Improve package type inference in github importer
@@ -97,6 +97,14 @@ class GitHubAPIDataSource(DataSource):
except KeyError:
raise GitHubTokenError("Environment variable GH_TOKEN is missing")
+ self.ecosytem_type = {
+ "RUBYGEMS": "gem",
+ "NUGET": "nuget",
+ "PIP": "pypi",
+ "MAVEN": "maven",
+ "COMPOSER": "composer",
+ }
+
def __enter__(self):
self.advisories = self.fetch()
@@ -135,7 +143,7 @@ class GitHubAPIDataSource(DataSource):
"NUGET": NugetVersionAPI,
"COMPOSER": ComposerVersionAPI,
"PIP": PypiVersionAPI,
- "RUBYGEMS": RubyVersionAPI
+ "RUBYGEMS": RubyVersionAPI,
}
versioner = versioners.get(ecosystem)
if versioner:
@@ -169,7 +177,7 @@ class GitHubAPIDataSource(DataSource):
adv_list = []
for ecosystem in self.advisories:
self.set_version_api(ecosystem)
- pkg_type = ecosystem.lower()
+ pkg_type = self.ecosytem_type[ecosystem]
for resp_page in self.advisories[ecosystem]:
for adv in resp_page["data"]["securityVulnerabilities"]["edges"]:
name = adv["node"]["package"]["name"]
@@ -181,21 +189,18 @@ class GitHubAPIDataSource(DataSource):
aff_range, self.version_api.get(name)
)
affected_purls = {
- PackageURL(name=pkg_name, namespace=ns,
- version=version, type=pkg_type)
+ PackageURL(name=pkg_name, namespace=ns, version=version, type=pkg_type)
for version in aff_vers
}
unaffected_purls = {
- PackageURL(name=pkg_name, namespace=ns,
- version=version, type=pkg_type)
+ PackageURL(name=pkg_name, namespace=ns, version=version, type=pkg_type)
for version in unaff_vers
}
else:
affected_purls = set()
unaffected_purls = set()
-
cve_ids = set()
vuln_references = []
vuln_desc = adv["node"]["advisory"]["summary"]
@@ -205,12 +210,13 @@ class GitHubAPIDataSource(DataSource):
cve_ids.add(vuln["value"])
elif vuln["type"] == "GHSA":
- ghsa = vuln['value']
- vuln_references.append(Reference(
+ ghsa = vuln["value"]
+ vuln_references.append(
+ Reference(
reference_id=ghsa,
- url="https://github.com/advisories/{}".format(
- ghsa)
- ))
+ url="https://github.com/advisories/{}".format(ghsa),
+ )
+ )
for cve_id in cve_ids:
adv_list.append(
@@ -225,8 +231,9 @@ class GitHubAPIDataSource(DataSource):
return adv_list
@staticmethod
- def categorize_versions(version_range: str, all_versions: Set[str]) -> Tuple[Set[str], Set[str]]: # nopep8
+ def categorize_versions(
+ version_range: str, all_versions: Set[str]
+ ) -> Tuple[Set[str], Set[str]]: # nopep8
version_range = RangeSpecifier(version_range)
- affected_versions = {
- version for version in all_versions if version in version_range}
+ affected_versions = {version for version in all_versions if version in version_range}
return (affected_versions, all_versions - affected_versions)
