Repository navigation
Close GHSAs when the associated CVE has a patch (#54) - #70
Conversation
|
@sethmlarson Please take a look. |
sethmlarson
left a comment
sethmlarson
left a comment
There was a problem hiding this comment.
Thanks! Some thoughts for you:
| try: | ||
| cve = cve_api.show_cve_record(cve_id) | ||
| cve_refs = cve["containers"]["cna"]["references"] | ||
| except KeyError, RequestFailed, TypeError: |
There was a problem hiding this comment.
Does this error out if the CVE ID is reserved but hasn't been published yet?
There was a problem hiding this comment.
That's a good question that I would probably need to play with the cvelib CLI to verify. The API docs don't say anything about the API being limited about what kinds of CVEs it returns, but basically every key lookup is optional and I don't know what reserved CVE records will actually look like.
I think what you're getting it is we should check both the CVE state and the existence of a patch? If that's right that sounds good to me too, I can make that change.
| import datetime | ||
| import json | ||
| import operator | ||
| from collections import abc |
There was a problem hiding this comment.
same as above, we can drop the abc and use typing
This implements the requested feature. It tries to be efficient about it, only requesting CVEs when a draft GHSA already has one.
I could add a lot more tests for the new iterator function itself as well as different shapes of input data. The current tests don't seem to strive for that much coverage, so I've stopped here, but I'm very open to feedback about more you would or wouldn't like to see.