swh.vulns.osv.parser package

Submodules:

• swh.vulns.osv.parser.utils module
  • utc_now()
  • find_release_from_version()

Module contents:

swh.vulns.osv.parser.is_sha1_hex_str(s)

class swh.vulns.osv.parser.OSVReportParser(storage: StorageInterface, vulnerabilities_storage: VulnerabilitiesStorageInterface, **kwargs)

Bases: object

Class dedicated to the parsing of and OSV report so that vulnerability events are extracted then persisted to a storage.

Parameters:

• storage – instance of SWH archive main storage

• vulnerabilities_storage – instance of OSV vulnerabilities storage

OSV_REPORT_BASE_URL = 'https://api.osv.dev/v1/vulns'

classmethod from_config(storage: Dict[str, Any], vulnerabilities_storage: Dict[str, Any], **kwargs) → OSVReportParser

Instantiate an OSV report parser from configuration.

Parameters:

• storage – Configuration for SWH main storage

• vulnerabilities_storage – Configuration for OSV vulnerabilities storage

Returns:

an instance of the OSV report parser

classmethod from_configfile(**kwargs: Any) → OSVReportParser

Instantiate a parser from the configuration loaded from the SWH_CONFIG_FILENAME envvar, with potential extra keyword arguments if their value is not None.

Parameters:

kwargs – kwargs passed to the parser instantiation

Returns:

an instance of the OSV report parser

process_osv_report(osv_vulnerability_id: str, store_vulnerability_events: bool = True) → List[OSVVulnerabilityEvent]

Process an OSV report by parsing it and persisting vulnerability events in storage.

Parameters:

• vulnerability_id – Identifier of vulnerability in OSV database

• store_vulnerability_events – Whether to persist or not extracted vulnerability events in storage

Returns:

list of extracted vulnerability events

swh.vulns.osv.parser.parse_osv_report(osv_report: Dict[str, Any], storage: StorageInterface) → List[OSVVulnerabilityEvent]

Parse an OSV report: extract vulnerability events and find related SWHIDs into the SWH archive.

Parameters:

• osv_report – OSV report parsed from JSON

• storage – instance of SWH main storage

Returns:

list of extracted vulnerability events