diff --git a/dojo/tools/govulncheck/parser.py b/dojo/tools/govulncheck/parser.py index 4bdea0908ff..9214218d68b 100644 --- a/dojo/tools/govulncheck/parser.py +++ b/dojo/tools/govulncheck/parser.py @@ -40,6 +40,22 @@ def get_location(data, node): def get_version(data, node): return data["Requires"]["Modules"][str(node)]["Version"] + @staticmethod + def get_fix_info(affected_ranges): + for r in affected_ranges: + for event in r.get("events", []): + if "fixed" in event: + return True, event["fixed"] + return False, "" + + @staticmethod + def get_introduced_version(affected_ranges): + for r in affected_ranges: + for event in r.get("events", []): + if "introduced" in event: + return event["introduced"] + return "" + def get_finding_trace_info(self, data, osv_id): # Browse the findings to look for matching OSV-id. If the OSV-id is matching, extract traces. trace_info_strs = [] @@ -202,8 +218,12 @@ def get_findings(self, scan_file, test): else: title = f"{osv_data['id']} - {affected_package['name']}" - affected_version = self.get_affected_version(data, osv_data["id"]) + fix_available, fix_version = self.get_fix_info(affected_ranges) + affected_version = ( + self.get_affected_version(data, osv_data["id"]) + or self.get_introduced_version(affected_ranges) + ) severity = elem["osv"].get("severity", SEVERITY) d = { @@ -215,6 +235,8 @@ def get_findings(self, scan_file, test): "description": description, "impact": impact, "references": references, + "fix_available": fix_available, + "fix_version": fix_version, "file_path": path, "url": db_specific_url, "unique_id_from_tool": osv_id, diff --git a/unittests/tools/test_govulncheck_parser.py b/unittests/tools/test_govulncheck_parser.py index 90499dc48fd..3b0a8efc474 100644 --- a/unittests/tools/test_govulncheck_parser.py +++ b/unittests/tools/test_govulncheck_parser.py @@ -127,6 +127,8 @@ def test_parse_new_version_many_findings_custom_severity(self): self.assertIsNotNone(finding.impact) self.assertIsNotNone(finding.description) self.assertIsNotNone(finding.references) + self.assertTrue(finding.fix_available) + self.assertEqual("0.3.8", finding.fix_version) def test_parse_issue_14642(self): with (get_unit_tests_scans_path("govulncheck") / "issue_14642.json").open(encoding="utf-8") as testfile: