Migrate Xen, Curl, Istio and OSS-Fuzz importer#1946
Conversation
Signed-off-by: Tushar Goel <tushar.goel.dav@gmail.com>
Signed-off-by: Tushar Goel <tushar.goel.dav@gmail.com>
Signed-off-by: Tushar Goel <tushar.goel.dav@gmail.com>
Signed-off-by: Tushar Goel <tushar.goel.dav@gmail.com>
Signed-off-by: Tushar Goel <tushar.goel.dav@gmail.com>
Signed-off-by: Tushar Goel <tushar.goel.dav@gmail.com>
Signed-off-by: Tushar Goel <tushar.goel.dav@gmail.com>
Signed-off-by: Tushar Goel <tushar.goel.dav@gmail.com>
Signed-off-by: Tushar Goel <tushar.goel.dav@gmail.com>
Signed-off-by: Tushar Goel <tushar.goel.dav@gmail.com>
6d6626e to
3479b49
Compare
keshav-space
left a comment
There was a problem hiding this comment.
Thanks @TG1999, see some feedback.
| weaknesses=weaknesses, | ||
| url=reference.url, | ||
| severities=severities, | ||
| original_advisory_text=json.dumps(data, indent=2, ensure_ascii=False), |
There was a problem hiding this comment.
I don't think we need indent.
| weaknesses = get_cwe_from_curl_advisory(raw_data) | ||
|
|
||
| aliases = raw_data.get("aliases", []) | ||
| advisory_id = raw_data.get("id") or "" |
There was a problem hiding this comment.
Instead of returning an advisory data with no advisory_id, we should log error and continue.
| affected_packages=affected_packages, | ||
| url=advisory_url, | ||
| date_published=date_published, | ||
| original_advisory_text=advisory_text or str(yaml_file), |
There was a problem hiding this comment.
Wouldn't it be more appropriate to do yaml dump instead of str(yaml_file)?
| ] | ||
| ) | ||
|
|
||
| title = data.get("title") or "" |
There was a problem hiding this comment.
Since we are using it as an advisory_id, if there is no title we should log error and continue, instead for returning a AdvisoryData with empty advisory_id.
| references_v2=references, | ||
| severities=severities, | ||
| url=f"https://github.com/nodejs/security-wg/blob/main/vuln/npm/{id}.json", | ||
| original_advisory_text=advisory_text or json.dumps(data, indent=2, ensure_ascii=False), |
There was a problem hiding this comment.
Isn't advisory_text already a JSON dump?
advisory_text or json.dumps(data, indent=2, ensure_ascii=False)
This seems redundant, if we don't have an advisory_text how can we have data.
| if not self.links: | ||
| self.collect_links() | ||
| return len(self.links) | ||
| return 30 |
There was a problem hiding this comment.
This is not fixed postgres will have more advisory here in future, right?
Closes: #1878