Skip to content

Commit a636144

Browse files
ziadhanyziadhany
committed
Update the model to store commit hash if unsupported
Signed-off-by: ziad hany <ziadhany2016@gmail.com>
1 parent 2b17e77 commit a636144

8 files changed

Lines changed: 154 additions & 219 deletions

File tree

‎vulnerabilities/models.py‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2664,13 +2664,15 @@ class AdvisoryReference(models.Model):
26642664

26652665
ADVISORY = "advisory"
26662666
EXPLOIT = "exploit"
2667+
COMMIT = "commit"
26672668
MAILING_LIST = "mailing_list"
26682669
BUG = "bug"
26692670
OTHER = "other"
26702671

26712672
REFERENCE_TYPES = [
26722673
(ADVISORY, "Advisory"),
26732674
(EXPLOIT, "Exploit"),
2675+
(COMMIT, "Commit"),
26742676
(MAILING_LIST, "Mailing List"),
26752677
(BUG, "Bug"),
26762678
(OTHER, "Other"),

‎vulnerabilities/pipelines/v2_importers/aosp_importer.py‎

Lines changed: 17 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@
1919
from vulnerabilities.importer import AffectedPackageV2
2020
from vulnerabilities.importer import PackageCommitPatchData
2121
from vulnerabilities.importer import PatchData
22+
from vulnerabilities.importer import ReferenceV2
2223
from vulnerabilities.importer import VulnerabilitySeverity
2324
from vulnerabilities.pipelines import VulnerableCodeBaseImporterPipelineV2
2425
from vulnerabilities.pipes.advisory import classify_patch_source
@@ -84,26 +85,28 @@ def collect_advisories(self):
8485

8586
patches = []
8687
affected_packages = []
88+
references = []
8789
for commit_data in vulnerability_data.get("fixes", []):
8890
patch_url = commit_data.get("patchUrl")
8991
commit_id = commit_data.get("commitId")
9092

91-
base_purl, patch_obj_list = classify_patch_source(
92-
vcs_url=None,
93+
base_purl, patch_obj = classify_patch_source(
94+
url=patch_url,
9395
commit_hash=commit_id,
94-
patch_url=patch_url,
9596
patch_text=None,
9697
)
97-
for patch_obj in patch_obj_list:
98-
if isinstance(patch_obj, PackageCommitPatchData):
99-
fixed_commit = patch_obj
100-
affected_package = AffectedPackageV2(
101-
package=base_purl,
102-
fixed_by_commit_patches=[fixed_commit],
103-
)
104-
affected_packages.append(affected_package)
105-
elif isinstance(patch_obj, PatchData):
106-
patches.append(patch_obj)
98+
99+
if isinstance(patch_obj, PackageCommitPatchData):
100+
fixed_commit = patch_obj
101+
affected_package = AffectedPackageV2(
102+
package=base_purl,
103+
fixed_by_commit_patches=[fixed_commit],
104+
)
105+
affected_packages.append(affected_package)
106+
elif isinstance(patch_obj, PatchData):
107+
patches.append(patch_obj)
108+
elif isinstance(patch_obj, ReferenceV2):
109+
references.append(patch_obj)
107110

108111
url = (
109112
"https://raw.githubusercontent.com/quarkslab/aosp_dataset/refs/heads/master/cves/"
@@ -116,6 +119,7 @@ def collect_advisories(self):
116119
affected_packages=affected_packages,
117120
severities=severities,
118121
patches=patches,
122+
references_v2=references,
119123
date_published=date_published,
120124
url=url,
121125
)

‎vulnerabilities/pipes/advisory.py‎

Lines changed: 20 additions & 49 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@
2727
from vulnerabilities.importer import AdvisoryData
2828
from vulnerabilities.importer import PackageCommitPatchData
2929
from vulnerabilities.importer import PatchData
30+
from vulnerabilities.importer import ReferenceV2
3031
from vulnerabilities.improver import MAX_CONFIDENCE
3132
from vulnerabilities.models import Advisory
3233
from vulnerabilities.models import AdvisoryAlias
@@ -174,61 +175,31 @@ def get_or_create_advisory_patches(
174175
VCS_URLS_SUPPORTED_TYPES = {"github", "bitbucket", "gitlab"}
175176

