Return an AdvisoryData build from a ``raw_data`` mapping of OSV advisory and a ``supported_ecosystem`` string.
(
raw_data: dict, supported_ecosystems, advisory_url: str
)
| 49 | |
| 50 | |
| 51 | def parse_advisory_data( |
| 52 | raw_data: dict, supported_ecosystems, advisory_url: str |
| 53 | ) -> Optional[AdvisoryData]: |
| 54 | """ |
| 55 | Return an AdvisoryData build from a ``raw_data`` mapping of OSV advisory and |
| 56 | a ``supported_ecosystem`` string. |
| 57 | """ |
| 58 | raw_id = raw_data.get("id") or "" |
| 59 | summary = raw_data.get("summary") or "" |
| 60 | details = raw_data.get("details") or "" |
| 61 | summary = build_description(summary=summary, description=details) |
| 62 | aliases = raw_data.get("aliases") or [] |
| 63 | if raw_id: |
| 64 | aliases.append(raw_id) |
| 65 | aliases = dedupe(original=aliases) |
| 66 | |
| 67 | date_published = get_published_date(raw_data=raw_data) |
| 68 | severities = list(get_severities(raw_data=raw_data)) |
| 69 | references = get_references(raw_data=raw_data, severities=severities) |
| 70 | |
| 71 | affected_packages = [] |
| 72 | |
| 73 | for affected_pkg in raw_data.get("affected") or []: |
| 74 | purl = get_affected_purl(affected_pkg=affected_pkg, raw_id=raw_id) |
| 75 | |
| 76 | if not purl or purl.type not in supported_ecosystems: |
| 77 | logger.error(f"Unsupported package type: {affected_pkg!r} in OSV: {raw_id!r}") |
| 78 | continue |
| 79 | |
| 80 | affected_version_range = get_affected_version_range( |
| 81 | affected_pkg=affected_pkg, |
| 82 | raw_id=raw_id, |
| 83 | supported_ecosystem=purl.type, |
| 84 | ) |
| 85 | |
| 86 | for fixed_range in affected_pkg.get("ranges") or []: |
| 87 | fixed_version = get_fixed_versions( |
| 88 | fixed_range=fixed_range, raw_id=raw_id, supported_ecosystem=purl.type |
| 89 | ) |
| 90 | |
| 91 | for version in fixed_version: |
| 92 | affected_packages.append( |
| 93 | AffectedPackage( |
| 94 | package=purl, |
| 95 | affected_version_range=affected_version_range, |
| 96 | fixed_version=version, |
| 97 | ) |
| 98 | ) |
| 99 | database_specific = raw_data.get("database_specific") or {} |
| 100 | cwe_ids = database_specific.get("cwe_ids") or [] |
| 101 | weaknesses = list(map(get_cwe_id, cwe_ids)) |
| 102 | |
| 103 | return AdvisoryData( |
| 104 | aliases=aliases, |
| 105 | summary=summary, |
| 106 | references=references, |
| 107 | affected_packages=affected_packages, |
| 108 | date_published=date_published, |