Refactor nginx importer to use universal_versions
@@ -27,7 +27,8 @@ import json
import requests
from packageurl import PackageURL
from bs4 import BeautifulSoup
-from dephell_specifier import RangeSpecifier
+from universal_versions.version_specifier import VersionSpecifier
+from universal_versions.versions import SemverVersion
from vulnerabilities.data_source import Advisory
from vulnerabilities.data_source import DataSource
@@ -58,7 +59,7 @@ class NginxDataSource(DataSource):
def updated_advisories(self):
advisories = []
- if create_etag(data_src=self, url=self.url, etag_key="ETag"):
+ # if create_etag(data_src=self, url=self.url, etag_key="ETag"):
self.set_api()
data = requests.get(self.url).content
advisories.extend(self.to_advisories(data))
@@ -126,13 +127,15 @@ class NginxDataSource(DataSource):
raw_ranges = version_info.split(",")
version_ranges = []
for rng in raw_ranges:
- # Eg. "1.7.3+" gets converted to RangeSpecifier("^1.7.3")
+ # Eg. "1.7.3+" gets converted to VersionSpecifier.from_scheme_version_spec_string("semver","^1.7.3")
# The advisory in this case uses `+` in the sense that any version
# with greater or equal `minor` version satisfies the range.
# "1.7.4" satisifes "1.7.3+", but "1.8.4" does not. "1.7.3+" has same
# semantics as that of "^1.7.3"
- version_ranges.append(RangeSpecifier("^" + rng[:-1]))
+ version_ranges.append(
+ VersionSpecifier.from_scheme_version_spec_string("semver", "^" + rng[:-1])
+ )
valid_versions = find_valid_versions(self.version_api.get("nginx/nginx"), version_ranges)
@@ -148,16 +151,26 @@ class NginxDataSource(DataSource):
version_ranges = []
windows_only = False
for version_info in version_infos.split(", "):
+ if version_info == "all":
+ # This is misleading since eventually some version get fixed.
+ continue
+
if "-" not in version_info:
# These are discrete versions
- version_ranges.append(RangeSpecifier(version_info[0]))
+ version_ranges.append(
+ VersionSpecifier.from_scheme_version_spec_string("semver", version_info[0])
+ )
continue
windows_only = "nginx/Windows" in version_info
version_info = version_info.replace("nginx/Windows", "")
lower_bound, upper_bound = version_info.split("-")
- version_ranges.append(RangeSpecifier(f">={lower_bound},<={upper_bound}"))
+ version_ranges.append(
+ VersionSpecifier.from_scheme_version_spec_string(
+ "semver", f">={lower_bound},<={upper_bound}"
+ )
+ )
valid_versions = find_valid_versions(self.version_api.get("nginx/nginx"), version_ranges)
qualifiers = {}
@@ -173,7 +186,8 @@ class NginxDataSource(DataSource):
def find_valid_versions(versions, version_ranges):
valid_versions = set()
for version in versions:
- if any([version in ver_range for ver_range in version_ranges]):
+ version_obj = SemverVersion(version)
+ if any([version_obj in ver_range for ver_range in version_ranges]):
valid_versions.add(version)
return valid_versions
