Skip to content

Commit aa74065

Browse files
jess-lowejess-lowe
authored
refactor(vulnfeeds): Move BuildVersionRange into common dir for conversion (#4814)
This is going to be used by both NVD and CVEList conversion so makes sense to put it in a common dir.
1 parent 2f4273b commit aa74065

10 files changed

Lines changed: 120 additions & 118 deletions

File tree

‎vulnfeeds/cmd/combine-to-osv/main.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ import (
1515
"strings"
1616

1717
"cloud.google.com/go/storage"
18-
"github.com/google/osv/vulnfeeds/cves"
18+
"github.com/google/osv/vulnfeeds/conversion"
1919
"github.com/google/osv/vulnfeeds/models"
2020
"github.com/google/osv/vulnfeeds/upload"
2121
"github.com/google/osv/vulnfeeds/utility/logger"
@@ -312,7 +312,7 @@ func pickAffectedInformation(cve5Affected []*osvschema.Affected, nvdAffected []*
312312
}
313313

314314
if c5Intro != "" || c5Fixed != "" {
315-
newRange := cves.BuildVersionRange(c5Intro, "", c5Fixed)
315+
newRange := conversion.BuildVersionRange(c5Intro, "", c5Fixed)
316316
newRange.Repo = repo
317317
newRange.Type = osvschema.Range_GIT // Preserve the repo
318318
newAffectedRanges = append(newAffectedRanges, newRange)

‎vulnfeeds/conversion/common.go‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -111,3 +111,28 @@ func WriteMetricsFile(metrics *models.ConversionMetrics, metricsFile *os.File) e
111111

112112
return nil
113113
}
114+
115+
// BuildVersionRange is a helper function that adds 'introduced', 'fixed', or 'last_affected'
116+
// events to an OSV version range. If 'intro' is empty, it defaults to "0".
117+
func BuildVersionRange(intro string, lastAff string, fixed string) *osvschema.Range {
118+
var versionRange osvschema.Range
119+
var i string
120+
if intro == "" {
121+
i = "0"
122+
} else {
123+
i = intro
124+
}
125+
versionRange.Events = append(versionRange.Events, &osvschema.Event{
126+
Introduced: i})
127+
128+
if fixed != "" {
129+
versionRange.Events = append(versionRange.Events, &osvschema.Event{
130+
Fixed: fixed})
131+
} else if lastAff != "" {
132+
versionRange.Events = append(versionRange.Events, &osvschema.Event{
133+
LastAffected: lastAff,
134+
})
135+
}
136+
137+
return &versionRange
138+
}

‎vulnfeeds/conversion/common_test.go‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
package conversion
2+
3+
import (
4+
"testing"
5+
6+
"github.com/google/go-cmp/cmp"
7+
"github.com/ossf/osv-schema/bindings/go/osvschema"
8+
"google.golang.org/protobuf/testing/protocmp"
9+
)
10+
11+
func TestBuildVersionRange(t *testing.T) {
12+
tests := []struct {
13+
name string
14+
intro string
15+
lastAff string
16+
fixed string
17+
want *osvschema.Range
18+
}{
19+
{
20+
name: "intro and fixed",
21+
intro: "1.0.0",
22+
fixed: "1.0.1",
23+
want: &osvschema.Range{
24+
Events: []*osvschema.Event{
25+
{Introduced: "1.0.0"},
26+
{Fixed: "1.0.1"},
27+
},
28+
},
29+
},
30+
{
31+
name: "intro and last_affected",
32+
intro: "1.0.0",
33+
lastAff: "1.0.0",
34+
want: &osvschema.Range{
35+
Events: []*osvschema.Event{
36+
{Introduced: "1.0.0"},
37+
{LastAffected: "1.0.0"},
38+
},
39+
},
40+
},
41+
{
42+
name: "only intro",
43+
intro: "1.0.0",
44+
want: &osvschema.Range{
45+
Events: []*osvschema.Event{
46+
{Introduced: "1.0.0"},
47+
},
48+
},
49+
},
50+
{
51+
name: "empty intro",
52+
want: &osvschema.Range{
53+
Events: []*osvschema.Event{
54+
{Introduced: "0"},
55+
},
56+
},
57+
},
58+
}
59+
60+
for _, tt := range tests {
61+
t.Run(tt.name, func(t *testing.T) {
62+
got := BuildVersionRange(tt.intro, tt.lastAff, tt.fixed)
63+
if diff := cmp.Diff(tt.want, got, protocmp.Transform()); diff != "" {
64+
t.Errorf("BuildVersionRange() mismatch (-want +got):\n%s", diff)
65+
}
66+
})
67+
}
68+
}

