map Snyk publication time

Signed-off-by: sahibamittal <sahiba.mittal@citi.com>
sahibamittal · Mar 27, 2023 · 09ee0b0 · 09ee0b0
1 parent 09d3492
commit 09ee0b0
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 2 deletions.
diff --git a/src/main/java/org/dependencytrack/parser/snyk/SnykParser.java b/src/main/java/org/dependencytrack/parser/snyk/SnykParser.java
@@ -59,8 +59,14 @@ public Vulnerability parse(JSONArray data, QueryManager qm, String purl, int cou
         if (vulnAttributes != null && vulnAttributes.optString("type").equalsIgnoreCase("package_vulnerability")) {
             // get the references of the data record (vulnerability)
             final JSONObject slots = vulnAttributes.optJSONObject("slots");
-            if (slots != null && slots.optJSONArray("references") != null) {
-                vulnerability.setReferences(addReferences(slots));
+            if (slots != null) {
+                var publishedTime = jsonStringToTimestamp(slots.optString("publication_time"));
+                if (publishedTime != null) {
+                    vulnerability.setPublished(Date.from(publishedTime.toInstant()));
+                }
+                if (slots.optJSONArray("references") != null) {
+                    vulnerability.setReferences(addReferences(slots));
+                }
             }
             vulnerability.setTitle(vulnAttributes.optString("title", null));
             vulnerability.setDescription(vulnAttributes.optString("description", null));

diff --git a/src/test/java/org/dependencytrack/tasks/scanners/SnykAnalysisTaskTest.java b/src/test/java/org/dependencytrack/tasks/scanners/SnykAnalysisTaskTest.java
@@ -302,6 +302,7 @@ public void testAnalyzeWithRateLimiting() {
         assertThat(vulnerability.getSeverity()).isEqualTo(Severity.HIGH);
         assertThat(vulnerability.getCreated()).isInSameDayAs("2022-10-31");
         assertThat(vulnerability.getUpdated()).isInSameDayAs("2022-11-26");
+        assertThat(vulnerability.getPublished()).isInSameDayAs("2022-10-31");
         assertThat(vulnerability.getRecommendation()).contains("Upgrade the package version to 5.0.4,6.0.4 to fix this vulnerability");
         assertThat(vulnerability.getAliases()).satisfiesExactly(
                 alias -> {