Skip to content

Commit d5c07d0

Browse files
TG1999TG1999
committed
Address review comments
Signed-off-by: Tushar Goel <[email protected]>
1 parent 3b29651 commit d5c07d0

File tree

2 files changed

+64
-79
lines changed

2 files changed

+64
-79
lines changed

‎vulnerabilities/importers/gentoo.py‎

Lines changed: 64 additions & 55 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,10 @@
2727
class GentooImporter(Importer):
2828
repo_url = "git+https://anongit.gentoo.org/git/data/glsa.git"
2929
spdx_license_expression = "CC-BY-SA-4.0"
30-
license_url = "https://anongit.gentoo.org/"
30+
# the license notice is at this url https://anongit.gentoo.org/ says:
31+
# The contents of this document, unless otherwise expressly stated, are licensed
32+
# under the [CC-BY-SA-4.0](https://creativecommons.org/licenses/by-sa/4.0/) license.
33+
license_url = "https://creativecommons.org/licenses/by-sa/4.0/"
3134

3235
def advisory_data(self) -> Iterable[AdvisoryData]:
3336
try:
@@ -42,12 +45,12 @@ def advisory_data(self) -> Iterable[AdvisoryData]:
4245
def process_file(self, file):
4346
cves = []
4447
summary = ""
45-
vuln_reference = []
48+
vuln_references = []
4649
xml_root = ET.parse(file).getroot()
4750
id = xml_root.attrib.get("id")
4851
if id:
4952
glsa = "GLSA-" + id
50-
vuln_reference = [
53+
vuln_references = [
5154
Reference(
5255
reference_id=glsa,
5356
url=f"https://security.gentoo.org/glsa/{id}",
@@ -70,7 +73,7 @@ def process_file(self, file):
7073
yield AdvisoryData(
7174
aliases=[cve],
7275
summary=summary,
73-
references=vuln_reference,
76+
references=vuln_references,
7477
affected_packages=affected_packages,
7578
)
7679

@@ -87,57 +90,63 @@ def cves_from_reference(reference):
8790

8891
@staticmethod
8992
def affected_and_safe_purls(affected_elem):
93+
constraints = []
94+
for pkg in affected_elem:
95+
name = pkg.attrib.get("name")
96+
if not name:
97+
continue
98+
pkg_ns, _, pkg_name = name.rpartition("/")
99+
purl = PackageURL(type="ebuild", name=pkg_name, namespace=pkg_ns)
100+
safe_versions, affected_versions = GentooImporter.get_safe_and_affected_versions(pkg)
101+
102+
for version in safe_versions:
103+
constraints.append(
104+
VersionConstraint(version=GentooVersion(version), comparator="=").invert()
105+
)
106+
107+
for version in affected_versions:
108+
constraints.append(
109+
VersionConstraint(version=GentooVersion(version), comparator="=")
110+
)
111+
112+
if not constraints:
113+
continue
114+
115+
yield AffectedPackage(
116+
package=purl, affected_version_range=EbuildVersionRange(constraints=constraints)
117+
)
118+
119+
@staticmethod
120+
def get_safe_and_affected_versions(pkg):
121+
# TODO : Revisit why we are skipping some versions in gentoo importer
122+
skip_versions = {"1.3*", "7.3*", "7.4*"}
90123
safe_versions = set()
91124
affected_versions = set()
92-
skip_versions = {"1.3*", "7.3*", "7.4*"}
93-
for pkg in affected_elem:
94-
for info in pkg:
95-
if info.text in skip_versions:
125+
for info in pkg:
126+
if info.text in skip_versions:
127+
continue
128+
129+
if info.attrib.get("range"):
130+
if len(info.attrib.get("range")) > 2:
96131
continue
97-
name = pkg.attrib.get("name")
98-
if name:
99-
(
100-
pkg_ns,
101-
pkg_name,
102-
) = name.split("/")
103-
purl = PackageURL(type="ebuild", name=pkg_name, namespace=pkg_ns)
104-
105-
if info.attrib.get("range"):
106-
if len(info.attrib.get("range")) > 2:
107-
continue
108-
109-
if info.tag == "unaffected":
110-
# quick hack, to know whether this
111-
# version lies in this range, 'e' stands for
112-
# equal, which is paired with 'greater' or 'less'.
113-
# All possible values of info.attrib['range'] =
114-
# {'gt', 'lt', 'rle', 'rge', 'rgt', 'le', 'ge', 'eq'}, out of
115-
# which ('rle', 'rge', 'rgt') are ignored, because they compare
116-
# 'release' not the 'version'.
117-
118-
if "e" in info.attrib["range"]:
119-
safe_versions.add(info.text)
120-
else:
121-
affected_versions.add(info.text)
122-
123-
elif info.tag == "vulnerable":
124-
if "e" in info.attrib["range"]:
125-
affected_versions.add(info.text)
126-
else:
127-
safe_versions.add(info.text)
128-
129-
constraints = []
130-
131-
for version in safe_versions:
132-
constraints.append(
133-
VersionConstraint(version=GentooVersion(version), comparator="=").invert()
134-
)
135-
136-
for version in affected_versions:
137-
constraints.append(
138-
VersionConstraint(version=GentooVersion(version), comparator="=")
139-
)
140-
141-
yield AffectedPackage(
142-
package=purl, affected_version_range=EbuildVersionRange(constraints=constraints)
143-
)
132+
133+
if info.tag == "unaffected":
134+
# quick hack, to know whether this
135+
# version lies in this range, 'e' stands for
136+
# equal, which is paired with 'greater' or 'less'.
137+
# All possible values of info.attrib['range'] =
138+
# {'gt', 'lt', 'rle', 'rge', 'rgt', 'le', 'ge', 'eq'}, out of
139+
# which ('rle', 'rge', 'rgt') are ignored, because they compare
140+
# 'release' not the 'version'.
141+
if "e" in info.attrib["range"]:
142+
safe_versions.add(info.text)
143+
else:
144+
affected_versions.add(info.text)
145+
146+
elif info.tag == "vulnerable":
147+
if "e" in info.attrib["range"]:
148+
affected_versions.add(info.text)
149+
else:
150+
safe_versions.add(info.text)
151+
152+
return safe_versions, affected_versions

‎vulnerabilities/tests/test_data/gentoo/gentoo-expected.json‎

Lines changed: 0 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -5,30 +5,6 @@
55
],
66
"summary": "A command injection vulnerability in Subversion may allow remote\n attackers to execute arbitrary code.\n ",
77
"affected_packages": [
8-
{
9-
"package": {
10-
"type": "ebuild",
11-
"namespace": "dev-vcs",
12-
"name": "subversion",
13-
"version": null,
14-
"qualifiers": null,
15-
"subpath": null
16-
},
17-
"affected_version_range": "vers:ebuild/!=1.9.7",
18-
"fixed_version": null
19-
},
20-
{
21-
"package": {
22-
"type": "ebuild",
23-
"namespace": "dev-vcs",
24-
"name": "subversion",
25-
"version": null,
26-
"qualifiers": null,
27-
"subpath": null
28-
},
29-
"affected_version_range": "vers:ebuild/!=1.9.7",
30-
"fixed_version": null
31-
},
328
{
339
"package": {
3410
"type": "ebuild",

0 commit comments

Comments
 (0)