‎vulnfeeds/cvelist2osv/common.go‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ import (
77
"strconv"
88
"strings"
99

10-
"github.com/google/osv/vulnfeeds/cves"
10+
"github.com/google/osv/vulnfeeds/conversion"
1111
"github.com/google/osv/vulnfeeds/git"
1212
"github.com/google/osv/vulnfeeds/models"
1313
"github.com/google/osv/vulnfeeds/utility"
@@ -120,9 +120,9 @@ func gitVersionsToCommits(cveID models.CVEID, versionRanges []*osvschema.Range,
120120
var newVR *osvschema.Range
121121

122122
if fixedCommit != "" {
123-
newVR = cves.BuildVersionRange(introducedCommit, "", fixedCommit)
123+
newVR = conversion.BuildVersionRange(introducedCommit, "", fixedCommit)
124124
} else {
125-
newVR = cves.BuildVersionRange(introducedCommit, lastAffectedCommit, "")
125+
newVR = conversion.BuildVersionRange(introducedCommit, lastAffectedCommit, "")
126126
}
127127

128128
newVR.Repo = repo
@@ -187,9 +187,9 @@ func findCPEVersionRanges(cve models.CVE5) (versionRanges []*osvschema.Range, cp
187187
}
188188

189189
if match.VersionEndExcluding != "" {
190-
versionRanges = append(versionRanges, cves.BuildVersionRange(match.VersionStartIncluding, "", match.VersionEndExcluding))
190+
versionRanges = append(versionRanges, conversion.BuildVersionRange(match.VersionStartIncluding, "", match.VersionEndExcluding))
191191
} else if match.VersionEndIncluding != "" {
192-
versionRanges = append(versionRanges, cves.BuildVersionRange(match.VersionStartIncluding, match.VersionEndIncluding, ""))
192+
versionRanges = append(versionRanges, conversion.BuildVersionRange(match.VersionStartIncluding, match.VersionEndIncluding, ""))
193193
}
194194
}
195195
}

‎vulnfeeds/cvelist2osv/default_extractor.go‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -100,10 +100,10 @@ func (d *DefaultVersionExtractor) FindNormalAffectedRanges(affected models.Affec
100100
continue
101101
}
102102
if av.Fixed != "" {
103-
versionRanges = append(versionRanges, cves.BuildVersionRange(av.Introduced, "", av.Fixed))
103+
versionRanges = append(versionRanges, conversion.BuildVersionRange(av.Introduced, "", av.Fixed))
104104
continue
105105
} else if av.LastAffected != "" {
106-
versionRanges = append(versionRanges, cves.BuildVersionRange(av.Introduced, av.LastAffected, ""))
106+
versionRanges = append(versionRanges, conversion.BuildVersionRange(av.Introduced, av.LastAffected, ""))
107107
continue
108108
}
109109
}
@@ -118,7 +118,7 @@ func (d *DefaultVersionExtractor) FindNormalAffectedRanges(affected models.Affec
118118

119119
// As a fallback, assume a single version means it's the last affected version.
120120
if vulns.CheckQuality(vers.Version).AtLeast(acceptableQuality) {
121-
versionRanges = append(versionRanges, cves.BuildVersionRange("0", vers.Version, ""))
121+
versionRanges = append(versionRanges, conversion.BuildVersionRange("0", vers.Version, ""))
122122
metrics.AddNote("Single version found %v - Assuming introduced = 0 and last affected = %v", vers.Version, vers.Version)
123123
}
124124
}

