Class PackageSerializer

vulnerabilities/api.py:302–412

Lookup software package using Package URLs

class PackageSerializer(BaseResourceSerializer):
    """
    Lookup software package using Package URLs
    """

    next_non_vulnerable_version = serializers.CharField(read_only=True)
    latest_non_vulnerable_version = serializers.CharField(read_only=True)

    purl = serializers.CharField(source="package_url")

    affected_by_vulnerabilities = serializers.SerializerMethodField("get_affected_vulnerabilities")

    fixing_vulnerabilities = serializers.SerializerMethodField("get_fixing_vulnerabilities")

    qualifiers = serializers.SerializerMethodField()

    is_vulnerable = serializers.BooleanField()

    def get_qualifiers(self, package):
        return normalize_qualifiers(package.qualifiers, encode=False)

    def get_fixed_packages(self, package):
        """
        Return a queryset of all packages that fix a vulnerability with
        same type, namespace, name, subpath and qualifiers of the `package`
        """
        return (
            Package.objects.filter(
                name=package.name,
                namespace=package.namespace,
                type=package.type,
                qualifiers=package.qualifiers,
                subpath=package.subpath,
                fixingpackagerelatedvulnerability__isnull=False,
            )
            .with_is_vulnerable()
            .distinct()
        )

    def get_vulnerabilities_for_a_package(self, package, fix) -> dict:
        """
        Return a mapping of vulnerabilities data related to the given `package`.
        Return vulnerabilities that affect the `package` if given `fix` flag is False,
        otherwise return vulnerabilities fixed by the `package`.
        """
        fixed_packages = self.get_fixed_packages(package=package)
        if not fix:
            qs = package.affected_by_vulnerabilities.all()
        else:
            qs = package.fixing_vulnerabilities.all()
        qs = qs.prefetch_related(
            Prefetch(
                "fixed_by_packages",
                queryset=fixed_packages,
                to_attr="filtered_fixed_packages",
            )
        )
        return VulnSerializerRefsAndSummary(