Use V2 views

Signed-off-by: Tushar Goel <tushar.goel.dav@gmail.com>

Author: TG1999

vulnerabilities/templates/package_details_v2.html

@@ -136,8 +136,6 @@
                             <thead>
                                 <tr>
                                     <th style="width: 200px;">Advisory</th>
-                                    <th style="width: 310px;">Source</th>
-                                    <th style="width: 200px;">Date Published</th>
                                     <th>Summary</th>
                                     <th style="width: 310px;">Fixed in package version</th>
                                 </tr>
@@ -147,15 +145,15 @@
                                 {% for advisory in affected_by_advisories_v2 %}
                                 <tr>
                                     <td>
-                                        <a href="{{advisory.primary.get_absolute_url}}">
-                                            {{advisory.primary.avid }}
+                                        <a href="{{advisory.advisory.get_absolute_url}}">
+                                            {{advisory.identifier }}
                                         </a>
                                         <br />
-                                        {% if advisory.primary.alias|length != 0 %}
+                                        {% if advisory.aliases|length != 0 %}
                                         Aliases:
                                         {% endif %}
                                         <br />
-                                        {% for alias in advisory.primary.alias %}
+                                        {% for alias in advisory.aliases %}
                                         {% if alias.url %}
                                         <a href="{{ alias.url }}" target="_blank">{{ alias }}<i
                                                 class="fa fa-external-link fa_link_custom"></i></a>
@@ -166,26 +164,12 @@
                                         {% endif %}
                                         {% endfor %}
 
-                                        {% if advisory.secondary|length != 0 %}
-                                    <p>Supporting advisories are listed below the primary advisory.</p>
-                                    {% for secondary in advisory.secondary %}
-                                            <a href="{{secondary.get_absolute_url}}">
-                                                {{secondary.avid }}
-                                            </a>
-                                    {% endfor %}
-                                    {% endif %}
                                     </td>
                                     <td style="word-wrap: break-word; word-break: break-word;">
-                                        <a href={{advisory.primary.url}} target="_blank">{{advisory.primary.url}}</a>
-                                    </td>
-                                    <td style="word-wrap: break-word; word-break: break-word;">
-                                        {{advisory.primary.date_published}}
-                                    </td>
-                                    <td style="word-wrap: break-word; word-break: break-word;">
-                                        {{ advisory.primary.summary }}
+                                        {{ advisory.advisory.summary|truncatewords:20 }}
                                     </td>
                                     <td style="word-wrap: break-word; word-break: break-all;">
-                                        {% with fixed=fixed_package_details|get_item:advisory.primary.avid %}
+                                        {% with fixed=fixed_package_details|get_item:advisory.advisory.avid %}
                                             {% if fixed %}
                                                 {% for item in fixed %}
                                                 <section>
@@ -240,8 +224,6 @@
                             <thead>
                                 <tr>
                                     <th style="width: 200px;">Advisory</th>
-                                    <th style="width: 225px;">Source</th>
-                                    <th style="width: 225px;">Date Published</th>
                                     <th>Summary</th>
                                     <th style="width: 225px;">Aliases</th>
                                 </tr>
@@ -250,30 +232,16 @@
                                 {% for advisory in fixing_advisories_v2 %}
                                 <tr>
                                     <td>
-                                        <a href="{{advisory.primary.get_absolute_url}}">
-                                            {{advisory.primary.avid }}
+                                        <a href="{{advisory.advisory.get_absolute_url}}">
+                                            {{advisory.identifier }}
                                         </a>
                                     <br />
-                                    {% if advisory.secondary|length != 0 %}
-                                    <p>Supporting advisories are listed below the primary advisory.</p>
-                                    {% for secondary in advisory.secondary %}
-                                            <a href="{{secondary.get_absolute_url}}">
-                                                {{secondary.avid }}
-                                            </a>
-                                    {% endfor %}
-                                    {% endif %}
-                                    </td>
-                                    <td>
-                                        <a href={{advisory.primary.url}} target="_blank">{{advisory.primary.url}}</a>
-                                    </td>
-                                    <td>
-                                        {{advisory.primary.date_published}}
                                     </td>
                                     <td>
-                                        {{ advisory.primary.summary }}
+                                        {{ advisory.advisory.summary|truncatewords:20 }}
                                     </td>
                                     <td>
-                                        {% for alias in advisory.primary.alias %}
+                                        {% for alias in advisory.aliases %}
                                         {% if alias.url %}
                                         <a href="{{ alias.url }}" target="_blank">{{ alias }}<i
                                                 class="fa fa-external-link fa_link_custom"></i></a>