‎vulnfeeds/cvelist2osv/linux_extractor.go‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,6 @@ import (
77
"strings"
88

99
"github.com/google/osv/vulnfeeds/conversion"
10-
"github.com/google/osv/vulnfeeds/cves"
1110
"github.com/google/osv/vulnfeeds/models"
1211
"github.com/google/osv/vulnfeeds/vulns"
1312
"github.com/ossf/osv-schema/bindings/go/osvconstants"
@@ -137,7 +136,7 @@ func findInverseAffectedRanges(cveAff models.Affected, metrics *models.Conversio
137136
// Create ranges by pairing sorted introduced and fixed versions.
138137
for index, f := range fixed {
139138
if index < len(introduced) {
140-
ranges = append(ranges, cves.BuildVersionRange(introduced[index], "", f))
139+
ranges = append(ranges, conversion.BuildVersionRange(introduced[index], "", f))
141140
metrics.AddNote("Introduced from version value - %s", introduced[index])
142141
metrics.AddNote("Fixed from version value - %s", f)
143142
}
@@ -166,13 +165,13 @@ func (l *LinuxVersionExtractor) FindNormalAffectedRanges(affected models.Affecte
166165
metrics.AddNote("Only version exists")
167166

168167
if currentVersionType == VersionRangeTypeGit {
169-
versionRanges = append(versionRanges, cves.BuildVersionRange(vers.Version, "", ""))
168+
versionRanges = append(versionRanges, conversion.BuildVersionRange(vers.Version, "", ""))
170169
continue
171170
}
172171

173172
// As a fallback, assume a single version means it's the last affected version.
174173
if vulns.CheckQuality(vers.Version).AtLeast(acceptableQuality) {
175-
versionRanges = append(versionRanges, cves.BuildVersionRange("0", vers.Version, ""))
174+
versionRanges = append(versionRanges, conversion.BuildVersionRange("0", vers.Version, ""))
176175
metrics.AddNote("Single version found %v - Assuming introduced = 0 and last affected = %v", vers.Version, vers.Version)
177176
}
178177
}

‎vulnfeeds/cvelist2osv/strategies.go‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
package cvelist2osv
22

33
import (
4+
"github.com/google/osv/vulnfeeds/conversion"
45
"github.com/google/osv/vulnfeeds/cves"
56
"github.com/google/osv/vulnfeeds/models"
67
"github.com/google/osv/vulnfeeds/vulns"
@@ -75,9 +76,9 @@ func initialNormalExtraction(vers models.Versions, metrics *models.ConversionMet
7576
}
7677
var versionRanges []*osvschema.Range
7778
if fixed != "" {
78-
versionRanges = append(versionRanges, cves.BuildVersionRange(introduced, "", fixed))
79+
versionRanges = append(versionRanges, conversion.BuildVersionRange(introduced, "", fixed))
7980
} else if lastaffected != "" {
80-
versionRanges = append(versionRanges, cves.BuildVersionRange(introduced, lastaffected, ""))
81+
versionRanges = append(versionRanges, conversion.BuildVersionRange(introduced, lastaffected, ""))
8182
}
8283

8384
return versionRanges, currentVersionType, true

‎vulnfeeds/cvelist2osv/version_extraction_test.go‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ import (
66
"testing"
77

