fix: remove empty anchor tags from GHSA vulnerability details

gcp/website/frontend_emulator.py

@@ -90,9 +90,9 @@ def _dict_to_vuln(data: object,
         if not vuln_id:
           return None
 
-        vulnerability = vulnerability_pb2.Vulnerability()
         try:
-          json_format.ParseDict(data, vulnerability, ignore_unknown_fields=True)
+          vulnerability = sources.parse_vulnerability_from_dict(
+              data, strict=False)
         except Exception as error:
           print(f'[emulator] Failed to convert entry in {path}: {error}')
           return None

gcp/website/frontend_handlers.py

@@ -834,6 +834,9 @@ def sort_versions(versions: list[str], ecosystem: str) -> list[str]:
 # with
 # <a href="https://chromium.googlesource.com/v8/v8.git/+/refs/heads/beta">
 _URL_MARKDOWN_REPLACER = re.compile(r'(<a href=\".*?)(/ /)(.*?\">)')
+_ANCHOR_TAG_REPLACER = re.compile(
+    r'<a\s+[^>]*name=["\'][^"\']*["\'][^>]*>\s*</a>|<a\s+[^>]*name=["\'][^"\']*["\'][^>]*/>',
+    re.IGNORECASE)
 
 
 @blueprint.app_template_filter('markdown')
@@ -852,6 +855,7 @@ def markdown(text):
     # space rather than %2B
     # See: https://github.com/trentm/python-markdown2/issues/621
     md = _URL_MARKDOWN_REPLACER.sub(r'\1/+/\3', md)
+    md = _ANCHOR_TAG_REPLACER.sub('', md)
 
     return md
 

osv/sources.py

@@ -17,6 +17,7 @@
 import hashlib
 import logging
 import os
+import re
 
 import jsonschema
 import pygit2
@@ -162,9 +163,21 @@ def _get_nested_vulnerability(data, key_path=None):
   return data
 
 
+def _sanitize_anchor_tags(text):
+  if not text or not isinstance(text, str):
+    return text
+  pattern = r'<a\s+[^>]*name=["\'][^"\']*["\'][^>]*>\s*</a>|<a\s+[^>]*name=["\'][^"\']*["\'][^>]*/>'
+  return re.sub(pattern, '', text, flags=re.IGNORECASE)
+
+
 def parse_vulnerability_from_dict(data, key_path=None, strict=False):
   """Parse vulnerability from dict."""
   data = _get_nested_vulnerability(data, key_path)
+
+  # Sanitize anchor tags from details field if present
+  if isinstance(data, dict) and 'details' in data and data['details']:
+    data['details'] = _sanitize_anchor_tags(data['details'])
+
   try:
     jsonschema.validate(data, load_schema())
   except jsonschema.exceptions.ValidationError as e: