Skip to content

Commit 1bf6e84

Browse files
keshav-spacekeshav-space
committed
Add ArchLinux AdvisoryV2 importer pipeline
Signed-off-by: Keshav Priyadarshi <git@keshav.space>
1 parent 2eb80ba commit 1bf6e84

File tree

4 files changed

+210
-0
lines changed

4 files changed

+210
-0
lines changed

‎vulnerabilities/importers/__init__.py

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,7 @@
4242
from vulnerabilities.pipelines import pypa_importer
4343
from vulnerabilities.pipelines import pysec_importer
4444
from vulnerabilities.pipelines.v2_importers import apache_httpd_importer as apache_httpd_v2
45+
from vulnerabilities.pipelines.v2_importers import archlinux_importer as archlinux_importer_v2
4546
from vulnerabilities.pipelines.v2_importers import (
4647
elixir_security_importer as elixir_security_importer_v2,
4748
)
@@ -99,5 +100,6 @@
99100
ubuntu_usn.UbuntuUSNImporter,
100101
fireeye.FireyeImporter,
101102
oss_fuzz.OSSFuzzImporter,
103+
archlinux_importer_v2.ArchLinuxImporterPipeline,
102104
]
103105
)

‎vulnerabilities/pipelines/v2_importers/archlinux_importer.py

Lines changed: 101 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,101 @@
1+
#
2+
# Copyright (c) nexB Inc. and others. All rights reserved.
3+
# VulnerableCode is a trademark of nexB Inc.
4+
# SPDX-License-Identifier: Apache-2.0
5+
# See http://www.apache.org/licenses/LICENSE-2.0 for the license text.
6+
# See https://github.com/aboutcode-org/vulnerablecode for support or download.
7+
# See https://aboutcode.org for more information about nexB OSS projects.
8+
#
9+
10+
from typing import Iterable
11+
from typing import Mapping
12+
13+
from packageurl import PackageURL
14+
from univers.version_range import ArchLinuxVersionRange
15+
from univers.versions import ArchLinuxVersion
16+
17+
from vulnerabilities.importer import AdvisoryData
18+
from vulnerabilities.importer import AffectedPackage
19+
from vulnerabilities.importer import ReferenceV2
20+
from vulnerabilities.pipelines import VulnerableCodeBaseImporterPipelineV2
21+
from vulnerabilities.utils import fetch_response
22+
23+
24+
class ArchLinuxImporterPipeline(VulnerableCodeBaseImporterPipelineV2):
25+
"""ArchLinux Importer Pipeline"""
26+
27+
pipeline_id = "archlinux_importer_v2"
28+
spdx_license_expression = "MIT"
29+
license_url = "https://github.com/archlinux/arch-security-tracker/blob/master/LICENSE"
30+
31+
@classmethod
32+
def steps(cls):
33+
return (
34+
cls.fetch,
35+
cls.collect_and_store_advisories,
36+
)
37+
38+
def fetch(self) -> Iterable[Mapping]:
39+
url = "https://security.archlinux.org/json"
40+
self.log(f"Fetching `{url}`")
41+
response = fetch_response(url)
42+
self.response = response.json()
43+
44+
def advisories_count(self) -> int:
45+
return len(self.response)
46+
47+
def collect_advisories(self) -> Iterable[AdvisoryData]:
48+
for record in self.response:
49+
yield self.parse_advisory(record)
50+
51+
def parse_advisory(self, record) -> AdvisoryData:
52+
affected_packages = []
53+
references = []
54+
avg_name = record.get("name")
55+
aliases = record.get("issues", [])
56+
aliases.extend(record.get("advisories", []))
57+
summary = record.get("type", "")
58+
summary = "" if summary == "unknown" else summary
59+
60+
for name in record["packages"]:
61+
affected = record.get("affected")
62+
fixed = record.get("fixed")
63+
64+
affected_version_range = (
65+
ArchLinuxVersionRange.from_versions([affected]) if affected else None
66+
)
67+
fixed_version = ArchLinuxVersion(fixed) if fixed else None
68+
affected_package = AffectedPackage(
69+
package=PackageURL(
70+
name=name,
71+
type="alpm",
72+
namespace="archlinux",
73+
),
74+
affected_version_range=affected_version_range,
75+
fixed_version=fixed_version,
76+
)
77+
affected_packages.append(affected_package)
78+
79+
references.append(
80+
ReferenceV2(
81+
reference_id=avg_name,
82+
url="https://security.archlinux.org/{}".format(avg_name),
83+
)
84+
)
85+
for ref in record["advisories"]:
86+
references.append(
87+
ReferenceV2(
88+
reference_id=ref,
89+
url="https://security.archlinux.org/{}".format(ref),
90+
)
91+
)
92+
93+
return AdvisoryData(
94+
advisory_id=f"alpm/{avg_name}",
95+
aliases=aliases,
96+
summary=summary,
97+
references_v2=references,
98+
affected_packages=affected_packages,
99+
weaknesses=[],
100+
url=f"https://security.archlinux.org/{avg_name}.json",
101+
)

