Add PyPI OSV #632

ziadhany · 2022-02-20T17:52:08Z

#607
Signed-off-by: Ziad [email protected]

pombredanne

@ziadhany Thank you ++ do you mind to add a few tests?
Also may be rename this module to pysec.py?

vulnerabilities/importers/pysec.py

pombredanne

BTW you may want to amend your commit message in 2fb225d
"Add PyPL OSV" could be something like:

Add PyPI OSV importer

Reference: https://github.com/nexB/vulnerablecode/issues/607
Signed-off-by: Ziad <[email protected]>

and you could squash your commits too

TG1999

Thank You for your contribution, please check for items before accessing them, if they are not there log it, please check alpine importer for reference. I have added some comments for your consideration.

vulnerabilities/importers/pysec.py

TG1999 · 2022-03-04T14:21:33Z

@ziadhany Please rebase your branch as well :)

Hritik14

Thank you for researching on OSV! There are a few points I'd like you to consider

vulnerabilities/importers/pysec.py

vulnerabilities/tests/test_data/pysec/pysec_test.json

vulnerabilities/tests/test_pysec.py

vulnerabilities/importers/pysec.py

pombredanne

Thank you ++ for the updates!
I added some comments for your kind consideration.

vulnerabilities/importers/pysec.py

pombredanne · 2022-03-10T14:07:09Z

vulnerabilities/importers/pysec.py

+                                        f"fixed_version InvalidVersion - PypiVersion - {raw_data['id'] !r}"
+                                    )
+
+                        if fix_range["type"] == "SEMVER":


How would it be possible for a PyPI range to use semver?
Also this code is too complicated for me to understand as is the same code above... can you find a way to decompose this in something simpler? Also it is duplicated almost exactly with the code above... so creating a function would make sense to avoid duplicated code.

ex: GHSA-2ghc-6v89-pw9j.json
https://osv.dev/vulnerability/GHSA-2ghc-6v89-pw9j

@ziadhany Thanks ... so in https://osv.dev/vulnerability/GHSA-2ghc-6v89-pw9j I see three different affected packages:

npm/body-parser-xml which would become the purl pkg:npm/body-parser-xml and is reported as SEMVER versioning which would become the npm vers scheme on our side. This is found at https://www.npmjs.com/package/body-parser-xml

NuGet/body-parser-xml-nuget which would become the purl pkg:nuget/body-parser-xml-nuget and is reported as ECOSYSTEM versioning and would become the nuget vers scheme on our side... BUT this does NOT exist as a nuget package at all. https://www.nuget.org/packages?q=body-parser-xml ... not even close

PyPI/body-parser-xml-pip which would become the purl pkg:nuget/body-parser-xml-pip and is reported as ECOSYSTEM versioning and would become the pypi vers scheme on our side. BUT this does NOT exist as a pypi package at all: https://pypi.org/search/?q=body-parser-xml

So what to make of this? OSV and GitHub data are likely not really reviewed after all. That's not the first time I see junk ghost records like this that are supposedly reviewed.

In anycase this are not a Pypi package... but it is going to be hard to figure this out ... at least not at import time.
I note that this is not seen at all in https://github.com/pypa/advisory-database
So practically:

I entered Add improver to validate that collected purl are real. #644 to add improvers to validate purls

short term we could flag these with lower confidence but I am not sure we have enough at import time

so we can import these ... each should use their own specific vers scheme though and PyPI is NOT semver alright

There is not much harm done to import non-existing purl BTW because these would never be found in the wild.

vulnerabilities/importers/pysec.py

vulnerabilities/tests/test_pysec.py

vulnerabilities/importers/pysec.py

TG1999

Thanks Ziad, for your changes, I have added some comments for your consideration

vulnerabilities/importers/pysec.py

vulnerabilities/tests/test_pysec.py

TG1999 · 2022-03-17T17:01:40Z

@ziadhany there is a field called "database_specific" in test data, do see if we can derive some severities from there

vulnerabilities/importers/pysec.py

ziadhany · 2022-03-20T12:48:56Z

@ziadhany there is a field called "database_specific" in test data, do see if we can derive some severities from there

@TG1999 Do we support CWE Scoring System ?

vulnerabilities/tests/test_pysec.py

pombredanne

Looking great!
I am nitpicking on a few extra things because I am picky!, but the code overall looks nice as it is.