vulnerabilities/utils.py

@@ -895,3 +895,103 @@ def compute_advisory_content(advisory_data):
     content_hash = hashlib.sha256(normalized_json.encode("utf-8")).hexdigest()
 
     return content_hash
+
+
+def merge_advisories(advisories, package):
+
+    advisories = list(advisories)
+
+    content_hash_map = defaultdict(list)
+
+    for adv in advisories:
+        content_hash = compute_advisory_content_hash(adv, package)
+        content_hash_map[content_hash].append(adv)
+
+    final_groups = []
+
+    for group in content_hash_map.values():
+        groups = get_merged_identifier_groups(group)
+        final_groups.extend(groups)
+
+    return final_groups
+
+
+def compute_advisory_content_hash(adv, package):
+    affected = []
+    fixed = []
+
+    version_less_purl = PackageURL(
+        type=package.type,
+        namespace=package.namespace,
+        name=package.name,
+        qualifiers=package.qualifiers,
+        subpath=package.subpath,
+    )
+
+    for impact in adv.impacted_packages.filter(base_purl=str(version_less_purl)):
+        affected.extend([pkg.package_url for pkg in impact.affecting_packages.all()])
+        fixed.extend([pkg.package_url for pkg in impact.fixed_by_packages.all()])
+
+    normalized_data = {
+        "affected_packages": normalize_list(affected),
+        "fixed_packages": normalize_list(fixed),
+    }
+
+    normalized_json = json.dumps(normalized_data, separators=(",", ":"), sort_keys=True)
+    content_hash = hashlib.sha256(normalized_json.encode("utf-8")).hexdigest()
+    return content_hash
+
+
+def get_merged_identifier_groups(advisories):
+
+    identifier_groups = defaultdict(set)
+
+    advisories = list(advisories)
+
+    for adv in advisories:
+
+        identifier_groups[adv.advisory_id].add(adv)
+
+        for alias in adv.aliases.values_list("alias", flat=True):
+            identifier_groups[alias].add(adv)
+
+    groups = [set(advs) for advs in identifier_groups.values() if len(advs) > 1]
+
+    merged = []
+
+    for group in groups:
+        group = set(group)
+
+        i = 0
+        while i < len(merged):
+            if group & merged[i]:
+                group |= merged[i]
+                merged.pop(i)
+            else:
+                i += 1
+
+        merged.append(group)
+
+    all_grouped = set()
+    for g in merged:
+        all_grouped |= g
+
+    for adv in advisories:
+        if adv not in all_grouped:
+            merged.append({adv})
+
+    final_groups = []
+
+    for group in merged:
+        identifiers = set()
+        for adv in group:
+            for alias in adv.aliases.all():
+                identifiers.add(alias)
+
+        primary = max(group, key=lambda a: a.precedence if a.precedence is not None else -1)
+
+        secondary = [a for a in group if a != primary]
+
+        final_groups.append((identifiers, primary, secondary))
+
+    return final_groups

vulnerabilities/views.py

@@ -38,13 +38,15 @@
 from vulnerabilities.forms import PipelineSchedulePackageForm
 from vulnerabilities.forms import VulnerabilitySearchForm
 from vulnerabilities.models import AdvisorySetMember
+from vulnerabilities.models import AdvisoryV2
 from vulnerabilities.models import ImpactedPackage
 from vulnerabilities.models import PipelineRun
 from vulnerabilities.models import PipelineSchedule
 from vulnerabilities.pipelines.v2_importers.epss_importer_v2 import EPSSImporterPipeline
 from vulnerabilities.severity_systems import EPSS
 from vulnerabilities.severity_systems import SCORING_SYSTEMS
 from vulnerabilities.utils import group_advisories_by_content
+from vulnerabilities.utils import merge_advisories
 from vulnerablecode import __version__ as VULNERABLECODE_VERSION
 from vulnerablecode.settings import env
 
@@ -218,22 +220,30 @@ def get_context_data(self, **kwargs):
         context["latest_non_vulnerable"] = latest_non_vulnerable
         context["package_search_form"] = PackageSearchForm(self.request.GET)
 
