-
-
Notifications
You must be signed in to change notification settings - Fork 309
fix: skip withdrawn OSV advisories in parse_advisory_data_v3#2240
fix: skip withdrawn OSV advisories in parse_advisory_data_v3 #2240shivamshrma09 wants to merge 1 commit into
Conversation
Withdrawn advisories were being imported by the v2 pipeline because parse_advisory_data_v3 in pipes/osv_v2.py had no withdrawn check. This caused packages like pkg:pypi/py@1.11.0 to appear as affected even though the advisory (e.g. GHSA-w596-4wvx-j9j6) was withdrawn. Add a withdrawn check at the top of parse_advisory_data_v3, consistent with the existing check in parse_advisory_data (v1). This fix covers all 5 pipelines that use parse_advisory_data_v3: github_osv_importer, oss_fuzz, pypa_importer, pysec_importer, ubuntu_osv_importer. Add tests for both withdrawn and non-withdrawn cases in test_osv_v2.py. Fixes aboutcode-org#2238 Signed-off-by: shivamshrma09 <shivamsharma27107@gmail.com>
@ziadhany
ziadhany
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@shivamshrma09 Please also fix the CI, and don't use AI- generated tools.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@shivamshrma09 withdrawn OSV advisories should not affect any package, but I think it should still been stored and reported.
so the result shouldn't be None
shivamshrma09
commented
Apr 1, 2026
@ziadhany i understand your point. initialy i understand the codebase correctly but can't write a good logic i thought that we should skip the data if it's not affecting any package, but i agree that we should store that data also and add an affected_packages DB filed empty.
i am thinking to add an prefix to summary like
WITHRAWN: ....summary to make it clear.
and i am working on CI fixes
Summary
Fixes #2238
pkg:pypi/py@1.11.0was shown as affected in GitHub and GitLab advisories even though the advisoryGHSA-w596-4wvx-j9j6was withdrawn.Root Cause
parse_advisory_data_v3inpipes/osv_v2.pyhad nowithdrawncheck, so withdrawn advisories were being imported by the v2 pipeline.Changes
pipes/osv_v2.py: Addedwithdrawncheck at the top ofparse_advisory_data_v3, consistent with the existing check inparse_advisory_data(v1). This covers all 5 pipelines using this function:github_osv_importer,oss_fuzz,pypa_importer,pysec_importer,ubuntu_osv_importer.importers/osv.py: Addedwithdrawncheck inparse_advisory_data(v1).importers/github_osv.py: GuardyieldagainstNonereturn.tests/pipes/test_osv_v2.py: Added tests for withdrawn and non-withdrawn cases.tests/test_osv.py: Added tests for withdrawn and non-withdrawn cases.Signed-off-by: shivamshrma09 shivamsharma27107@gmail.com