Skip to content

Commit b5c6b46

Browse files
ziadhanyziadhany
committed
Update gentoo to create an affected_package for every index range
Signed-off-by: ziad hany <ziadhany2016@gmail.com>
1 parent d73249f commit b5c6b46

File tree

4 files changed

+112
-41
lines changed

4 files changed

+112
-41
lines changed

‎vulnerabilities/pipelines/v2_importers/gentoo_importer.py‎

Lines changed: 25 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,6 @@
99

1010
import re
1111
import xml.etree.ElementTree as ET
12-
from collections import defaultdict
1312
from pathlib import Path
1413
from typing import Iterable
1514

@@ -82,22 +81,23 @@ def process_file(self, file):
8281

8382
if child.tag == "affected":
8483
affected_packages = []
85-
for purl, (affected_ranges, fixed_ranges) in get_affected_and_fixed_purls(
84+
for purl, constraints, is_unaffected in get_affected_and_fixed_purls(
8685
child, logger=self.log
8786
):
88-
affected_version_constraint = build_constraints(
89-
affected_ranges, logger=self.log
90-
)
91-
fixed_version_constraint = build_constraints(fixed_ranges, logger=self.log)
92-
affected_version_range = EbuildVersionRange(
93-
constraints=affected_version_constraint
94-
)
95-
fixed_version_range = EbuildVersionRange(constraints=fixed_version_constraint)
96-
affected_package = AffectedPackageV2(
97-
package=purl,
98-
affected_version_range=affected_version_range,
99-
fixed_version_range=fixed_version_range,
100-
)
87+
constraints = build_constraints(constraints, logger=self.log)
88+
version_range = EbuildVersionRange(constraints=constraints)
89+
90+
if is_unaffected:
91+
affected_package = AffectedPackageV2(
92+
package=purl,
93+
fixed_version_range=version_range,
94+
)
95+
else:
96+
affected_package = AffectedPackageV2(
97+
package=purl,
98+
affected_version_range=version_range,
99+
)
100+
101101
affected_packages.append(affected_package)
102102

103103
if child.tag == "impact":
@@ -160,14 +160,10 @@ def get_affected_and_fixed_purls(affected_elem, logger):
160160
continue
161161

162162
pkg_ns, _, pkg_name = name.rpartition("/")
163-
# purl_components, (fixed_ranges_set, affected_ranges_set)
164-
purl_ranges_map = defaultdict(lambda: {"fixed_ranges": set(), "affected_ranges": set()})
165-
166163
for info in pkg:
167164
# All possible values of info.attrib['range'] =
168165
# {'gt', 'lt', 'rle', 'rge', 'rgt', 'le', 'ge', 'eq'}
169166
# rge means revision greater than equals and rgt means revision greater than
170-
171167
range_value = info.attrib.get("range")
172168
slot_value = info.attrib.get("slot")
173169
comparator_dict = {
@@ -185,24 +181,15 @@ def get_affected_and_fixed_purls(affected_elem, logger):
185181
logger(f"Unsupported range value {range_value}:{info.text}")
186182
continue
187183

188-
if info.tag == "unaffected":
189-
purl_ranges_map[(pkg_name, pkg_ns, slot_value)]["fixed_ranges"].add(
190-
(comparator, info.text)
191-
)
192-
193-
elif info.tag == "vulnerable":
194-
purl_ranges_map[(pkg_name, pkg_ns, slot_value)]["affected_ranges"].add(
195-
(comparator, info.text)
196-
)
197-
198-
if range_value in ["rgt", "rge", "rle"]:
199-
next_minor_version = GentooVersion(info.text).bump()
200-
invert_comp = "<" if range_value in ["rgt", "rge"] else ">"
201-
purl_ranges_map[(pkg_name, pkg_ns, slot_value)]["fixed_ranges"].add(
202-
(invert_comp, next_minor_version)
203-
)
204-
205-
for (pkg_name, pkg_ns, slot_value), data in purl_ranges_map.items():
206184
qualifiers = {"slot": slot_value} if slot_value else {}
207185
purl = PackageURL(type="ebuild", name=pkg_name, namespace=pkg_ns, qualifiers=qualifiers)
208-
yield purl, (data["affected_ranges"], data["fixed_ranges"])
186+
187+
constraints = [(comparator, info.text)]
188+
if range_value in ["rgt", "rge", "rle"]:
189+
try:
190+
next_minor_version = str(GentooVersion(info.text).bump())
191+
invert_comp = "<" if range_value in ["rgt", "rge"] else ">"
192+
constraints.append((invert_comp, next_minor_version))
193+
except Exception as e:
194+
logger(f"Invalid Gentoo version for bumping: {info.text} - {e}")
195+
yield purl, constraints, (info.tag == "unaffected")

