Skip to content

Add heuristics to ingest advisories without aliases #981 - #995

Closed
TG1999 wants to merge 8 commits into
aboutcode-org:mainfrom
TG1999:failing_test_improver
Closed

TG1999 wants to merge 8 commits into
aboutcode-org:mainfrom
TG1999:failing_test_improver

Conversation

@TG1999

@TG1999 TG1999 commented Nov 7, 2022

Copy link
Copy Markdown
Contributor

Reference: #981
Signed-off-by: Tushar Goel tushar.goel.dav@gmail.com

@TG1999 TG1999 changed the title Added a failing tests to show multiple vulnerabilities are created for single advisory without aliases Added a failing test to show multiple vulnerabilities are created for single advisory without aliases Nov 7, 2022
@TG1999 TG1999 changed the title Added a failing test to show multiple vulnerabilities are created for single advisory without aliases Add heuristics to get vulnerability without aliases Nov 10, 2022
@TG1999 TG1999 changed the title Add heuristics to get vulnerability without aliases Add heuristics to get vulnerability without aliases #981 Nov 11, 2022
@TG1999

TG1999 commented Nov 11, 2022

Copy link
Copy Markdown
Contributor Author

closes #981

@TG1999
TG1999 requested review from pombredanne and tdruez November 11, 2022 09:05
…r single advisory without aliases

Signed-off-by: Tushar Goel <tushar.goel.dav@gmail.com>
Signed-off-by: Tushar Goel <tushar.goel.dav@gmail.com>
Signed-off-by: Tushar Goel <tushar.goel.dav@gmail.com>
@TG1999
TG1999 force-pushed the failing_test_improver branch from 906bba6 to 5fe61fb Compare November 11, 2022 09:09
Signed-off-by: Tushar Goel <tushar.goel.dav@gmail.com>
@TG1999 TG1999 changed the title Add heuristics to get vulnerability without aliases #981 Add heuristics to ingest advsiories without aliases #981 Nov 11, 2022
Signed-off-by: Tushar Goel <tushar.goel.dav@gmail.com>
@TG1999 TG1999 changed the title Add heuristics to ingest advsiories without aliases #981 Add heuristics to ingest advisories without aliases #981 Nov 11, 2022
Comment thread vulnerabilities/models.py Outdated

def get_from_purl(self, purl: PackageURL):
"""
Return an existing or new Package (created if neeed) given a

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

"(created if neeed) "?
Are you sure?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You are right, we are not creating here.

Comment thread vulnerabilities/models.py Outdated
package, _ = Package.objects.get_or_create(**purl_fields)
return package

def get_from_purl(self, purl: PackageURL):

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I wonder if we could do better? may be for_purl?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done!

Signed-off-by: Tushar Goel <tushar.goel.dav@gmail.com>
Signed-off-by: Tushar Goel <tushar.goel.dav@gmail.com>
Signed-off-by: Tushar Goel <tushar.goel.dav@gmail.com>
@TG1999
TG1999 marked this pull request as draft November 21, 2022 10:15

@pombredanne pombredanne left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just a nit for now, I am not sure this is ready for review.

return vulnerability


# def match_packages(inference, vuln):

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please remove commented code.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes this is not ready for review as of now. It's out of scope for now ( this needs model changes, which we will consider after the migration of importers is done )

@TG1999 TG1999 closed this Sep 11, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Check if OLD nodejs advisories are still relevant was:[Find a way to ingest advisories without aliases]

2 participants