Refactor severity score model and fix incorrect suse scores#1636
Refactor severity score model and fix incorrect suse scores#1636keshav-space merged 14 commits intomainfrom
Conversation
keshav-space
changed the title
keshav-space
force-pushed
the
1597-refactor-vulnerability-severity
branch
from
193628e to
84a3a93
Compare
- Add 'severities' field to AffectedByPackageRelatedVulnerability. - Add 'severities' field to Vulnerability. - Add 'url' field to VulnerabilitySeverity. - Data migration to remove corrupted SUSE scores. - Data migration to populate new VulnerabilitySeverity url field using reference. - Data migration to populate Vulnerability 'severities' M2M relationship. - Delete VulnerabilitySeverity reference field. Signed-off-by: Keshav Priyadarshi <git@keshav.space>
Signed-off-by: Keshav Priyadarshi <git@keshav.space>
Signed-off-by: Keshav Priyadarshi <git@keshav.space>
Signed-off-by: Keshav Priyadarshi <git@keshav.space>
Signed-off-by: Keshav Priyadarshi <git@keshav.space>
Signed-off-by: Keshav Priyadarshi <git@keshav.space>
Signed-off-by: Keshav Priyadarshi <git@keshav.space>
Signed-off-by: Keshav Priyadarshi <git@keshav.space>
Signed-off-by: Keshav Priyadarshi <git@keshav.space>
- Prefetch related vulnerability, severities, references, and exploits for better performance Signed-off-by: Keshav Priyadarshi <git@keshav.space>
Signed-off-by: Keshav Priyadarshi <git@keshav.space>
Signed-off-by: Keshav Priyadarshi <git@keshav.space>
keshav-space
force-pushed
the
1597-refactor-vulnerability-severity
branch
from
84a3a93 to
4107451
Compare
Signed-off-by: Keshav Priyadarshi <git@keshav.space>
| model = VulnerabilitySeverity | ||
| fields = ["url", "value", "scoring_system", "scoring_elements", "published_at"] | ||
|
|
||
| def to_representation(self, instance): |
There was a problem hiding this comment.
Why we need to_representation method here? if published_at is None, let it be sent as None
There was a problem hiding this comment.
Added this just to preserve the response structure we're already using in APIv2 https://github.com/aboutcode-org/vulnerablecode/blob/8a68c97dfa369ad048de3ece14cc1b3cf40591cc/vulnerabilities/api_v2.py#L16C33-L16C64.
IMO yes we should simpy send None when we don't have published date.
vulnerabilities/migrations/0078_alter_vulnerabilityseverity_options_and_more.py
Show resolved
Hide resolved
|
|
||
| return data | ||
|
|
||
| def get_references(self, vulnerability): |
There was a problem hiding this comment.
Minor nit: Why we are having a method here?
There was a problem hiding this comment.
In our old API, references used to contain the nested severity, as severity and reference were related through a foreignkey relationship. In our new model we have dissociated reference and severity. To ensure we maintain compatibility for existing users of old API we're manually crafting the references to include the relevant severity.
Signed-off-by: Keshav Priyadarshi <git@keshav.space>
3 participants
severitiesfield to both AffectedByPackageRelatedVulnerability and Vulnerability.urlfield to VulnerabilitySeverity and removereferencerelationship.urlfield in VulnerabilitySeverity usingreferences, set the severity-vulnerablity relationship from the old model.Resolves #1597