OSV v3 parser shares introduced/fixed commit patches across affected packages

Abierto Apto para principiantes
  • ¿Algo no está bien?
#2,489 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

@Celestial-0 ya está trabajando en esto.

Desde el 3/11/2026.

  • #2490 de @Celestial-0 — abierto

Evaluación

Dificultad
2/5
Tiempo estimado
1-3 horas
Aptitud para principiantes
84/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
python
Área
backend

Línea de trabajo

Empieza en vulnerabilities/pipes/osv_v2.py, en parse_advisory_data_v3, donde el issue señala las listas de commits que se inicializan y se pasan a cada paquete. Ejecuta las pruebas de regresión del parser real para bloques Git distintos y un bloque que solo contiene versiones, en cualquier orden; se considera terminado cuando cada paquete recibe únicamente sus propios commits y listas separadas, mientras que varios rangos Git dentro de un bloque siguen acumulándose.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

When an OSV advisory contains multiple affected blocks, parse_advisory_data_v3 puts all collected Git commits into each parsed package. Packages with only version ranges inherit commits too.

Reproduced on current main, commit 8af2bd39510f909c852c5cc086e9b56addc8c50a, with Python 3.12.14, univers==32.0.1, and packageurl-python==0.17.6.

Reproduction

Run this in the project's configured Django shell. The package names, repositories and hashes below are synthetic. Parsing these GitHub URLs does not fetch any repositories.

python manage.py shell

from vulnerabilities.pipes.osv_v2 import parse_advisory_data_v3

raw = {
    "id": "x_REPRO-OSV-COMMIT-SCOPE",
    "modified": "2026-11-03T00:00:00Z",
    "affected": [
        {
            "package": {"ecosystem": "PyPI", "name": f"demo-{suffix}"},
            "ranges": [{
                "type": "GIT",
                "repo": f"https://github.com/example/repo-{suffix}",
                "events": [{"introduced": intro * 40}, {"fixed": fixed * 40}],
            }],
        }
        for suffix, intro, fixed in [("a", "a", "b"), ("b", "c", "d")]
    ],
}
advisory = parse_advisory_data_v3(
    raw, ["pypi"], "https://example.org/advisory", ""
)
first, second = advisory.affected_packages
for package in advisory.affected_packages:
    print(package.package, len(package.introduced_by_commit_patches),
          len(package.fixed_by_commit_patches))
print(first.introduced_by_commit_patches is second.introduced_by_commit_patches)
print(first.fixed_by_commit_patches is second.fixed_by_commit_patches)

Actual output:

pkg:pypi/demo-a 2 2
pkg:pypi/demo-b 2 2
True
True

Each package contains both repositories' introduced and fixed commits. Expected output is 1 1 for each package and separate lists: demo-a should only have repo-a commits and demo-b only repo-b commits.

With a Git block and a version-only block in the same advisory, the version-only package receives the Git block's introduced and fixed patches in either order.

Cause

The parser initializes the two commit lists before the affected-package loop and passes them unchanged to every AffectedPackageV2. The constructor validates the lists without copying them, so the parsed advisory associates packages with other packages' commits.

The lists should be initialized for each affected block, alongside its version constraints. Multiple Git ranges within the same block should still accumulate into that block's lists.

I checked existing OSV issues and PRs, including #2080, #2066, #2116 and the current parser PRs, and found no report of this attribution bug. Tests using the real parser and classifier fail for two distinct Git blocks and for a version-only block in either order. The control with multiple Git ranges in one block passes.

I'd like to work on the fix. Would you welcome a PR that scopes the lists to each affected block and adds these regression tests?

Lenguaje dominante
Python
Estrellas
717
Forks
352
Merge medio
6 h 19 min
PR fusionados (30 d)
6

Preparar el entorno

  • Incluye un Dockerfile o un archivo de Docker Compose
  • Sin plantilla de pull request
  • Sin guía de contribución

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de aboutcode-org/vulnerablecode

Todos los issues de aboutcode-org/vulnerablecode

Issues similares

Más issues de Python

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.