Skip to content

Commit 03d9309

Browse files
johnmhoranTG1999
johnmhoran
authored and
TG1999
committed
Update postgresql.py and test file, clean up code and comments #969
Reference: #969 Signed-off-by: John M. Horan <[email protected]>
1 parent e81c3c1 commit 03d9309

File tree

5 files changed

+205
-216
lines changed

5 files changed

+205
-216
lines changed

‎vulnerabilities/importers/__init__.py‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@
1616
from vulnerabilities.importers import nginx
1717
from vulnerabilities.importers import nvd
1818
from vulnerabilities.importers import openssl
19+
from vulnerabilities.importers import postgresql
1920
from vulnerabilities.importers import pypa
2021
from vulnerabilities.importers import pysec
2122
from vulnerabilities.importers import redhat
@@ -31,6 +32,7 @@
3132
pysec.PyPIImporter,
3233
debian.DebianImporter,
3334
gitlab.GitLabAPIImporter,
35+
postgresql.PostgreSQLImporter,
3436
pypa.PyPaImporter,
3537
archlinux.ArchlinuxImporter,
3638
ubuntu.UbuntuImporter,

‎vulnerabilities/importers/postgresql.py‎

Lines changed: 23 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -22,39 +22,30 @@
2222
from vulnerabilities.importer import Reference
2323
from vulnerabilities.importer import VulnerabilitySeverity
2424

25-
# we no longer use nearest_patched_package, do we?
26-
from vulnerabilities.utils import nearest_patched_package
27-
2825

2926
class PostgreSQLImporter(Importer):
3027

3128
root_url = "https://www.postgresql.org/support/security/"
32-
# need license_url; 'mit' below is just a placeholder value -- need to determine actual license
33-
spdx_license_expression = "mit"
29+
license_url = "https://www.postgresql.org/about/licence/"
30+
spdx_license_expression = "PostgreSQL"
3431

3532
def advisory_data(self):
36-
# Not used but we added during huddle?
37-
# urls = []
38-
# No longer used
39-
# advisories = []
4033
known_urls = {self.root_url}
4134
visited_urls = set()
35+
data_by_url = {}
4236
while True:
4337
unvisited_urls = known_urls - visited_urls
4438
for url in unvisited_urls:
4539
data = requests.get(url).content
40+
data_by_url[url] = data
4641
visited_urls.add(url)
4742
known_urls.update(find_advisory_urls(data))
4843

49-
# Could these 2 lines be replaced with `known_urls != visited_urls`?
5044
if known_urls == visited_urls:
5145
break
5246

53-
# What is batch_advisories()? Old code?
54-
# return self.batch_advisories(advisories)
55-
56-
for url in visited_urls:
57-
data = requests.get(url).content
47+
# JMH: why did we replace "for url in visited_urls:"?
48+
for url, data in data_by_url.items():
5849
yield from to_advisories(data)
5950

6051

@@ -79,9 +70,8 @@ def to_advisories(data):
7970
AffectedPackage(
8071
package=PackageURL(
8172
name="postgresql",
73+
# TODO: See https://github.com/nexB/vulnerablecode/issues/990
8274
type="generic",
83-
# TODO: Discuss namespace issue for postgresql
84-
namespace="postgresql",
8575
qualifiers=pkg_qualifiers,
8676
),
8777
affected_version_range=GenericVersionRange.from_versions(
@@ -97,20 +87,21 @@ def to_advisories(data):
9787
AffectedPackage(
9888
package=PackageURL(
9989
name="postgresql",
90+
# TODO: See https://github.com/nexB/vulnerablecode/issues/990
10091
type="generic",
101-
# TODO: Discuss namespace issue for postgresql
102-
namespace="postgresql",
10392
qualifiers=pkg_qualifiers,
10493
),
10594
affected_version_range=GenericVersionRange.from_versions(affected_version_list),
10695
)
10796
)
108-
97+
cve_id = ""
10998
try:
99+
# in the prior code, this is the only place where cve_id was defined, and presumably
100+
# there was no error like the error we got:
101+
# UnboundLocalError: local variable 'cve_id' referenced before assignment
110102
cve_id = ref_col.select("nobr")[0].text
111103
# This is for the anomaly in https://www.postgresql.org/support/security/8.1/ 's
112104
# last entry
113-
# Note: in this example and others, final entry/entries have no CVE in the 1st column
114105
except IndexError:
115106
pass
116107

@@ -134,19 +125,18 @@ def to_advisories(data):
134125
)
135126
severities.append(severity)
136127
references.append(Reference(url=link, severities=severities))
137-
138-
advisories.append(
139-
AdvisoryData(
140-
aliases=[cve_id],
141-
summary=summary,
142-
references=references,
143-
affected_packages=affected_packages,
128+
if cve_id:
129+
advisories.append(
130+
AdvisoryData(
131+
# we defined cve_id and added the if... because we got this error:
132+
# UnboundLocalError: local variable 'cve_id' referenced before assignment
133+
# but JMH is not sure what caused the error or whether this is a legit fix
134+
aliases=[cve_id],
135+
summary=summary,
136+
references=references,
137+
affected_packages=affected_packages,
138+
)
144139
)
145-
)
146-
147-
# Keep temporarily for reference
148-
print("\ntotal test_advisories (i.e., AdvisoryData objects) = {}".format(len(advisories)))
149-
print("\nadvisories = {}".format(advisories))
150140

