From 823c1e6749ecc471b83477f2444c4247e397c29d Mon Sep 17 00:00:00 2001 From: Manoj Gowda Date: Thu, 27 Aug 2026 19:59:43 +0530 Subject: [PATCH] Drop OSVDB-derived OSV aliases from the rubygem data sources The rubysec advisory data carries references to the defunct OSVDB database in its osvdb field, and both the ruby importer and the v2 ruby importer pipeline turned these into OSV- aliases. These are not public aliases and the prefix collides with the modern OSV.dev namespace. Remove the code that imports them and add a data migration deleting the previously imported ones from both the Alias and AdvisoryAlias tables. Genuine OSV.dev identifiers (OSV--, with two hyphens) are preserved by the migration regex. Closes https://github.com/aboutcode-org/vulnerablecode/issues/2421 Signed-off-by: Manoj Gowda --- vulnerabilities/importers/ruby.py | 2 - .../0143_remove_rubygem_osvdb_aliases.py | 42 +++++++++++++++++++ .../pipelines/v2_importers/ruby_importer.py | 2 - .../ruby/CVE-2010-1330-expected.json | 5 +-- 4 files changed, 44 insertions(+), 7 deletions(-) create mode 100644 vulnerabilities/migrations/0143_remove_rubygem_osvdb_aliases.py diff --git a/vulnerabilities/importers/ruby.py b/vulnerabilities/importers/ruby.py index 268419587..c6ec0f444 100644 --- a/vulnerabilities/importers/ruby.py +++ b/vulnerabilities/importers/ruby.py @@ -145,8 +145,6 @@ def get_aliases(record) -> [str]: aliases = [] if record.get("cve"): aliases.append("CVE-{}".format(record.get("cve"))) - if record.get("osvdb"): - aliases.append("OSV-{}".format(record.get("osvdb"))) if record.get("ghsa"): aliases.append("GHSA-{}".format(record.get("ghsa"))) return aliases diff --git a/vulnerabilities/migrations/0143_remove_rubygem_osvdb_aliases.py b/vulnerabilities/migrations/0143_remove_rubygem_osvdb_aliases.py new file mode 100644 index 000000000..941eb36ed --- /dev/null +++ b/vulnerabilities/migrations/0143_remove_rubygem_osvdb_aliases.py @@ -0,0 +1,42 @@ +# +# Copyright (c) nexB Inc. and others. All rights reserved. +# VulnerableCode is a trademark of nexB Inc. +# SPDX-License-Identifier: Apache-2.0 +# See http://www.apache.org/licenses/LICENSE-2.0 for the license text. +# See https://github.com/aboutcode-org/vulnerablecode for support or download. +# See https://aboutcode.org for more information about nexB OSS projects. +# + +from django.db import migrations + +""" +Remove the OSVDB-derived aliases imported from the rubygem data sources. + +The rubysec advisory data contains legacy references to the defunct OSVDB +database, and these were imported as "OSV-" aliases. These are not +public aliases and collide with the modern OSV.dev namespace. Genuine +OSV.dev identifiers have the form "OSV--" with two hyphens +and are preserved. + +See https://github.com/aboutcode-org/vulnerablecode/issues/2421 +""" + +OSVDB_DERIVED_ALIAS_REGEX = r"^OSV-\d+$" + + +def remove_osvdb_aliases(apps, schema_editor): + Alias = apps.get_model("vulnerabilities", "Alias") + Alias.objects.filter(alias__regex=OSVDB_DERIVED_ALIAS_REGEX).delete() + + AdvisoryAlias = apps.get_model("vulnerabilities", "AdvisoryAlias") + AdvisoryAlias.objects.filter(alias__regex=OSVDB_DERIVED_ALIAS_REGEX).delete() + + +class Migration(migrations.Migration): + dependencies = [ + ("vulnerabilities", "0142_advisoryv2_is_curation_advisoryv2_resolves_todos"), + ] + + operations = [ + migrations.RunPython(remove_osvdb_aliases, reverse_code=migrations.RunPython.noop), + ] diff --git a/vulnerabilities/pipelines/v2_importers/ruby_importer.py b/vulnerabilities/pipelines/v2_importers/ruby_importer.py index 5858ad00c..189dc5cea 100644 --- a/vulnerabilities/pipelines/v2_importers/ruby_importer.py +++ b/vulnerabilities/pipelines/v2_importers/ruby_importer.py @@ -202,8 +202,6 @@ def get_aliases(record) -> [str]: aliases = [] if record.get("cve"): aliases.append("CVE-{}".format(record.get("cve"))) - if record.get("osvdb"): - aliases.append("OSV-{}".format(record.get("osvdb"))) if record.get("ghsa"): aliases.append("GHSA-{}".format(record.get("ghsa"))) return aliases diff --git a/vulnerabilities/tests/test_data/ruby/CVE-2010-1330-expected.json b/vulnerabilities/tests/test_data/ruby/CVE-2010-1330-expected.json index fa77e85a8..5cc203812 100644 --- a/vulnerabilities/tests/test_data/ruby/CVE-2010-1330-expected.json +++ b/vulnerabilities/tests/test_data/ruby/CVE-2010-1330-expected.json @@ -1,7 +1,6 @@ { "aliases": [ - "CVE-2010-1330", - "OSV-77297" + "CVE-2010-1330" ], "summary": "CVE-2010-1330 jruby: XSS in the regular expression engine when processing invalid UTF-8 byte sequences\nThe regular expression engine in JRuby before 1.4.1, when $KCODE is set to 'u', does not properly handle characters immediately after a UTF-8 character, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted string.", "affected_packages": [ @@ -29,4 +28,4 @@ "date_published": "2010-04-26T00:00:00+00:00", "weaknesses": [], "url": "https://github.com/rubysec/ruby-advisory-db" -} \ No newline at end of file +}