-        affected_by_advisories_qs = models.AdvisoryV2.objects.latest_affecting_advisories_for_purl(
-            package.package_url
+        affecting_advisories = AdvisoryV2.objects.latest_affecting_advisories_for_purl(
+            purl=package.purl
+        ).prefetch_related(
+            "aliases",
+            "impacted_packages__affecting_packages",
+            "impacted_packages__fixed_by_packages",
         )
 
-        fixing_advisories_qs = models.AdvisoryV2.objects.latest_fixed_by_advisories_for_purl(
-            package.package_url
+        fixed_by_advisories = AdvisoryV2.objects.latest_fixed_by_advisories_for_purl(
+            purl=package.purl
+        ).prefetch_related(
+            "aliases",
+            "impacted_packages__affecting_packages",
+            "impacted_packages__fixed_by_packages",
         )
 
         affected_by_advisories_url = None
         fixing_advisories_url = None
 
-        affected_by_advisories_qs_ids = affected_by_advisories_qs.only("id")
-        fixing_advisories_qs_ids = fixing_advisories_qs.only("id")
+        affected_by_advisories_qs_ids = affecting_advisories.only("id")
+        fixing_advisories_qs_ids = fixed_by_advisories.only("id")
 
-        affected_by_advisories = list(affected_by_advisories_qs_ids[:101])
-        if len(affected_by_advisories) > 100:
+        affected_by_advisories = list(affected_by_advisories_qs_ids[:1001])
+        if len(affected_by_advisories) > 1001:
             affected_by_advisories_url = reverse_lazy(
                 "affected_by_advisories_v2", kwargs={"purl": package.package_url}
             )
@@ -242,33 +252,46 @@ def get_context_data(self, **kwargs):
             context["fixed_package_details"] = {}
 
         else:
+            advisories = []
+
             fixed_pkg_details = get_fixed_package_details(package)
-            affected_avid_by_hash = {}
-            affected_avid_by_hash = group_advisories_by_content(affected_by_advisories_qs)
-            affecting_advs = []
+            groups = merge_advisories(affecting_advisories, package)
+            for aliases, primary, _ in groups:
+                identifier = primary.advisory_id.split("/")[-1]
+
+                filtered_aliases = [alias for alias in aliases if alias.alias != identifier]
+
+                advisories.append(
+                    {"aliases": filtered_aliases, "advisory": primary, "identifier": identifier}
+                )
 
-            for hash in affected_avid_by_hash:
-                affecting_advs.append(affected_avid_by_hash[hash])
-            context["affected_by_advisories_v2"] = affecting_advs
+            context["affected_by_advisories_v2"] = advisories
             context["fixed_package_details"] = fixed_pkg_details
             context["affected_by_advisories_v2_url"] = None
 
-        fixing_advisories = list(fixing_advisories_qs_ids[:101])
-        if len(fixing_advisories) > 100:
+        fixing_advisories = list(fixing_advisories_qs_ids[:1001])
+        if len(fixing_advisories) > 1001:
             fixing_advisories_url = reverse_lazy(
                 "fixing_advisories_v2", kwargs={"purl": package.package_url}
             )
             context["fixing_advisories_v2_url"] = fixing_advisories_url
             context["fixing_advisories_v2"] = []
 
         else:
-            fixing_avid_by_hash = {}
-            fixing_avid_by_hash = group_advisories_by_content(fixing_advisories_qs)
-            fixing_advs = []
+            advisories = []
+
+            fixed_pkg_details = get_fixed_package_details(package)
+            groups = merge_advisories(fixing_advisories, package)
+            for aliases, primary, _ in groups:
+                identifier = primary.advisory_id.split("/")[-1]
+
+                filtered_aliases = [alias for alias in aliases if alias.alias != identifier]
+
+                advisories.append(
+                    {"aliases": filtered_aliases, "advisory": primary, "identifier": identifier}
+                )
 
-            for hash in fixing_avid_by_hash:
-                fixing_advs.append(fixing_avid_by_hash[hash])
-            context["fixing_advisories_v2"] = fixing_advs
+            context["fixing_advisories_v2"] = advisories
             context["fixing_advisories_v2_url"] = None
 
         return context

vulnerablecode/urls.py

@@ -142,7 +142,7 @@ def __init__(self, *args, **kwargs):
     ),
     re_path(
         r"^packages/v2/(?P<purl>pkg:.+)$",
-        PackageV3Details.as_view(),
+        PackageV2Details.as_view(),
         name="package_details_v2",
     ),
     re_path(