151141
return advisories
152142

‎vulnerabilities/tests/conftest.py‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,6 @@ def no_rmtree(monkeypatch):
3737
"test_msr2019.py",
3838
"test_npm.py",
3939
"test_package_managers.py",
40-
"test_postgresql.py",
4140
"test_retiredotnet.py",
4241
"test_ruby.py",
4342
"test_rust.py",

‎vulnerabilities/tests/test_data/postgresql/parse-advisory-postgresql-expected.json‎

Lines changed: 170 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,170 @@
1+
[
2+
{
3+
"aliases": [
4+
"CVE-2020-10733"
5+
],
6+
"summary": "Windows installer runs executables from uncontrolled directoriesmore details",
7+
"affected_packages": [
8+
{
9+
"package": {
10+
"type": "generic",
11+
"namespace": null,
12+
"name": "postgresql",
13+
"version": null,
14+
"qualifiers": {
15+
"os": "windows"
16+
},
17+
"subpath": null
18+
},
19+
"affected_version_range": "vers:generic/9.6.0|10.0.0|11.0.0|12.0.0",
20+
"fixed_version": "12.3"
21+
},
22+
{
23+
"package": {
24+
"type": "generic",
25+
"namespace": null,
26+
"name": "postgresql",
27+
"version": null,
28+
"qualifiers": {
29+
"os": "windows"
30+
},
31+
"subpath": null
32+
},
33+
"affected_version_range": "vers:generic/9.6.0|10.0.0|11.0.0|12.0.0",
34+
"fixed_version": "11.8"
35+
},
36+
{
37+
"package": {
38+
"type": "generic",
39+
"namespace": null,
40+
"name": "postgresql",
41+
"version": null,
42+
"qualifiers": {
43+
"os": "windows"
44+
},
45+
"subpath": null
46+
},
47+
"affected_version_range": "vers:generic/9.6.0|10.0.0|11.0.0|12.0.0",
48+
"fixed_version": "10.13"
49+
},
50+
{
51+
"package": {
52+
"type": "generic",
53+
"namespace": null,
54+
"name": "postgresql",
55+
"version": null,
56+
"qualifiers": {
57+
"os": "windows"
58+
},
59+
"subpath": null
60+
},
61+
"affected_version_range": "vers:generic/9.6.0|10.0.0|11.0.0|12.0.0",
62+
"fixed_version": "9.6.18"
63+
}
64+
],
65+
"references": [
66+
{
67+
"reference_id": "",
68+
"url": "https://www.postgresql.org/support/security/CVE-2020-10733/",
69+
"severities": [
70+
{
71+
"system": "cvssv3",
72+
"value": "6.7"
73+
},
74+
{
75+
"system": "cvssv3_vector",
76+
"value": [
77+
"AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H"
78+
]
79+
}
80+
]
81+
},
82+
{
83+
"reference_id": "",
84+
"url": "https://www.postgresql.org/about/news/postgresql-123-118-1013-9618-and-9522-released-2038/",
85+
"severities": []
86+
}
87+
],
88+
"date_published": null
89+
},
90+
{
91+
"aliases": [
92+
"CVE-2020-1720"
93+
],
94+
"summary": "ALTER ... DEPENDS ON EXTENSION is missing authorization checks.more details",
95+
"affected_packages": [
96+
{
97+
"package": {
98+
"type": "generic",
99+
"namespace": null,
100+
"name": "postgresql",
101+
"version": null,
102+
"qualifiers": null,
103+
"subpath": null
104+
},
105+
"affected_version_range": "vers:generic/9.6.0|10.0.0|11.0.0|12.0.0",
106+
"fixed_version": "12.2"
107+
},
108+
{
109+
"package": {
110+
"type": "generic",
111+
"namespace": null,
112+
"name": "postgresql",
113+
"version": null,
114+
"qualifiers": null,
115+
"subpath": null
116+
},
117+
"affected_version_range": "vers:generic/9.6.0|10.0.0|11.0.0|12.0.0",
118+
"fixed_version": "11.7"
119+
},
120+
{
121+
"package": {
122+
"type": "generic",
123+
"namespace": null,
124+
"name": "postgresql",
125+
"version": null,
126+
"qualifiers": null,
127+
"subpath": null
128+
},
129+
"affected_version_range": "vers:generic/9.6.0|10.0.0|11.0.0|12.0.0",
130+
"fixed_version": "10.12"
131+
},
132+
{
133+
"package": {
134+
"type": "generic",
135+
"namespace": null,
136+
"name": "postgresql",
137+
"version": null,
138+
"qualifiers": null,
139+
"subpath": null
140+
},
141+
"affected_version_range": "vers:generic/9.6.0|10.0.0|11.0.0|12.0.0",
142+
"fixed_version": "9.6.17"
143+
}
144+
],
145+
"references": [
146+
{
147+
"reference_id": "",
148+
"url": "https://www.postgresql.org/support/security/CVE-2020-1720/",
149+
"severities": [
150+
{
151+
"system": "cvssv3",
152+
"value": "3.1"
153+
},
154+
{
155+
"system": "cvssv3_vector",
156+
"value": [
157+
"AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"
158+
]
159+
}
160+
]
161+
},
162+
{
163+
"reference_id": "",
164+
"url": "https://www.postgresql.org/about/news/postgresql-122-117-1012-9617-9521-and-9426-released-2011/",
165+
"severities": []
166+
}
167+
],
168+
"date_published": null
169+
}
170+
]

0 commit comments

Comments
 (0)