Some general remarks:

create variables early rather than looking up a dict over and over
a small docstring to explain what a function does is not mandatory but useful for no-trivial, non-obvious functions.

pombredanne · 2022-04-18T15:37:44Z

vulnerabilities/tests/test_pysec.py

+            }
+        ) == [
+            VulnerabilitySeverity(
+                system=SCORING_SYSTEMS["cvssv3_vector"],


Are you sure this may not be CVSS:3.1 and cvssv3.1_vector instead? https://github.com/nexB/vulnerablecode/blob/47f6ae62d919fff5094b960c1f56bc0c6b8b4be3/vulnerabilities/severity_systems.py#L83

No, I'm not sure.
but have a look at osv-schema:
https://ossf.github.io/osv-schema/#severitytype-field
Severity Type: CVSS_V3
Score Description : A CVSS vector string ...

ex GHSA-xc3p-ff3m-f46v.json:
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"

vulnerabilities/tests/test_pysec.py

pombredanne · 2022-04-18T15:42:07Z

vulnerabilities/importers/pysec.py

+        return []
+
+
+def get_aff_purl(affected_pkg, raw_id):


What about this? Spelling out whole words is fine

Suggested change

def get_aff_purl(affected_pkg, raw_id):

def get_affected_purl(affected_pkg, raw_id):

"""

Return an affected PackageURL given an ``affected_pkg`` mapping and a ``raw_id``

"""

BTW, why do you need a raw_id there?

just for logs (to track the root cause of errors and fix them easily)

pombredanne · 2022-04-18T15:42:43Z

vulnerabilities/importers/pysec.py

+        logger.error(f"purl affected_pkg not found - {raw_id !r}")
+
+
+def get_aff_version_range(affected_pkg, raw_id):


Same comment as above...

Suggested change

def get_aff_version_range(affected_pkg, raw_id):

def get_affected_version_range(affected_pkg, raw_id):

pombredanne · 2022-04-18T15:45:03Z

vulnerabilities/importers/pysec.py

+
+
+def get_aff_version_range(affected_pkg, raw_id):
+    if "versions" in affected_pkg:


What about something like this instead?

affected_versions = affected_pkg.get("versions") if affected_versions: try: return PypiVersionRange(affected_versions)

pombredanne · 2022-04-18T15:45:54Z

vulnerabilities/importers/pysec.py

+    if "versions" in affected_pkg:
+        try:
+            return PypiVersionRange(affected_pkg["versions"])
+        except Exception as e:


What could be the exceptions raised here?

I think InvalidVersionRange

pombredanne · 2022-04-18T15:48:03Z

vulnerabilities/importers/pysec.py

+    if "type" in fixed_range:
+        list_fixed = fixed_filter(fixed_range)
+        for i in list_fixed:
+            if fixed_range["type"] == "ECOSYSTEM":


Always prefer to create a named variable in such case:

Suggested change

if fixed_range["type"] == "ECOSYSTEM":

fixed_range_type = fixed_range["type"]

if fixed_range_type == "ECOSYSTEM":

vulnerabilities/importers/pysec.py

pombredanne

See a few final nit pickings for your kind consideration.
As a general note, think about creating a variable early and then using this rather than doing multiple lookups in a mapping: this is more readable and more robust.

pombredanne · 2022-05-02T14:57:47Z

vulnerabilities/helpers.py

+
+def dedupe(original: List) -> List:
+    """
+    Remove all duplicate items and return a new list


Suggested change

Remove all duplicate items and return a new list

Remove all duplicate items and return a new list preserving ordering

pombredanne · 2022-05-02T15:00:47Z

vulnerabilities/importers/pysec.py

+    if "affected" in raw_data:
+        for affected_pkg in raw_data["affected"]:
+            purl = get_affected_purl(affected_pkg, raw_data["id"])
+            if purl.type == "pypi":


Suggested change

if purl.type == "pypi":

if purl.type != "pypi":

logger.error(f"Non PyPI package found in PYSEC advisories: {purl} - from: {raw_data!r}")

else:

pombredanne · 2022-05-02T15:01:37Z

vulnerabilities/importers/pysec.py

+        for affected_pkg in raw_data["affected"]:
+            purl = get_affected_purl(affected_pkg, raw_data["id"])
+            if purl.type == "pypi":
+                affected_version_range = get_affected_version_range(affected_pkg, raw_data["id"])


Try to give a name early to avoid multiple lookups and carrying around less common names:

