OSV v3 parser shares introduced/fixed commit patches across affected packages

未关闭 适合新手
  • 哪里不对？
#2,489 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

@Celestial-0 已经在做这个了。

开始于 2026年11月3日。

  • #2490 来自 @Celestial-0 —— 未关闭

评估

难度
2/5
预计耗时
1-3 小时
新手友好度
84/100
Issue 类型
缺陷
描述清晰度
描述清楚
活跃度
活跃
技术栈
python
领域
backend

调研方向

从 vulnerabilities/pipes/osv_v2.py 中的 parse_advisory_data_v3 开始，issue 在此指出了被初始化并传递给每个包的提交列表。针对不同的 Git 块和仅包含版本的块，以任意顺序运行真实解析器回归测试；完成的标准是每个包只获得自己的提交，且列表彼此独立，同时一个块内的多个 Git 范围仍会累积。

由索引模型根据 Issue 内容生成。

描述

When an OSV advisory contains multiple affected blocks, parse_advisory_data_v3 puts all collected Git commits into each parsed package. Packages with only version ranges inherit commits too.

Reproduced on current main, commit 8af2bd39510f909c852c5cc086e9b56addc8c50a, with Python 3.12.14, univers==32.0.1, and packageurl-python==0.17.6.

Reproduction

Run this in the project's configured Django shell. The package names, repositories and hashes below are synthetic. Parsing these GitHub URLs does not fetch any repositories.

python manage.py shell

from vulnerabilities.pipes.osv_v2 import parse_advisory_data_v3

raw = {
    "id": "x_REPRO-OSV-COMMIT-SCOPE",
    "modified": "2026-11-03T00:00:00Z",
    "affected": [
        {
            "package": {"ecosystem": "PyPI", "name": f"demo-{suffix}"},
            "ranges": [{
                "type": "GIT",
                "repo": f"https://github.com/example/repo-{suffix}",
                "events": [{"introduced": intro * 40}, {"fixed": fixed * 40}],
            }],
        }
        for suffix, intro, fixed in [("a", "a", "b"), ("b", "c", "d")]
    ],
}
advisory = parse_advisory_data_v3(
    raw, ["pypi"], "https://example.org/advisory", ""
)
first, second = advisory.affected_packages
for package in advisory.affected_packages:
    print(package.package, len(package.introduced_by_commit_patches),
          len(package.fixed_by_commit_patches))
print(first.introduced_by_commit_patches is second.introduced_by_commit_patches)
print(first.fixed_by_commit_patches is second.fixed_by_commit_patches)

Actual output:

pkg:pypi/demo-a 2 2
pkg:pypi/demo-b 2 2
True
True

Each package contains both repositories' introduced and fixed commits. Expected output is 1 1 for each package and separate lists: demo-a should only have repo-a commits and demo-b only repo-b commits.

With a Git block and a version-only block in the same advisory, the version-only package receives the Git block's introduced and fixed patches in either order.

Cause

The parser initializes the two commit lists before the affected-package loop and passes them unchanged to every AffectedPackageV2. The constructor validates the lists without copying them, so the parsed advisory associates packages with other packages' commits.

The lists should be initialized for each affected block, alongside its version constraints. Multiple Git ranges within the same block should still accumulate into that block's lists.

I checked existing OSV issues and PRs, including #2080, #2066, #2116 and the current parser PRs, and found no report of this attribution bug. Tests using the real parser and classifier fail for two distinct Git blocks and for a version-only block in either order. The control with multiple Git ranges in one block passes.

I'd like to work on the fix. Would you welcome a PR that scopes the lists to each affected block and adds these regression tests?

主要语言
Python
星标
717
派生
352
平均合并
6 小时 19 分钟
30 天内合并 PR
6

环境准备

  • 提供 Dockerfile 或 Docker Compose 文件
  • 没有 Pull Request 模板
  • 没有贡献指南

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

aboutcode-org/vulnerablecode 的其他 Issue

查看 aboutcode-org/vulnerablecode 的全部 Issue

相似的 Issue

更多 Python Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。