Skip to content

Commit 0bed9dd

Browse files
ziadhanyziadhany
committed
Fix Gentoo importer v1
Update the Gentoo get_safe_and_affected_versions function in advisory v2 Signed-off-by: ziad hany <ziadhany2016@gmail.com>
1 parent 0611b55 commit 0bed9dd

6 files changed

Lines changed: 150 additions & 62 deletions

File tree

‎vulnerabilities/importers/gentoo.py‎

Lines changed: 16 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,7 @@
66
# See https://github.com/aboutcode-org/vulnerablecode for support or download.
77
# See https://aboutcode.org for more information about nexB OSS projects.
88
#
9-
10-
9+
import logging
1110
import re
1211
import xml.etree.ElementTree as ET
1312
from pathlib import Path
@@ -17,12 +16,15 @@
1716
from univers.version_constraint import VersionConstraint
1817
from univers.version_range import EbuildVersionRange
1918
from univers.versions import GentooVersion
19+
from univers.versions import InvalidVersion
2020

2121
from vulnerabilities.importer import AdvisoryData
2222
from vulnerabilities.importer import AffectedPackage
2323
from vulnerabilities.importer import Importer
2424
from vulnerabilities.importer import Reference
2525

26+
logger = logging.getLogger(__name__)
27+
2628

2729
class GentooImporter(Importer):
2830
repo_url = "git+https://anongit.gentoo.org/git/data/glsa.git"
@@ -104,14 +106,20 @@ def affected_and_safe_purls(affected_elem):
104106
safe_versions, affected_versions = GentooImporter.get_safe_and_affected_versions(pkg)
105107

106108
for version in safe_versions:
107-
constraints.append(
108-
VersionConstraint(version=GentooVersion(version), comparator="=").invert()
109-
)
109+
try:
110+
constraints.append(
111+
VersionConstraint(version=GentooVersion(version), comparator="=").invert()
112+
)
113+
except InvalidVersion as e:
114+
logger.error(f"Invalid safe_version {version} - error: {e}")
110115

111116
for version in affected_versions:
112-
constraints.append(
113-
VersionConstraint(version=GentooVersion(version), comparator="=")
114-
)
117+
try:
118+
constraints.append(
119+
VersionConstraint(version=GentooVersion(version), comparator="=")
120+
)
121+
except InvalidVersion as e:
122+
logger.error(f"Invalid affected_version {version} - error: {e}")
115123

116124
if not constraints:
117125
continue

‎vulnerabilities/pipelines/v2_importers/gentoo_importer.py‎

Lines changed: 40 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -121,43 +121,43 @@ def cves_from_reference(reference):
121121
return cves
122122

123123

124+
def _yield_packages(pkg_name, pkg_ns, constraints, invert):
125+
"""
126+
Generate AffectedPackageV2 objects for a list of constraints.
127+
"""
128+
for comparator, version, slot_value in constraints:
129+
qualifiers = {"slot": slot_value} if slot_value else {}
130+
purl = PackageURL(type="ebuild", name=pkg_name, namespace=pkg_ns, qualifiers=qualifiers)
131+
132+
try:
133+
constraint = VersionConstraint(version=GentooVersion(version), comparator=comparator)
134+
135+
if invert:
136+
constraint = constraint.invert()
137+
138+
yield AffectedPackageV2(
139+
package=purl,
140+
affected_version_range=EbuildVersionRange(constraints=[constraint]),
141+
fixed_version_range=None,
142+
)
143+
except InvalidVersion as e:
144+
logger.error(f"InvalidVersion constraints version: {version} error:{e}")
145+
146+
124147
def affected_and_safe_purls(affected_elem):
125-
constraints = []
126148
for pkg in affected_elem:
127149
name = pkg.attrib.get("name")
128150
if not name:
129151
continue
130152
pkg_ns, _, pkg_name = name.rpartition("/")
131-
purl = PackageURL(type="ebuild", name=pkg_name, namespace=pkg_ns)
132-
safe_versions, affected_versions = get_safe_and_affected_versions(pkg)
133-
134-
for version in safe_versions:
135-
try:
136-
constraints.append(
137-
VersionConstraint(version=GentooVersion(version), comparator="=").invert()
138-
)
139-
except InvalidVersion as e:
140-
logger.error(f"InvalidVersion - version: {version} - error:{e}")
141-
142-
for version in affected_versions:
143-
try:
144-
constraints.append(
145-
VersionConstraint(version=GentooVersion(version), comparator="=")
146-
)
147-
except InvalidVersion as e:
148-
logger.error(f"InvalidVersion - version: {version} - error:{e}")
149-
150-
if not constraints:
151-
continue
152153