176177

177-
def classify_patch_source(vcs_url, commit_hash, patch_text, patch_url):
178+
def classify_patch_source(url, commit_hash, patch_text):
178179
"""Classify a patch as a PackageCommitPatchData or PatchData using provided args."""
179-
purl = None
180+
if not url:
181+
if not patch_text:
182+
return
180183

181-
if patch_url:
182-
purl = url2purl(patch_url)
184+
return None, PatchData(patch_text=patch_text)
183185

184-
if not purl or (purl.type not in VCS_URLS_SUPPORTED_TYPES) or (not purl.version and vcs_url):
185-
purl = url2purl(vcs_url)
186-
187-
if not purl:
188-
return None, [
189-
PatchData(
190-
patch_text=patch_text,
191-
patch_url=patch_url,
186+
purl = url2purl(url)
187+
if not purl or (purl.type not in VCS_URLS_SUPPORTED_TYPES):
188+
if commit_hash:
189+
return None, ReferenceV2(
190+
reference_id=commit_hash, reference_type=AdvisoryReference.COMMIT, url=url
192191
)
193-
]
192+
return None, PatchData(patch_url=url, patch_text=patch_text)
193+
194+
if not commit_hash and not purl.version:
195+
return None, PatchData(patch_url=url, patch_text=patch_text or None)
194196

195197
base_purl = get_core_purl(purl)
196-
purl_string = base_purl.to_string()
197-
198-
vcs_url_p = purl2url(purl_string)
199-
commit_hash_p = purl.version
200-
201-
final_vcs_url = vcs_url or vcs_url_p
202-
final_commit_hash = commit_hash or commit_hash_p
203-
204-
if (
205-
final_vcs_url
206-
and final_commit_hash
207-
and is_commit(final_commit_hash)
208-
and purl.type in VCS_URLS_SUPPORTED_TYPES
209-
):
210-
purl = PackageURL(
211-
type=purl.type, namespace=purl.namespace, name=purl.name, version=final_commit_hash
212-
)
213-
final_patch_url = patch_url or purl2url(str(purl))
214-
return base_purl, [
215-
PackageCommitPatchData(
216-
vcs_url=final_vcs_url,
217-
commit_hash=final_commit_hash,
218-
patch_text=patch_text,
219-
),
220-
PatchData(
221-
patch_text=patch_text,
222-
patch_url=final_patch_url,
223-
),
224-
]
225-
226-
return None, [
227-
PatchData(
228-
patch_url=patch_url or final_vcs_url,
229-
patch_text=patch_text,
230-
)
231-
]
198+
base_purl_str = base_purl.to_string()
199+
base_url = purl2url(base_purl_str)
200+
return base_purl, PackageCommitPatchData(
201+
vcs_url=base_url, commit_hash=purl.version or commit_hash, patch_text=patch_text or None
202+
)
232203

233204

234205
def insert_advisory(advisory: AdvisoryData, pipeline_id: str, logger: Callable = None):

‎vulnerabilities/tests/test_data/aosp/CVE-aosp_test2-expected.json‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -4,14 +4,14 @@
44
"aliases": [],
55
"summary": "Remote Code Execution Vulnerability",
66
"affected_packages": [],
7-
"references_v2": [],
8-
"patches": [
7+
"references_v2": [
98
{
10-
"patch_url": "https://android.googlesource.com/platform/system/bt/+/6ecbbc093f4383e90cbbf681cd55da1303a8ef94",
11-
"patch_text": null,
12-
"patch_checksum": null
9+
"reference_id": "6ecbbc093f4383e90cbbf681cd55da1303a8ef94",
10+
"reference_type": "commit",
11+
"url": "https://android.googlesource.com/platform/system/bt/+/6ecbbc093f4383e90cbbf681cd55da1303a8ef94"
1312
}
1413
],
14+
"patches": [],
1515
"severities": [
1616
{
1717
"system": "generic_textual",

‎vulnerabilities/tests/test_data/aosp/CVE-aosp_test3-expected.json‎

Lines changed: 1 addition & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -27,13 +27,7 @@
2727
}
2828
],
2929
"references_v2": [],
30-
"patches": [
31-
{
32-
"patch_url": "https://github.com/torvalds/linux/commit/0048b4837affd153897ed1222283492070027aa9",
33-
"patch_text": null,
34-
"patch_checksum": null
35-
}
36-
],
30+
"patches": [],
3731
"severities": [
3832
{
3933
"system": "generic_textual",

‎vulnerabilities/tests/test_data/aosp/CVE-aosp_test4-expected.json‎

Lines changed: 35 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -4,64 +4,64 @@
44
"aliases": [],
55
"summary": "Elevation of Privilege Vulnerability",
66
"affected_packages": [],
7-
"references_v2": [],
8-
"patches": [
7+
"references_v2": [
98
{
10-
"patch_url": "https://android.googlesource.com/kernel/common/+/c22e479e335628ce8766cfbf06e2ba17e8f9a1bb",
11-
"patch_text": null,
12-
"patch_checksum": null
9+
"reference_id": "c22e479e335628ce8766cfbf06e2ba17e8f9a1bb",
10+
"reference_type": "commit",
11+
"url": "https://android.googlesource.com/kernel/common/+/c22e479e335628ce8766cfbf06e2ba17e8f9a1bb"
1312
},
1413
{
15-
"patch_url": "https://android.googlesource.com/kernel/common/+/1b627d4e5e61e89b840f77abb3ca6711ad6ffbeb",
16-
"patch_text": null,
17-
"patch_checksum": null
14+
"reference_id": "1b627d4e5e61e89b840f77abb3ca6711ad6ffbeb",
15+
"reference_type": "commit",
16+
"url": "https://android.googlesource.com/kernel/common/+/1b627d4e5e61e89b840f77abb3ca6711ad6ffbeb"
1817
},
1918
{
20-
"patch_url": "https://android.googlesource.com/kernel/common/+/4c941665c7368a34b146929b31949555e680a4ee",
21-
"patch_text": null,
22-
"patch_checksum": null
19+
"reference_id": "4c941665c7368a34b146929b31949555e680a4ee",
20+
"reference_type": "commit",
21+
"url": "https://android.googlesource.com/kernel/common/+/4c941665c7368a34b146929b31949555e680a4ee"
2322
},
2423
{
25-
"patch_url": "https://android.googlesource.com/kernel/common/+/758f0dac9104b46016af98304656a0268ac3e105",
26-
"patch_text": null,
27-
"patch_checksum": null
24+
"reference_id": "758f0dac9104b46016af98304656a0268ac3e105",
25+
"reference_type": "commit",
26+
"url": "https://android.googlesource.com/kernel/common/+/758f0dac9104b46016af98304656a0268ac3e105"
2827
},
2928
{
30-
"patch_url": "https://android.googlesource.com/kernel/common/+/44d057a37868a60bc2eb6e7d1dcea701f234d56a",
31-
"patch_text": null,
32-
"patch_checksum": null
29+
"reference_id": "44d057a37868a60bc2eb6e7d1dcea701f234d56a",
30+
"reference_type": "commit",
31+
"url": "https://android.googlesource.com/kernel/common/+/44d057a37868a60bc2eb6e7d1dcea701f234d56a"
3332
},
3433
{
35-
"patch_url": "https://android.googlesource.com/kernel/common/+/b9b9f908c8ae82b73b9d75181982028b6bc06c2b",
36-
"patch_text": null,
37-
"patch_checksum": null
34+
"reference_id": "b9b9f908c8ae82b73b9d75181982028b6bc06c2b",
35+
"reference_type": "commit",
36+
