From 70949f9bb09771ea3a7da6ff3c2953a405c6acc2 Mon Sep 17 00:00:00 2001
From: chauhanshiv1711-dot <chauhanshiv1711@gmail.com>
Date: Thu, 12 Nov 2026 21:29:49 +0530
Subject: [PATCH 1/2] Map crates.io ecosystem to cargo in OSV parsers

Signed-off-by: chauhanshiv1711-dot <chauhanshiv1711@gmail.com>
---
 vulnerabilities/importers/osv.py         |  1 +
 vulnerabilities/pipes/osv_v2.py          |  1 +
 vulnerabilities/tests/test_github_osv.py | 33 ++++++++++++++++++++++++
 3 files changed, 35 insertions(+)

diff --git a/vulnerabilities/importers/osv.py b/vulnerabilities/importers/osv.py
index 3658c57b3..c1d5968a8 100644
--- a/vulnerabilities/importers/osv.py
+++ b/vulnerabilities/importers/osv.py
@@ -45,6 +45,7 @@
     "go": "golang",
     "hex": "hex",
     "cargo": "cargo",
+    "crates.io": "cargo",
 }
 
 
diff --git a/vulnerabilities/pipes/osv_v2.py b/vulnerabilities/pipes/osv_v2.py
index 4b8ce47c7..265775895 100644
--- a/vulnerabilities/pipes/osv_v2.py
+++ b/vulnerabilities/pipes/osv_v2.py
@@ -49,6 +49,7 @@
     "go": "golang",
     "hex": "hex",
     "cargo": "cargo",
+    "crates.io": "cargo",
 }
 
 OSV_TO_VCIO_SEVERITY_MAP = {
diff --git a/vulnerabilities/tests/test_github_osv.py b/vulnerabilities/tests/test_github_osv.py
index 081cfa0e1..d9a20a083 100644
--- a/vulnerabilities/tests/test_github_osv.py
+++ b/vulnerabilities/tests/test_github_osv.py
@@ -124,3 +124,36 @@ def test_github_osv_importer8(self):
         )
         result = imported_data.to_dict()
         util_tests.check_results_against_json(result, expected_file)
+
+    def test_github_osv_importer_crates_io(self):
+        mock_response = {
+            "id": "GHSA-test-crates-io",
+            "summary": "Sample advisory for crates.io",
+            "modified": "2024-02-03T00:18:06Z",
+            "published": "2024-02-03T00:18:06Z",
+            "affected": [
+                {
+                    "package": {
+                        "ecosystem": "crates.io",
+                        "name": "serde",
+                    },
+                    "ranges": [
+                        {
+                            "type": "ECOSYSTEM",
+                            "events": [
+                                {"introduced": "0"},
+                                {"fixed": "1.0.0"},
+                            ],
+                        }
+                    ],
+                }
+            ],
+        }
+        imported_data = parse_advisory_data(
+            mock_response,
+            supported_ecosystems=["cargo"],
+            advisory_url="https://github.com/advisories/GHSA-test-crates-io",
+        )
+        self.assertEqual(len(imported_data.affected_packages), 1)
+        self.assertEqual(str(imported_data.affected_packages[0].package), "pkg:cargo/serde")
+

From e1ce721bae978e4ba7c74d8107bfaee7c281dc37 Mon Sep 17 00:00:00 2001
From: chauhanshiv1711-dot <chauhanshiv1711@gmail.com>
Date: Thu, 12 Nov 2026 21:55:52 +0530
Subject: [PATCH 2/2] Update OSV v2 expected test data for crates.io and add
 comments

Signed-off-by: chauhanshiv1711-dot <chauhanshiv1711@gmail.com>
---
 vulnerabilities/importers/osv.py              |  1 +
 vulnerabilities/pipes/osv_v2.py               |  1 +
 .../osv_test/github/github-expected-4.json    | 19 +++++++++++++++++--
 3 files changed, 19 insertions(+), 2 deletions(-)

diff --git a/vulnerabilities/importers/osv.py b/vulnerabilities/importers/osv.py
index c1d5968a8..7beb1b0f1 100644
--- a/vulnerabilities/importers/osv.py
+++ b/vulnerabilities/importers/osv.py
@@ -45,6 +45,7 @@
     "go": "golang",
     "hex": "hex",
     "cargo": "cargo",
+    # In OSV specifications, Rust packages use the "crates.io" ecosystem
     "crates.io": "cargo",
 }
 
diff --git a/vulnerabilities/pipes/osv_v2.py b/vulnerabilities/pipes/osv_v2.py
index 265775895..3ef7f61ad 100644
--- a/vulnerabilities/pipes/osv_v2.py
+++ b/vulnerabilities/pipes/osv_v2.py
@@ -49,6 +49,7 @@
     "go": "golang",
     "hex": "hex",
     "cargo": "cargo",
+    # In OSV specifications, Rust packages use the "crates.io" ecosystem
     "crates.io": "cargo",
 }
 
diff --git a/vulnerabilities/tests/test_data/osv_test/github/github-expected-4.json b/vulnerabilities/tests/test_data/osv_test/github/github-expected-4.json
index bb5d4d5ab..41b9b498d 100644
--- a/vulnerabilities/tests/test_data/osv_test/github/github-expected-4.json
+++ b/vulnerabilities/tests/test_data/osv_test/github/github-expected-4.json
@@ -2,7 +2,22 @@
   "advisory_id": "GHSA-wjxc-pjx9-4wvm",
   "aliases": [],
   "summary": "Nervos CKB Panic on malformed input\n### Impact\nCKB process will panic when received malformed p2p message because of snappy, which is used to compress network messages\n\n### References\nhttps://github.com/BurntSushi/rust-snappy/issues/29",
-  "affected_packages": [],
+  "affected_packages": [
+    {
+      "package": {
+        "type": "cargo",
+        "namespace": "",
+        "name": "ckb",
+        "version": "",
+        "qualifiers": "",
+        "subpath": ""
+      },
+      "affected_version_range": "vers:cargo/<=0.34.1",
+      "fixed_version_range": "vers:cargo/0.34.2",
+      "introduced_by_commit_patches": [],
+      "fixed_by_commit_patches": []
+    }
+  ],
   "references": [
     {
       "reference_id": "",
@@ -21,4 +36,4 @@
   "date_published": "2024-02-03T00:18:06+00:00",
   "weaknesses": [],
   "url": "https://test.com"
-}
\ No newline at end of file
+}