Suggested change

affected_version_range = get_affected_version_range(affected_pkg, raw_data["id"])

vulnid = raw_data["id"]

affected_version_range = get_affected_version_range(affected_pkg, vulnid)

pombredanne · 2022-05-02T15:02:43Z

vulnerabilities/importers/pysec.py

+            if purl.type == "pypi":
+                affected_version_range = get_affected_version_range(affected_pkg, raw_data["id"])
+                for fixed_range in affected_pkg.get("ranges", []):
+                    fixed_version = get_fixed_version(fixed_range, raw_data["id"])


Suggested change

fixed_version = get_fixed_version(fixed_range, raw_data["id"])

fixed_version = get_fixed_version(fixed_range, vulnid)

vulnerabilities/importers/pysec.py

pombredanne · 2022-05-02T15:13:50Z

vulnerabilities/importers/pysec.py

+
+
+def get_references(raw_data, severity) -> []:
+    if "references" in raw_data:


You replace the whole function body by:

Suggested change

if "references" in raw_data:

references = raw_data.get("references") or []

return [Reference(url=ref["url"], severities=severity) for ref in references if ref]

Also what is severity here? a list since it afterward assigned to severities?
how does it apply to the whole list of references and not just to a single one?

Do you have an example of data?

reference field (url) and a severity field are separated from each other in osv-schema. I think we can make use of ADVISORY type field in reference and assign the severities to it but What if there is two ADVISORY ?

ex: GHSA-2qx8-589j-gcpx

{ "database_specific": { "severity": "MODERATE", "github_reviewed": true, "cwe_ids": [] }, "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-1950" }, { "type": "WEB", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/67695" }, { "type": "ADVISORY", "url": "https://github.com/advisories/GHSA-2qx8-589j-gcpx" }, ... ] }

ex: GHSA-2gwj-7jmv-h26r

{ "database_specific": { "severity": "CRITICAL", } "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-28346" }, { "type": "WEB", "url": "https://github.com/django/django/commit/93cae5cb2f9a4ef1514cf1a41f714fef08005200" }, { "type": "WEB", "url": "https://lists.debian.org/debian-lts-announce/2022/04/msg00013.html" }, { "type": "PACKAGE", "url": "https://github.com/django/django" } ] ] ...}

Any suggestions?

pombredanne · 2022-05-02T15:15:15Z

vulnerabilities/importers/pysec.py

+        except ValueError:
+            logger.error(f"PackageURL ValueError - {raw_id !r} - purl: {package['purl'] !r}")
+
+    if "ecosystem" in package and "name" in package:


Same nit as above: you are doing two lookups in package: here and below on line 184.
You should collect ecosystem and name in variables once instead

vulnerabilities/importers/pysec.py

pombredanne · 2022-05-02T15:16:55Z

vulnerabilities/importers/pysec.py

+    if "type" in fixed_range:
+        list_fixed = fixed_filter(fixed_range)
+        for i in list_fixed:
+            fixed_range_type = fixed_range["type"]


Should this be outside of the loop rather?

pombredanne · 2022-05-02T15:19:09Z

vulnerabilities/importers/pysec.py

+            if fixed_range_type == "GIT":
+                # TODO add GitHubVersion univers fix_version
+                logger.error(f"NotImplementedError GIT Version - {raw_id !r} - {i !r}")
+    else:


You should put error checks first at the top and invert this if/else block and if there no "type" you should return right way.
This will make the code simpler and remove one indentation level

pombredanne · 2022-05-05T21:33:04Z

vulnerabilities/importers/pysec.py

+    >>> fixed_filter({"type": "ECOSYSTEM","events":[{"introduced": "0"},{"fixed": "1.0.0"},{"fixed": "9.0.0"}]})
+    ['1.0.0', '9.0.0']
+    """
+    filter_fixed = list(filter(lambda x: x.keys() == {"fixed"}, fixed_range["events"]))


What about this instead? It may be easier to read than a filter with a lambda?

for event in fixed_range.get("events") or []: fixed = event.get("fixed") if fixed: yield fixed

vulnerabilities/importers/pysec.py

pombredanne · 2022-05-05T21:43:20Z

vulnerabilities/importers/pysec.py

+    if "published" in raw_data:
+        return parse(raw_data["published"])
+    else:
+        logger.warning(f"date_published not found {raw_data['id'] !r}")


