Drop OSVDB-derived OSV aliases from the rubygem data sources

vulnerabilities/importers/ruby.py

@@ -145,8 +145,6 @@ def get_aliases(record) -> [str]:
     aliases = []
     if record.get("cve"):
         aliases.append("CVE-{}".format(record.get("cve")))
-    if record.get("osvdb"):
-        aliases.append("OSV-{}".format(record.get("osvdb")))
     if record.get("ghsa"):
         aliases.append("GHSA-{}".format(record.get("ghsa")))
     return aliases

vulnerabilities/migrations/0143_remove_rubygem_osvdb_aliases.py

@@ -0,0 +1,42 @@
+#
+# Copyright (c) nexB Inc. and others. All rights reserved.
+# VulnerableCode is a trademark of nexB Inc.
+# SPDX-License-Identifier: Apache-2.0
+# See http://www.apache.org/licenses/LICENSE-2.0 for the license text.
+# See https://github.com/aboutcode-org/vulnerablecode for support or download.
+# See https://aboutcode.org for more information about nexB OSS projects.
+#
+
+from django.db import migrations
+
+"""
+Remove the OSVDB-derived aliases imported from the rubygem data sources.
+
+The rubysec advisory data contains legacy references to the defunct OSVDB
+database, and these were imported as "OSV-<number>" aliases. These are not
+public aliases and collide with the modern OSV.dev namespace. Genuine
+OSV.dev identifiers have the form "OSV-<year>-<number>" with two hyphens
+and are preserved.
+
+See https://github.com/aboutcode-org/vulnerablecode/issues/2421
+"""
+
+OSVDB_DERIVED_ALIAS_REGEX = r"^OSV-\d+$"
+
+
+def remove_osvdb_aliases(apps, schema_editor):
+    Alias = apps.get_model("vulnerabilities", "Alias")
+    Alias.objects.filter(alias__regex=OSVDB_DERIVED_ALIAS_REGEX).delete()
+
+    AdvisoryAlias = apps.get_model("vulnerabilities", "AdvisoryAlias")
+    AdvisoryAlias.objects.filter(alias__regex=OSVDB_DERIVED_ALIAS_REGEX).delete()
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("vulnerabilities", "0142_advisoryv2_is_curation_advisoryv2_resolves_todos"),
+    ]
+
+    operations = [
+        migrations.RunPython(remove_osvdb_aliases, reverse_code=migrations.RunPython.noop),
+    ]

vulnerabilities/pipelines/v2_importers/ruby_importer.py

@@ -202,8 +202,6 @@ def get_aliases(record) -> [str]:
     aliases = []
     if record.get("cve"):
         aliases.append("CVE-{}".format(record.get("cve")))
-    if record.get("osvdb"):
-        aliases.append("OSV-{}".format(record.get("osvdb")))
     if record.get("ghsa"):
         aliases.append("GHSA-{}".format(record.get("ghsa")))
     return aliases

vulnerabilities/tests/test_data/ruby/CVE-2010-1330-expected.json

@@ -1,7 +1,6 @@
 {
   "aliases": [
-    "CVE-2010-1330",
-    "OSV-77297"
+    "CVE-2010-1330"
   ],
   "summary": "CVE-2010-1330 jruby: XSS in the regular expression engine when processing invalid UTF-8 byte sequences\nThe regular expression engine in JRuby before 1.4.1, when $KCODE is set to 'u', does not properly handle characters immediately after a UTF-8 character, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted string.",
   "affected_packages": [
@@ -29,4 +28,4 @@
   "date_published": "2010-04-26T00:00:00+00:00",
   "weaknesses": [],
   "url": "https://github.com/rubysec/ruby-advisory-db"
-}
+}