Skip to content

Commit 5172be5

Browse files
committed
Parse and collect all supported scoring systems from osv
Signed-off-by: Keshav Priyadarshi <git@keshav.space>
1 parent 5418e3e commit 5172be5

1 file changed

Lines changed: 16 additions & 13 deletions

File tree

vulnerabilities/pipes/osv_v2.py

Lines changed: 16 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,7 @@ def parse_advisory_data_v3(
6969
aliases = raw_data.get("aliases") or []
7070

7171
date_published = get_published_date(raw_data=raw_data)
72-
severities = list(get_severities(raw_data=raw_data))
72+
severities = list(get_severities(raw_data=raw_data, url=advisory_url))
7373
references = get_references_v2(raw_data=raw_data)
7474

7575
patches = []
@@ -236,24 +236,27 @@ def get_published_date(raw_data):
236236
return published and dateparser.parse(date_string=published)
237237

238238

239-
def get_severities(raw_data) -> Iterable[VulnerabilitySeverity]:
240-
"""
241-
Yield VulnerabilitySeverity extracted from a mapping of OSV ``raw_data``
242-
"""
239+
def get_severities(raw_data, url) -> Iterable[VulnerabilitySeverity]:
240+
"""Yield VulnerabilitySeverity extracted from a mapping of OSV ``raw_data``"""
243241
try:
244242
for severity in raw_data.get("severity") or []:
245-
vector = severity.get("score")
246-
valid_vector = vector[:-1] if vector and vector.endswith("/") else vector
243+
severity_type = severity.get("type")
244+
score = severity.get("score")
247245

248-
if severity.get("type") == "CVSS_V3":
246+
if severity_type == "CVSS_V3":
249247
system = SCORING_SYSTEMS["cvssv3.1"]
250-
score = system.compute(valid_vector)
251-
yield VulnerabilitySeverity(system=system, value=score, scoring_elements=vector)
248+
valid_vector = score[:-1] if score and score.endswith("/") else score
249+
value = system.compute(valid_vector)
250+
yield VulnerabilitySeverity(system=system, value=value, scoring_elements=score)
252251

253-
elif severity.get("type") == "CVSS_V4":
252+
elif severity_type == "CVSS_V4":
254253
system = SCORING_SYSTEMS["cvssv4"]
255-
score = system.compute(valid_vector)
256-
yield VulnerabilitySeverity(system=system, value=score, scoring_elements=vector)
254+
valid_vector = score[:-1] if score and score.endswith("/") else score
255+
value = system.compute(valid_vector)
256+
yield VulnerabilitySeverity(system=system, value=value, scoring_elements=score)
257+
elif severity_type.lower() in SCORING_SYSTEMS:
258+
system = SCORING_SYSTEMS[severity_type.lower()]
259+
yield VulnerabilitySeverity(system=system, value=score, url=url)
257260

258261
else:
259262
logger.error(

0 commit comments

Comments
 (0)