Skip to content

Commit b5c94bd

Browse files
johnmhoranTG1999
johnmhoran
authored and
TG1999
committed
Begin postgresql.py migration #969
Reference: #969 Signed-off-by: John M. Horan <[email protected]>
1 parent bf49673 commit b5c94bd

File tree

2 files changed

+261
-24
lines changed

2 files changed

+261
-24
lines changed

‎vulnerabilities/importers/postgresql.py‎

Lines changed: 71 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -13,17 +13,27 @@
1313
from bs4 import BeautifulSoup
1414
from packageurl import PackageURL
1515

16+
# is there a univers versionrange? a version?
17+
from univers.version_range import GenericVersionRange
18+
from univers.versions import GenericVersion
19+
1620
from vulnerabilities import severity_systems
21+
22+
# add AffectedPackage
1723
from vulnerabilities.importer import AdvisoryData
24+
from vulnerabilities.importer import AffectedPackage
1825
from vulnerabilities.importer import Importer
1926
from vulnerabilities.importer import Reference
2027
from vulnerabilities.importer import VulnerabilitySeverity
28+
29+
# we no longer use nearest_patched_package, do we?
2130
from vulnerabilities.utils import nearest_patched_package
2231

2332

2433
class PostgreSQLImporter(Importer):
2534

2635
root_url = "https://www.postgresql.org/support/security/"
36+
# need spdx_license_expression and license_url
2737

2838
def updated_advisories(self):
2939
advisories = []
@@ -54,26 +64,64 @@ def to_advisories(data):
5464
if "windows" in summary.lower():
5565
pkg_qualifiers = {"os": "windows"}
5666

57-
affected_packages = [
58-
PackageURL(
59-
type="generic",
60-
name="postgresql",
61-
version=version.strip(),
62-
qualifiers=pkg_qualifiers,
67+
# affected_packages = [
68+
# PackageURL(
69+
# type="generic",
70+
# name="postgresql",
71+
# version=version.strip(),
72+
# qualifiers=pkg_qualifiers,
73+
# )
74+
# for version in affected_col.text.split(",")
75+
# ]
76+
77+
# fixed_packages = [
78+
# PackageURL(
79+
# type="generic",
80+
# name="postgresql",
81+
# version=version.strip(),
82+
# qualifiers=pkg_qualifiers,
83+
# )
84+
# for version in fixed_col.text.split(",")
85+
# # why the "if version" here but not in affected_packages?
86+
# # aren't we assuming (can we assume?) there are an equal number of versions in affect_packages and fixed_packages?
87+
# if version
88+
# ]
89+
90+
# This will replace the affected_packages and fixed_packages lists above. ============
91+
affected_packages = []
92+
affected_version_list = affected_col.text.split(",")
93+
fixed_version_list = fixed_col.text.split(",")
94+
package_count = len(affected_version_list)
95+
96+
while package_count > 0:
97+
summary = summary
98+
99+
affected = affected_version_list[0]
100+
affected_version_list.pop(0)
101+
# Do we need "if affected else None"?
102+
affected_version_range = (
103+
GenericVersionRange.from_versions([affected]) if affected else None
63104
)
64-
for version in affected_col.text.split(",")
65-
]
66-
67-
fixed_packages = [
68-
PackageURL(
69-
type="generic",
70-
name="postgresql",
71-
version=version.strip(),
72-
qualifiers=pkg_qualifiers,
105+
106+
fixed = fixed_version_list[0]
107+
fixed_version_list.pop(0)
108+
# Do we need "if affected else None"?
109+
fixed_version = GenericVersion(fixed) if fixed else None
110+
111+
package_count -= 1
112+
113+
affected_package = AffectedPackage(
114+
package=PackageURL(
115+
name="postgresql",
116+
type="generic",
117+
namespace="postgresql",
118+
),
119+
affected_version_range=affected_version_range,
120+
fixed_version=fixed_version,
73121
)
74-
for version in fixed_col.text.split(",")
75-
if version
76-
]
122+
affected_packages.append(affected_package)
123+
124+
# end of initial draft insert ===================================
77125

78126
try:
79127
cve_id = ref_col.select("nobr")[0].text
@@ -105,10 +153,13 @@ def to_advisories(data):
105153

