Centrally normalize vulnerability data #9525
Conversation
sschuberth
requested review from
MarcelBochtler,
oheger-bosch and
a team
as code owners
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## main #9525 +/- ##
=========================================
Coverage 68.00% 68.00%
Complexity 1291 1291
=========================================
Files 249 249
Lines 8819 8819
Branches 917 917
=========================================
Hits 5997 5997
Misses 2433 2433
Partials 389 389
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. |
advisor/src/main/kotlin/Advisor.kt
Outdated
| reference | ||
| .let { | ||
| // Treat "MODERATE" as an alias for "MEDIUM" independently of the scoring system. | ||
| if (it.severity == "MODERATE") reference.copy(severity = "MEDIUM") else it |
There was a problem hiding this comment.
Should be it.copy, but maybe also switch from let to run altogether.
There was a problem hiding this comment.
BTW, this is one of the cases where I've wondered whether we should make use of var instead of val in model data classes. Being able to reassign properties instead of making copies of the parent object would be so much more memory-friendly, and probably also result in more readable code.
There was a problem hiding this comment.
So you want to do pandora.box.open = true instead of pandora.copy(box = pandora.box.copy(open = true))? 😜
There was a problem hiding this comment.
Yes, for some selected properties in selected data classes where we expect data to be fixed-up. If we had proper abstractions of the data models from the APIs, this could be made so that such fixups are only allowed by the producers of the data, but not the consumers (which get an immutable view on the data).
Avoid judgy "old" / "new" terms and use "existing" / "additional" instead. Signed-off-by: Sebastian Schuberth <sebastian@doubleopen.org>
Signed-off-by: Sebastian Schuberth <sebastian@doubleopen.org>
sschuberth
force-pushed
the
advisor-imps
branch
from
ffb9540 to
1bdc4ae
Compare
In all practical cases, OSV's "score" field holds the CVSS vector string, so rename the variable accordingly to avoid confusion with ORT's "severity" string. Signed-off-by: Sebastian Schuberth <sebastian@doubleopen.org>
There are more advisors than VulnerableCode that report "MODERATE" instead of "MEDIUM" as a severity. To address this, generally normalize vulnerability data independently of the advisor. This guarantees uniform data for more convenient use in rules and other places that implement conditions based on e.g. the severity, and results in a more consistent experience when displaying results in a UI. Signed-off-by: Sebastian Schuberth <sebastian@doubleopen.org>
sschuberth
force-pushed
the
advisor-imps
branch
from
1bdc4ae to
b7a28c2
Compare
|
Merging prematurely as relevant checks have passed. |
Please have a look at the individual commit messages for the details.
/cc @lamppu @Etsija