153-
yield AffectedPackageV2(
154-
package=purl,
155-
affected_version_range=EbuildVersionRange(constraints=constraints),
156-
fixed_version_range=None,
157-
)
154+
safe_constraints, affected_constraints = get_safe_and_affected_constraints(pkg)
155+
156+
yield from _yield_packages(pkg_name, pkg_ns, affected_constraints, invert=False)
157+
yield from _yield_packages(pkg_name, pkg_ns, safe_constraints, invert=True)
158158

159159

160-
def get_safe_and_affected_versions(pkg):
160+
def get_safe_and_affected_constraints(pkg):
161161
# TODO : Revisit why we are skipping some versions in gentoo importer
162162
skip_versions = {"1.3*", "7.3*", "7.4*"}
163163
safe_versions = set()
@@ -166,27 +166,20 @@ def get_safe_and_affected_versions(pkg):
166166
if info.text in skip_versions:
167167
continue
168168

169-
if info.attrib.get("range"):
170-
if len(info.attrib.get("range")) > 2:
171-
continue
169+
# All possible values of info.attrib['range'] =
170+
# {'gt', 'lt', 'rle', 'rge', 'rgt', 'le', 'ge', 'eq'}, out of
171+
# which ('rle', 'rge', 'rgt') are ignored, because they compare
172+
# 'release' not the 'version'.
173+
range_value = info.attrib.get("range")
174+
slot_value = info.attrib.get("slot")
175+
comparator_dict = {"gt": ">", "lt": "<", "ge": ">=", "le": "<=", "eq": "="}
176+
comparator = comparator_dict.get(range_value)
177+
if not comparator:
178+
continue
172179

173180
if info.tag == "unaffected":
174-
# quick hack, to know whether this
175-
# version lies in this range, 'e' stands for
176-
# equal, which is paired with 'greater' or 'less'.
177-
# All possible values of info.attrib['range'] =
178-
# {'gt', 'lt', 'rle', 'rge', 'rgt', 'le', 'ge', 'eq'}, out of
179-
# which ('rle', 'rge', 'rgt') are ignored, because they compare
180-
# 'release' not the 'version'.
181-
if "e" in info.attrib["range"]:
182-
safe_versions.add(info.text)
183-
else:
184-
affected_versions.add(info.text)
181+
safe_versions.add((comparator, info.text, slot_value))
185182

186183
elif info.tag == "vulnerable":
187-
if "e" in info.attrib["range"]:
188-
affected_versions.add(info.text)
189-
else:
190-
safe_versions.add(info.text)
191-
184+
affected_versions.add((comparator, info.text, slot_value))
192185
return safe_versions, affected_versions

‎vulnerabilities/tests/pipelines/v2_importers/test_gentoo_importer_v2.py‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
# See https://github.com/aboutcode-org/vulnerablecode for support or download.
77
# See https://aboutcode.org for more information about nexB OSS projects.
88
#
9-
9+
import json
1010
from pathlib import Path
1111
from unittest.mock import Mock
1212
from unittest.mock import patch
@@ -32,7 +32,10 @@ def test_gentoo_advisories_per_file(xml_file):
3232
pipeline.vcs_response = Mock(dest_dir=TEST_DATA)
3333

3434
with patch.object(Path, "glob", return_value=[xml_file]):
35-
result = [adv.to_dict() for adv in pipeline.collect_advisories()]
35+
results = [adv.to_dict() for adv in pipeline.collect_advisories()]
36+
37+
for adv in results:
38+
adv["affected_packages"].sort(key=lambda x: json.dumps(x, sort_keys=True))
3639

3740
expected_file = xml_file.with_name(xml_file.stem + "-expected.json")
38-
util_tests.check_results_against_json(result, expected_file)
41+
util_tests.check_results_against_json(results, expected_file)