106154
advisories.append(
107155
AdvisoryData(
108-
vulnerability_id=cve_id,
156+
# 10/26/2022 Wednesday 6:40:01 PM. Throws error (terminal points to test data): TypeError: __init__() got an unexpected keyword argument 'vulnerability_id'
157+
# vulnerability_id=cve_id,
158+
aliases=[cve_id],
109159
summary=summary,
110160
references=references,
111-
affected_packages=nearest_patched_package(affected_packages, fixed_packages),
161+
# affected_packages=nearest_patched_package(affected_packages, fixed_packages),
162+
affected_packages=affected_packages,
112163
)
113164
)
114165

‎vulnerabilities/tests/test_postgresql.py‎

Lines changed: 190 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,9 @@ def test_to_advisories(self):
3232
expected_advisories = [
3333
AdvisoryData(
3434
summary="ALTER ... DEPENDS ON EXTENSION is missing authorization checks.more details",
35-
vulnerability_id="CVE-2020-1720",
35+
# 10/26/2022 Wednesday 6:40:01 PM. Throws error: TypeError: __init__() got an unexpected keyword argument 'vulnerability_id'
36+
# vulnerability_id="CVE-2020-1720",
37+
aliases=["CVE-2020-1720"],
3638
affected_packages=[
3739
AffectedPackage(
3840
vulnerable_package=PackageURL(
@@ -103,7 +105,9 @@ def test_to_advisories(self):
103105
),
104106
AdvisoryData(
105107
summary="Windows installer runs executables from uncontrolled directoriesmore details",
106-
vulnerability_id="CVE-2020-10733",
108+
# 10/26/2022 Wednesday 6:40:01 PM. Throws error: TypeError: __init__() got an unexpected keyword argument 'vulnerability_id'
109+
# vulnerability_id="CVE-2020-10733",
110+
aliases=["CVE-2020-10733"],
107111
affected_packages=[
108112
AffectedPackage(
109113
vulnerable_package=PackageURL(
@@ -184,6 +188,188 @@ def test_to_advisories(self):
184188

