Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

osv: account for event objects that have multiple streams #1428

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

osv: account for event objects that have multiple streams #1428

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
133 changes: 81 additions & 52 deletions updater/osv/osv.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -484,6 +484,11 @@ func newECS(u string) ecs {
}
}

type rangeVer struct {
rng *claircore.Range
fixedInVersion string
}

func (e *ecs) Insert(ctx context.Context, skipped *stats, name string, a *advisory) (err error) {
if a.GitOnly() {
return nil
Expand Down Expand Up @@ -533,15 +538,14 @@ func (e *ecs) Insert(ctx context.Context, skipped *stats, name string, a *adviso
}
b.WriteString(ref.URL)
}

proto.Links = b.String()
for i := range a.Affected {
af := &a.Affected[i]
v := e.NewVulnerability()
(*v) = proto
for _, r := range af.Ranges {
vers := []*rangeVer{}
switch r.Type {
case `SEMVER`:
v.Range = &claircore.Range{}
case `ECOSYSTEM`:
b.Reset()
case `GIT`:
Expand All @@ -554,24 +558,40 @@ func (e *ecs) Insert(ctx context.Context, skipped *stats, name string, a *adviso
}
// This does some heavy assumptions about valid inputs.
ranges := make(url.Values)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

does this need the same kind of treatment?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

https://api.osv.dev/v1/vulns/PYSEC-2008-3 Good catch, it appears like yes

for _, ev := range r.Events {
vs := &rangeVer{rng: &claircore.Range{}}
var seenIntroduced bool
for ie := range r.Events {
ev := r.Events[ie]
var err error
switch r.Type {
case `SEMVER`:
var ver *semver.Version
switch {
case ev.Introduced == "0": // -Inf
v.Range.Lower.Kind = `semver`
case ev.Introduced != "" && seenIntroduced:
vs = &rangeVer{rng: &claircore.Range{}}
RTann marked this conversation as resolved.
Show resolved Hide resolved
fallthrough
case ev.Introduced != "":
ver, err = semver.NewVersion(ev.Introduced)
if err == nil {
v.Range.Lower = claircore.FromSemver(ver)
seenIntroduced = true
switch {
case ev.Introduced == "0": // -Inf
vs.rng.Lower.Kind = `semver`
default:
ver, err = semver.NewVersion(ev.Introduced)
if err == nil {
vs.rng.Lower = claircore.FromSemver(ver)
}
}
// Is this the last event? If so append the range and
// implicitly terminate.
if ie == len(r.Events)-1 {
vers = append(vers, vs)
}
continue
case ev.Fixed != "": // less than
ver, err = semver.NewVersion(ev.Fixed)
if err == nil {
v.Range.Upper = claircore.FromSemver(ver)
v.FixedInVersion = ver.Original()
vs.rng.Upper = claircore.FromSemver(ver)
vs.fixedInVersion = ver.Original()
}
case ev.LastAffected != "" && len(af.Versions) != 0: // less than equal to
// TODO(hank) Should be able to convert this to a "less than."
Expand All @@ -586,11 +606,11 @@ func (e *ecs) Insert(ctx context.Context, skipped *stats, name string, a *adviso
ver, err = semver.NewVersion(ev.LastAffected)
if err == nil {
nv := ver.IncPatch()
v.Range.Upper = claircore.FromSemver(&nv)
vs.rng.Upper = claircore.FromSemver(&nv)
}
case ev.Limit == "*": // +Inf
v.Range.Upper.Kind = `semver`
v.Range.Upper.V[0] = 65535
vs.rng.Upper.Kind = `semver`
vs.rng.Upper.V[0] = 65535
case ev.Limit != "": // Something arbitrary
zlog.Info(ctx).
Str("which", "limit").
Expand All @@ -616,7 +636,7 @@ func (e *ecs) Insert(ctx context.Context, skipped *stats, name string, a *adviso
case ev.Introduced == "0": // -Inf
case ev.Introduced != "":
case ev.Fixed != "":
v.FixedInVersion = ev.Fixed
vs.fixedInVersion = ev.Fixed
case ev.LastAffected != "":
case ev.Limit == "*": // +Inf
case ev.Limit != "":
Expand All @@ -626,49 +646,58 @@ func (e *ecs) Insert(ctx context.Context, skipped *stats, name string, a *adviso
if err != nil {
zlog.Warn(ctx).Err(err).Msg("event version error")
}
vers = append(vers, vs)
}
if len(ranges) > 0 {
switch af.Package.Ecosystem {
case ecosystemMaven, ecosystemPyPI, ecosystemRubyGems:
v.FixedInVersion = ranges.Encode()
// Now we need to cycle through the ranges and create the vulnerabilities.
for _, ve := range vers {
v := e.NewVulnerability()
(*v) = proto
v.Range = ve.rng
v.FixedInVersion = ve.fixedInVersion
if len(ranges) > 0 {
switch af.Package.Ecosystem {
case ecosystemMaven, ecosystemPyPI, ecosystemRubyGems:
v.FixedInVersion = ranges.Encode()
}
}
}

if r := v.Range; r != nil {
// We have an implicit +Inf range if there's a single event,
// this should catch it?
if r.Upper.Kind == "" {
r.Upper.Kind = r.Lower.Kind
r.Upper.V[0] = 65535
if r := v.Range; r != nil {
// We have an implicit +Inf range if there's a single event,
// this should catch it?
if r.Upper.Kind == "" {
r.Upper.Kind = r.Lower.Kind
r.Upper.V[0] = 65535
}
if r.Lower.Compare(&r.Upper) == 1 {
e.RemoveVulnerability(v)
skipped.Ignored = append(skipped.Ignored, fmt.Sprintf("%s(%s,%s)", a.ID, r.Lower.String(), r.Upper.String()))
continue
}
}
var vs string
switch r.Type {
case `ECOSYSTEM`:
vs = b.String()
}
if r.Lower.Compare(&r.Upper) == 1 {
e.RemoveVulnerability(v)
skipped.Ignored = append(skipped.Ignored, fmt.Sprintf("%s(%s,%s)", a.ID, r.Lower.String(), r.Upper.String()))
continue
pkgName := af.Package.PURL
switch af.Package.Ecosystem {
case ecosystemGo, ecosystemMaven, ecosystemNPM, ecosystemPyPI, ecosystemRubyGems:
pkgName = af.Package.Name
}
pkg, novel := e.LookupPackage(pkgName, vs)
v.Package = pkg
switch af.Package.Ecosystem {
case ecosystemGo, ecosystemMaven, ecosystemNPM, ecosystemPyPI, ecosystemRubyGems:
v.Package.Kind = claircore.BINARY
}
if novel {
pkg.RepositoryHint = af.Package.Ecosystem
}
if repo := e.LookupRepository(name); repo != nil {
v.Repo = repo
}
}
var vs string
switch r.Type {
case `ECOSYSTEM`:
vs = b.String()
}
pkgName := af.Package.PURL
switch af.Package.Ecosystem {
case ecosystemGo, ecosystemMaven, ecosystemNPM, ecosystemPyPI, ecosystemRubyGems:
pkgName = af.Package.Name
}
pkg, novel := e.LookupPackage(pkgName, vs)
v.Package = pkg
switch af.Package.Ecosystem {
case ecosystemGo, ecosystemMaven, ecosystemNPM, ecosystemPyPI, ecosystemRubyGems:
v.Package.Kind = claircore.BINARY
}
if novel {
pkg.RepositoryHint = af.Package.Ecosystem
}
if repo := e.LookupRepository(name); repo != nil {
v.Repo = repo
}

}
}
return nil
Expand Down
Loading
Loading