Skip to content

Commit 4e5bc67

Browse files
sbs2001sbs2001
committed
Refactor to handle default epochs
Signed-off-by: Shivam Sandbhor <shivam.sandbhor@gmail.com>
1 parent 4406f16 commit 4e5bc67

File tree

3 files changed

+77
-36
lines changed

3 files changed

+77
-36
lines changed

‎vulnerabilities/package_managers.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -67,7 +67,7 @@ async def set_api(self, pkg, session):
6767
self.cache[pkg] = {}
6868
break
6969
for release in resp_json["entries"]:
70-
all_versions.add(release["source_package_version"])
70+
all_versions.add(release["source_package_version"].replace("0:", ""))
7171
if resp_json.get("next_collection_link"):
7272
url = resp_json["next_collection_link"]
7373
else:
@@ -197,7 +197,7 @@ async def set_api(self, pkg, session, retry_count=5):
197197
self.cache[pkg] = {}
198198
return
199199
for release in resp_json["versions"]:
200-
all_versions.add(release["version"])
200+
all_versions.add(release["version"].replace("0:", ""))
201201

202202
self.cache[pkg] = all_versions
203203
# TODO : Handle ServerDisconnectedError by using some sort of

‎vulnerabilities/tests/test_debian_oval.py‎

Lines changed: 45 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -33,10 +33,12 @@ def setUpClass(cls):
3333
cls.debian_oval_data_src = DebianOvalDataSource(batch_size=1, config=data_source_cfg)
3434

3535
@patch(
36-
"vulnerabilities.importers.debian_oval.DebianVersionAPI.get",
37-
return_value={"0:1.11.1+dfsg-5+deb7u1", "0:0.11.1+dfsg-5+deb7u1", "2.3.9"},
38-
)
39-
@patch("vulnerabilities.importers.debian_oval.DebianVersionAPI.load_api", new=mock)
36+
'vulnerabilities.importers.debian_oval.DebianVersionAPI.get',
37+
return_value={
38+
'1.11.1+dfsg-5+deb7u1',
39+
'0.11.1+dfsg-5+deb7u1',
40+
'2.3.9'})
41+
@patch('vulnerabilities.importers.debian_oval.DebianVersionAPI.load_api', new=mock)
4042
def test_get_data_from_xml_doc(self, mock_write):
4143
expected_advisories = [
4244
Advisory(
@@ -45,21 +47,36 @@ def test_get_data_from_xml_doc(self, mock_write):
4547
PackageURL(
4648
type="deb",
4749
namespace=None,
50+
<<<<<<< HEAD
4851
name="krb5",
4952
version="0:0.11.1+dfsg-5+deb7u1",
5053
qualifiers=OrderedDict([("distro", "wheezy")]),
5154
subpath=None,
5255
)
5356
},
57+
=======
58+
name='krb5',
59+
version='0.11.1+dfsg-5+deb7u1',
60+
qualifiers=OrderedDict([('distro', 'wheezy')]),
61+
subpath=None
62+
)},
63+
>>>>>>> Refactor to handle default epochs
5464
resolved_package_urls={
5565
PackageURL(
5666
type="deb",
5767
namespace=None,
68+
<<<<<<< HEAD
5869
name="krb5",
5970
version="0:1.11.1+dfsg-5+deb7u1",
6071
qualifiers=OrderedDict([("distro", "wheezy")]),
6172
subpath=None,
6273
),
74+
=======
75+
name='krb5',
76+
version='1.11.1+dfsg-5+deb7u1',
77+
qualifiers=OrderedDict([('distro', 'wheezy')]),
78+
subpath=None),
79+
>>>>>>> Refactor to handle default epochs
6380
PackageURL(
6481
type="deb",
6582
namespace=None,
@@ -77,6 +94,7 @@ def test_get_data_from_xml_doc(self, mock_write):
7794
PackageURL(
7895
type="deb",
7996
namespace=None,
97+
<<<<<<< HEAD
8098
name="a2ps",
8199
version="0:0.11.1+dfsg-5+deb7u1",
82100
qualifiers=OrderedDict([("distro", "wheezy")]),
@@ -104,6 +122,29 @@ def test_get_data_from_xml_doc(self, mock_write):
104122
vulnerability_id="CVE-2001-1593",
105123
),
106124
]
125+
=======
126+
name='a2ps',
127+
version='0.11.1+dfsg-5+deb7u1',
128+
qualifiers=OrderedDict([('distro', 'wheezy')]),
129+
subpath=None
130+
)},
131+
resolved_package_urls={
132+
PackageURL(type='deb',
133+
namespace=None,
134+
name='a2ps',
135+
version='2.3.9',
136+
qualifiers=OrderedDict([('distro', 'wheezy')]),
137+
subpath=None),
138+
PackageURL(type='deb',
139+
namespace=None,
140+
name='a2ps',
141+
version='1.11.1+dfsg-5+deb7u1',
142+
qualifiers=OrderedDict([('distro', 'wheezy')]),
143+
subpath=None)},
144+
vulnerability_id='CVE-2001-1593')
145+
146+
}
147+
>>>>>>> Refactor to handle default epochs
107148

