aboutcode-org / aboutcode-org/vulnerablecode

Improve Improvers

未关闭
#701 2 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看
core enhancement
主要语言
Python
星标
702
派生
328
平均合并
3 天 8 小时
30 天内合并 PR
3

描述

Improvers are constraining.

For eg: Improving reference id to reference URL, improving vuln data (not an advisory).
The problem is with both ``interesting_advisories`` and ``get_inferences`` where both of them expect ``AdvisoryData``.
Improvers cloud be split in
- A condition which checks if this improver runs or not
- then a handling thing.

TOCTOU conditions are also present, we check at ``interesting_advisories`` and use the value at ``get_inferences``. Could do https://docs.djangoproject.com/en/4.0/ref/models/querysets/#select-for-update to avoid TOCTOU closer where things are going to change. This would mean returning a QuerySet from ``interesting_advisories`` might not be an ideal case.

Current implementation could become a subclass which is a advisory based improver.

_(via: https://github.com/nexB/vulnerablecode/wiki/WeeklyMeetings#meeting-on-tuesday-2022-04-19-at-1000-utc)_

贡献指南

这个仓库没有索引到贡献指南

评估

这个 Issue 还没有评估数据。

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。