google / google/osv.dev

Impact analysis - Multiple ranges not handled for GIT range

Open
#1,938 3 comments 0 reactions 1 assignee Claimed by @Ly-Joey View on GitHub
backlog bug
Dominant language
Go
Stars
2.9k
Forks
369
Avg merge
1d 17h
Merged PRs (30d)
149

Description

**Describe the bug**
Multiple ranges on the same branch are not handled for GIT type.

I created a toy example based on the "multiple range example" : https://ossf.github.io/osv-schema/#multiple-range-example.
In order to avoid recreating a toy repository we will reuse the one that we created for the previous issue :
https://github.com/RomainLefeuvre/osv_issue_minimal_example with the following git history :
![image](https://github.com/google/osv.dev/assets/33905216/5ca360d9-36fb-494c-befe-8ae890cc5d13)

And this range of events :
```
"events": [
{
"introduced": "d241812d2722d573a7b096d44d139946d8dcb484" [X]
},
{
"fixed": "ec5e313170f68d3fc575d107a8b92d43ae140249" [B]
},
{
"introduced": "868d891cffe96cd67b2abac82c62ade7219af9b5" [C]
},
{
"fixed": "80f15009d903ac95ffc5a5a07a3a213e4980bb62" [Y]
}
]
}
```
https://github.com/google/osv.dev/commit/b22dc07d42b3117269aa6126238ffba086a2c255

**To Reproduce**
Steps to reproduce the behaviour:
1. clone https://github.com/RomainLefeuvre/osv.dev
2. setup your python virtualenv as described in the osv documentation
3. from the root level of the repo, execute `python -m osv.analyze_tool --detect_cherrypicks true --format json "./osv/osv_bug/vuln_2.json"`

**Result**
```
❯ python -m osv.analyze_tool --format json --detect_cherrypicks true "./osv/osv_bug/vuln_2.json"
AnalyzeResult(has_changes=False, commits={'d241812d2722d573a7b096d44d139946d8dcb484', 'e54222cfdedd86a37dc37d999ebc63dccf3fc9da'})
```

The following commits are detected
- `d241812d2722d573a7b096d44d139946d8dcb484` (X)
- `e54222cfdedd86a37dc37d999ebc63dccf3fc9da` (A)

**Expected behaviour**
C and D should also be reported as vulnerable

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.