Skip to content

Commit

Permalink
Move fixed_packages to vulnerabilities in packages endpoint aboutcode…
Browse files Browse the repository at this point in the history 
…-org#809

Reference: aboutcode-org#809
Signed-off-by: Tushar Goel <[email protected]>
  • Loading branch information
@TG1999
TG1999 committed Aug 8, 2022
1 parent 2670b03 commit 9de782b
Show file tree
Hide file tree
Showing 3 changed files with 76 additions and 53 deletions.
75 changes: 51 additions & 24 deletions vulnerabilities/api.py
View file
Original file line number Diff line number Diff line change
Expand Up @@ -56,11 +56,15 @@ class VulnSerializerRefsAndSummary(serializers.HyperlinkedModelSerializer):
Used for nesting inside package focused APIs.
"""

fixed_packages = MinimalPackageSerializer(
many=True, source="filtered_fixed_packages", read_only=True
)

references = VulnerabilityReferenceSerializer(many=True, source="vulnerabilityreference_set")

class Meta:
model = Vulnerability
fields = ["url", "vulnerability_id", "summary", "references"]
fields = ["url", "vulnerability_id", "summary", "references", "fixed_packages"]


class MinimalVulnerabilitySerializer(serializers.HyperlinkedModelSerializer):
Expand All @@ -73,21 +77,6 @@ class Meta:
fields = ["url", "vulnerability_id"]


class PackageSerializerFixedVulns(serializers.HyperlinkedModelSerializer):
"""
Used for nesting inside vulnerability focused APIs.
"""

purl = serializers.CharField(source="package_url")
fixing_vulnerabilities = MinimalVulnerabilitySerializer(
many=True, source="resolved_to", read_only=True
)

class Meta:
model = Package
fields = ["url", "purl", "fixing_vulnerabilities"]


class AliasSerializer(serializers.HyperlinkedModelSerializer):
"""
Used for nesting inside package focused APIs.
Expand Down Expand Up @@ -128,13 +117,52 @@ def to_representation(self, instance):
return data

purl = serializers.CharField(source="package_url")
affected_by_vulnerabilities = VulnSerializerRefsAndSummary(
many=True, source="vulnerable_to", read_only=True
)
fixing_vulnerabilities = VulnSerializerRefsAndSummary(
many=True, source="resolved_to", read_only=True
)
fixed_packages = PackageSerializerFixedVulns(many=True, read_only=True)

affected_by_vulnerabilities = serializers.SerializerMethodField("get_affected_vulnerabilities")

fixing_vulnerabilities = serializers.SerializerMethodField("get_fixed_vulnerabilities")

def get_fixed_packages(self, package):
return Package.objects.filter(
name=package.name,
namespace=package.namespace,
type=package.type,
qualifiers=package.qualifiers,
subpath=package.subpath,
packagerelatedvulnerability__fix=True,
).distinct()

def get_affected_vulnerabilities(self, package):
fixed_packages = self.get_fixed_packages(package=package)
qs = package.vulnerabilities.filter(packagerelatedvulnerability__fix=False)
qs = qs.prefetch_related(
Prefetch(
"packages",
queryset=fixed_packages,
to_attr="filtered_fixed_packages",
)
)
return VulnSerializerRefsAndSummary(
instance=qs,
many=True,
context={"request": self.context["request"]},
).data

def get_fixed_vulnerabilities(self, package):
fixed_packages = self.get_fixed_packages(package=package)
qs = package.vulnerabilities.filter(packagerelatedvulnerability__fix=True)
qs = qs.prefetch_related(
Prefetch(
"packages",
queryset=fixed_packages,
to_attr="filtered_fixed_packages",
)
)
return VulnSerializerRefsAndSummary(
instance=qs,
many=True,
context={"request": self.context["request"]},
).data

class Meta:
model = Package
Expand All @@ -148,7 +176,6 @@ class Meta:
"qualifiers",
"subpath",
"affected_by_vulnerabilities",
"fixed_packages",
"fixing_vulnerabilities",
]

