Elixir Security Importer #294

tushar912 · 2020-12-05T08:02:47Z

Fixes #287 by @sbs2001

Description

I have added importer and tests for elixir security

steven-esser

@tushar912 Just a few formatting and stylistic comments.

Also, please squash your minor commits into a single and write a descriptive commit message.

This helps future developers understand what exactly was added or changed when looking at the history.

Thanks for your contribution!

vulnerabilities/tests/test_elixir_security.py

vulnerabilities/importers/elixir_security.py

vulnerabilities/importers/__init__.py

vulnerabilities/tests/test_elixir_security.py

vulnerabilities/importers/elixir_security.py

sbs2001 · 2020-12-09T03:06:22Z

Thanks ! @tushar912 I've done a light review for now, see comments inline. I'll do another review once this is resolved.

Signed-off-by: Tushar912 <tushar.912u@gmail.com> add elixir security to init.py Signed-off-by: Tushar912 <tushar.912u@gmail.com> add test for elixir security Signed-off-by: Tushar912 <tushar.912u@gmail.com> fixed code style Signed-off-by: Tushar912 <tushar.912u@gmail.com>

Signed-off-by: Tushar912 <tushar.912u@gmail.com>

vulnerabilities/importers/elixir_security.py

vulnerabilities/tests/test_elixir_security.py

sbs2001 · 2020-12-11T08:53:37Z

vulnerabilities/importers/elixir_security.py

+            version_list.append(release["version"])
+        return version_list
+
+    def get_pkg_from_range(self, version_list, pkg_name):


The function says get_pkg_from_range but returns a version list

is get_versions_from_range better

vulnerabilities/importers/elixir_security.py

Signed-off-by: Tushar912 <tushar.912u@gmail.com>

vulnerabilities/tests/test_elixir_security.py

vulnerabilities/importers/elixir_security.py

vulnerabilities/package_managers.py

vulnerabilities/tests/test_elixir_security.py

vulnerabilities/importers/elixir_security.py

sbs2001 · 2020-12-17T11:46:43Z

@tushar912 btw after the rebase :

Add your name to https://github.com/nexB/vulnerablecode/blob/main/AUTHORS.rst
Add details of the importer to https://github.com/nexB/vulnerablecode/blob/main/SOURCES.rst

tushar912 · 2020-12-17T15:43:51Z

@sbs2001 should i fetch the latest changes and resolve the conflicts

tushar912 · 2020-12-17T15:45:27Z

I think you have added a load_yaml function in helpers. I may need it.

sbs2001 · 2020-12-18T04:44:02Z

@tushar912

@sbs2001 should i fetch the latest changes and resolve the conflicts

Yes !

I think you have added a load_yaml function in helpers. I may need it.

That will be great use it :) .

Signed-off-by: Tushar912 <tushar.912u@gmail.com>

sbs2001

Thanks @tushar912 for your patience, we're almost done see my comments inline

vulnerabilities/importers/elixir_security.py

vulnerabilities/importer_yielder.py

vulnerabilities/importers/elixir_security.py

vulnerabilities/tests/test_elixir_security.py

vulnerabilities/importers/elixir_security.py

sbs2001 · 2020-12-19T04:55:58Z

@tushar912 what is b0e9451 ?

used load_yaml from helpers Signed-off-by: Tushar912 <tushar.912u@gmail.com> fix typo in importer Signed-off-by: Tushar912 <tushar.912u@gmail.com>

tushar912 · 2020-12-19T18:10:52Z

@sbs2001 i have reworded that

Signed-off-by: Tushar912 <tushar.912u@gmail.com>

vulnerabilities/importers/elixir_security.py

sbs2001 · 2020-12-22T15:48:35Z

vulnerabilities/importers/elixir_security.py

+
+        return packages
+
+    def get_versions_from_range(self, version_list, pkg_name):


A comment or docstring would be very helpful here.

Actually this function doesn't make sense it's called get_versions_from_range but the parameters don't have suggest any sort of range

Plus the name of package is required, which the name of the function doesn't suggest

should I rename it as get_versions_for_pkg_from_range_list. I would rename the parameter version_list to version_range_list. I would make sure to add comment also

That's verbose, but fine by me :) . A better design would be to decouple the obtaining of all versions of package from categorising the versions.

Signed-off-by: Tushar912 <tushar.912u@gmail.com>

sbs2001 · 2020-12-25T06:32:36Z

vulnerabilities/importers/elixir_security.py

+from packageurl import PackageURL
+
+from vulnerabilities.data_source import GitDataSource
+from vulnerabilities.data_source import GitDataSourceConfiguration


This import is not required

sbs2001 · 2020-12-25T06:33:07Z

vulnerabilities/importers/elixir_security.py

+            yaml_file["unaffected_versions"] = []
+
+        safe_pkg_versions, vuln_pkg_versions = self.get_versions_for_pkg_from_range_list(
+            yaml_file.get("patched_versions") + yaml_file.get("unaffected_versions"),


No need for get now

sbs2001

@tushar912 This PR can be merged after fixing the few nits I've suggested.

