Skip to content

Commit 2776cb2

Browse files
johnmhoranjohnmhoran
committed
Address PR comments including simplifying code #972
Reference: #972 Signed-off-by: John M. Horan <[email protected]>
1 parent 6b2cd15 commit 2776cb2

File tree

3 files changed

+84
-248
lines changed

3 files changed

+84
-248
lines changed

‎vulnerabilities/importers/apache_kafka.py‎

Lines changed: 36 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -8,12 +8,11 @@
88
#
99

1010

11+
import pytz
1112
import requests
1213
from bs4 import BeautifulSoup
14+
from dateutil.parser import parse
1315
from packageurl import PackageURL
14-
from univers.version_constraint import VersionConstraint
15-
from univers.version_range import MavenVersionRange
16-
from univers.versions import MavenVersion
1716

1817
from vulnerabilities.importer import AdvisoryData
1918
from vulnerabilities.importer import AffectedPackage
@@ -28,6 +27,7 @@
2827
"2.8.0 - 2.8.1, 3.0.0 - 3.0.1, 3.1.0 - 3.1.1, 3.2.0 - 3.2.1": "affected",
2928
"2.8.2, 3.0.2, 3.1.2, 3.2.3": "fixed",
3029
"affected_version_range": "vers:apache/>=2.8.0|<=2.8.1|!=2.8.2|>=3.0.0|<=3.0.1|!=3.0.2|>=3.1.0|<=3.1.1|!=3.1.2|>=3.2.0|<=3.2.1|!=3.2.3",
30+
"Issue announced": "19 Sep 2022",
3131
},
3232
"CVE-2022-23302": {
3333
"action": "omit",
@@ -52,30 +52,35 @@
5252
"2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, 2.2.2, 2.3.0, 2.3.1, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.6.0, 2.6.1, 2.6.2, 2.7.0, 2.7.1, 2.8.0.": "affected",
5353
"2.6.3, 2.7.2, 2.8.1, 3.0.0 and later": "fixed",
5454
"affected_version_range": "vers:apache/2.0.0|2.0.1|2.1.0|2.1.1|2.2.0|2.2.1|2.2.2|2.3.0|2.3.1|2.4.0|2.4.1|2.5.0|2.5.1|2.6.0|2.6.1|2.6.2|!=2.6.3|2.7.0|2.7.1|!=2.7.2|2.8.0.|!=2.8.1|<3.0.0",
55+
"Issue announced": "21 Sep 2021",
5556
},
5657
"CVE-2019-12399": {
5758
"action": "include",
5859
"2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, 2.3.0": "affected",
5960
"2.2.2, 2.3.1 and later": "fixed",
6061
"affected_version_range": "vers:apache/2.0.0|2.0.1|2.1.0|2.1.1|2.2.0|2.2.1|!=2.2.2|2.3.0|<2.3.1",
62+
"Issue announced": "13 Jan 2020",
6163
},
6264
"CVE-2018-17196": {
6365
"action": "include",
6466
"0.11.0.0 to 2.1.0": "affected",
6567
"2.1.1 and later": "fixed",
6668
"affected_version_range": "vers:apache/>=0.11.0.0|<2.1.1",
69+
"Issue announced": "10 July 2019",
6770
},
6871
"CVE-2018-1288": {
6972
"action": "include",
7073
"0.9.0.0 to 0.9.0.1, 0.10.0.0 to 0.10.2.1, 0.11.0.0 to 0.11.0.2, 1.0.0": "affected",
7174
"0.10.2.2, 0.11.0.3, 1.0.1, 1.1.0": "fixed",
7275
"affected_version_range": "vers:apache/>=0.9.0.0|<=0.9.0.1|>=0.10.0.0|<=0.10.2.1|!=0.10.2.2|>=0.11.0.0|<=0.11.0.2|!=0.11.0.3|1.0.0|!=1.0.1|!=1.1.0",
76+
"Issue announced": "26 July 2018",
7377
},
7478
"CVE-2017-12610": {
7579
"action": "include",
7680
"0.10.0.0 to 0.10.2.1, 0.11.0.0 to 0.11.0.1": "affected",
7781
"0.10.2.2, 0.11.0.2, 1.0.0": "fixed",
7882
"affected_version_range": "vers:apache/>=0.10.0.0|<=0.10.2.1|!=0.10.2.2|>=0.11.0.0|<=0.11.0.1|!=0.11.0.2|!=1.0.0",
83+
"Issue announced": "26 July 2018",
7984
},
8085
}
8186