I am not sure the date is important enough to warrant logging

pombredanne · 2022-05-05T21:43:56Z

vulnerabilities/importers/pysec.py

+def get_severity(raw_data) -> []:
+    severities = []
+    if "severity" in raw_data:
+        for sever_list in raw_data["severity"]:


Suggested change

for sever_list in raw_data["severity"]:

for sever_list in raw_data.get("severity") or []:

pombredanne · 2022-05-05T21:45:43Z

vulnerabilities/importers/pysec.py

+        logger.warning(f"date_published not found {raw_data['id'] !r}")
+
+
+def get_severity(raw_data) -> []:


get_severity --> get_severities since there are more than one

pombredanne · 2022-05-05T21:46:16Z

vulnerabilities/importers/pysec.py

+
+
+def get_severity(raw_data) -> []:
+    severities = []


IMHO you should rather yield as you go instead of accumulating in a list. The code will be leaner then

pombredanne

Thank you for the updates. A very last round few nitpickings for your consideration!

pombredanne · 2022-05-10T21:14:49Z

vulnerabilities/importers/pysec.py

+
+
+def get_severities(raw_data) -> []:
+    if "severity" in raw_data:


This is no longer needed since the code below (for sever_list in raw_data.get("severity") or []: handles all the possible cases:

Suggested change

if "severity" in raw_data:

vulnerabilities/importers/pysec.py

pombredanne · 2022-05-10T21:21:04Z

vulnerabilities/importers/pysec.py

+
+    affected_packages = []
+    if "affected" not in raw_data:
+        logger.error(f"affected_packages not found - {raw_data['id'] !r}")


It is always best to return early if there is nothing left to do.
This way you can de-indent the code that comes after

Suggested change

logger.error(f"affected_packages not found - {raw_data['id'] !r}")

logger.error(f"affected_packages not found - {raw_data['id'] !r}")

return

pombredanne · 2022-05-10T21:21:46Z

vulnerabilities/importers/pysec.py

+    if "affected" not in raw_data:
+        logger.error(f"affected_packages not found - {raw_data['id'] !r}")
+
+    if "affected" in raw_data:


Following from above, this becomes not needed:

Suggested change

if "affected" in raw_data:

if "affected" in raw_data:

pombredanne · 2022-05-10T21:22:31Z

vulnerabilities/importers/pysec.py

+        logger.error(f"affected_packages not found - {raw_data['id'] !r}")
+
+    if "affected" in raw_data:
+        for affected_pkg in raw_data["affected"]:


affected may not be a list, so to be safe, I would use this:

Suggested change

for affected_pkg in raw_data["affected"]:

for affected_pkg in raw_data.get("affected") or []:

pombredanne · 2022-05-10T21:22:50Z

vulnerabilities/importers/pysec.py

+
+    if "affected" in raw_data:
+        for affected_pkg in raw_data["affected"]:
+            purl = get_affected_purl(affected_pkg, raw_data["id"])


Use a raw_id variable defined above

pombredanne · 2022-05-10T21:24:00Z

vulnerabilities/importers/pysec.py

+                logger.error(
+                    f"Non PyPI package found in PYSEC advisories: {purl} - from: {raw_data['id']!r}"
+                )
+            else:


Return early and de-indent:

Suggested change

else:

return

pombredanne · 2022-05-10T21:24:21Z

vulnerabilities/importers/pysec.py

+                    f"Non PyPI package found in PYSEC advisories: {purl} - from: {raw_data['id']!r}"
+                )
+            else:
+                vulnid = raw_data["id"]


Use raw_id variable

Reference: aboutcode-org#607 Signed-off-by: Ziad <[email protected]> add the necessary changes Signed-off-by: Ziad <[email protected]> remove aliases de-duplicate Signed-off-by: Ziad <[email protected]> reslove conflicts Signed-off-by: Ziad <[email protected]> add dateparser to setup.cfg Signed-off-by: Ziad <[email protected]> Resolving conflicts Signed-off-by: Ziad <[email protected]> resolve conflicts Signed-off-by: Ziad <[email protected]> add a require changes Signed-off-by: Ziad <[email protected]> add a require changes Signed-off-by: Ziad <[email protected]> add a require changes Signed-off-by: Ziad <[email protected]> add a require changes Signed-off-by: Ziad <[email protected]> add a require changes Signed-off-by: Ziad <[email protected]> add a require changes Signed-off-by: Ziad <[email protected]>

pombredanne

LGTM. Merging! Thank you ++ for your peseverance!r

vulnerabilities/importers/pysec.py

Signed-off-by: Philippe Ombredanne <[email protected]>

armijnhemel · 2022-05-15T19:52:17Z

vulnerabilities/helpers.py

@@ -267,3 +267,16 @@ def _get_gh_response(gh_token, graphql_query):
    endpoint = "https://api.github.com/graphql"
    headers = {"Authorization": f"bearer {gh_token}"}
    return requests.post(endpoint, headers=headers, json=graphql_query).json()
+
+
+def dedupe(original: List) -> List:


You could also have implemented this using a OrderedDict from collections.