Expand Down
2 changes: 1 addition & 1 deletion vulnerabilities/models.py
View file
Original file line number Diff line number Diff line change
Expand Up @@ -83,7 +83,7 @@ def alias(self):
Returns packages that first received patch against this vulnerability
in their particular version history.
"""
return self.aliases.all()
return self.aliases.all().order_by("-alias")

def __str__(self):
return self.vulnerability_id
Expand Down
52 changes: 24 additions & 28 deletions vulnerabilities/tests/test_fix_api.py
View file
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,8 @@
# See https://aboutcode.org for more information about nexB OSS projects.
#

from collections import OrderedDict

from django.test import TestCase
from django.utils.http import int_to_base36
from rest_framework import status
Expand Down Expand Up @@ -138,30 +140,24 @@ def test_api_with_single_vulnerability_and_fixed_package(self):
"namespace": "nginx",
"name": "test",
"version": "11",
"unresolved_vulnerabilities": [],
"qualifiers": {},
"subpath": "",
"fixed_packages": [
{
"url": f"http://testserver/api/packages/{self.package.id}",
"purl": "pkg:generic/nginx/test@11",
"fixing_vulnerabilities": [
{
"url": f"http://testserver/api/vulnerabilities/{self.vuln.id}",
"vulnerability_id": f"VULCOID-{int_to_base36(self.vuln.id).upper()}",
}
],
}
],
"affected_by_vulnerabilities": [],
"fixing_vulnerabilities": [
{
"url": f"http://testserver/api/vulnerabilities/{self.vuln.id}",
"vulnerability_id": f"VULCOID-{int_to_base36(self.vuln.id).upper()}",
"summary": "test-vuln",
"references": [],
}
"fixed_packages": [
{
"url": f"http://testserver/api/packages/{self.package.id}",
"purl": "pkg:generic/nginx/test@11",
}
],
},
],
"unresolved_vulnerabilities": [],
}

def test_api_with_single_vulnerability_and_vulnerable_package(self):
Expand All @@ -173,37 +169,37 @@ def test_api_with_single_vulnerability_and_vulnerable_package(self):
"namespace": "nginx",
"name": "test",
"version": "9",
"unresolved_vulnerabilities": [
"qualifiers": {},
"subpath": "",
"affected_by_vulnerabilities": [
{
"url": f"http://testserver/api/vulnerabilities/{self.vuln.id}",
"vulnerability_id": f"VULCOID-{int_to_base36(self.vuln.id).upper()}",
"summary": "test-vuln",
"references": [],
}
],
"qualifiers": {},
"subpath": "",
"fixed_packages": [
{
"url": f"http://testserver/api/packages/{self.package.id}",
"purl": "pkg:generic/nginx/test@11",
"fixing_vulnerabilities": [
"fixed_packages": [
{
"url": f"http://testserver/api/vulnerabilities/{self.vuln.id}",
"vulnerability_id": f"VULCOID-{int_to_base36(self.vuln.id).upper()}",
"url": f"http://testserver/api/packages/{self.package.id}",
"purl": "pkg:generic/nginx/test@11",
}
],
}
],
"affected_by_vulnerabilities": [
"fixing_vulnerabilities": [],
"unresolved_vulnerabilities": [
{
"url": f"http://testserver/api/vulnerabilities/{self.vuln.id}",
"vulnerability_id": f"VULCOID-{int_to_base36(self.vuln.id).upper()}",
"summary": "test-vuln",
"references": [],
"fixed_packages": [
{
"url": f"http://testserver/api/packages/{self.package.id}",
"purl": "pkg:generic/nginx/test@11",
}
],
}
],
"fixing_vulnerabilities": [],
}


Expand Down

0 comments on commit 9de782b

Please sign in to comment.