@@ -111,50 +116,46 @@ def to_advisory(self, advisory_page):
111116

112117
cve_description_paragraph = cve_section_beginning.find_next_sibling("p")
113118

114-
stripped_cve_description_paragraph = str(cve_description_paragraph.get_text())
115-
stripped_cve_description_paragraph = stripped_cve_description_paragraph.replace(
116-
"\n", ""
117-
)
118-
stripped_cve_description_paragraph = " ".join(
119-
stripped_cve_description_paragraph.split()
120-
)
119+
description = str(cve_description_paragraph.get_text())
120+
description = " ".join(description.split())
121121

122122
cve_data_table = cve_section_beginning.find_next_sibling("table")
123123
cve_data_table_rows = cve_data_table.find_all("tr")
124124
affected_versions_row = cve_data_table_rows[0]
125125
fixed_versions_row = cve_data_table_rows[1]
126126

127-
affected_versions_string = affected_versions_row.find_all("td")[1].text
128-
fixed_versions_string = fixed_versions_row.find_all("td")[1].text
129-
130127
# Remove leading white space after initial comma
131-
affected_versions_string_split_SPLIT = [
132-
substring.strip()
133-
for substring in affected_versions_string.split(",")
134-
if not substring.isspace()
135-
]
136-
fixed_versions_string_split_SPLIT = [
137-
substring.strip()
138-
for substring in fixed_versions_string.split(",")
139-
if not substring.isspace()
140-
]
128+
affected_versions = affected_versions_row.find_all("td")[1].text
129+
130+
affected_versions_clean = [v.strip() for v in affected_versions.split(",")]
131+
affected_versions_clean = [v for v in affected_versions if v]
132+
133+
fixed_versions = fixed_versions_row.find_all("td")[1].text
134+
135+
fixed_versions_clean = [v.strip() for v in fixed_versions.split(",")]
136+
fixed_versions_clean = [v for v in fixed_versions if v]
141137

142138
# This throws a KeyError if the opening h2 tag `id` data changes or is not in the
143139
# hard-coded affected_version_range_mapping dictionary.
144140
if affected_version_range_mapping[cve_id]["action"] == "include":
145141

146142
# These 2 variables (not used elsewhere) trigger the KeyError for changed/missing data.
147143
check_affected_versions_key = affected_version_range_mapping[cve_id][
148-
affected_versions_string
149-
]
150-
check_fixed_versions_key = affected_version_range_mapping[cve_id][
151-
fixed_versions_string
144+
affected_versions
152145
]
146+
check_fixed_versions_key = affected_version_range_mapping[cve_id][fixed_versions]
153147

154148
references = [
155-
Reference(url=self.ASF_PAGE_URL),
156149
Reference(
157-
url=f"https://cve.mitre.org/cgi-bin/cvename.cgi?name={cve_id}",
150+
url=self.ASF_PAGE_URL,
151+
reference_id=cve_id,
152+
),
153+
Reference(
154+
url=f"{self.ASF_PAGE_URL}#{cve_id}",
155+
reference_id=cve_id,
156+
),
157+
Reference(
158+
url=f"https://nvd.nist.gov/vuln/detail/{cve_id}",
158159
reference_id=cve_id,
159160
),
160161
]
@@ -171,12 +172,17 @@ def to_advisory(self, advisory_page):
171172
)
172173
affected_packages.append(affected_package)
173174

175+
date_published = parse(
176+
affected_version_range_mapping[cve_id]["Issue announced"]
177+
).replace(tzinfo=pytz.UTC)
178+
174179
advisories.append(
175180
AdvisoryData(
176181
aliases=[cve_id],
177-
summary=stripped_cve_description_paragraph,
182+
summary=description,
178183
affected_packages=affected_packages,
179184
references=references,
185+
date_published=date_published,
180186
)
181187
)
182188

‎vulnerabilities/tests/test_data/apache_kafka/test-advisories.json‎

Lines changed: 0 additions & 200 deletions
This file was deleted.

0 commit comments

Comments
 (0)