Skip to content

Commit e53126c

Browse files
TG1999TG1999
committed
Add tests
Signed-off-by: Tushar Goel <tushar.goel.dav@gmail.com>
1 parent 1132774 commit e53126c

4 files changed

Lines changed: 591 additions & 72 deletions

File tree

‎api_v3_usage.rst‎

Lines changed: 338 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,338 @@
1+
2+
Package endpoint
3+
------------------
4+
5+
We are moving from API v1 to API V3.
6+
7+
- /api/packages earlier had "bulk_search", "bulk_lookup", "lookup" and "all" endpoints.
8+
9+
- /api/v3/packages has only one endpoint, which have same capabilities as all of these endpoints.
10+
11+
- Response by package endpoint, will always be paginated, with 10 results per page, and will have "next" and "previous" links for pagination. If there are more than 100 advisories for a package, then it will return "affected_by_vulnerabilities_url" and "fixing_vulnerabilities_url" instead of "affected_by_vulnerabilities" and "fixing_vulnerabilities" respectively.
12+
13+
"all"
14+
15+
- Instead of doing /api/packages/all, we can do /api/v3/packages with empty purls list.
16+
17+
- To get all vulnerable packages:
18+
19+
```
20+
POST /api/v3/packages
21+
{
22+
"purls": []
23+
}
24+
```
25+
26+
Response:
27+
28+
```
29+
30+
{
31+
"count": 596,
32+
"next": "http://example.com/api/v3/packages?page=2",
33+
"previous": null,
34+
"results": [
35+
"pkg:npm/626@1.1.1",
36+
"pkg:npm/aedes@0.35.0",
37+
"pkg:npm/airbrake@0.3.8",
38+
"pkg:npm/angular-http-server@1.4.3",
39+
"pkg:npm/apex-publish-static-files@2.0.0",
40+
"pkg:npm/atob@2.0.3",
41+
"pkg:npm/augustine@0.2.3",
42+
"pkg:npm/backbone@0.3.3",
43+
"pkg:npm/base64-url@1.3.3",
44+
"pkg:npm/base64url@2.0.0"
45+
]
46+
}
47+
```
48+
49+
50+
"bulk_search"
51+
52+
- Instead of doing /api/packages/bulk_search, we can do /api/v3/packages with purls list and "details" as false or true (by default it's false), earlier we had "purls_only" . Also, previosuly we used to have "plain_purl" as a parameter, to ignore qualifiers and subpaths in purls, now we have "approximate", if set to True will ignore qualifiers and subpaths in purls.
53+
54+
Examples:
55+
56+
- To get only purls of vulnerable packages:
57+
```
58+
POST /api/v3/packages
59+
{
60+
"purls": ["pkg:npm/atob@2.0.3", "pkg:pypi/sample@2.0.0"],
61+
"details": false
62+
}
63+
```
64+
65+
Response:
66+
67+
```
68+
{
69+
"count": 1,
70+
"next": null,
71+
"previous": null,
72+
"results": [
73+
"pkg:npm/atob@2.0.3"
74+
]
75+
}
76+
77+
```
78+
79+
- To get details of vulnerable packages:
80+
```
81+
POST /api/v3/packages
82+
{
83+
"purls": ["pkg:npm/atob@2.0.3", "pkg:pypi/sample@2.0.0"],
84+
"details": true
85+
}
86+
```
87+
88+
Response:
89+
```
90+
91+
{
92+
"count": 1,
93+
"next": null,
94+
"previous": null,
95+
"results": [
96+
{
97+
"purl": "pkg:npm/atob@2.0.3",
98+
"affected_by_vulnerabilities": [
99+
{
100+
"advisory_id": "nodejs_security_wg/npm-403",
101+
"fixed_by_packages": [
102+
"pkg:npm/atob@2.1.0"
103+
],
104+
"duplicate_advisory_ids": []
105+
}
106+
],
107+
"fixing_vulnerabilities": [],
108+
"next_non_vulnerable_version": "2.1.0",
109+
"latest_non_vulnerable_version": "2.1.0",
110+
"risk_score": null
111+
}
112+
]
113+
}
114+
```
115+
116+
- To get details of vulnerable packages by ignoring qualifiers and subpaths in purls:
117+
```
118+
POST /api/v3/packages
119+
{
120+
"purls": ["pkg:npm/atob@2.0.3?foo=bar", "pkg:pypi/sample@2.0.0"],
121+
"approximate": true,
122+
"details": true
123+
}
124+
```
125+
126+
Response:
127+
```
128+
129+
{
130+
"count": 1,
131+
"next": null,
132+
"previous": null,
133+
"results": [
134+
{
135+
"purl": "pkg:npm/atob@2.0.3",
136+
"affected_by_vulnerabilities": [
137+
{
138+
"advisory_id": "nodejs_security_wg/npm-403",
139+
"fixed_by_packages": [
140+
"pkg:npm/atob@2.1.0"
141+
],
142+
"duplicate_advisory_ids": []
143+
}
144+
],
145+
"fixing_vulnerabilities": [],
146+
"next_non_vulnerable_version": "2.1.0",
147+
"latest_non_vulnerable_version": "2.1.0",
148+
"risk_score": null
149+
}
150+
]
151+
}
152+
```
153+
154+
- To get vulnerable packages by ignoring qualifiers and subpaths in purls:
155+
```
156+
POST /api/v3/packages
157+
{
158+
"purls": ["pkg:npm/atob@2.0.3?foo=bar"],
159+
"approximate": true,
160+
}
161+
```
162+
163+
Response:
164+
165+
```
166+
{
167+
"count": 1,
168+
"next": null,
169+
"previous": null,
170+
"results": [
171+
"pkg:npm/atob@2.0.3"
172+
]
173+
}
174+
175+
```
176+
177+
Advisory endpoint
178+
------------------
179+
180+
- You can get all advisories for a purl or list of purls by using /api/v3/advisories endpoint. It will also be paginated with 10 results per page, and will have "next" and "previous" links for pagination
