Skip to content

Commit abf81d5

Browse files
keshav-spacekeshav-space
authored
Merge pull request #1942 from aboutcode-org/archlinux-adv-v2
Add ArchLinux AdvisoryV2 importer pipeline
2 parents 55dc5d3 + 76e915c commit abf81d5

4 files changed

Lines changed: 209 additions & 0 deletions

File tree

‎vulnerabilities/importers/__init__.py‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,7 @@
4242
from vulnerabilities.pipelines import pypa_importer
4343
from vulnerabilities.pipelines import pysec_importer
4444
from vulnerabilities.pipelines.v2_importers import apache_httpd_importer as apache_httpd_v2
45+
from vulnerabilities.pipelines.v2_importers import archlinux_importer as archlinux_importer_v2
4546
from vulnerabilities.pipelines.v2_importers import curl_importer as curl_importer_v2
4647
from vulnerabilities.pipelines.v2_importers import (
4748
elixir_security_importer as elixir_security_importer_v2,
@@ -62,6 +63,7 @@
6263

6364
IMPORTERS_REGISTRY = create_registry(
6465
[
66+
archlinux_importer_v2.ArchLinuxImporterPipeline,
6567
nvd_importer_v2.NVDImporterPipeline,
6668
elixir_security_importer_v2.ElixirSecurityImporterPipeline,
6769
npm_importer_v2.NpmImporterPipeline,

‎vulnerabilities/pipelines/v2_importers/archlinux_importer.py‎

Lines changed: 100 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,100 @@
1+
#
2+
# Copyright (c) nexB Inc. and others. All rights reserved.
3+
# VulnerableCode is a trademark of nexB Inc.
4+
# SPDX-License-Identifier: Apache-2.0
5+
# See http://www.apache.org/licenses/LICENSE-2.0 for the license text.
6+
# See https://github.com/aboutcode-org/vulnerablecode for support or download.
7+
# See https://aboutcode.org for more information about nexB OSS projects.
8+
#
9+
10+
from typing import Iterable
11+
from typing import Mapping
12+
13+
from packageurl import PackageURL
14+
from univers.version_range import ArchLinuxVersionRange
15+
16+
from vulnerabilities.importer import AdvisoryData
17+
from vulnerabilities.importer import AffectedPackageV2
18+
from vulnerabilities.importer import ReferenceV2
19+
from vulnerabilities.pipelines import VulnerableCodeBaseImporterPipelineV2
20+
from vulnerabilities.utils import fetch_response
21+
22+
23+
class ArchLinuxImporterPipeline(VulnerableCodeBaseImporterPipelineV2):
24+
"""ArchLinux Importer Pipeline"""
25+
26+
pipeline_id = "archlinux_importer_v2"
27+
spdx_license_expression = "MIT"
28+
license_url = "https://github.com/archlinux/arch-security-tracker/blob/master/LICENSE"
29+
30+
@classmethod
31+
def steps(cls):
32+
return (
33+
cls.fetch,
34+
cls.collect_and_store_advisories,
35+
)
36+
37+
def fetch(self) -> Iterable[Mapping]:
38+
url = "https://security.archlinux.org/json"
39+
self.log(f"Fetching `{url}`")
40+
response = fetch_response(url)
41+
self.response = response.json()
42+
43+
def advisories_count(self) -> int:
44+
return len(self.response)
45+
46+
def collect_advisories(self) -> Iterable[AdvisoryData]:
47+
for record in self.response:
48+
yield self.parse_advisory(record)
49+
50+
def parse_advisory(self, record) -> AdvisoryData:
51+
affected_packages = []
52+
references = []
53+
avg_name = record.get("name")
54+
aliases = record.get("issues", [])
55+
aliases.extend(record.get("advisories", []))
56+
summary = record.get("type", "")
57+
summary = "" if summary == "unknown" else summary
58+
59+
for name in record["packages"]:
60+
affected = record.get("affected")
61+
fixed = record.get("fixed")
62+
63+
affected_version_range = (
64+
ArchLinuxVersionRange.from_versions([affected]) if affected else None
65+
)
66+
fixed_version_range = ArchLinuxVersionRange.from_versions([fixed]) if fixed else None
67+
affected_package = AffectedPackageV2(
68+
package=PackageURL(
69+
name=name,
70+
type="alpm",
71+
namespace="archlinux",
72+
),
73+
affected_version_range=affected_version_range,
74+
fixed_version_range=fixed_version_range,
75+
)
76+
affected_packages.append(affected_package)
77+
78+
references.append(
79+
ReferenceV2(
80+
reference_id=avg_name,
81+
url="https://security.archlinux.org/{}".format(avg_name),
82+
)
83+
)
84+
for ref in record["advisories"]:
85+
references.append(
86+
ReferenceV2(
87+
reference_id=ref,
88+
url="https://security.archlinux.org/{}".format(ref),
89+
)
90+
)
91+
92+
return AdvisoryData(
93+
advisory_id=avg_name,
94+
aliases=aliases,
95+
summary=summary,
96+
references_v2=references,
97+
affected_packages=affected_packages,
98+
weaknesses=[],
99+
url=f"https://security.archlinux.org/{avg_name}.json",
100+
)

