aboutcode-org / aboutcode-org/vulnerablecode

Error in running github_osv importer

Open
#1,851 0 comments 0 reactions 1 assignee Claimed by @TG1999 View on GitHub
bug Priority: high
Dominant language
Python
Stars
702
Forks
328
Avg merge
3d 8h
Merged PRs (30d)
3

Description

The import crashes with this error:

```
Traceback (most recent call last):
File "/app/vulnerabilities/management/commands/import.py", line 70, in import_data
ImportRunner(importer).run()
File "/app/vulnerabilities/import_runner.py", line 62, in run
count = self.process_advisories(advisory_datas=advisory_datas, importer_name=importer_name)
File "/app/vulnerabilities/import_runner.py", line 105, in process_advisories
for data in advisory_datas:
File "/app/vulnerabilities/importers/github_osv.py", line 53, in advisory_data
yield parse_advisory_data(raw_data, supported_ecosystems, advisory_url)
File "/app/vulnerabilities/importers/osv.py", line 70, in parse_advisory_data
purl = get_affected_purl(affected_pkg=affected_pkg, raw_id=raw_id)
File "/app/vulnerabilities/importers/osv.py", line 223, in get_affected_purl
return PackageURL.from_string(str(purl))
File "/usr/local/lib/python3.9/site-packages/packageurl/__init__.py", line 508, in from_string
raise ValueError(msg)
ValueError: Invalid purl 'pkg:npm/org.webjars.npm:json-pointer' cannot contain a "user:pass@host:port" URL Authority component: ''.
```

The correct purl should have been:
- `pkg:maven/org.webjars.npm/json-pointer`
and not that:
- `pkg:npm/org.webjars.npm:json-pointer`

We have three issues:
- [ ] some bug in parsing OSV data where this is not parsed correctly: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/05/GHSA-7mg4-w3w5-x5pc/GHSA-7mg4-w3w5-x5pc.json
- [ ] the packageurl-python should not have crashed on a colon in the namespace/name even if this is not correct for maven
- [x] #1856

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.