181+
182+
```
183+
POST /api/v3/advisories
184+
{
185+
"purls": ["pkg:npm/atob@2.0.3", "pkg:pypi/sample@2.0.0"]
186+
}
187+
```
188+
189+
Response:
190+
191+
```
192+
{
193+
"count": 1,
194+
"next": null,
195+
"previous": null,
196+
"results": [
197+
{
198+
"advisory_id": "nodejs_security_wg/npm-403",
199+
"url": "https://github.com/nodejs/security-wg/blob/main/vuln/npm/403.json",
200+
"aliases": [
201+
"CVE-2018-3745"
202+
],
203+
"summary": "Out-of-bounds Read\n`atob` allocates uninitialized Buffers when number is passed in input on Node.js 4.x and below",
204+
"severities": [
205+
{
206+
"url": "https://github.com/nodejs/security-wg/blob/main/vuln/npm/403.json",
207+
"value": "6.5",
208+
"scoring_system": "cvssv3",
209+
"scoring_elements": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H"
210+
}
211+
],
212+
"weaknesses": [],
213+
"references": [
214+
{
215+
"url": "https://hackerone.com/reports/321686",
216+
"reference_type": "",
217+
"reference_id": ""
218+
},
219+
{
220+
"url": "https://github.com/nodejs/security-wg/blob/main/vuln/npm/403.json",
221+
"reference_type": "",
222+
"reference_id": "403"
223+
}
224+
],
225+
"exploitability": null,
226+
"weighted_severity": null,
227+
"risk_score": null,
228+
"related_ssvc_trees": []
229+
}
230+
]
231+
}
232+
```
233+
234+
Affected By Advisories endpoint
235+
--------------------------------------
236+
237+
- You can get all advisories that fix a purl by using /api/v3/affected-by-advisories?purl=<purl> endpoint
238+
239+
```
240+
GET /api/v3/affected-by-advisories?purl=pkg:npm/atob@2.0.3
241+
```
242+
243+
Response:
244+
```
245+
{
246+
"count": 1,
247+
"next": null,
248+
"previous": null,
249+
"results": [
250+
{
251+
"advisory_id": "nodejs_security_wg/npm-403",
252+
"url": "https://github.com/nodejs/security-wg/blob/main/vuln/npm/403.json",
253+
"aliases": [
254+
"CVE-2018-3745"
255+
],
256+
"summary": "Out-of-bounds Read\n`atob` allocates uninitialized Buffers when number is passed in input on Node.js 4.x and below",
257+
"severities": [
258+
{
259+
"url": "https://github.com/nodejs/security-wg/blob/main/vuln/npm/403.json",
260+
"value": "6.5",
261+
"scoring_system": "cvssv3",
262+
"scoring_elements": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H"
263+
}
264+
],
265+
"weaknesses": [],
266+
"references": [
267+
{
268+
"url": "https://hackerone.com/reports/321686",
269+
"reference_type": "",
270+
"reference_id": ""
271+
},
272+
{
273+
"url": "https://github.com/nodejs/security-wg/blob/main/vuln/npm/403.json",
274+
"reference_type": "",
275+
"reference_id": "403"
276+
}
277+
],
278+
"exploitability": null,
279+
"weighted_severity": null,
280+
"risk_score": null,
281+
"related_ssvc_trees": []
282+
}
283+
]
284+
}
285+
```
286+
287+
Fixing Advisories endpoint
288+
-----------------------------
289+
290+
- You can get all advisories that are fixed by a purl by using /api/v3/fixing-advisories?purl=<purl> endpoint
291+
292+
```
293+
GET /api/v3/fixing-advisories?purl=pkg:npm/atob@2.1.0
294+
```
295+
296+
Response:
297+
```
298+
{
299+
"count": 1,
300+
"next": null,
301+
"previous": null,
302+
"results": [
303+
{
304+
"advisory_id": "nodejs_security_wg/npm-403",
305+
"url": "https://github.com/nodejs/security-wg/blob/main/vuln/npm/403.json",
306+
"aliases": [
307+
"CVE-2018-3745"
308+
],
309+
"summary": "Out-of-bounds Read\n`atob` allocates uninitialized Buffers when number is passed in input on Node.js 4.x and below",
310+
"severities": [
311+
{
312+
"url": "https://github.com/nodejs/security-wg/blob/main/vuln/npm/403.json",
313+
"value": "6.5",
314+
"scoring_system": "cvssv3",
315+
"scoring_elements": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H"
316+
}
317+
],
318+
"weaknesses": [],
319+
"references": [
320+
{
321+
"url": "https://hackerone.com/reports/321686",
322+
"reference_type": "",
323+
"reference_id": ""
324+
},
325+
{
326+
"url": "https://github.com/nodejs/security-wg/blob/main/vuln/npm/403.json",
327+
"reference_type": "",
328+
"reference_id": "403"
329+
}
330+
],
331+
"exploitability": null,
332+
"weighted_severity": null,
333+
"risk_score": null,
334+
"related_ssvc_trees": []
335+
}
336+
]
337+
}
338+
```

‎vulnerabilities/api_v3.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -333,9 +333,9 @@ def create(self, request, *args, **kwargs):
333333
else:
334334
query = (
335335
PackageV2.objects.filter(package_url__in=purls)
336-
.values_list("package_url", flat=True)
337336
.distinct()
338337
.order_by("package_url")
338+
.values_list("package_url", flat=True)
339339
)
340340

341341
page = self.paginate_queryset(query)

0 commit comments

Comments
 (0)