Function get_exact_purls

vulnerabilities/improvers/default.py:87–140

Return a list of affected purls and the fixed package found in the ``affected_package`` AffectedPackage disregarding any ranges. Only exact version constraints (ie with an equality) are considered For eg: >>> purl = {"type": "turtle", "name": "green"} >>> vers = "vers:npm/<

(affected_package: AffectedPackage)

def get_exact_purls(affected_package: AffectedPackage) -> Tuple[List[PackageURL], PackageURL]:
    """
    Return a list of affected purls and the fixed package found in the ``affected_package``
    AffectedPackage disregarding any ranges.

    Only exact version constraints (ie with an equality) are considered
    For eg:
    >>> purl = {"type": "turtle", "name": "green"}
    >>> vers = "vers:npm/<1.0.0 | >=2.0.0 | <3.0.0"
    >>> affected_package = AffectedPackage.from_dict({
    ...     "package": purl,
    ...     "affected_version_range": vers,
    ...     "fixed_version": "5.0.0"
    ... })
    >>> got = get_exact_purls(affected_package)
    >>> expected = (
    ...     [PackageURL(type='turtle', namespace=None, name='green', version='2.0.0', qualifiers={}, subpath=None)],
    ...     [PackageURL(type='turtle', namespace=None, name='green', version='5.0.0', qualifiers={}, subpath=None)]
    ... )
    >>> assert expected == got
    """
    if not affected_package:
        return [], []

    try:
        vr = affected_package.affected_version_range
        # We need ``if c`` below because univers returns None as version
        # in case of vers:nginx/*
        # TODO: Revisit after https://github.com/nexB/univers/issues/33
        affected_purls = []
        fixed_versions = []
        if vr:
            range_versions = [c.version for c in vr.constraints if c]
            # Any version that's not affected by a vulnerability is considered
            # fixed.
            fixed_versions = [c.version for c in vr.constraints if c and c.comparator == "!="]
            resolved_versions = [v for v in range_versions if v and v in vr]
            for version in resolved_versions:
                affected_purl = update_purl_version(
                    purl=affected_package.package, version=str(version)
                )
                affected_purls.append(affected_purl)

        if affected_package.fixed_version:
            fixed_versions.append(affected_package.fixed_version)

        fixed_purls = [
            update_purl_version(purl=affected_package.package, version=str(version))
            for version in fixed_versions
        ]
        return affected_purls, fixed_purls
    except Exception as e:
        logger.error(f"Failed to get exact purls for: {affected_package!r} with error: {e!r}")
        return [], []


class DefaultImporter(DefaultImprover):