Also add your name in the CONTRIBUTING.rst.

tushar912 · 2020-12-25T11:57:38Z

@sbs2001 what should I write in ecosystems covered in SOURCES.rst for this importer.

sbs2001 · 2020-12-25T12:10:14Z

@tushar912 the ecosystem would be hex packages

tushar912 · 2020-12-27T21:16:33Z

@sbs2001 I have made the changes

sbs2001 · 2020-12-28T07:07:00Z

SOURCES.rst

 +----------------+------------------------------------------------------------------------------------------------------+----------------------------------------------------+
 |postgresql      | https://www.postgresql.org/support/security/                                                         |postgresql                                          |
 +----------------+------------------------------------------------------------------------------------------------------+----------------------------------------------------+
+|elixir_security | https://github.com/dependabot/elixir-security-advisories'                                            |hex packages                                        |


Remove the single quote at end of the url

Oh Sorry I missed it.I will make the change

Signed-off-by: Tushar912 <tushar.912u@gmail.com> remove single quote at end of url Signed-off-by: Tushar912 <tushar.912u@gmail.com>

sbs2001

LGTM ! Thanks @tushar912 I'm merging this :)

tushar912 changed the title ~~Elixir~~ Elixir Security Importer Dec 5, 2020

steven-esser reviewed Dec 7, 2020

View reviewed changes

sbs2001 reviewed Dec 9, 2020

View reviewed changes

vulnerabilities/importers/elixir_security.py Outdated Show resolved Hide resolved

sbs2001 reviewed Dec 9, 2020

View reviewed changes

vulnerabilities/importers/elixir_security.py Outdated Show resolved Hide resolved

sbs2001 reviewed Dec 9, 2020

View reviewed changes

vulnerabilities/importers/elixir_security.py Outdated Show resolved Hide resolved

sbs2001 reviewed Dec 9, 2020

View reviewed changes

vulnerabilities/importers/elixir_security.py Outdated Show resolved Hide resolved

tushar912 force-pushed the elixir branch from 095fbef to 38ec05f Compare December 9, 2020 07:40

use dephell_specifier for version ranges and sort imports

70ac4cd

Signed-off-by: Tushar912 <tushar.912u@gmail.com>

tushar912 requested a review from sbs2001 December 9, 2020 10:31

sbs2001 requested changes Dec 11, 2020

View reviewed changes

tushar912 added 2 commits December 12, 2020 13:13

added HexVersionAPI and mock test it

f809a89

Signed-off-by: Tushar912 <tushar.912u@gmail.com>

fixed code style

922e34f

Signed-off-by: Tushar912 <tushar.912u@gmail.com>

tushar912 requested a review from sbs2001 December 12, 2020 08:51

sbs2001 requested changes Dec 15, 2020

View reviewed changes

initialize hexapi with cache and sort imports

ee6dd62

Signed-off-by: Tushar912 <tushar.912u@gmail.com>

tushar912 force-pushed the elixir branch from 8a1f30a to 9a41fad Compare December 18, 2020 17:59

tushar912 requested a review from sbs2001 December 18, 2020 18:06

sbs2001 requested changes Dec 19, 2020

View reviewed changes

Merge new changes and use load_yaml from helpers

58a253f

used load_yaml from helpers Signed-off-by: Tushar912 <tushar.912u@gmail.com> fix typo in importer Signed-off-by: Tushar912 <tushar.912u@gmail.com>

tushar912 force-pushed the elixir branch from 9a41fad to 58a253f Compare December 19, 2020 18:10

add license and categorize left versions as vuln

6e62cdf

Signed-off-by: Tushar912 <tushar.912u@gmail.com>

tushar912 requested a review from sbs2001 December 21, 2020 21:19

sbs2001 reviewed Dec 22, 2020

View reviewed changes

vulnerabilities/importers/elixir_security.py Outdated Show resolved Hide resolved

sbs2001 reviewed Dec 22, 2020

View reviewed changes

vulnerabilities/importers/elixir_security.py Show resolved Hide resolved

sbs2001 reviewed Dec 22, 2020

View reviewed changes

vulnerabilities/importers/elixir_security.py Show resolved Hide resolved

sbs2001 reviewed Dec 22, 2020

View reviewed changes

change name of function get_version_from range and add comments in it

fd25df3

Signed-off-by: Tushar912 <tushar.912u@gmail.com>

tushar912 requested a review from sbs2001 December 22, 2020 21:25

sbs2001 reviewed Dec 25, 2020

View reviewed changes

sbs2001 requested changes Dec 25, 2020

View reviewed changes

tushar912 requested a review from sbs2001 December 25, 2020 14:10

sbs2001 reviewed Dec 28, 2020

View reviewed changes

remove unused import and add name to authors and add importer to sources

0fa1bf4

Signed-off-by: Tushar912 <tushar.912u@gmail.com> remove single quote at end of url Signed-off-by: Tushar912 <tushar.912u@gmail.com>

tushar912 force-pushed the elixir branch from b5dc3c1 to 0fa1bf4 Compare December 28, 2020 20:40

tushar912 requested a review from sbs2001 December 28, 2020 20:42

sbs2001 approved these changes Dec 29, 2020

View reviewed changes

sbs2001 merged commit 9897939 into aboutcode-org:main Dec 29, 2020


		return packages

		def get_versions_from_range(self, version_list, pkg_name):

Uh oh!

Elixir Security Importer #294

Elixir Security Importer #294

Uh oh!

Conversation

tushar912 commented Dec 5, 2020

Description

Uh oh!

steven-esser left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sbs2001 commented Dec 9, 2020

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sbs2001 commented Dec 17, 2020

Uh oh!

tushar912 commented Dec 17, 2020

Uh oh!

tushar912 commented Dec 17, 2020

Uh oh!

sbs2001 commented Dec 18, 2020

Uh oh!

sbs2001 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sbs2001 commented Dec 19, 2020

Uh oh!

tushar912 commented Dec 19, 2020

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sbs2001 Dec 22, 2020 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

tushar912 Dec 22, 2020 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

sbs2001 Dec 22, 2020 •

edited

Loading

tushar912 Dec 22, 2020 •

edited

Loading