‎vulnerabilities/tests/pipelines/v2_importers/test_archlinux_importer_v2.py‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
#
2+
# Copyright (c) nexB Inc. and others. All rights reserved.
3+
# VulnerableCode is a trademark of nexB Inc.
4+
# SPDX-License-Identifier: Apache-2.0
5+
# See http://www.apache.org/licenses/LICENSE-2.0 for the license text.
6+
# See https://github.com/aboutcode-org/vulnerablecode for support or download.
7+
# See https://aboutcode.org for more information about nexB OSS projects.
8+
#
9+
10+
import json
11+
import os
12+
from pathlib import Path
13+
from unittest import TestCase
14+
15+
from vulnerabilities.pipelines.v2_importers.archlinux_importer import ArchLinuxImporterPipeline
16+
from vulnerabilities.tests import util_tests
17+
18+
TEST_DATA = Path(__file__).parent.parent.parent / "test_data" / "archlinux"
19+
20+
21+
class TestArchLinuxImporterPipeline(TestCase):
22+
def test_to_archlinux_advisories_v2(self):
23+
archlinux_advisory_path = TEST_DATA / "archlinux-multi.json"
24+
25+
data = json.loads(archlinux_advisory_path.read_text(encoding="utf-8"))
26+
expected_file = os.path.join(TEST_DATA, "archlinux_advisoryv2-expected.json")
27+
pipeline = ArchLinuxImporterPipeline()
28+
pipeline.response = data
29+
result = [adv.to_dict() for adv in pipeline.collect_advisories()]
30+
util_tests.check_results_against_json(result, expected_file)

‎vulnerabilities/tests/test_data/archlinux/archlinux_advisoryv2-expected.json‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
[
2+
{
3+
"aliases": [
4+
"CVE-2022-29217"
5+
],
6+
"summary": "",
7+
"affected_packages": [
8+
{
9+
"package": {
10+
"type": "alpm",
11+
"namespace": "archlinux",
12+
"name": "python-pyjwt",
13+
"version": "",
14+
"qualifiers": "",
15+
"subpath": ""
16+
},
17+
"affected_version_range": "vers:alpm/2.3.0-1",
18+
"fixed_version_range": "vers:alpm/2.4.0-1"
19+
}
20+
],
21+
"references": [],
22+
"date_published": null,
23+
"weaknesses": [],
24+
"url": "https://security.archlinux.org/AVG-2781.json"
25+
},
26+
{
27+
"aliases": [
28+
"CVE-2022-26710",
29+
"CVE-2022-22677",
30+
"CVE-2022-22662"
31+
],
32+
"summary": "",
33+
"affected_packages": [
34+
{
35+
"package": {
36+
"type": "alpm",
37+
"namespace": "archlinux",
38+
"name": "wpewebkit",
39+
"version": "",
40+
"qualifiers": "",
41+
"subpath": ""
42+
},
43+
"affected_version_range": "vers:alpm/2.36.3-1",
44+
"fixed_version_range": "vers:alpm/2.36.4-1"
45+
}
46+
],
47+
"references": [],
48+
"date_published": null,
49+
"weaknesses": [],
50+
"url": "https://security.archlinux.org/AVG-2780.json"
51+
},
52+
{
53+
"aliases": [
54+
"CVE-2016-3189",
55+
"ASA-201702-19"
56+
],
57+
"summary": "denial of service",
58+
"affected_packages": [
59+
{
60+
"package": {
61+
"type": "alpm",
62+
"namespace": "archlinux",
63+
"name": "bzip2",
64+
"version": "",
65+
"qualifiers": "",
66+
"subpath": ""
67+
},
68+
"affected_version_range": "vers:alpm/1.0.6-5",
69+
"fixed_version_range": "vers:alpm/1.0.6-6"
70+
}
71+
],
72+
"references": [],
73+
"date_published": null,
74+
"weaknesses": [],
75+
"url": "https://security.archlinux.org/AVG-4.json"
76+
}
77+
]

0 commit comments

Comments
 (0)