Function get_exact_purls_v2

vulnerabilities/pipes/univers_utils.py:47–95

Return a list of affected purls and the fixed package found in the ``affected_package`` AffectedPackageV2 disregarding any ranges. Only exact version constraints (ie with an equality) are considered For eg: >>> purl = {"type": "turtle", "name": "green"} >>> vers = "vers:npm

(
    affected_package: AffectedPackageV2,
    logger: Callable = None,
)

def get_exact_purls_v2(
    affected_package: AffectedPackageV2,
    logger: Callable = None,
) -> Tuple[List[PackageURL], PackageURL]:
    """
    Return a list of affected purls and the fixed package found in the ``affected_package``
    AffectedPackageV2 disregarding any ranges.

    Only exact version constraints (ie with an equality) are considered
    For eg:
    >>> purl = {"type": "turtle", "name": "green"}
    >>> vers = "vers:npm/<1.0.0 | >=2.0.0 | <3.0.0"
    >>> vers2 = "vers:npm/5.0.0"
    >>> affected_package = AffectedPackageV2.from_dict({
    ...     "package": purl,
    ...     "affected_version_range": vers,
    ...     "fixed_version_range": vers2
    ... })
    >>> got = get_exact_purls_v2(affected_package)
    >>> expected = (
    ...     [PackageURL(type='turtle', namespace=None, name='green', version='2.0.0', qualifiers={}, subpath=None)],
    ...     [PackageURL(type='turtle', namespace=None, name='green', version='5.0.0', qualifiers={}, subpath=None)]
    ... )
    >>> assert expected == got
    """
    if not affected_package:
        return [], []

    try:
        affected_purls, fixed_purls = get_exact_purl_from_vers(
            version_range=affected_package.affected_version_range,
            base_purl=affected_package.package,
        )

        fixed_purls_2, affected_purls_2 = get_exact_purl_from_vers(
            version_range=affected_package.fixed_version_range,
            base_purl=affected_package.package,
        )

        affected_purls.extend(affected_purls_2)
        fixed_purls.extend(fixed_purls_2)

        return affected_purls, fixed_purls
    except Exception as e:
        logger(
            f"Failed to get exact purls for: {affected_package!r} with error: {e!r} \n{traceback_format_exc()}",
            level=logging.ERROR,
        )
        return [], []