"url": "https://android.googlesource.com/kernel/common/+/b9b9f908c8ae82b73b9d75181982028b6bc06c2b"
3837
},
3938
{
40-
"patch_url": "https://android.googlesource.com/kernel/common/+/e068734f9e7344997a61022629b92d142a985ab3",
41-
"patch_text": null,
42-
"patch_checksum": null
39+
"reference_id": "e068734f9e7344997a61022629b92d142a985ab3",
40+
"reference_type": "commit",
41+
"url": "https://android.googlesource.com/kernel/common/+/e068734f9e7344997a61022629b92d142a985ab3"
4342
},
4443
{
45-
"patch_url": "https://android.googlesource.com/kernel/common/+/fdc6c1052bc7d89a5826904fbb4318677e8442ce",
46-
"patch_text": null,
47-
"patch_checksum": null
44+
"reference_id": "fdc6c1052bc7d89a5826904fbb4318677e8442ce",
45+
"reference_type": "commit",
46+
"url": "https://android.googlesource.com/kernel/common/+/fdc6c1052bc7d89a5826904fbb4318677e8442ce"
4847
},
4948
{
50-
"patch_url": "https://android.googlesource.com/kernel/common/+/211d59c0034ec9d88690c750ccd6da27f6952dc5",
51-
"patch_text": null,
52-
"patch_checksum": null
49+
"reference_id": "211d59c0034ec9d88690c750ccd6da27f6952dc5",
50+
"reference_type": "commit",
51+
"url": "https://android.googlesource.com/kernel/common/+/211d59c0034ec9d88690c750ccd6da27f6952dc5"
5352
},
5453
{
55-
"patch_url": "https://android.googlesource.com/kernel/common/+/c9e31d5a4747e9967ace6d05896c78516c4c0850",
56-
"patch_text": null,
57-
"patch_checksum": null
54+
"reference_id": "c9e31d5a4747e9967ace6d05896c78516c4c0850",
55+
"reference_type": "commit",
56+
"url": "https://android.googlesource.com/kernel/common/+/c9e31d5a4747e9967ace6d05896c78516c4c0850"
5857
},
5958
{
60-
"patch_url": "https://android.googlesource.com/kernel/common/+/e01834bfbafd25fd392bf10014451c4e5f34f829",
61-
"patch_text": null,
62-
"patch_checksum": null
59+
"reference_id": "e01834bfbafd25fd392bf10014451c4e5f34f829",
60+
"reference_type": "commit",
61+
"url": "https://android.googlesource.com/kernel/common/+/e01834bfbafd25fd392bf10014451c4e5f34f829"
6362
}
6463
],
64+
"patches": [],
6565
"severities": [
6666
{
6767
"system": "generic_textual",

‎vulnerabilities/tests/test_data/aosp/CVE-aosp_test5-expected.json‎

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -4,13 +4,14 @@
44
"aliases": [],
55
"summary": "Elevation of Privilege Vulnerability",
66
"affected_packages": [],
7-
"references_v2": [],
8-
"patches": [
7+
"references_v2": [
98
{
10-
"patch_url": "https://android.googlesource.com/platform/external/wpa_supplicant_8/+/c66556ca2473620df9751e73eb97ec50a40ffd3e",
11-
"patch_text": null,
12-
"patch_checksum": null
13-
},
9+
"reference_id": "c66556ca2473620df9751e73eb97ec50a40ffd3e",
10+
"reference_type": "commit",
11+
"url": "https://android.googlesource.com/platform/external/wpa_supplicant_8/+/c66556ca2473620df9751e73eb97ec50a40ffd3e"
12+
}
13+
],
14+
"patches": [
1415
{
1516
"patch_url": "https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=776f17c87599fae3202e69bb5718ac9062f14695",
1617
"patch_text": null,

0 commit comments

Comments
 (0)