Return an AdvisoryData build from a ``raw_data`` mapping of OSV advisory and a ``supported_ecosystem`` string.
(
raw_data: dict,
supported_ecosystems,
advisory_url: str,
advisory_text: str,
advisory_id: Optional[str] = None,
)
| 59 | |
| 60 | |
| 61 | def parse_advisory_data_v3( |
| 62 | raw_data: dict, |
| 63 | supported_ecosystems, |
| 64 | advisory_url: str, |
| 65 | advisory_text: str, |
| 66 | advisory_id: Optional[str] = None, |
| 67 | ) -> Optional[AdvisoryDataV2]: |
| 68 | """ |
| 69 | Return an AdvisoryData build from a ``raw_data`` mapping of OSV advisory and |
| 70 | a ``supported_ecosystem`` string. |
| 71 | """ |
| 72 | adv_id = raw_data.get("id") |
| 73 | if not adv_id: |
| 74 | logger.error(f"Missing advisory id in OSV data: {raw_data}") |
| 75 | return None |
| 76 | aliases = raw_data.get("aliases") or [] |
| 77 | if not advisory_id: |
| 78 | advisory_id = adv_id |
| 79 | else: |
| 80 | aliases.append(adv_id) |
| 81 | summary = raw_data.get("summary") or "" |
| 82 | details = raw_data.get("details") or "" |
| 83 | summary = build_description(summary=summary, description=details) |
| 84 | aliases.extend(raw_data.get("upstream", [])) |
| 85 | date_published = get_published_date(raw_data=raw_data) |
| 86 | severities = list(get_severities(raw_data=raw_data, url=advisory_url)) |
| 87 | references = get_references_v2(raw_data=raw_data) |
| 88 | |
| 89 | patches = [] |
| 90 | affected_packages = [] |
| 91 | fixed_by_commit_patches = [] |
| 92 | introduced_by_commit_patches = [] |
| 93 | for affected_pkg in raw_data.get("affected") or []: |
| 94 | purl = get_affected_purl(affected_pkg=affected_pkg, raw_id=advisory_id) |
| 95 | |
| 96 | if not purl or purl.type not in supported_ecosystems: |
| 97 | logger.error(f"Unsupported package type: {affected_pkg!r} in OSV: {advisory_id!r}") |
| 98 | continue |
| 99 | |
| 100 | affected_constraints = [] |
| 101 | fixed_constraints = [] |
| 102 | for r in affected_pkg.get("ranges") or []: |
| 103 | ( |
| 104 | affected_constraint, |
| 105 | fixed_constraint, |
| 106 | intro_commits, |
| 107 | fixed_commits, |
| 108 | ) = get_version_ranges_constraints( |
| 109 | ranges=r, |
| 110 | raw_id=advisory_id, |
| 111 | supported_ecosystem=purl.type, |
| 112 | ) |
| 113 | if affected_constraint: |
| 114 | affected_constraints.extend(affected_constraint) |
| 115 | |
| 116 | if fixed_constraint: |
| 117 | fixed_constraints.extend(fixed_constraint) |
| 118 |