Skip to content

Commit 05be92c

Browse files
johnmhoranTG1999
johnmhoran
authored and
TG1999
committed
Update postgresql.py, clean up code #969
Reference: #969 Signed-off-by: John M. Horan <[email protected]>
1 parent 4da46d3 commit 05be92c

File tree

1 file changed

+41
-115
lines changed

1 file changed

+41
-115
lines changed

‎vulnerabilities/importers/postgresql.py‎

Lines changed: 41 additions & 115 deletions
Original file line numberDiff line numberDiff line change
@@ -13,13 +13,11 @@
1313
from bs4 import BeautifulSoup
1414
from packageurl import PackageURL
1515

16-
# is there a univers versionrange? a version?
1716
from univers.version_range import GenericVersionRange
1817
from univers.versions import GenericVersion
1918

2019
from vulnerabilities import severity_systems
2120

22-
# add AffectedPackage
2321
from vulnerabilities.importer import AdvisoryData
2422
from vulnerabilities.importer import AffectedPackage
2523
from vulnerabilities.importer import Importer
@@ -33,117 +31,77 @@
3331
class PostgreSQLImporter(Importer):
3432

3533
root_url = "https://www.postgresql.org/support/security/"
36-
# need spdx_license_expression and license_url
37-
38-
def updated_advisories(self):
39-
advisories = []
34+
# need license_url; 'mit' below is just a placeholder value -- need to determine actual license
35+
spdx_license_expression = 'mit'
36+
def advisory_data(self):
37+
# Not used but we added during huddle?
38+
# urls = []
39+
# No longer used
40+
# advisories = []
4041
known_urls = {self.root_url}
4142
visited_urls = set()
4243
while True:
4344
unvisited_urls = known_urls - visited_urls
4445
for url in unvisited_urls:
4546
data = requests.get(url).content
46-
advisories.extend(to_advisories(data))
4747
visited_urls.add(url)
4848
known_urls.update(find_advisory_urls(data))
4949

50+
# Could these 2 lines be replaced with `known_urls != visited_urls`?
5051
if known_urls == visited_urls:
5152
break
5253

53-
return self.batch_advisories(advisories)
54+
# What is batch_advisories()? Old code?
55+
# return self.batch_advisories(advisories)
56+
57+
for url in visited_urls:
58+
data = requests.get(url).content
59+
yield from to_advisories(data)
5460

5561

5662
def to_advisories(data):
57-
print("\n\n>> This is a test.")
58-
print("\n=====")
5963
advisories = []
6064
soup = BeautifulSoup(data, features="lxml")
6165
table = soup.select("table")[0]
62-
test_row_count = 0
6366
for row in table.select("tbody tr"):
64-
test_row_count += 1
65-
print("\ntest_row_count = {}".format(test_row_count))
6667
ref_col, affected_col, fixed_col, severity_score_col, desc_col = row.select("td")
6768
summary = desc_col.text
6869
pkg_qualifiers = {}
6970
if "windows" in summary.lower():
7071
pkg_qualifiers = {"os": "windows"}
7172

72-
# affected_packages = [
73-
# PackageURL(
74-
# type="generic",
75-
# name="postgresql",
76-
# version=version.strip(),
77-
# qualifiers=pkg_qualifiers,
78-
# )
79-
# for version in affected_col.text.split(",")
80-
# ]
81-
82-
# fixed_packages = [
83-
# PackageURL(
84-
# type="generic",
85-
# name="postgresql",
86-
# version=version.strip(),
87-
# qualifiers=pkg_qualifiers,
88-
# )
89-
# for version in fixed_col.text.split(",")
90-
# # why the "if version" here but not in affected_packages?
91-
# # aren't we assuming (can we assume?) there are an equal number of versions in affect_packages and fixed_packages?
92-
# if version
93-
# ]
94-
95-
# This will replace the affected_packages and fixed_packages lists above. ============
9673
affected_packages = []
97-
# do I need to trim these? e.g., affected_version_list = [x.strip() for x in affected_col.text.split(',')]
9874
affected_version_list = affected_col.text.split(",")
9975
fixed_version_list = fixed_col.text.split(",")
100-
package_count = len(affected_version_list)
101-
102-
print("\naffected_version_list = {}".format(affected_version_list))
103-
print("\nfixed_version_list = {}".format(fixed_version_list))
104-
print("\npackage_count = {}".format(package_count))
105-
106-
while package_count > 0:
107-
summary = summary
108-
109-
affected = affected_version_list[0]
110-
affected_version_list.pop(0)
111-
# Do we need "if affected else None"?
112-
affected_version_range = (
113-
GenericVersionRange.from_versions([affected]) if affected else None
114-
)
115-
116-
fixed = fixed_version_list[0]
117-
fixed_version_list.pop(0)
118-
# Do we need "if fixed else None"?
119-
fixed_version = GenericVersion(fixed) if fixed else None
120-
121-
package_count -= 1
122-
123-
affected_package = AffectedPackage(
124-
package=PackageURL(
125-
name="postgresql",
126-
type="generic",
127-
namespace="postgresql",
128-
qualifiers=pkg_qualifiers,
129-
),
130-
affected_version_range=affected_version_range,
131-
fixed_version=fixed_version,
132-
)
133-
affected_packages.append(affected_package)
13476

