aboutcode-org / aboutcode-org/vulnerablecode

Use `affected` instead of `versionUnaffected` for reporting fixed versions from DEPS

Aberta
#1,153 0 comentários 0 reações 0 responsáveis Ver no GitHub
enhancement VulnTotal
Linguagem predominante
Python
Estrelas
702
Forks
328
Merge médio
3d 8h
PRs com merge (30d)
3

Descrição

Currently, we're reporting `versionUnaffected` as the fixed version which is not precisely the fixed version.
We can make use of `affected` to get the fixed version.

```json
"affected": "{[0.0.0-0:2.1.3)}",
"rawAffected": "Introduced: 0, Fixed: 2.1.3",
```
![Screenshot 2023-03-17 at 1 39 00 PM](https://user-images.githubusercontent.com/44315208/225856783-58d4a131-f40a-4eee-9a3c-027b476e1d69.png)




> **Warning**
> Don't use `rawAffected` as it's susceptible to change as shown below
>
> [GHSA-jfh8-c2jp-5v3q (as on 17-Mar-2023)](https://web.archive.org/web/20230317090918/https://deps.dev/_/advisory/osv/GHSA-jfh8-c2jp-5v3q)
> ```json
> "affected": "{[0.alpha:2.3.1),[2.4:2.12.2),[2.13:2.15)}"
> "rawAffected": "Introduced: 2.13.0, Fixed: 2.15.0, Introduced: 0, Fixed: 2.3.1, Introduced: 2.4, Fixed: 2.12.2"
> ```
>
> [GHSA-jfh8-c2jp-5v3q (as on 22-Dec-2022)](https://web.archive.org/web/20221216222510/https://deps.dev/_/advisory/GHSA/GHSA-jfh8-c2jp-5v3q)
> ```json
> "affected": "{[2.4:2.12.2),[0.alpha:2.3.1),[2.13:2.15)}",
> "rawAffected": ">= 2.4, < 2.12.2 or < 2.3.1 or >= 2.13.0, < 2.15.0",
> ```

Guia de contribuição

Nenhum guia de contribuição indexado para este repositório

Avaliação

Esta issue ainda não foi avaliada.

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.