Skip to content

Commit 6fcb068

Browse files
ziadhanyziadhany
committed
Refactor the code for postgresql_live importer
Signed-off-by: ziad hany <ziadhany2016@gmail.com>
1 parent 0ce7c4f commit 6fcb068

3 files changed

Lines changed: 61 additions & 73 deletions

File tree

‎vulnerabilities/importers/__init__.py‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -67,13 +67,13 @@
6767
from vulnerabilities.pipelines.v2_importers import oss_fuzz as oss_fuzz_v2
6868
from vulnerabilities.pipelines.v2_importers import postgresql_importer as postgresql_importer_v2
6969
from vulnerabilities.pipelines.v2_importers import (
70-
project_kb_msr2019_importer as project_kb_msr2019_importer_v2,
70+
postgresql_live_importer as postgresql_live_importer_v2,
7171
)
7272
from vulnerabilities.pipelines.v2_importers import (
73-
project_kb_statements_importer as project_kb_statements_importer_v2,
73+
project_kb_msr2019_importer as project_kb_msr2019_importer_v2,
7474
)
7575
from vulnerabilities.pipelines.v2_importers import (
76-
postgresql_live_importer as postgresql_live_importer_v2,
76+
project_kb_statements_importer as project_kb_statements_importer_v2,
7777
)
7878
from vulnerabilities.pipelines.v2_importers import pypa_importer as pypa_importer_v2
7979
from vulnerabilities.pipelines.v2_importers import pysec_importer as pysec_importer_v2

‎vulnerabilities/pipelines/v2_importers/postgresql_live_importer.py‎

Lines changed: 11 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -9,10 +9,10 @@
99
from typing import Iterable
1010

1111
from packageurl import PackageURL
12-
from univers.versions import GenericVersion
12+
from univers.versions import InvalidVersion
1313
from univers.versions import SemverVersion
1414

15-
from vulnerabilities.importer import AdvisoryData
15+
from vulnerabilities.importer import AdvisoryDataV2
1616
from vulnerabilities.pipelines.v2_importers.postgresql_importer import PostgreSQLImporterPipeline
1717

1818
logger = logging.getLogger(__name__)
@@ -49,54 +49,29 @@ def get_purl_inputs(self):
4949
f"PURL: {purl!s} is not among the supported package types {self.supported_types!r}"
5050
)
5151

52-
if purl.name != "postgresql":
53-
raise ValueError(f"PURL: {purl!s} is expected to be for 'postgresql'")
54-
5552
if not purl.version:
5653
raise ValueError(f"PURL: {purl!s} is expected to have a version")
57-
5854
self.purl = purl
5955

60-
def collect_advisories(self) -> Iterable[AdvisoryData]:
56+
def collect_advisories(self) -> Iterable[AdvisoryDataV2]:
6157
for advisory in super().collect_advisories():
62-
if self._advisory_affects_purl(advisory):
58+
if self._advisory_related_purl(advisory):
6359
yield advisory
6460

65-
def _advisory_affects_purl(self, advisory: AdvisoryData) -> bool:
61+
def _advisory_related_purl(self, advisory: AdvisoryDataV2) -> bool:
6662
if not advisory.affected_packages:
6763
return False
6864

6965
try:
70-
package_semver_version = SemverVersion(self.purl.version)
71-
package_generic_version = GenericVersion(self.purl.version)
72-
except Exception as e:
66+
package_version = SemverVersion(self.purl.version)
67+
except InvalidVersion as e:
7368
logger.debug(f"Invalid PURL version {self.purl.version!r}: {e}")
7469
return False
7570

7671
for ap in advisory.affected_packages:
77-
if ap.package.type != "generic" or ap.package.name != "postgresql":
78-
continue
79-
80-
purl_q = self.purl.qualifiers or None
81-
ap_q = ap.package.qualifiers or None
82-
83-
if purl_q is None and ap_q is None:
84-
qualifiers_match = True
85-
else:
86-
qualifiers_match = all(ap_q.get(k) == v for k, v in purl_q.items())
87-
88-
if not qualifiers_match:
89-
continue
90-
91-
try:
92-
if getattr(ap, "affected_version_range", None):
93-
if package_semver_version in ap.affected_version_range:
94-
return True
95-
elif getattr(ap, "fixed_version", None):
96-
if package_generic_version < ap.fixed_version:
97-
return True
98-
except Exception as e:
99-
logger.debug(f"Version comparison failed for {package_semver_version}: {e}")
100-
continue
72+
if (ap.affected_version_range and package_version in ap.affected_version_range) or (
73+
ap.fixed_version_range and package_version in ap.fixed_version_range
74+
):
75+
return True
10176