185189
found_advisories = to_advisories(raw_data)
186190

187-
found_advisories = list(map(AdvisoryData.normalized, found_advisories))
188-
expected_advisories = list(map(AdvisoryData.normalized, expected_advisories))
191+
# 10/26/2022 Wednesday 7:07:13 PM. Throws error: AttributeError: type object 'AdvisoryData' has no attribute 'normalized'
192+
# found_advisories = list(map(AdvisoryData.normalized, found_advisories))
193+
found_advisories = list(map(AdvisoryData, found_advisories))
194+
# expected_advisories = list(map(AdvisoryData.normalized, expected_advisories))
195+
expected_advisories = list(map(AdvisoryData, expected_advisories))
196+
assert sorted(found_advisories) == sorted(expected_advisories)
197+
198+
# 10/27/2022 Thursday 6:40:04 PM. This is intended to be an updated test -- but I have barely started to work on it!
199+
# Focusing instead on postgresql.py for now.
200+
def test_to_advisories_updated(self):
201+
202+
with open(TEST_DATA) as f:
203+
raw_data = f.read()
204+
205+
expected_advisories = [
206+
AdvisoryData(
207+
summary="ALTER ... DEPENDS ON EXTENSION is missing authorization checks.more details",
208+
# 10/26/2022 Wednesday 6:40:01 PM. Throws error: TypeError: __init__() got an unexpected keyword argument 'vulnerability_id'
209+
# vulnerability_id="CVE-2020-1720",
210+
aliases=["CVE-2020-1720"],
211+
affected_packages=[
212+
AffectedPackage(
213+
vulnerable_package=PackageURL(
214+
type="generic",
215+
name="postgresql",
216+
version="10",
217+
),
218+
patched_package=PackageURL(
219+
type="generic",
220+
name="postgresql",
221+
version="10.12",
222+
),
223+
),
224+
AffectedPackage(
225+
vulnerable_package=PackageURL(
226+
type="generic",
227+
name="postgresql",
228+
version="11",
229+
),
230+
patched_package=PackageURL(
231+
type="generic",
232+
name="postgresql",
233+
version="11.7",
234+
),
235+
),
236+
AffectedPackage(
237+
vulnerable_package=PackageURL(
238+
type="generic",
239+
name="postgresql",
240+
version="12",
241+
),
242+
patched_package=PackageURL(
243+
type="generic",
244+
name="postgresql",
245+
version="12.2",
246+
),
247+
),
248+
AffectedPackage(
249+
vulnerable_package=PackageURL(
250+
type="generic",
251+
name="postgresql",
252+
version="9.6",
253+
),
254+
patched_package=PackageURL(
255+
type="generic",
256+
name="postgresql",
257+
version="9.6.17",
258+
),
259+
),
260+
],
261+
references=[
262+
Reference(
263+
reference_id="",
264+
url="https://www.postgresql.org/about/news/postgresql-122-117-1012-9617-9521-and-9426-released-2011/",
265+
),
266+
Reference(
267+
reference_id="",
268+
url="https://www.postgresql.org/support/security/CVE-2020-1720/",
269+
severities=[
270+
VulnerabilitySeverity(
271+
system=severity_systems.CVSSV3,
272+
value="3.1",
273+
),
274+
VulnerabilitySeverity(
275+
system=severity_systems.CVSSV3_VECTOR,
276+
value=["AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"],
277+
),
278+
],
279+
),
280+
],
281+
),
282+
AdvisoryData(
283+
summary="Windows installer runs executables from uncontrolled directoriesmore details",
284+
# 10/26/2022 Wednesday 6:40:01 PM. Throws error: TypeError: __init__() got an unexpected keyword argument 'vulnerability_id'
285+
# vulnerability_id="CVE-2020-10733",
286+
aliases=["CVE-2020-10733"],
287+
affected_packages=[
288+
AffectedPackage(
289+
vulnerable_package=PackageURL(
290+
type="generic",
291+
name="postgresql",
292+
version="10",
293+
qualifiers={"os": "windows"},
294+
),
295+
patched_package=PackageURL(
296+
type="generic",
297+
name="postgresql",
298+
version="10.13",
299+
qualifiers={"os": "windows"},
300+
),
301+
),
302+
AffectedPackage(
303+
vulnerable_package=PackageURL(
304+
type="generic",
305+
name="postgresql",
306+
version="11",
307+
qualifiers={"os": "windows"},
308+
),
309+
patched_package=PackageURL(
310+
type="generic",
311+
name="postgresql",
312+
version="11.8",
313+
qualifiers={"os": "windows"},
314+
),
315+
),
316+
AffectedPackage(
317+
vulnerable_package=PackageURL(
318+
type="generic",
319+
name="postgresql",
320+
version="12",
321+
qualifiers={"os": "windows"},
322+
),
323+
patched_package=PackageURL(
324+
type="generic",
325+
name="postgresql",
326+
version="12.3",
327+
qualifiers={"os": "windows"},
328+
),
329+
),
330+
AffectedPackage(
331+
vulnerable_package=PackageURL(
332+
type="generic",
333+
name="postgresql",
334+
version="9.6",
335+
qualifiers={"os": "windows"},
336+
),
337+
patched_package=PackageURL(
338+
type="generic",
339+
name="postgresql",
340+
version="9.6.18",
341+
qualifiers={"os": "windows"},
342+
),
343+
),
344+
],
345+
references=[
346+
Reference(
347+
reference_id="",
348+
url="https://www.postgresql.org/about/news/postgresql-123-118-1013-9618-and-9522-released-2038/",
349+
),
350+
Reference(
351+
reference_id="",
352+
url="https://www.postgresql.org/support/security/CVE-2020-10733/",
353+
severities=[
354+
VulnerabilitySeverity(
355+
system=severity_systems.CVSSV3,
356+
value="6.7",
357+
),
358+
VulnerabilitySeverity(
359+
system=severity_systems.CVSSV3_VECTOR,
360+
value=["AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H"],
361+
),
362+
],
363+
),
364+
],
365+
),
366+
]
367+
368+
found_advisories = to_advisories(raw_data)
369+
370+
# 10/26/2022 Wednesday 7:07:13 PM. Throws error: AttributeError: type object 'AdvisoryData' has no attribute 'normalized'
371+
# found_advisories = list(map(AdvisoryData.normalized, found_advisories))
372+
# found_advisories = list(map(AdvisoryData, found_advisories))
373+
# expected_advisories = list(map(AdvisoryData.normalized, expected_advisories))
374+
# expected_advisories = list(map(AdvisoryData, expected_advisories))
189375
assert sorted(found_advisories) == sorted(expected_advisories)

0 commit comments

Comments
 (0)