Sync with main branch and fix latest tests

Signed-off-by: Shivam Sandbhor <[email protected]>

Author: sbs2001

vulnerabilities/import_runner.py

@@ -143,6 +143,7 @@ def process_advisories(data_source: DataSource, create_vulcodes) -> None:
     for batch in advisory_batches:
         for advisory in batch:
             try:
+
                 if not advisory.identifier and not create_vulcodes:
                     continue
 
@@ -154,9 +155,11 @@ def process_advisories(data_source: DataSource, create_vulcodes) -> None:
                         reference_id=vuln_ref.reference_id,
                     )
 
-                    if vuln_created or not vuln_ref_exists(vuln, vuln_ref.url, vuln_ref.reference_id):
-                        # A vulnerability reference can't exist if the vulnerability is just created so
-                        # insert it
+                    if vuln_created or not vuln_ref_exists(
+                        vuln, vuln_ref.url, vuln_ref.reference_id
+                    ):
+                        # A vulnerability reference can't exist if the vulnerability is
+                        # just created, so insert it
                         bulk_create_vuln_refs.add(ref)
 
                 for purl in chain(advisory.impacted_package_urls, advisory.resolved_package_urls):
@@ -176,25 +179,27 @@ def process_advisories(data_source: DataSource, create_vulcodes) -> None:
                         existing_ref = get_vuln_pkg_refs(vuln, pkg)
                         if not existing_ref:
                             bulk_create_vuln_pkg_refs.add(pkg_vuln_ref)
-                            # A vulnerability-package relationship does not exist already if either the
-                            # vulnerability or the package is just created.
+                            # A vulnerability-package relationship does not exist already
+                            # if either the vulnerability or the package is just created.
 
                         else:
-                            # insert only if it there is no existing vulnerability-package relationship.
+                            # insert only if it there is no existing vulnerability-package relationship.  # nopep8
                             existing_ref = get_vuln_pkg_refs(vuln, pkg)
                             if not existing_ref:
                                 bulk_create_vuln_pkg_refs.add(pkg_vuln_ref)
 
                             else:
                                 # This handles conflicts between existing data and obtained data
                                 if existing_ref[0].is_vulnerable != pkg_vuln_ref.is_vulnerable:
-                                    handle_conflicts([existing_ref[0], pkg_vuln_ref.to_model_object()])
+                                    handle_conflicts(
+                                        [existing_ref[0], pkg_vuln_ref.to_model_object()]
+                                    )
                                     existing_ref.delete()
+
             except Exception:
                 # TODO: store error but continue
                 logger.error(
-                    f"Failed to process advisory: {advisory!r}:\n"
-                    + traceback.format_exc()
+                    f"Failed to process advisory: {advisory!r}:\n" + traceback.format_exc()
                 )
 
     models.VulnerabilityReference.objects.bulk_create(
@@ -259,17 +264,20 @@ def _get_or_create_vulnerability(
     advisory: Advisory,
 ) -> Tuple[models.Vulnerability, bool]:
 
-    vuln, created = models.Vulnerability.objects.get_or_create(identifier=advisory.identifier)
+    try:
+        vuln, created = models.Vulnerability.objects.get_or_create(identifier=advisory.identifier)
 
-    # Eventually we only want to keep summary from NVD and ignore other descriptions.
-    if advisory.summary and vuln.summary != advisory.summary:
-        vuln.summary = advisory.summary
-        vuln.save()
+        # Eventually we only want to keep summary from NVD and ignore other descriptions.
+        if advisory.summary and vuln.summary != advisory.summary:
+            vuln.summary = advisory.summary
+            vuln.save()
+
+        return vuln, created
 
     except Exception:
         logger.error(
-            f"Failed to _get_or_create_vulnerability: {query_kwargs!r}:\n"
-            + traceback.format_exc())
+            f"Failed to _get_or_create_vulnerability: {query_kwargs!r}:\n" + traceback.format_exc()
+        )
         raise
 
 

vulnerabilities/importers/apache_tomcat.py

@@ -116,7 +116,7 @@ def to_advisories(self, apache_tomcat_advisory_html):
                         summary="",
                         impacted_package_urls=affected_packages,
                         resolved_package_urls=fixed_package,
-                        cve_id=cve_id,
+                        identifier=cve_id,
                         vuln_references=references,
                     )
                 )

vulnerabilities/tests/test_apache_tomcat.py

@@ -89,7 +89,7 @@ def test_to_advisories(self):
                             reference_id="",
                         ),
                     ],
-                    cve_id="CVE-2016-0763",
+                    identifier="CVE-2016-0763",
                 ),
                 Advisory(
                     summary="",
@@ -127,7 +127,7 @@ def test_to_advisories(self):
                             reference_id="",
                         ),
                     ],
-                    cve_id="CVE-2015-5351",
+                    identifier="CVE-2015-5351",
                 ),
                 Advisory(
                     summary="",
@@ -169,7 +169,7 @@ def test_to_advisories(self):
                             reference_id="",
                         ),
                     ],
-                    cve_id="CVE-2016-0706",
+                    identifier="CVE-2016-0706",
                 ),
                 Advisory(
                     summary="",
@@ -207,16 +207,16 @@ def test_to_advisories(self):
                             reference_id="",
                         ),
                     ],
-                    cve_id="CVE-2016-0714",
+                    identifier="CVE-2016-0714",
                 ),
             ],
-            key=lambda x: x.cve_id,
+            key=lambda x: x.identifier,
         )
 
         with open(TEST_DATA) as f:
             found_advisories = self.data_src.to_advisories(f)
 
-        found_advisories.sort(key=lambda x: x.cve_id)
+        found_advisories.sort(key=lambda x: x.identifier)
 
         for i in range(len(found_advisories)):
             found_advisories[i].vuln_references.sort(key=lambda x: x.url)