10277
return False

‎vulnerabilities/tests/pipelines/v2_importers/test_postgresql_live_importer_v2.py‎

Lines changed: 47 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,6 @@
88
import requests
99
from packageurl import PackageURL
1010

11-
from vulnerabilities.importer import AdvisoryData
1211
from vulnerabilities.pipelines.v2_importers.postgresql_live_importer import (
1312
PostgreSQLLiveImporterPipeline,
1413
)
@@ -48,55 +47,69 @@ def test_affected_version(monkeypatch):
4847
pipeline = PostgreSQLLiveImporterPipeline(purl=purl)
4948
pipeline.get_purl_inputs()
5049
advisories = list(pipeline.collect_advisories())
51-
52-
assert len(advisories) == 1
53-
adv = advisories[0]
54-
assert isinstance(adv, AdvisoryData)
55-
assert adv.advisory_id == "CVE-2022-1234"
50+
assert [adv.to_dict() for adv in advisories] == [
51+
{
52+
"advisory_id": "CVE-2022-1234",
53+
"affected_packages": [
54+
{
55+
"affected_version_range": "vers:generic/10.0.0|10.1.0",
56+
"fixed_by_commit_patches": [],
57+
"fixed_version_range": "vers:generic/10.2.0",
58+
"introduced_by_commit_patches": [],
59+
"package": {
60+
"name": "postgresql",
61+
"namespace": "",
62+
"qualifiers": "",
63+
"subpath": "",
64+
"type": "generic",
65+
"version": "",
66+
},
67+
}
68+
],
69+
"aliases": [],
70+
"date_published": None,
71+
"patches": [],
72+
"references": [
73+
{
74+
"reference_id": "",
75+
"reference_type": "",
76+
"url": "https://www.postgresql.org/support/security/CVE-2022-1234/",
77+
},
78+
{
79+
"reference_id": "",
80+
"reference_type": "",
81+
"url": "https://www.postgresql.org/about/news/postgresql-175-169-1513-1418-and-1321-released-3072/",
82+
},
83+
],
84+
"severities": [
85+
{
86+
"scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
87+
"system": "cvssv3",
88+
"value": "9.8",
89+
}
90+
],
91+
"summary": "Issue affects all",
92+
"url": "https://www.postgresql.org/support/security/",
93+
"weaknesses": [],
94+
}
95+
]
5696

5797

5898
def test_unaffected_version(monkeypatch):
5999
html = HTML_BASE.format(affected="10.0, 10.1", fixed="10.2", summary="Issue affects all")
60100
monkeypatch.setattr(requests, "get", lambda url: DummyResponse(html))
61101

62-
purl = PackageURL(type="generic", name="postgresql", version="10.2")
102+
purl = PackageURL(type="generic", name="postgresql", version="14.3")
63103
pipeline = PostgreSQLLiveImporterPipeline(purl=purl)
64104
pipeline.get_purl_inputs()
65105
advisories = list(pipeline.collect_advisories())
66106

67107
assert len(advisories) == 0
68108

69109

70-
def test_qualifier_filtering(monkeypatch):
71-
html = HTML_BASE.format(affected="12.0, 12.1", fixed="12.2", summary="Windows-specific issue")
72-
monkeypatch.setattr(requests, "get", lambda url: DummyResponse(html))
73-
74-
purl = PackageURL(
75-
type="generic", name="postgresql", version="12.1", qualifiers={"os": "windows"}
76-
)
77-
pipeline = PostgreSQLLiveImporterPipeline(purl=purl)
78-
pipeline.get_purl_inputs()
79-
advisories = list(pipeline.collect_advisories())
80-
assert len(advisories) == 1
81-
82-
purl = PackageURL(type="generic", name="postgresql", version="12.1", qualifiers={"os": "linux"})
83-
pipeline = PostgreSQLLiveImporterPipeline(purl=purl)
84-
pipeline.get_purl_inputs()
85-
advisories = list(pipeline.collect_advisories())
86-
assert len(advisories) == 0
87-
88-
89110
def test_invalid_purl():
90111
pipeline = PostgreSQLLiveImporterPipeline()
91112

92113
pipeline.inputs = {"purl": "pkg:pypi/postgresql@10.1"}
93114
with pytest.raises(ValueError):
94115
pipeline.get_purl_inputs()
95-
96-
pipeline.inputs = {"purl": "pkg:generic/notpostgresql@10.1"}
97-
with pytest.raises(ValueError):
98-
pipeline.get_purl_inputs()
99-
100-
pipeline.inputs = {"purl": "pkg:generic/postgresql"}
101-
with pytest.raises(ValueError):
102-
pipeline.get_purl_inputs()

0 commit comments

Comments
 (0)