aboutcode-org / aboutcode-org/vulnerablecode

Error in running github_osv importer

Đang mở
#1,851 0 bình luận 0 reaction 1 người được giao Được @TG1999 nhận Xem trên GitHub
bug Priority: high
Ngôn ngữ chính
Python
Star
702
Fork
328
Merge trung bình
3 ngày 8 giờ
Pull request đã merge (30 ngày)
3

Mô tả

The import crashes with this error:

```
Traceback (most recent call last):
File "/app/vulnerabilities/management/commands/import.py", line 70, in import_data
ImportRunner(importer).run()
File "/app/vulnerabilities/import_runner.py", line 62, in run
count = self.process_advisories(advisory_datas=advisory_datas, importer_name=importer_name)
File "/app/vulnerabilities/import_runner.py", line 105, in process_advisories
for data in advisory_datas:
File "/app/vulnerabilities/importers/github_osv.py", line 53, in advisory_data
yield parse_advisory_data(raw_data, supported_ecosystems, advisory_url)
File "/app/vulnerabilities/importers/osv.py", line 70, in parse_advisory_data
purl = get_affected_purl(affected_pkg=affected_pkg, raw_id=raw_id)
File "/app/vulnerabilities/importers/osv.py", line 223, in get_affected_purl
return PackageURL.from_string(str(purl))
File "/usr/local/lib/python3.9/site-packages/packageurl/__init__.py", line 508, in from_string
raise ValueError(msg)
ValueError: Invalid purl 'pkg:npm/org.webjars.npm:json-pointer' cannot contain a "user:pass@host:port" URL Authority component: ''.
```

The correct purl should have been:
- `pkg:maven/org.webjars.npm/json-pointer`
and not that:
- `pkg:npm/org.webjars.npm:json-pointer`

We have three issues:
- [ ] some bug in parsing OSV data where this is not parsed correctly: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/05/GHSA-7mg4-w3w5-x5pc/GHSA-7mg4-w3w5-x5pc.json
- [ ] the packageurl-python should not have crashed on a colon in the namespace/name even if this is not correct for maven
- [x] #1856

Hướng dẫn đóng góp

Chưa lập chỉ mục được hướng dẫn đóng góp cho kho mã nguồn này

Đánh giá

Issue này chưa được đánh giá.

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.