Add Liferay Importer (Fixes #1410) #2027
Conversation
Signed-off-by: Parth Bhatt <paarthbhatt37@gmail.com>
paarthbhatt
force-pushed
the
add-liferay-importer
branch
from
f427734 to
5bf9f26
Compare
|
@paarthbhatt thank you so much for this PR. https://github.com/aboutcode-org/vulnerablecode/tree/main/vulnerabilities/pipelines/v2_importers We are using these type of importer pipelines now. Can you adjust/migrate your code accordingly. Also see: If you need any help, let us know. Thanks! Also please run the importer on your system once and provide us logs. Thanks! |
Signed-off-by: Parth Bhatt <paarthbhatt37@gmail.com>
paarthbhatt
force-pushed
the
add-liferay-importer
branch
from
7b14215 to
fbb92c0
Compare
|
Hey @TG1999 , thanks for the feedback! I've updated the code to use the new V2 pipeline architecture as requested. I also ran the importer locally to make sure it's working, and it successfully started collecting advisories. Here's a snippet from my local logs: I've also signed off on the commits to fix the DCO check. Let me know if you spot anything else! |
TG1999
left a comment
TG1999
left a comment
There was a problem hiding this comment.
Some reviews for your consideration!
- Implement proper advisories_count with release link caching - Remove redundant CVE ID from aliases field (advisory_id already contains it) - Add URL cleaning comment with example - Update tests to match corrected behavior Signed-off-by: Parth Bhatt <paarthbhatt37@gmail.com>
paarthbhatt
force-pushed
the
add-liferay-importer
branch
from
8b6d066 to
cbceb88
Compare
|
Hey @TG1999, Sorry about those errors - you're absolutely right. I rushed through the initial implementation and didn't properly review the code before submitting. I've fixed all three issues now and pushed the changes. Tests are passing. Thanks for catching these and for your patience! |
|
Hi @TG1999, I'm facing bit of a problem here. My importer is working - it's successfully scraping and storing 59 advisories with CVE IDs, descriptions, severities, and references. The issue is just that the affected package version information isn't being converted to PackageV2 objects due to the version range format issue. |
2 participants
Fixes #1410
Hey, this PR adds a new importer for Liferay security advisories. It crawls the Liferay security page to fetch CVEs, severity scores, and affected versions.
I've also added tests to verify the parsing logic. Let me know if anything needs changing!