‎vulnerabilities/tests/test_data/gentoo_v2/glsa-201709-09-expected.json‎

Lines changed: 44 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,8 +15,50 @@
1515
"qualifiers": "",
1616
"subpath": ""
1717
},
18-
"affected_version_range": "vers:ebuild/0.1.1|<1.9.7",
19-
"fixed_version_range": "vers:ebuild/>1.8.18|<1.9|>=1.9.7",
18+
"affected_version_range": "vers:ebuild/0.1.1",
19+
"fixed_version_range": null,
20+
"introduced_by_commit_patches": [],
21+
"fixed_by_commit_patches": []
22+
},
23+
{
24+
"package": {
25+
"type": "ebuild",
26+
"namespace": "dev-vcs",
27+
"name": "subversion",
28+
"version": "",
29+
"qualifiers": "",
30+
"subpath": ""
31+
},
32+
"affected_version_range": "vers:ebuild/<1.9.7",
33+
"fixed_version_range": null,
34+
"introduced_by_commit_patches": [],
35+
"fixed_by_commit_patches": []
36+
},
37+
{
38+
"package": {
39+
"type": "ebuild",
40+
"namespace": "dev-vcs",
41+
"name": "subversion",
42+
"version": "",
43+
"qualifiers": "",
44+
"subpath": ""
45+
},
46+
"affected_version_range": null,
47+
"fixed_version_range": "vers:ebuild/>1.8.18|<1.9",
48+
"introduced_by_commit_patches": [],
49+
"fixed_by_commit_patches": []
50+
},
51+
{
52+
"package": {
53+
"type": "ebuild",
54+
"namespace": "dev-vcs",
55+
"name": "subversion",
56+
"version": "",
57+
"qualifiers": "",
58+
"subpath": ""
59+
},
60+
"affected_version_range": null,
61+
"fixed_version_range": "vers:ebuild/>=1.9.7",
2062
"introduced_by_commit_patches": [],
2163
"fixed_by_commit_patches": []
2264
}

‎vulnerabilities/tests/test_data/gentoo_v2/glsa-202511-02-expected.json‎

Lines changed: 29 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@
4040
"subpath": ""
4141
},
4242
"affected_version_range": "vers:ebuild/<2.48.5",
43-
"fixed_version_range": "vers:ebuild/>=2.48.5",
43+
"fixed_version_range": null,
4444
"introduced_by_commit_patches": [],
4545
"fixed_by_commit_patches": []
4646
},
@@ -54,6 +54,34 @@
5454
"subpath": ""
5555
},
5656
"affected_version_range": "vers:ebuild/<2.48.5",
57+
"fixed_version_range": null,
58+
"introduced_by_commit_patches": [],
59+
"fixed_by_commit_patches": []
60+
},
61+
{
62+
"package": {
63+
"type": "ebuild",
64+
"namespace": "net-libs",
65+
"name": "webkit-gtk",
66+
"version": "",
67+
"qualifiers": "slot=4.1",
68+
"subpath": ""
69+
},
70+
"affected_version_range": null,
71+
"fixed_version_range": "vers:ebuild/>=2.48.5",
72+
"introduced_by_commit_patches": [],
73+
"fixed_by_commit_patches": []
74+
},
75+
{
76+
"package": {
77+
"type": "ebuild",
78+
"namespace": "net-libs",
79+
"name": "webkit-gtk",
80+
"version": "",
81+
"qualifiers": "slot=6",
82+
"subpath": ""
83+
},
84+
"affected_version_range": null,
5785
"fixed_version_range": "vers:ebuild/>=2.48.5",
5886
"introduced_by_commit_patches": [],
5987
"fixed_by_commit_patches": []

‎vulnerabilities/tests/test_data/gentoo_v2/glsa-202512-01-expected.json‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,20 @@
1414
"subpath": ""
1515
},
1616
"affected_version_range": "vers:ebuild/<2.5.14",
17+
"fixed_version_range": null,
18+
"introduced_by_commit_patches": [],
19+
"fixed_by_commit_patches": []
20+
},
21+
{
22+
"package": {
23+
"type": "ebuild",
24+
"namespace": "app-crypt",
25+
"name": "gnupg",
26+
"version": "",
27+
"qualifiers": "",
28+
"subpath": ""
29+
},
30+
"affected_version_range": null,
1731
"fixed_version_range": "vers:ebuild/>=2.5.14",
1832
"introduced_by_commit_patches": [],
1933
"fixed_by_commit_patches": []

0 commit comments

Comments
 (0)