108149
xml_doc = ET.parse(os.path.join(TEST_DATA, "debian_oval_data.xml"))
109150
# Dirty quick patch to mock batch_advisories

‎vulnerabilities/tests/test_suse.py‎

Lines changed: 30 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -103,7 +103,7 @@ def test_get_version_ranges_from_state(self):
103103
state_2 = self.parsed_oval.oval_document.getStates()[1]
104104

105105
exp_range_1 = None
106-
exp_range_2 = RangeSpecifier("<0:1.2.11-lp151.3.6")
106+
exp_range_2 = RangeSpecifier("<1.2.11-lp151.3.6")
107107
#In a full run we wont get exp_range1 because we won't obtain
108108
#it's state due to filters to avoid such tests in the first place
109109
assert self.parsed_oval.get_version_ranges_from_state(state_1) == exp_range_1
@@ -131,36 +131,36 @@ def test_get_urls_from_definition(self):
131131
def test_get_data(self):
132132

133133
expected_data = [
134-
{
135-
"test_data": [
136-
{
137-
"package_list": ["cacti"],
138-
"version_ranges": RangeSpecifier("<0:1.2.11-lp151.3.6"),
139-
},
140-
{
141-
"package_list": ["cacti-spine"],
142-
"version_ranges": RangeSpecifier("<0:1.2.11-lp151.3.6"),
143-
},
144-
],
145-
"description": '\n Cacti 0.8.7e and earlier allows remote authenticated administrators to gain privileges by modifying the "Data Input Method" for the "Linux - Get Memory Usage" setting to contain arbitrary commands.\n ',
146-
"vuln_id": "CVE-2009-4112",
147-
"reference_urls": {
148-
"https://bugzilla.suse.com/1122535",
149-
"https://bugzilla.suse.com/558664",
150-
"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4112",
151-
"https://www.suse.com/security/cve/CVE-2009-4112.html",
134+
{
135+
'test_data':
136+
[
137+
{
138+
'package_list': ['cacti'],
139+
'version_ranges': RangeSpecifier("<1.2.11-lp151.3.6")
140+
}
141+
,
142+
{
143+
'package_list': ['cacti-spine'],
144+
'version_ranges': RangeSpecifier("<1.2.11-lp151.3.6")
145+
}
146+
],
147+
'description':'\n Cacti 0.8.7e and earlier allows remote authenticated administrators to gain privileges by modifying the "Data Input Method" for the "Linux - Get Memory Usage" setting to contain arbitrary commands.\n ',
148+
'vuln_id': 'CVE-2009-4112',
149+
'reference_urls': {
150+
'https://bugzilla.suse.com/1122535',
151+
'https://bugzilla.suse.com/558664',
152+
'http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4112',
153+
'https://www.suse.com/security/cve/CVE-2009-4112.html'}
154+
},
155+
{ 'test_data':
156+
[
157+
{
158+
'package_list': ['apache2-mod_perl'],
159+
'version_ranges': RangeSpecifier("<2.0.11-lp151.3.3")
152160
},
153-
},
154-
{
155-
"test_data": [
156-
{
157-
"package_list": ["apache2-mod_perl"],
158-
"version_ranges": RangeSpecifier("<0:2.0.11-lp151.3.3"),
159-
},
160-
{
161-
"package_list": ["apache2-mod_perl-devel"],
162-
"version_ranges": RangeSpecifier("<0:2.0.11-lp151.3.3"),
163-
},
161+
{
162+
'package_list': ['apache2-mod_perl-devel'],
163+
'version_ranges': RangeSpecifier("<2.0.11-lp151.3.3")}
164164
],
165165
"description": "\n mod_perl 2.0 through 2.0.10 allows attackers to execute arbitrary Perl code by placing it in a user-owned .htaccess file, because (contrary to the documentation) there is no configuration option that permits Perl code for the administrator's control of HTTP request processing without also permitting unprivileged users to run Perl code in the context of the user account that runs Apache HTTP Server processes.\n ",
166166
"vuln_id": "CVE-2011-2767",

0 commit comments

Comments
 (0)