‎vulnerabilities/tests/test_data/gentoo_v2/glsa-201709-09-expected.json‎

Lines changed: 29 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,35 @@
1515
"qualifiers": "",
1616
"subpath": ""
1717
},
18-
"affected_version_range": "vers:ebuild/0.1.1|!=1.9.7",
18+
"affected_version_range": "vers:ebuild/0.1.1",
19+
"fixed_version_range": null,
20+
"introduced_by_commit_patches": [],
21+
"fixed_by_commit_patches": []
22+
},
23+
{
24+
"package": {
25+
"type": "ebuild",
26+
"namespace": "dev-vcs",
27+
"name": "subversion",
28+
"version": "",
29+
"qualifiers": "",
30+
"subpath": ""
31+
},
32+
"affected_version_range": "vers:ebuild/<1.9.7",
33+
"fixed_version_range": null,
34+
"introduced_by_commit_patches": [],
35+
"fixed_by_commit_patches": []
36+
},
37+
{
38+
"package": {
39+
"type": "ebuild",
40+
"namespace": "dev-vcs",
41+
"name": "subversion",
42+
"version": "",
43+
"qualifiers": "",
44+
"subpath": ""
45+
},
46+
"affected_version_range": "vers:ebuild/<1.9.7",
1947
"fixed_version_range": null,
2048
"introduced_by_commit_patches": [],
2149
"fixed_by_commit_patches": []

‎vulnerabilities/tests/test_data/gentoo_v2/glsa-202511-02-expected.json‎

Lines changed: 44 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -36,10 +36,52 @@
3636
"namespace": "net-libs",
3737
"name": "webkit-gtk",
3838
"version": "",
39-
"qualifiers": "",
39+
"qualifiers": "slot=4.1",
4040
"subpath": ""
4141
},
42-
"affected_version_range": "vers:ebuild/!=2.48.5",
42+
"affected_version_range": "vers:ebuild/<2.48.5",
43+
"fixed_version_range": null,
44+
"introduced_by_commit_patches": [],
45+
"fixed_by_commit_patches": []
46+
},
47+
{
48+
"package": {
49+
"type": "ebuild",
50+
"namespace": "net-libs",
51+
"name": "webkit-gtk",
52+
"version": "",
53+
"qualifiers": "slot=4.1",
54+
"subpath": ""
55+
},
56+
"affected_version_range": "vers:ebuild/<2.48.5",
57+
"fixed_version_range": null,
58+
"introduced_by_commit_patches": [],
59+
"fixed_by_commit_patches": []
60+
},
61+
{
62+
"package": {
63+
"type": "ebuild",
64+
"namespace": "net-libs",
65+
"name": "webkit-gtk",
66+
"version": "",
67+
"qualifiers": "slot=6",
68+
"subpath": ""
69+
},
70+
"affected_version_range": "vers:ebuild/<2.48.5",
71+
"fixed_version_range": null,
72+
"introduced_by_commit_patches": [],
73+
"fixed_by_commit_patches": []
74+
},
75+
{
76+
"package": {
77+
"type": "ebuild",
78+
"namespace": "net-libs",
79+
"name": "webkit-gtk",
80+
"version": "",
81+
"qualifiers": "slot=6",
82+
"subpath": ""
83+
},
84+
"affected_version_range": "vers:ebuild/<2.48.5",
4385
"fixed_version_range": null,
4486
"introduced_by_commit_patches": [],
4587
"fixed_by_commit_patches": []

‎vulnerabilities/tests/test_data/gentoo_v2/glsa-202512-01-expected.json‎

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,21 @@
1313
"qualifiers": "",
1414
"subpath": ""
1515
},
16-
"affected_version_range": "vers:ebuild/!=2.5.14",
16+
"affected_version_range": "vers:ebuild/<2.5.14",
17+
"fixed_version_range": null,
18+
"introduced_by_commit_patches": [],
19+
"fixed_by_commit_patches": []
20+
},
21+
{
22+
"package": {
23+
"type": "ebuild",
24+
"namespace": "app-crypt",
25+
"name": "gnupg",
26+
"version": "",
27+
"qualifiers": "",
28+
"subpath": ""
29+
},
30+
"affected_version_range": "vers:ebuild/<2.5.14",
1731
"fixed_version_range": null,
1832
"introduced_by_commit_patches": [],
1933
"fixed_by_commit_patches": []

0 commit comments

Comments
 (0)