory_data.affected_packages:
+                affected_purls, fixed_purl = get_exact_purls(affected_package)
+                yield Inference(
+                    aliases=advisory_data.aliases,
+                    confidence=MAX_CONFIDENCE,
+                    summary=advisory_data.summary,
+                    affected_purls=affected_purls,
+                    fixed_purl=fixed_purl,
+                    references=advisory_data.references,
+                )
+
+        else:
+            yield Inference.from_advisory_data(
+                advisory_data, confidence=MAX_CONFIDENCE, fixed_purl=None
             )
 
 

vulnerabilities/tests/test_data/default_improver/alpine-expected.json

@@ -0,0 +1,184 @@
+[
+  {
+    "vulnerability_id": null,
+    "aliases": [],
+    "confidence": 100,
+    "summary": null,
+    "affected_purls": [],
+    "fixed_purl": {
+      "type": "alpine",
+      "namespace": null,
+      "name": "xen",
+      "version": "4.10.0-r1",
+      "qualifiers": {
+        "arch": "aarch64",
+        "distroversion": "v3.11",
+        "reponame": "main"
+      },
+      "subpath": null
+    },
+    "references": [
+      {
+        "reference_id": "XSA-248",
+        "url": "https://xenbits.xen.org/xsa/advisory-248.html",
+        "severities": []
+      }
+    ]
+  },
+  {
+    "vulnerability_id": null,
+    "aliases": [],
+    "confidence": 100,
+    "summary": null,
+    "affected_purls": [],
+    "fixed_purl": {
+      "type": "alpine",
+      "namespace": null,
+      "name": "xen",
+      "version": "4.10.0-r1",
+      "qualifiers": {
+        "arch": "armhf",
+        "distroversion": "v3.11",
+        "reponame": "main"
+      },
+      "subpath": null
+    },
+    "references": [
+      {
+        "reference_id": "XSA-248",
+        "url": "https://xenbits.xen.org/xsa/advisory-248.html",
+        "severities": []
+      }
+    ]
+  },
+  {
+    "vulnerability_id": null,
+    "aliases": [],
+    "confidence": 100,
+    "summary": null,
+    "affected_purls": [],
+    "fixed_purl": {
+      "type": "alpine",
+      "namespace": null,
+      "name": "xen",
+      "version": "4.10.0-r1",
+      "qualifiers": {
+        "arch": "armv7",
+        "distroversion": "v3.11",
+        "reponame": "main"
+      },
+      "subpath": null
+    },
+    "references": [
+      {
+        "reference_id": "XSA-248",
+        "url": "https://xenbits.xen.org/xsa/advisory-248.html",
+        "severities": []
+      }
+    ]
+  },
+  {
+    "vulnerability_id": null,
+    "aliases": [],
+    "confidence": 100,
+    "summary": null,
+    "affected_purls": [],
+    "fixed_purl": {
+      "type": "alpine",
+      "namespace": null,
+      "name": "xen",
+      "version": "4.10.0-r1",
+      "qualifiers": {
+        "arch": "ppc64le",
+        "distroversion": "v3.11",
+        "reponame": "main"
+      },
+      "subpath": null
+    },
+    "references": [
+      {
+        "reference_id": "XSA-248",
+        "url": "https://xenbits.xen.org/xsa/advisory-248.html",
+        "severities": []
+      }
+    ]
+  },
+  {
+    "vulnerability_id": null,
+    "aliases": [],
+    "confidence": 100,
+    "summary": null,
+    "affected_purls": [],
+    "fixed_purl": {
+      "type": "alpine",
+      "namespace": null,
+      "name": "xen",
+      "version": "4.10.0-r1",
+      "qualifiers": {
+        "arch": "s390x",
+        "distroversion": "v3.11",
+        "reponame": "main"
+      },
+      "subpath": null
+    },
+    "references": [
+      {
+        "reference_id": "XSA-248",
+        "url": "https://xenbits.xen.org/xsa/advisory-248.html",
+        "severities": []
+      }
+    ]
+  },
+  {
+    "vulnerability_id": null,
+    "aliases": [],
+    "confidence": 100,
+    "summary": null,
+    "affected_purls": [],
+    "fixed_purl": {
+      "type": "alpine",
+      "namespace": null,
+      "name": "xen",
+      "version": "4.10.0-r1",
+      "qualifiers": {
+        "arch": "x86",
+        "distroversion": "v3.11",
+        "reponame": "main"
+      },
+      "subpath": null
+    },
+    "references": [
+      {
+        "reference_id": "XSA-248",
+        "url": "https://xenbits.xen.org/xsa/advisory-248.html",
+        "severities": []
+      }
+    ]
+  },
+  {
+    "vulnerability_id": null,
+    "aliases": [],
+    "confidence": 100,
+    "summary": null,
+    "affected_purls": [],
+    "fixed_purl": {
+      "type": "alpine",
+      "namespace": null,
+      "name": "xen",
+      "version": "4.10.0-r1",
+      "qualifiers": {
+        "arch": "x86_64",
+        "distroversion": "v3.11",
+        "reponame": "main"
+      },
+      "subpath": null
+    },
+    "references": [
+      {
+        "reference_id": "XSA-248",
+        "url": "https://xenbits.xen.org/xsa/advisory-248.html",
+        "severities": []
+      }
+    ]
+  }
+]