Skip to content

Commit 5e7cb04

Browse files
NucleiAvNucleiAv
committed
Address Ziad review on eclipse importer
Signed-off-by: Anmol Vats <anmolvats2003@gmail.com>
1 parent ece4604 commit 5e7cb04

File tree

3 files changed

+92
-79
lines changed

3 files changed

+92
-79
lines changed

‎vulnerabilities/pipelines/v2_importers/eclipse_importer.py‎

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -58,8 +58,6 @@ def collect_advisories(self) -> Iterable[AdvisoryDataV2]:
5858

5959
def parse_advisory(entry: dict):
6060
advisory_id = entry.get("id") or ""
61-
if not advisory_id:
62-
return None
6361

6462
date_published = None
6563
raw_date = entry.get("date_published") or ""
@@ -71,8 +69,8 @@ def parse_advisory(entry: dict):
7169
if date_published is None:
7270
logger.warning("Could not parse date %r for %s", raw_date, advisory_id)
7371

74-
summary_obj = entry.get("summary")
75-
summary = summary_obj.get("content") or "" if isinstance(summary_obj, dict) else ""
72+
summary_obj = entry.get("summary") or {}
73+
summary = summary_obj.get("content") or ""
7674

7775
references = []
7876
for url in [
@@ -85,7 +83,7 @@ def parse_advisory(entry: dict):
8583

8684
severities = []
8785
cvss = entry.get("cvss")
88-
if cvss is not None:
86+
if cvss:
8987
severities.append(VulnerabilitySeverity(system=GENERIC, value=str(cvss)))
9088

9189
advisory_url = entry.get("live_link") or ""

‎vulnerabilities/tests/pipelines/v2_importers/test_eclipse_importer.py‎

Lines changed: 7 additions & 74 deletions
Original file line numberDiff line numberDiff line change
@@ -7,83 +7,25 @@
77
# See https://aboutcode.org for more information about nexB OSS projects.
88
#
99

10-
import json
1110
from pathlib import Path
1211
from unittest import TestCase
1312
from unittest.mock import MagicMock
1413
from unittest.mock import patch
1514

16-
import requests
17-
1815
from vulnerabilities.pipelines.v2_importers.eclipse_importer import EclipseImporterPipeline
1916
from vulnerabilities.pipelines.v2_importers.eclipse_importer import parse_advisory
17+
from vulnerabilities.tests import util_tests
18+
from vulnerabilities.utils import load_json
2019

2120
TEST_DATA = Path(__file__).parent.parent.parent / "test_data" / "eclipse"
2221

23-
with open(TEST_DATA / "eclipse_api_sample.json") as f:
24-
SAMPLE_DATA = json.load(f)
25-
26-
ENTRY_WITH_CVSS = SAMPLE_DATA[0]
27-
ENTRY_WITHOUT_CVSS = SAMPLE_DATA[1]
28-
ENTRY_WITHOUT_SUMMARY = SAMPLE_DATA[2]
29-
30-
31-
class TestParseAdvisory(TestCase):
32-
def test_parses_id_and_summary(self):
33-
advisory = parse_advisory(ENTRY_WITH_CVSS)
34-
assert advisory.advisory_id == "CVE-2017-7649"
35-
assert "Kura" in advisory.summary
36-
37-
def test_parses_date(self):
38-
advisory = parse_advisory(ENTRY_WITH_CVSS)
39-
assert advisory.date_published is not None
40-
assert advisory.date_published.year == 2017
41-
42-
def test_cvss_stored_as_generic_severity(self):
43-
advisory = parse_advisory(ENTRY_WITH_CVSS)
44-
assert len(advisory.severities) == 1
45-
assert advisory.severities[0].value == "9.8"
46-
47-
def test_missing_cvss_yields_empty_severities(self):
48-
advisory = parse_advisory(ENTRY_WITHOUT_CVSS)
49-
assert advisory.severities == []
50-
51-
def test_missing_summary_yields_empty_string(self):
52-
advisory = parse_advisory(ENTRY_WITHOUT_SUMMARY)
53-
assert advisory.summary == ""
22+
SAMPLE_DATA = load_json(TEST_DATA / "eclipse_api_sample.json")
5423

55-
def test_references_populated(self):
56-
advisory = parse_advisory(ENTRY_WITH_CVSS)
57-
urls = [r.url for r in advisory.references]
58-
assert "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7649" in urls
59-
assert "https://bugs.eclipse.org/bugs/show_bug.cgi?id=514681" in urls
6024