135-
print("\naffected_package = {}".format(affected_package))
136-
print("\n\taffected_package.package = {}".format(affected_package.package))
137-
print(
138-
"\n\taffected_package.affected_version_range = {}".format(
139-
affected_package.affected_version_range
77+
if fixed_version_list:
78+
for fixed_version in fixed_version_list:
79+
affected_packages.append(
80+
AffectedPackage(
81+
package=PackageURL(
82+
name="postgresql",
83+
type="generic",
84+
# TODO: Discuss namespace issue for postgresql
85+
namespace="postgresql",
86+
qualifiers=pkg_qualifiers,
87+
),
88+
affected_version_range=GenericVersionRange.from_versions(affected_version_list) if affected_version_list else None,
89+
fixed_version=GenericVersion(fixed_version) if fixed_version else None
90+
)
91+
)
92+
elif affected_version_list:
93+
affected_packages.append(
94+
AffectedPackage(
95+
package=PackageURL(
96+
name="postgresql",
97+
type="generic",
98+
# TODO: Discuss namespace issue for postgresql
99+
namespace="postgresql",
100+
qualifiers=pkg_qualifiers,
101+
),
102+
affected_version_range=GenericVersionRange.from_versions(affected_version_list),
140103
)
141104
)
142-
print("\n\taffected_package.fixed_version = {}".format(affected_package.fixed_version))
143-
144-
print("\ninterim package_count = {}".format(package_count))
145-
146-
# end of initial draft insert ===================================
147105

148106
try:
149107
cve_id = ref_col.select("nobr")[0].text
@@ -176,49 +134,17 @@ def to_advisories(data):
176134

177135
advisories.append(
178136
AdvisoryData(
179-
# 10/26/2022 Wednesday 6:40:01 PM. Throws error (terminal points to test data): TypeError: __init__() got an unexpected keyword argument 'vulnerability_id'
180-
# vulnerability_id=cve_id,
181137
aliases=[cve_id],
182138
summary=summary,
183139
references=references,
184-
# affected_packages=nearest_patched_package(affected_packages, fixed_packages),
185140
affected_packages=affected_packages,
186141
)
187142
)
188143

189-
print("\n------------------------------------")
190-
144+
# Keep temporarily for reference
191145
print("\ntotal test_advisories (i.e., AdvisoryData objects) = {}".format(len(advisories)))
192146
print("\nadvisories = {}".format(advisories))
193147

194-
test_advisory_count = 0
195-
for test_advisory in advisories:
196-
test_advisory_count += 1
197-
print("\ntest_advisory #{} = {}".format(test_advisory_count, test_advisory))
198-
print("\n\ttest_advisory.aliases = {}".format(test_advisory.aliases))
199-
print("\n\ttest_advisory.summary = {}".format(test_advisory.summary))
200-
print("\n\ttest_advisory.affected_packages = {}".format(test_advisory.affected_packages))
201-
for test_affected_package in test_advisory.affected_packages:
202-
print("\n\ttest_affected_package = {}".format(test_affected_package))
203-
print("\n\t\ttest_affected_package.package = {}".format(test_affected_package.package))
204-
print(
205-
"\n\t\ttest_affected_package.affected_version_range = {}".format(
206-
test_affected_package.affected_version_range
207-
)
208-
)
209-
print(
210-
"\n\t\ttest_affected_package.fixed_version = {}".format(
211-
test_affected_package.fixed_version
212-
)
213-
)
214-
print("\n\ttest_advisory.references = {}".format(test_advisory.references))
215-
for test_reference in test_advisory.references:
216-
print("\n\ttest_test_reference = {}".format(test_reference))
217-
218-
print("\n------------------------------------")
219-
220-
print("\n>> This is the end of the test.\n")
221-
222148
return advisories
223149

224150

0 commit comments

Comments
 (0)