>>> import collections >>> collections.OrderedDict.fromkeys(["z","i","a","a","d","d"]).keys() odict_keys(['z', 'i', 'a', 'd'])

good point! actually on Python 3.6+, this could be even shorter: dict.fromkeys(["z","i","a","a","d","d"]).keys()

pombredanne changed the title ~~Add PyPL OSV~~ Add PyPY OSV Feb 21, 2022

pombredanne changed the title ~~Add PyPY OSV~~ Add PyPI OSV Feb 21, 2022

pombredanne requested changes Feb 21, 2022

View reviewed changes

ziadhany commented Feb 25, 2022

View reviewed changes

vulnerabilities/importers/pysec.py Outdated Show resolved Hide resolved

pombredanne requested changes Feb 25, 2022

View reviewed changes

ziadhany force-pushed the osv_import branch 3 times, most recently from 3598d65 to cf3d432 Compare March 4, 2022 03:42

TG1999 requested changes Mar 4, 2022

View reviewed changes

vulnerabilities/importers/pysec.py Outdated Show resolved Hide resolved

vulnerabilities/importers/pysec.py Outdated Show resolved Hide resolved

vulnerabilities/importers/pysec.py Outdated Show resolved Hide resolved

vulnerabilities/importers/pysec.py Outdated Show resolved Hide resolved

ziadhany force-pushed the osv_import branch 4 times, most recently from 006b85b to 6a82e35 Compare March 6, 2022 09:12

Hritik14 requested changes Mar 8, 2022

View reviewed changes

ziadhany force-pushed the osv_import branch from 6a82e35 to eae09e7 Compare March 8, 2022 18:02

ziadhany commented Mar 10, 2022

View reviewed changes

vulnerabilities/importers/pysec.py Outdated Show resolved Hide resolved

pombredanne requested changes Mar 10, 2022

View reviewed changes

pombredanne reviewed Mar 12, 2022

View reviewed changes

vulnerabilities/importers/pysec.py Outdated Show resolved Hide resolved

pombredanne mentioned this pull request Mar 12, 2022

Add improver to validate that collected purl are real. #644

Closed

ziadhany force-pushed the osv_import branch from 3310d37 to 4e784a1 Compare March 16, 2022 23:09

TG1999 reviewed Mar 17, 2022

View reviewed changes

vulnerabilities/importers/pysec.py Outdated Show resolved Hide resolved

TG1999 mentioned this pull request Mar 21, 2022

Values larger than 1/3 of a buffer page cannot be indexed. #650

Closed

ziadhany force-pushed the osv_import branch 2 times, most recently from bf016a2 to 19d993a Compare March 23, 2022 19:36

ziadhany requested review from TG1999 and Hritik14 March 23, 2022 19:45

ziadhany force-pushed the osv_import branch 2 times, most recently from df196c6 to 8766874 Compare April 17, 2022 12:09

ziadhany requested a review from Hritik14 April 17, 2022 12:12

pombredanne reviewed Apr 18, 2022

View reviewed changes

vulnerabilities/tests/test_pysec.py Outdated Show resolved Hide resolved

pombredanne requested changes Apr 18, 2022

View reviewed changes

ziadhany force-pushed the osv_import branch from 8766874 to d1e896a Compare April 19, 2022 22:39

ziadhany requested a review from pombredanne April 19, 2022 22:42

pombredanne requested changes May 2, 2022

View reviewed changes

ziadhany force-pushed the osv_import branch from 2898139 to 59a14db Compare May 3, 2022 03:37

pombredanne reviewed May 5, 2022

View reviewed changes

vulnerabilities/importers/pysec.py Outdated Show resolved Hide resolved

pombredanne reviewed May 5, 2022

View reviewed changes

vulnerabilities/importers/pysec.py Outdated Show resolved Hide resolved

pombredanne reviewed May 5, 2022

View reviewed changes

pombredanne requested changes May 5, 2022

View reviewed changes

ziadhany force-pushed the osv_import branch 2 times, most recently from 63ca14e to a197a84 Compare May 6, 2022 18:51