‎vulnerabilities/tests/pipelines/v2_importers/test_archlinux_importer.py

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
#
2+
# Copyright (c) nexB Inc. and others. All rights reserved.
3+
# VulnerableCode is a trademark of nexB Inc.
4+
# SPDX-License-Identifier: Apache-2.0
5+
# See http://www.apache.org/licenses/LICENSE-2.0 for the license text.
6+
# See https://github.com/aboutcode-org/vulnerablecode for support or download.
7+
# See https://aboutcode.org for more information about nexB OSS projects.
8+
#
9+
10+
import json
11+
import os
12+
from pathlib import Path
13+
from unittest import TestCase
14+
15+
from vulnerabilities.pipelines.v2_importers.archlinux_importer import ArchLinuxImporterPipeline
16+
from vulnerabilities.tests import util_tests
17+
18+
TEST_DATA = Path(__file__).parent.parent.parent / "test_data" / "archlinux"
19+
20+
21+
class TestArchLinuxImporterPipeline(TestCase):
22+
def test_to_advisories_with_summary(self):
23+
archlinux_advisory_path = TEST_DATA / "archlinux-multi.json"
24+
25+
data = json.loads(archlinux_advisory_path.read_text(encoding="utf-8"))
26+
expected_file = os.path.join(TEST_DATA, "archlinux_advisoryv2-expected.json")
27+
pipeline = ArchLinuxImporterPipeline()
28+
pipeline.response = data
29+
result = [adv.to_dict() for adv in pipeline.collect_advisories()]
30+
util_tests.check_results_against_json(result, expected_file)

‎vulnerabilities/tests/test_data/archlinux/archlinux_advisoryv2-expected.json

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
[
2+
{
3+
"aliases": [
4+
"CVE-2022-29217"
5+
],
6+
"summary": "",
7+
"affected_packages": [
8+
{
9+
"package": {
10+
"type": "alpm",
11+
"namespace": "archlinux",
12+
"name": "python-pyjwt",
13+
"version": "",
14+
"qualifiers": "",
15+
"subpath": ""
16+
},
17+
"affected_version_range": "vers:alpm/2.3.0-1",
18+
"fixed_version": "2.4.0-1"
19+
}
20+
],
21+
"references": [],
22+
"date_published": null,
23+
"weaknesses": [],
24+
"url": "https://security.archlinux.org/AVG-2781.json"
25+
},
26+
{
27+
"aliases": [
28+
"CVE-2022-26710",
29+
"CVE-2022-22677",
30+
"CVE-2022-22662"
31+
],
32+
"summary": "",
33+
"affected_packages": [
34+
{
35+
"package": {
36+
"type": "alpm",
37+
"namespace": "archlinux",
38+
"name": "wpewebkit",
39+
"version": "",
40+
"qualifiers": "",
41+
"subpath": ""
42+
},
43+
"affected_version_range": "vers:alpm/2.36.3-1",
44+
"fixed_version": "2.36.4-1"
45+
}
46+
],
47+
"references": [],
48+
"date_published": null,
49+
"weaknesses": [],
50+
"url": "https://security.archlinux.org/AVG-2780.json"
51+
},
52+
{
53+
"aliases": [
54+
"CVE-2016-3189",
55+
"ASA-201702-19"
56+
],
57+
"summary": "denial of service",
58+
"affected_packages": [
59+
{
60+
"package": {
61+
"type": "alpm",
62+
"namespace": "archlinux",
63+
"name": "bzip2",
64+
"version": "",
65+
"qualifiers": "",
66+
"subpath": ""
67+
},
68+
"affected_version_range": "vers:alpm/1.0.6-5",
69+
"fixed_version": "1.0.6-6"
70+
}
71+
],
72+
"references": [],
73+
"date_published": null,
74+
"weaknesses": [],
75+
"url": "https://security.archlinux.org/AVG-4.json"
76+
}
77+
]

0 commit comments

Comments
 (0)