diff --git a/vulnerabilities/importers/npm.py b/vulnerabilities/importers/npm.py index 71d64b6ab..89952d6b0 100644 --- a/vulnerabilities/importers/npm.py +++ b/vulnerabilities/importers/npm.py @@ -106,14 +106,6 @@ def to_advisory_data(self, file: Path) -> List[AdvisoryData]: aliases=[alias], ) - if not advsisory_aliases: - yield AdvisoryData( - summary=build_description(summary=summary, description=description), - references=references, - date_published=date_published, - affected_packages=affected_packages, - ) - def get_affected_package(self, data, package_name): vulnerable_range = data.get("vulnerable_versions") or "" diff --git a/vulnerabilities/tests/test_npm.py b/vulnerabilities/tests/test_npm.py index 2750f38c5..afd72181b 100644 --- a/vulnerabilities/tests/test_npm.py +++ b/vulnerabilities/tests/test_npm.py @@ -10,8 +10,15 @@ import os +from packageurl import PackageURL +from univers.version_constraint import VersionConstraint +from univers.version_range import NpmVersionRange +from univers.versions import SemverVersion + +from vulnerabilities.importer import AffectedPackage from vulnerabilities.importers.npm import NpmImporter from vulnerabilities.tests import util_tests +from vulnerabilities.utils import load_json BASE_DIR = os.path.dirname(os.path.abspath(__file__)) TEST_DATA = os.path.join(BASE_DIR, "test_data/") @@ -22,3 +29,17 @@ def test_npm_importer(): result = [adv.to_dict() for adv in NpmImporter().to_advisory_data(file=file)] expected_file = os.path.join(TEST_DATA, f"parse-advisory-npm-expected.json") util_tests.check_results_against_json(result, expected_file) + + +def test_get_affected_package(): + file = os.path.join(TEST_DATA, "npm_sample.json") + data = load_json(file) + assert AffectedPackage( + package=PackageURL( + type="npm", namespace=None, name="npm", version=None, qualifiers={}, subpath=None + ), + affected_version_range=NpmVersionRange( + constraints=(VersionConstraint(comparator="<", version=SemverVersion(string="1.3.3")),) + ), + fixed_version=SemverVersion(string="1.3.3"), + ) == NpmImporter().get_affected_package(data, "npm")