Add PySec Live V2 Importer Pipeline #1983

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Open

michaelehab wants to merge 1 commit into main

from 1981-pysec-live-importer

Open

Add PySec Live V2 Importer Pipeline #1983

michaelehab wants to merge 1 commit into main from 1981-pysec-live-importer

Conversation

@michaelehab

Copy link

Collaborator

@michaelehab michaelehab commented Aug 21, 2025

Solves #1981

Add PySec Live V2 Importer
Add tests for the PySec Live V2 Importer
Tested functionally using the Live Evaluation API in Add Live Evaluation API endpoint and PyPa live pipeline importer #1969

@michaelehab


 Add PySec Live V2 Importer Pipeline #1981

f88c543

* Add PySec Live V2 Importer
* Add tests for the PySec Live V2 Importer
* Tested functionally using the Live Evaluation API in #1969
Signed-off-by: Michael Ehab Mikhail <michael.ehab@hotmail.com>

ziadhany

ziadhany requested changes

Aug 23, 2025

View reviewed changes

Copy link

Collaborator

@ziadhany ziadhany left a comment •

edited

Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@michaelehab Great job 👍 A few functions could be refactored to improve readability.

vulnerabilities/tests/pipelines/v2_importers/test_pysec_live_importer_v2.py

Comment on lines +70 to +71

from vulnerabilities.pipelines.v2_importers.pysec_live_importer import PySecLiveImporterPipeline

Copy link

Collaborator

@ziadhany ziadhany Aug 23, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Move import PySecLiveImporterPipeline to the top of the test

Suggested change

from vulnerabilities.pipelines.v2_importers.pysec_live_importer import PySecLiveImporterPipeline

vulnerabilities/tests/pipelines/v2_importers/test_pysec_live_importer_v2.py

def test_package_with_version_not_affected(mock_zip_data):

from vulnerabilities.pipelines.v2_importers.pysec_live_importer import PySecLiveImporterPipeline

Copy link

Collaborator

@ziadhany ziadhany Aug 23, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change

from vulnerabilities.pipelines.v2_importers.pysec_live_importer import PySecLiveImporterPipeline

vulnerabilities/tests/pipelines/v2_importers/test_pysec_live_importer_v2.py

Comment on lines +129 to +130

from vulnerabilities.pipelines.v2_importers.pysec_live_importer import PySecLiveImporterPipeline

Copy link

Collaborator

@ziadhany ziadhany Aug 23, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change

from vulnerabilities.pipelines.v2_importers.pysec_live_importer import PySecLiveImporterPipeline

vulnerabilities/pipelines/v2_importers/pysec_live_importer.py

if not file_name.startswith("PYSEC-"):

continue

with zip_file.open(file_name) as f:

import json

Copy link

Collaborator

@ziadhany ziadhany Aug 23, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Move import json to the top

vulnerabilities/pipelines/v2_importers/pysec_live_importer.py

Comment on lines +59 to +62

try:

v = PypiVersion(version)

except Exception:

return False

Copy link

Collaborator

@ziadhany ziadhany Aug 23, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Catch only InvalidVersion instead of all errors.

vulnerabilities/pipelines/v2_importers/pysec_live_importer.py

return False

for entry in affected:

ranges = entry.get("ranges", [])

for r in ranges:

Copy link

Collaborator

@ziadhany ziadhany Aug 23, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

r in for r in ranges: could be renamed to something clearer like version_range/data_range for readability.

vulnerabilities/pipelines/v2_importers/pysec_live_importer.py

Comment on lines +64 to +65

ranges = entry.get("ranges", [])

for r in ranges:

Copy link

Collaborator

@ziadhany ziadhany Aug 23, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change

ranges = entry.get("ranges", [])

for r in ranges:

for event in r.get("events", []):

vulnerabilities/pipelines/v2_importers/pysec_live_importer.py

events = r.get("events", [])

introduced = None

fixed = None

for event in events:

Copy link

Collaborator

@ziadhany ziadhany Aug 23, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change

for event in events:

for event in r.get("events", []):

vulnerabilities/pipelines/v2_importers/pysec_live_importer.py

for entry in affected:

ranges = entry.get("ranges", [])

for r in ranges:

events = r.get("events", [])

Copy link

Collaborator

@ziadhany ziadhany Aug 23, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change

events = r.get("events", [])

vulnerabilities/pipelines/v2_importers/pysec_live_importer.py

if not self._is_version_affected(advisory_dict, self.purl.version):

continue

f.seek(0)

Copy link

Collaborator

@ziadhany ziadhany Aug 23, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why do we need f.seek(0) here? Could we just read the file once instead?

Labels

None yet

3 participants

@michaelehab @ziadhany

Uh oh!

Add PySec Live V2 Importer Pipeline #1983

Are you sure you want to change the base?

Add PySec Live V2 Importer Pipeline #1983

Uh oh!

Conversation

@michaelehab michaelehab commented Aug 21, 2025

Uh oh!

@ziadhany ziadhany left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

@ziadhany ziadhany Aug 23, 2025

Choose a reason for hiding this comment

Uh oh!

@ziadhany ziadhany Aug 23, 2025

Choose a reason for hiding this comment

Uh oh!

@ziadhany ziadhany Aug 23, 2025

Choose a reason for hiding this comment

Uh oh!

@ziadhany ziadhany Aug 23, 2025

Choose a reason for hiding this comment

Uh oh!

@ziadhany ziadhany Aug 23, 2025

Choose a reason for hiding this comment

Uh oh!

@ziadhany ziadhany Aug 23, 2025

Choose a reason for hiding this comment

Uh oh!

@ziadhany ziadhany Aug 23, 2025

Choose a reason for hiding this comment

Uh oh!

@ziadhany ziadhany Aug 23, 2025

Choose a reason for hiding this comment

Uh oh!

@ziadhany ziadhany Aug 23, 2025

Choose a reason for hiding this comment

Uh oh!

@ziadhany ziadhany Aug 23, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

@ziadhany ziadhany left a comment •

edited

Loading