Skip to content

Add OSV information #232

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
S4mB3ckS wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Add OSV information #232

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
e7478fe
feat: add purl information
Jun 19, 2026
310026c
feat: add summary information
Jun 19, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
34 changes: 34 additions & 0 deletions scripts/generate_osv_advisories.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -359,6 +359,38 @@ def patch_advisory(osv_id: str, sa_advisory: drupal.Advisory) -> bool:
)
return False

def build_summary(project: drupal.Project, sa_advisory: drupal.Advisory) -> str:
"""Build OSV summary"""
summary = None

package_name = project.get('title')
# strip for SA-CONTRIB-2020-038
package_name = package_name.strip()

# eg. Access Bypass, Cross site scripting
sa_type = sa_advisory['field_sa_type']

# function determine_sa_id() in download_sa_advisories.py (no duplicate)
# https://www.drupal.org/sa-contrib-2021-017 => SA-CONTRIB-2021-017
sa_name = sa_advisory['url'].split('/')[-1].upper()

# project_module => module
node_type = project.get('type').split('_', maxsplit=1)[-1]

# Exception for : SA-CONTRIB-2019-074, SA-CONTRIB-2024-022
if "for drupal " in node_type:

@greggles greggles Jun 19, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The name of these modules does include "for Drupal" which is a little odd. If this is not appropriate to have in the OSV summary then it seems OK to remove.

@S4mB3ckS S4mB3ckS Jun 20, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I see the problem. I hesitated for a long time about the format for the summary.

This resulted in the following :
BAT online reservations for Drupal module for Drupal - Access Bypass - SA-CONTRIB-2019-074

It might be more appropriate to use this type of formatting; it will avoid repetition :
BAT online reservations for Drupal (Module) - Access Bypass - SA-CONTRIB-2019-074

@G-Rath G-Rath Jun 20, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Tbh I think only the middle part is appropriate for the summary, as the other parts are already encoded in the advisory and would typically be displayed already as they're critical to doing anything with the advisory.

And then I'm not sure if the middle section is something that would stand well on its own...

@S4mB3ckS S4mB3ckS Jun 20, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The summary can also be seen as the title or subject of the advisory email, even if some elements are already in the description.

Like this :

Sélection_1083

But no problem, i understand your opinion.

node_type = node_type.replace("for drupal ","")

# build summary
if node_type == "core":
summary = f"Drupal {node_type} - {sa_type} - {sa_name}"
elif sa_type == "Unsupported":
summary = f"{package_name} {node_type} for Drupal is unsupported - {sa_name}"
else:
summary = f"{package_name} {node_type} for Drupal - {sa_type} - {sa_name}"

return summary


def fetch_drupal_packages_available_on_packagist() -> list[str]:
"""
Expand Down Expand Up @@ -431,13 +463,15 @@ def build_osv_advisory(
'id': osv_id,
'modified': unix_timestamp_to_rfc3339(int(sa_advisory['changed'])),
'published': unix_timestamp_to_rfc3339(int(sa_advisory['created'])),
'summary': build_summary(project, sa_advisory),
'aliases': sa_advisory['field_sa_cve'],
'details': markdownify(sa_advisory['field_sa_description']['value']),
'affected': [
{
'package': {
'ecosystem': ecosystem,
'name': composer_package_name,
'purl': f'pkg:composer/{composer_package_name.lower()}'
},
# todo: figure out how to map field_sa_criticality to severity
# https://ossf.github.io/osv-schema/#severitytype-field
Expand Down
Loading