Create a new model AdvisoryPOC

Update the pipeline to work with the new model

Signed-off-by: ziad hany <ziadhany2016@gmail.com>

Author: ziadhany

vulnerabilities/migrations/0104_advisorypoc.py

@@ -0,0 +1,37 @@
+# Generated by Django 4.2.25 on 2025-12-04 01:05
+
+from django.db import migrations, models
+import django.db.models.deletion
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("vulnerabilities", "0103_codecommit_impactedpackage_affecting_commits_and_more"),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name="AdvisoryPOC",
+            fields=[
+                (
+                    "id",
+                    models.AutoField(
+                        auto_created=True, primary_key=True, serialize=False, verbose_name="ID"
+                    ),
+                ),
+                ("created_at", models.DateTimeField(blank=True, null=True)),
+                ("updated_at", models.DateTimeField(blank=True, null=True)),
+                ("url", models.URLField()),
+                ("is_confirmed", models.BooleanField(default=False)),
+                (
+                    "advisory",
+                    models.ForeignKey(
+                        on_delete=django.db.models.deletion.CASCADE,
+                        related_name="pocs",
+                        to="vulnerabilities.advisoryv2",
+                    ),
+                ),
+            ],
+        ),
+    ]

vulnerabilities/models.py

@@ -3414,3 +3414,31 @@ class CodeCommit(models.Model):
 
     class Meta:
         unique_together = ("commit_hash", "vcs_url")
+
+
+class AdvisoryPOC(models.Model):
+    """
+    An AdvisoryPOC (Proof of Concept) demonstrating how a vulnerability related to an advisory can be exploited.
+    """
+
+    advisory = models.ForeignKey(
+        "AdvisoryV2",
+        related_name="pocs",
+        on_delete=models.CASCADE,
+    )
+
+    created_at = models.DateTimeField(
+        null=True, blank=True, help_text="The date and time when this POC was created."
+    )
+
+    updated_at = models.DateTimeField(
+        null=True, blank=True, help_text="The date and time when this POC was last updated."
+    )
+
+    url = models.URLField(
+        help_text="The URL of the PoC, such as a repository or resource link."
+    )
+
+    is_confirmed = models.BooleanField(
+        default=False, help_text="Indicates whether this POC has been verified or confirmed."
+    )

vulnerabilities/pipelines/v2_improvers/enhance_with_github_poc.py

@@ -10,18 +10,22 @@
 import json
 from pathlib import Path
 
-import dateparser
 from aboutcode.pipeline import LoopProgress
 from fetchcode.vcs import fetch_via_vcs
 
 from vulnerabilities.models import AdvisoryAlias
-from vulnerabilities.models import AdvisoryExploit
+from vulnerabilities.models import AdvisoryPOC
 from vulnerabilities.pipelines import VulnerableCodePipeline
 
 
 class GithubPocsImproverPipeline(VulnerableCodePipeline):
+    """
+    Pipeline to Collect an exploit-PoCs repository, parse exploit JSON files,
+    match them to advisories via aliases, and update/create POC records.
+    """
+
     pipeline_id = "enhance_with_github_poc"
-    repo_url = "https://github.com/nomi-sec/PoC-in-GitHub"
+    repo_url = "git+https://github.com/nomi-sec/PoC-in-GitHub"
 
     @classmethod
     def steps(cls):
@@ -55,8 +59,8 @@ def collect_and_store_exploits(self):
                     continue
 
             filename = file_path.stem.strip()
-            advisories = set()
 
+            advisories = set()
             try:
                 if alias := AdvisoryAlias.objects.get(alias=filename):
                     for adv in alias.advisories.all():
@@ -71,19 +75,16 @@ def collect_and_store_exploits(self):
                     if not exploit_repo_url:
                         continue
 
-                    AdvisoryExploit.objects.update_or_create(
+                    AdvisoryPOC.objects.update_or_create(
                         advisory=advisory,
-                        data_source="GitHub-PoC",
-                        source_url=exploit_repo_url,
+                        url=exploit_repo_url,
                         defaults={
-                            "description": exploit_data.get("description"),
-                            "source_date_published": dateparser.parse(
-                                exploit_data.get("created_at")
-                            ),
+                            "created_at": exploit_data.get("created_at"),
+                            "updated_at": exploit_data.get("updated_at"),
                         },
                     )
 
-        self.log(f"Successfully added {exploits_count:,d} exploit advisory")
+        self.log(f"Successfully added {exploits_count:,d} poc exploit advisory")
 
     def clean_downloads(self):
         if self.vcs_response:

vulnerabilities/tests/pipelines/v2_improvers/test_enhance_with_github_poc.py

@@ -15,7 +15,7 @@
 import pytest
 
 from vulnerabilities.models import AdvisoryAlias
-from vulnerabilities.models import AdvisoryExploit
+from vulnerabilities.models import AdvisoryPOC
 from vulnerabilities.models import AdvisoryV2
 from vulnerabilities.pipelines.v2_improvers.enhance_with_github_poc import (
     GithubPocsImproverPipeline,
@@ -69,7 +69,9 @@ def test_github_poc_db_improver(mock_fetch_via_vcs):
     improver = GithubPocsImproverPipeline()
     improver.execute()
 
-    assert len(AdvisoryExploit.objects.all()) == 10
-    exploit = AdvisoryExploit.objects.first()
-    assert exploit.data_source == "GitHub-PoC"
-    assert exploit.source_url == "https://github.com/iSee857/CVE-2025-0108-PoC"
+    assert len(AdvisoryPOC.objects.all()) == 10
+    exploit = AdvisoryPOC.objects.first()
+    assert exploit.url == "https://github.com/iSee857/CVE-2025-0108-PoC"
+    assert exploit.is_confirmed == False
+    assert str(exploit.created_at) == "2025-02-13 06:39:25+00:00"
+    assert str(exploit.updated_at) == "2025-09-03 18:40:14+00:00"