Add missing severity

Update reference_type in the expected advisory file

Signed-off-by: ziad hany <ziadhany2016@gmail.com>

Author: ziadhany

vulnerabilities/pipelines/v2_importers/aosp_importer.py

@@ -17,7 +17,9 @@
 
 from vulnerabilities.importer import AdvisoryData
 from vulnerabilities.importer import ReferenceV2
+from vulnerabilities.importer import VulnerabilitySeverity
 from vulnerabilities.pipelines import VulnerableCodeBaseImporterPipelineV2
+from vulnerabilities.severity_systems import GENERIC
 
 
 class AospImporterPipeline(VulnerableCodeBaseImporterPipelineV2):
@@ -68,20 +70,34 @@ def collect_advisories(self):
             date_reported = vulnerability_data.get("dateReported")
             date_published = dateparser.parse(date_reported) if date_reported else None
 
+            severities = []
+            severity_value = vulnerability_data.get("severity")
+            if severity_value:
+                severities.append(
+                    VulnerabilitySeverity(
+                        system=GENERIC,
+                        value=severity_value,
+                    )
+                )
+
             references = []
             for commit_data in vulnerability_data.get("fixes", []):
                 vcs_url = commit_data.get("patchUrl")
 
                 if not vcs_url:
                     continue
 
-                ref = ReferenceV2(reference_type="commit", url=vcs_url)
+                ref = ReferenceV2(
+                    reference_type="commit",
+                    url=vcs_url,
+                )
                 references.append(ref)
 
             yield AdvisoryData(
                 advisory_id=vulnerability_id,
                 summary=summary,
                 references_v2=references,
+                severities=severities,
                 date_published=date_published,
                 url=f"https://raw.githubusercontent.com/quarkslab/aosp_dataset/refs/heads/master/cves/{file_path.name}",
             )

vulnerabilities/tests/test_data/aosp/aosp_advisoryv2-expected.json

@@ -7,11 +7,17 @@
     "references_v2": [
       {
         "reference_id": "",
-        "reference_type": "",
+        "reference_type": "commit",
         "url": "https://source.codeaurora.org/quic/la/kernel/msm-5.4/commit/?id=d6876813add62f3cac7c429a41cc8710005d69e8"
       }
     ],
-    "severities": [],
+    "severities": [
+      {
+        "system": "generic_textual",
+        "value": "High",
+        "scoring_elements": ""
+      }
+    ],
     "date_published": null,
     "weaknesses": [],
     "url": "https://raw.githubusercontent.com/quarkslab/aosp_dataset/refs/heads/master/cves/CVE-aosp_test1.json"
@@ -24,11 +30,17 @@
     "references_v2": [
       {
         "reference_id": "",
-        "reference_type": "",
+        "reference_type": "commit",
         "url": "https://android.googlesource.com/platform/system/bt/+/6ecbbc093f4383e90cbbf681cd55da1303a8ef94"
       }
     ],
-    "severities": [],
+    "severities": [
+      {
+        "system": "generic_textual",
+        "value": "Critical",
+        "scoring_elements": ""
+      }
+    ],
     "date_published": "2018-04-04T00:00:00",
     "weaknesses": [],
     "url": "https://raw.githubusercontent.com/quarkslab/aosp_dataset/refs/heads/master/cves/CVE-aosp_test2.json"