Skip to content

Commit 481fb5b

Browse files
committed
Update grafana_importer.py
Signed-off-by: newklei <magmacicada@proton.me>
1 parent b6e6750 commit 481fb5b

File tree

1 file changed

+2
-41
lines changed

1 file changed

+2
-41
lines changed

vulnerabilities/pipelines/v2_importers/grafana_importer.py

Lines changed: 2 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -125,48 +125,9 @@ def fetch_grafana_advisories(
125125

126126
def parse_advisory_data(advisory: dict, purl_type: str, purl_namespace: str):
127127
"""
128-
Parse a GitHub Security Advisory REST API response for a Grafana repo and
129-
return an AdvisoryDataV2 object, or None if parsing fails.
130-
128+
Parse a GitHub Security Advisory REST API response for a Grafana repo and return an AdvisoryDataV2 object, or None if parsing fails.
131129
``advisory_id`` is set to the GHSA ID; any CVE ID goes into ``aliases``.
132-
Version ranges from the API (space-separated constraints) are normalized to
133-
comma-separated format before being passed to
134-
``build_range_from_github_advisory_constraint``.
135-
136-
>>> advisory = {
137-
... "ghsa_id": "GHSA-7rqg-hjwc-6mjf",
138-
... "cve_id": "CVE-2023-22462",
139-
... "html_url": "https://github.com/grafana/grafana/security/advisories/GHSA-7rqg-hjwc-6mjf",
140-
... "summary": "Stored XSS in Text plugin",
141-
... "description": "An attacker needs Editor role.",
142-
... "severity": "medium",
143-
... "state": "published",
144-
... "published_at": "2023-03-01T08:59:53Z",
145-
... "vulnerabilities": [
146-
... {
147-
... "package": {"ecosystem": "", "name": "github.com/grafana/grafana"},
148-
... "vulnerable_version_range": ">=9.2.0 <9.2.10",
149-
... "patched_versions": "9.2.10",
150-
... "vulnerable_functions": []
151-
... }
152-
... ],
153-
... "cvss_severities": {
154-
... "cvss_v3": {"vector_string": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N", "score": 6.4},
155-
... "cvss_v4": {"vector_string": None, "score": None}
156-
... },
157-
... "cwes": [{"cwe_id": "CWE-79", "name": "Cross-site Scripting"}],
158-
... "identifiers": [
159-
... {"value": "GHSA-7rqg-hjwc-6mjf", "type": "GHSA"},
160-
... {"value": "CVE-2023-22462", "type": "CVE"}
161-
... ]
162-
... }
163-
>>> result = parse_advisory_data(advisory, "golang", "github.com/grafana/grafana")
164-
>>> result.advisory_id
165-
'GHSA-7rqg-hjwc-6mjf'
166-
>>> result.aliases
167-
['CVE-2023-22462']
168-
>>> result.summary
169-
'Stored XSS in Text plugin'
130+
Version ranges from the API (space-separated constraints) are normalized to comma-separated format before being passed to ``build_range_from_github_advisory_constraint``.
170131
"""
171132
ghsa_id = advisory.get("ghsa_id") or ""
172133
cve_id = advisory.get("cve_id") or ""

0 commit comments

Comments
 (0)