ziadhany requested a review from pombredanne May 6, 2022 19:09

pombredanne requested changes May 10, 2022

View reviewed changes

ziadhany force-pushed the osv_import branch from a197a84 to 510f355 Compare May 13, 2022 16:46

ziadhany requested a review from pombredanne May 14, 2022 06:36

ziadhany force-pushed the osv_import branch from 510f355 to bda8aed Compare May 14, 2022 06:56

ziadhany force-pushed the osv_import branch from bda8aed to 6ff492a Compare May 14, 2022 07:09

pombredanne approved these changes May 14, 2022

View reviewed changes

vulnerabilities/importers/pysec.py Outdated Show resolved Hide resolved

vulnerabilities/importers/pysec.py Show resolved Hide resolved

Prefer json.load() over json.loads(read())

a85c9a4

Signed-off-by: Philippe Ombredanne <[email protected]>

pombredanne force-pushed the osv_import branch from 8c42a26 to a85c9a4 Compare May 14, 2022 19:47

pombredanne merged commit b53e4f4 into aboutcode-org:main May 15, 2022

armijnhemel reviewed May 15, 2022

View reviewed changes

ziadhany mentioned this pull request Jun 27, 2022

Add a PyPa importer, organize the code using a shared osv.py #780

Merged

-def get_aff_purl(affected_pkg, raw_id):
+def get_affected_purl(affected_pkg, raw_id):
+    """
+    Return an affected PackageURL given an ``affected_pkg`` mapping and a ``raw_id``
+    """

		logger.error(f"purl affected_pkg not found - {raw_id !r}")


		def get_aff_version_range(affected_pkg, raw_id):

	def get_aff_version_range(affected_pkg, raw_id):
	def get_affected_version_range(affected_pkg, raw_id):



		def get_aff_version_range(affected_pkg, raw_id):
		if "versions" in affected_pkg:

	if fixed_range["type"] == "ECOSYSTEM":
	fixed_range_type = fixed_range["type"]
	if fixed_range_type == "ECOSYSTEM":

	Remove all duplicate items and return a new list
	Remove all duplicate items and return a new list preserving ordering

-            if purl.type == "pypi":
+            if purl.type != "pypi":
+                logger.error(f"Non PyPI package found in PYSEC advisories: {purl} - from: {raw_data!r}")
+            else:

	affected_version_range = get_affected_version_range(affected_pkg, raw_data["id"])
	vulnid = raw_data["id"]
	affected_version_range = get_affected_version_range(affected_pkg, vulnid)

	fixed_version = get_fixed_version(fixed_range, raw_data["id"])
	fixed_version = get_fixed_version(fixed_range, vulnid)



		def get_references(raw_data, severity) -> []:
		if "references" in raw_data:

	if "references" in raw_data:
	references = raw_data.get("references") or []
	return [Reference(url=ref["url"], severities=severity) for ref in references if ref]

	for sever_list in raw_data["severity"]:
	for sever_list in raw_data.get("severity") or []:

		logger.warning(f"date_published not found {raw_data['id'] !r}")


		def get_severity(raw_data) -> []:



		def get_severities(raw_data) -> []:
		if "severity" in raw_data:

	logger.error(f"affected_packages not found - {raw_data['id'] !r}")
	logger.error(f"affected_packages not found - {raw_data['id'] !r}")
	return

	for affected_pkg in raw_data["affected"]:
	for affected_pkg in raw_data.get("affected") or []:

Add PyPI OSV #632

Add PyPI OSV #632

Conversation

ziadhany commented Feb 20, 2022

pombredanne left a comment

Choose a reason for hiding this comment

pombredanne left a comment

Choose a reason for hiding this comment

TG1999 left a comment

Choose a reason for hiding this comment

TG1999 commented Mar 4, 2022

Hritik14 left a comment

Choose a reason for hiding this comment

pombredanne left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

TG1999 left a comment

Choose a reason for hiding this comment

TG1999 commented Mar 17, 2022

ziadhany commented Mar 20, 2022 • edited Loading

pombredanne left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

pombredanne left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

pombredanne May 5, 2022 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

pombredanne left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

pombredanne left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ziadhany commented Mar 20, 2022 •

edited

Loading

pombredanne May 5, 2022 •

edited

Loading