88
"github.com/google/go-cmp/cmp"
9-
"github.com/google/osv/vulnfeeds/cves"
9+
"github.com/google/osv/vulnfeeds/conversion"
1010
"github.com/google/osv/vulnfeeds/models"
1111
"github.com/google/osv/vulnfeeds/vulns"
1212
"github.com/ossf/osv-schema/bindings/go/osvschema"
@@ -58,7 +58,7 @@ func TestFindNormalAffectedRanges(t *testing.T) {
5858
},
5959
},
6060
wantRanges: []*osvschema.Range{
61-
cves.BuildVersionRange("1.0", "", "1.5"),
61+
conversion.BuildVersionRange("1.0", "", "1.5"),
6262
},
6363
wantRangeType: VersionRangeTypeSemver,
6464
},
@@ -74,7 +74,7 @@ func TestFindNormalAffectedRanges(t *testing.T) {
7474
},
7575
},
7676
wantRanges: []*osvschema.Range{
77-
cves.BuildVersionRange("0", "2.0", ""),
77+
conversion.BuildVersionRange("0", "2.0", ""),
7878
},
7979
wantRangeType: VersionRangeTypeSemver,
8080
},
@@ -89,7 +89,7 @@ func TestFindNormalAffectedRanges(t *testing.T) {
8989
},
9090
},
9191
wantRanges: []*osvschema.Range{
92-
cves.BuildVersionRange("2.0", "", "2.5"),
92+
conversion.BuildVersionRange("2.0", "", "2.5"),
9393
},
9494
wantRangeType: VersionRangeTypeEcosystem,
9595
},
@@ -105,7 +105,7 @@ func TestFindNormalAffectedRanges(t *testing.T) {
105105
},
106106
},
107107
wantRanges: []*osvschema.Range{
108-
cves.BuildVersionRange("", "deadbeef", ""),
108+
conversion.BuildVersionRange("", "deadbeef", ""),
109109
},
110110
wantRangeType: VersionRangeTypeGit,
111111
},
@@ -175,7 +175,7 @@ func TestFindInverseAffectedRanges(t *testing.T) {
175175
versionType: VersionRangeTypeSemver,
176176
cnaAssigner: "Linux",
177177
want: []*osvschema.Range{
178-
cves.BuildVersionRange("5.0.0", "", "5.10.1"),
178+
conversion.BuildVersionRange("5.0.0", "", "5.10.1"),
179179
},
180180
},
181181
{
@@ -214,7 +214,7 @@ func TestFindInverseAffectedRanges(t *testing.T) {
214214
versionType: VersionRangeTypeSemver,
215215
cnaAssigner: "Linux",
216216
want: []*osvschema.Range{
217-
cves.BuildVersionRange("4.0.0", "", "4.5.2"),
217+
conversion.BuildVersionRange("4.0.0", "", "4.5.2"),
218218
},
219219
},
220220
}

‎vulnfeeds/cves/versions.go‎

Lines changed: 0 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,6 @@ import (
2929
"time"
3030

3131
"github.com/knqyf263/go-cpe/naming"
32-
"github.com/ossf/osv-schema/bindings/go/osvschema"
3332
"github.com/sethvargo/go-retry"
3433

3534
"github.com/google/osv/vulnfeeds/git"
@@ -1139,10 +1138,6 @@ func ReposFromReferences(cache *VPRepoCache, vp *VendorProduct, refs []models.Re
11391138
if len(repos) == 0 {
11401139
return repos
11411140
}
1142-
if vp != nil {
1143-
metrics.AddNote("Derived repos using references %q for %q %q", repos, vp.Vendor, vp.Product)
1144-
}
1145-
metrics.AddNote("Derived repos (no CPEs) using references: %q", repos)
11461141

11471142
return repos
11481143
}
@@ -1179,28 +1174,3 @@ func ReposFromReferencesCVEList(refs []models.Reference, tagDenyList []string, m
11791174

11801175
return repos
11811176
}
1182-
1183-
// BuildVersionRange is a helper function that adds 'introduced', 'fixed', or 'last_affected'
1184-
// events to an OSV version range. If 'intro' is empty, it defaults to "0".
1185-
func BuildVersionRange(intro string, lastAff string, fixed string) *osvschema.Range {
1186-
var versionRange osvschema.Range
1187-
var i string
1188-
if intro == "" {
1189-
i = "0"
1190-
} else {
1191-
i = intro
1192-
}
1193-
versionRange.Events = append(versionRange.Events, &osvschema.Event{
1194-
Introduced: i})
1195-
1196-
if fixed != "" {
1197-
versionRange.Events = append(versionRange.Events, &osvschema.Event{
1198-
Fixed: fixed})
1199-
} else if lastAff != "" {
1200-
versionRange.Events = append(versionRange.Events, &osvschema.Event{
1201-
LastAffected: lastAff,
1202-
})
1203-
}
1204-
1205-
return &versionRange
1206-
}

0 commit comments

Comments
 (0)