61-
def test_cve_pull_request_added_as_reference(self):
62-
advisory = parse_advisory(ENTRY_WITHOUT_CVSS)
63-
urls = [r.url for r in advisory.references]
64-
assert "https://github.com/CVEProject/cvelist/pull/932" in urls
65-
66-
def test_empty_cve_pull_request_not_added(self):
67-
advisory = parse_advisory(ENTRY_WITH_CVSS)
68-
urls = [r.url for r in advisory.references]
69-
assert "" not in urls
70-
71-
def test_missing_id_returns_none(self):
72-
assert parse_advisory({}) is None
73-
assert parse_advisory({"id": ""}) is None
74-
75-
def test_original_advisory_text_is_json(self):
76-
advisory = parse_advisory(ENTRY_WITH_CVSS)
77-
parsed = json.loads(advisory.original_advisory_text)
78-
assert parsed["id"] == "CVE-2017-7649"
79-
80-
def test_affected_packages_empty(self):
81-
advisory = parse_advisory(ENTRY_WITH_CVSS)
82-
assert advisory.affected_packages == []
83-
84-
def test_weaknesses_empty(self):
85-
advisory = parse_advisory(ENTRY_WITH_CVSS)
86-
assert advisory.weaknesses == []
25+
def test_parse_advisories():
26+
results = [parse_advisory(entry).to_dict() for entry in SAMPLE_DATA]
27+
expected_file = TEST_DATA / "expected_eclipse_output.json"
28+
util_tests.check_results_against_json(results, expected_file)
8729

8830

8931
class TestEclipseImporterPipeline(TestCase):
@@ -105,12 +47,3 @@ def test_fetch_stores_advisories_data(self, mock_get):
10547
mock_get.return_value = mock_resp
10648
self.pipeline.fetch()
10749
assert self.pipeline.advisories_data == SAMPLE_DATA
108-
109-
@patch("vulnerabilities.pipelines.v2_importers.eclipse_importer.requests.get")
110-
def test_collect_advisories_skips_on_http_error(self, mock_get):
111-
mock_get.side_effect = requests.RequestException("timeout")
112-
try:
113-
self.pipeline.fetch()
114-
except Exception:
115-
pass
116-
assert not hasattr(self.pipeline, "advisories_data") or True

‎vulnerabilities/tests/test_data/eclipse/expected_eclipse_output.json‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
[
2+
{
3+
"advisory_id": "CVE-2017-7649",
4+
"aliases": [],
5+
"summary": "The network enabled distribution of Kura before 2.1.0 takes control over the device's firewall...",
6+
"affected_packages": [],
7+
"references": [
8+
{
9+
"reference_id": "",
10+
"reference_type": "",
11+
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7649"
12+
},
13+
{
14+
"reference_id": "",
15+
"reference_type": "",
16+
"url": "https://bugs.eclipse.org/bugs/show_bug.cgi?id=514681"
17+
}
18+
],
19+
"patches": [],
20+
"severities": [
21+
{
22+
"system": "generic_textual",
23+
"value": "9.8",
24+
"scoring_elements": ""
25+
}
26+
],
27+
"date_published": "2017-04-14T00:00:00+00:00",
28+
"weaknesses": [],
29+
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7649"
30+
},
31+
{
32+
"advisory_id": "CVE-2018-12537",
33+
"aliases": [],
34+
"summary": "Moderate severity vulnerability that affects io.vertx:vertx-core",
35+
"affected_packages": [],
36+
"references": [
37+
{
38+
"reference_id": "",
39+
"reference_type": "",
40+
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12537"
41+
},
42+
{
43+
"reference_id": "",
44+
"reference_type": "",
45+
"url": "https://bugs.eclipse.org/bugs/show_bug.cgi?id=536038"
46+
},
47+
{
48+
"reference_id": "",
49+
"reference_type": "",
50+
"url": "https://github.com/CVEProject/cvelist/pull/932"
51+
}
52+
],
53+
"patches": [],
54+
"severities": [],
55+
"date_published": "2018-06-19T00:00:00+00:00",
56+
"weaknesses": [],
57+
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12537"
58+
},
59+
{
60+
"advisory_id": "CVE-2024-2212",
61+
"aliases": [],
62+
"summary": "",
63+
"affected_packages": [],
64+
"references": [
65+
{
66+
"reference_id": "",
67+
"reference_type": "",
68+
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2212"
69+
},
70+
{
71+
"reference_id": "",
72+
"reference_type": "",
73+
"url": "https://github.com/eclipse-threadx/threadx/security/advisories/GHSA-v9jj-7qjg-h6g6"
74+
}
75+
],
76+
"patches": [],
77+
"severities": [],
78+
"date_published": "2024-03-06T00:00:00+00:00",
79+
"weaknesses": [],
80+
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2212"
81+
}
82+
]

0 commit comments

Comments
 (0)