Skip to content

Commit 6d7905c

Browse files
TG1999TG1999
committed
Address review comments
Signed-off-by: Tushar Goel <tushar.goel.dav@gmail.com>
1 parent 38483f4 commit 6d7905c

5 files changed

Lines changed: 88 additions & 34 deletions

File tree

‎vulnerabilities/importers/debian.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@
3939

4040
class DebianImporter(Importer):
4141

42-
spdx_license_expression = "MIT"
42+
spdx_license_expression = "LicenseRef-scancode-other-permissive"
4343
license_url = "https://www.debian.org/license"
4444
notice = """
4545
From: Tushar Goel <tgoel@nexb.com>

‎vulnerabilities/importers/debian_oval.py‎

Lines changed: 37 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,43 @@
1616

1717

1818
class DebianOvalImporter(OvalImporter):
19-
spdx_license_expression = "LicenseRef-scancode-unknown"
19+
20+
spdx_license_expression = "LicenseRef-scancode-other-permissive"
21+
license_url = "https://www.debian.org/license"
22+
notice = """
23+
From: Tushar Goel <tgoel@nexb.com>
24+
Date: Thu, May 12, 2022 at 11:42 PM +00:00
25+
Subject: Usage of Debian Security Data in VulnerableCode
26+
To: <team@security.debian.org>
27+
Hey,
28+
We would like to integrate the debian security data in vulnerablecode
29+
[1][2] which is a FOSS db of FOSS vulnerability data. We were not able
30+
to know under which license the debian security data comes. We would
31+
be grateful to have your acknowledgement over usage of the debian
32+
security data in vulnerablecode and have some kind of licensing
33+
declaration from your side.
34+
[1] - https://github.com/nexB/vulnerablecode
35+
[2] - https://github.com/nexB/vulnerablecode/pull/723
36+
Regards,
37+
From: Moritz Mühlenhoff <jmm@inutil.org>
38+
Date: Wed, May 17, 2022, 19:12 PM +00:00
39+
Subject: Re: Usage of Debian Security Data in VulnerableCode
40+
To: Tushar Goel <tgoel@nexb.com>
41+
Cc: <team@security.debian.org>
42+
Am Thu, May 12, 2022 at 05:12:48PM +0530 schrieb Tushar Goel:
43+
> Hey,
44+
>
45+
> We would like to integrate the debian security data in vulnerablecode
46+
> [1][2] which is a FOSS db of FOSS vulnerability data. We were not able
47+
> to know under which license the debian security data comes. We would
48+
> be grateful to have your acknowledgement over usage of the debian
49+
> security data in vulnerablecode and have some kind of licensing
50+
> declaration from your side.
51+
We don't have a specific license, but you have our endorsemen to
52+
reuse the data by all means :-)
53+
Cheers,
54+
Moritz
55+
"""
2056

2157
def __init__(self, *args, **kwargs):
2258
super().__init__(*args, **kwargs)

‎vulnerabilities/tests/test_github.py‎

Lines changed: 0 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -26,9 +26,7 @@
2626
from vulnerabilities.importers.github import GitHubAPIImporter
2727
from vulnerabilities.importers.github import GitHubBasicImprover
2828
from vulnerabilities.importers.github import process_response
29-
from vulnerabilities.package_managers import PackageVersion
3029
from vulnerabilities.utils import GitHubTokenError
31-
from vulnerabilities.utils import resolve_version_range
3230

3331
BASE_DIR = os.path.dirname(os.path.abspath(__file__))
3432
TEST_DATA = os.path.join(BASE_DIR, "test_data", "github_api")
@@ -54,35 +52,6 @@ def test_process_response_github_importer(pkg_type, regen=False):
5452
assert result == expected
5553

5654

57-
def test_resolve_version_range():
58-
assert (["1.0.0", "2.0.0"], ["10.0.0"]) == resolve_version_range(
59-
GemVersionRange(
60-
constraints=(
61-
VersionConstraint(comparator="<", version=RubygemsVersion(string="9.0.0")),
62-
)
63-
),
64-
[
65-
"1.0.0",
66-
"2.0.0",
67-
"10.0.0",
68-
],
69-
[],
70-
)
71-
72-
73-
def test_resolve_version_range_failure(caplog):
74-
assert ([], []) == resolve_version_range(
75-
None,
76-
[
77-
PackageVersion(value="1.0.0"),
78-
PackageVersion(value="2.0.0"),
79-
PackageVersion(value="10.0.0"),
80-
],
81-
[],
82-
)
83-
assert "affected version range is" in caplog.text
84-
85-
8655
def test_process_response_with_empty_vulnaribilities(caplog):
8756
list(process_response({"data": {"securityVulnerabilities": {"edges": []}}}, "maven"))
8857
assert "No vulnerabilities found for package_type: 'maven'" in caplog.text

‎vulnerabilities/tests/test_utils.py‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,10 +8,15 @@
88
#
99

1010
from packageurl import PackageURL
11+
from univers.version_constraint import VersionConstraint
12+
from univers.version_range import GemVersionRange
13+
from univers.versions import RubygemsVersion
1114

15+
from vulnerabilities.package_managers import PackageVersion
1216
from vulnerabilities.utils import AffectedPackage
1317
from vulnerabilities.utils import get_item
1418
from vulnerabilities.utils import nearest_patched_package
19+
from vulnerabilities.utils import resolve_version_range
1520
from vulnerabilities.utils import split_markdown_front_matter
1621

1722

@@ -96,3 +101,47 @@ def test_get_item():
96101
d5 = {"a": {"b": {"c": "d"}}}
97102
assert get_item(d5, "a", "b", "c", "d") == None
98103
assert get_item(d5, "a", "b", "c") == "d"
104+
105+
106+
def test_resolve_version_range():
107+
assert (["1.0.0", "2.0.0"], ["10.0.0"]) == resolve_version_range(
108+
GemVersionRange(
109+
constraints=(
110+
VersionConstraint(comparator="<", version=RubygemsVersion(string="9.0.0")),
111+
)
112+
),
113+
[
114+
"1.0.0",
115+
"2.0.0",
116+
"10.0.0",
117+
],
118+
[],
119+
)
120+
121+
122+
def test_resolve_version_range_failure(caplog):
123+
assert ([], []) == resolve_version_range(
124+
None,
125+
[
126+
PackageVersion(value="1.0.0"),
127+
PackageVersion(value="2.0.0"),
128+
PackageVersion(value="10.0.0"),
129+
],
130+
[],
131+
)
132+
assert "affected version range is" in caplog.text
133+
134+
135+
def test_resolve_version_range_without_ignorable_versions():
136+
assert (["1.0.0", "2.0.0"], ["10.0.0"]) == resolve_version_range(
137+
GemVersionRange(
138+
constraints=(
139+
VersionConstraint(comparator="<", version=RubygemsVersion(string="9.0.0")),
140+
)
141+
),
142+
[
143+
"1.0.0",
144+
"2.0.0",
145+
"10.0.0",
146+
],
147+
)

‎vulnerabilities/utils.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -318,7 +318,7 @@ def get_reference_id(url: str):
318318
def resolve_version_range(
319319
affected_version_range: VersionRange,
320320
package_versions: List[str],
321-
ignorable_versions: List[str] = [],
321+
ignorable_versions: List[str] = tuple(),
322322
) -> Tuple[List[str], List[str]]:
323323
"""
324324
Given an affected version range and a list of `package_versions`, resolve

0 commit comments

Comments
 (0)