diff --git a/vulnerabilities/importers/ruby.py b/vulnerabilities/importers/ruby.py index 268419587..c6ec0f444 100644 --- a/vulnerabilities/importers/ruby.py +++ b/vulnerabilities/importers/ruby.py @@ -145,8 +145,6 @@ def get_aliases(record) -> [str]: aliases = [] if record.get("cve"): aliases.append("CVE-{}".format(record.get("cve"))) - if record.get("osvdb"): - aliases.append("OSV-{}".format(record.get("osvdb"))) if record.get("ghsa"): aliases.append("GHSA-{}".format(record.get("ghsa"))) return aliases diff --git a/vulnerabilities/migrations/0143_remove_rubygem_osvdb_aliases.py b/vulnerabilities/migrations/0143_remove_rubygem_osvdb_aliases.py new file mode 100644 index 000000000..941eb36ed --- /dev/null +++ b/vulnerabilities/migrations/0143_remove_rubygem_osvdb_aliases.py @@ -0,0 +1,42 @@ +# +# Copyright (c) nexB Inc. and others. All rights reserved. +# VulnerableCode is a trademark of nexB Inc. +# SPDX-License-Identifier: Apache-2.0 +# See http://www.apache.org/licenses/LICENSE-2.0 for the license text. +# See https://github.com/aboutcode-org/vulnerablecode for support or download. +# See https://aboutcode.org for more information about nexB OSS projects. +# + +from django.db import migrations + +""" +Remove the OSVDB-derived aliases imported from the rubygem data sources. + +The rubysec advisory data contains legacy references to the defunct OSVDB +database, and these were imported as "OSV-" aliases. These are not +public aliases and collide with the modern OSV.dev namespace. Genuine +OSV.dev identifiers have the form "OSV--" with two hyphens +and are preserved. + +See https://github.com/aboutcode-org/vulnerablecode/issues/2421 +""" + +OSVDB_DERIVED_ALIAS_REGEX = r"^OSV-\d+$" + + +def remove_osvdb_aliases(apps, schema_editor): + Alias = apps.get_model("vulnerabilities", "Alias") + Alias.objects.filter(alias__regex=OSVDB_DERIVED_ALIAS_REGEX).delete() + + AdvisoryAlias = apps.get_model("vulnerabilities", "AdvisoryAlias") + AdvisoryAlias.objects.filter(alias__regex=OSVDB_DERIVED_ALIAS_REGEX).delete() + + +class Migration(migrations.Migration): + dependencies = [ + ("vulnerabilities", "0142_advisoryv2_is_curation_advisoryv2_resolves_todos"), + ] + + operations = [ + migrations.RunPython(remove_osvdb_aliases, reverse_code=migrations.RunPython.noop), + ] diff --git a/vulnerabilities/pipelines/v2_importers/ruby_importer.py b/vulnerabilities/pipelines/v2_importers/ruby_importer.py index 5858ad00c..189dc5cea 100644 --- a/vulnerabilities/pipelines/v2_importers/ruby_importer.py +++ b/vulnerabilities/pipelines/v2_importers/ruby_importer.py @@ -202,8 +202,6 @@ def get_aliases(record) -> [str]: aliases = [] if record.get("cve"): aliases.append("CVE-{}".format(record.get("cve"))) - if record.get("osvdb"): - aliases.append("OSV-{}".format(record.get("osvdb"))) if record.get("ghsa"): aliases.append("GHSA-{}".format(record.get("ghsa"))) return aliases diff --git a/vulnerabilities/tests/test_data/ruby/CVE-2010-1330-expected.json b/vulnerabilities/tests/test_data/ruby/CVE-2010-1330-expected.json index fa77e85a8..5cc203812 100644 --- a/vulnerabilities/tests/test_data/ruby/CVE-2010-1330-expected.json +++ b/vulnerabilities/tests/test_data/ruby/CVE-2010-1330-expected.json @@ -1,7 +1,6 @@ { "aliases": [ - "CVE-2010-1330", - "OSV-77297" + "CVE-2010-1330" ], "summary": "CVE-2010-1330 jruby: XSS in the regular expression engine when processing invalid UTF-8 byte sequences\nThe regular expression engine in JRuby before 1.4.1, when $KCODE is set to 'u', does not properly handle characters immediately after a UTF-8 character, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted string.", "affected_packages": [ @@ -29,4 +28,4 @@ "date_published": "2010-04-26T00:00:00+00:00", "weaknesses": [], "url": "https://github.com/rubysec/ruby-advisory-db" -} \ No newline at end of file +}