aboutcode-org / aboutcode-org/vulnerablecode

Performances issues with API v2 bulk_search

Open
#1,681 1 comment 0 reactions 1 assignee Claimed by @TG1999 View on GitHub
bug
Dominant language
Python
Stars
702
Forks
328
Avg merge
3d 8h
Merged PRs (30d)
3

Description

The current implementation of the package bulk_search in API v2 is not usable.
It takes over 2 minutes to fetch a single purl, and searching for several purls ends in a timeout.

```
from timeit import default_timer as timer
import requests

purls = [
"pkg:alpm/archlinux/npm@8.1.4-1",
"pkg:composer/guzzlehttp/guzzle@6.5.8",
"pkg:composer/guzzlehttp/psr7@1.9.0",
"pkg:maven/org.apache.commons/commons-compress@1.9",
"pkg:maven/org.elasticsearch/elasticsearch@7.17.9",
"pkg:nuget/System.Text.Encodings.Web@6.0.0",
"pkg:nuget/System.Text.Encodings.Web@6.0.2",
"pkg:nuget/System.Text.Json@6.0.0",
"pkg:pypi/django@5.0.2",
"pkg:pypi/django@5.0.3",
"pkg:pypi/django@5.0.4",
"pkg:pypi/django@5.0.5",
"pkg:pypi/django@5.0.7",
"pkg:pypi/django@5.0.8",
"pkg:pypi/setuptools@68.0.0",
]
data = {
"purls": purls,
}

# v1, 15 purls
url = "https://public.vulnerablecode.io/api/packages/bulk_search"
start_time = timer()
response = requests.post(url, data)
print(timer() - start_time) # 7 seconds
print(len(response.json())) # -> 15 entries

# v2, 15 purls
url = "https://public.vulnerablecode.io/api/v2/packages/bulk_search"
start_time = timer()
response = requests.post(url, data) # -> TIMEOUT
print(timer() - start_time)

# v2, single purl
url = "https://public.vulnerablecode.io/api/v2/packages/bulk_search"
data = {"purls": "pkg:pypi/django@5.0.2"}
start_time = timer()
response = requests.post(url, data)
print(timer() - start_time) # -> 138 seconds
```

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.