Fix crates.io ecosystem mapping in OSV parsers

vulnerabilities/importers/osv.py

@@ -45,6 +45,8 @@
     "go": "golang",
     "hex": "hex",
     "cargo": "cargo",
+    # In OSV specifications, Rust packages use the "crates.io" ecosystem
+    "crates.io": "cargo",
 }
 
 

vulnerabilities/pipes/osv_v2.py

@@ -49,6 +49,8 @@
     "go": "golang",
     "hex": "hex",
     "cargo": "cargo",
+    # In OSV specifications, Rust packages use the "crates.io" ecosystem
+    "crates.io": "cargo",
 }
 
 OSV_TO_VCIO_SEVERITY_MAP = {

vulnerabilities/tests/test_data/osv_test/github/github-expected-4.json

@@ -2,7 +2,22 @@
   "advisory_id": "GHSA-wjxc-pjx9-4wvm",
   "aliases": [],
   "summary": "Nervos CKB Panic on malformed input\n### Impact\nCKB process will panic when received malformed p2p message because of snappy, which is used to compress network messages\n\n### References\nhttps://github.com/BurntSushi/rust-snappy/issues/29",
-  "affected_packages": [],
+  "affected_packages": [
+    {
+      "package": {
+        "type": "cargo",
+        "namespace": "",
+        "name": "ckb",
+        "version": "",
+        "qualifiers": "",
+        "subpath": ""
+      },
+      "affected_version_range": "vers:cargo/<=0.34.1",
+      "fixed_version_range": "vers:cargo/0.34.2",
+      "introduced_by_commit_patches": [],
+      "fixed_by_commit_patches": []
+    }
+  ],
   "references": [
     {
       "reference_id": "",
@@ -21,4 +36,4 @@
   "date_published": "2024-02-03T00:18:06+00:00",
   "weaknesses": [],
   "url": "https://test.com"
-}
+}

vulnerabilities/tests/test_github_osv.py

@@ -124,3 +124,36 @@ def test_github_osv_importer8(self):
         )
         result = imported_data.to_dict()
         util_tests.check_results_against_json(result, expected_file)
+
+    def test_github_osv_importer_crates_io(self):
+        mock_response = {
+            "id": "GHSA-test-crates-io",
+            "summary": "Sample advisory for crates.io",
+            "modified": "2024-02-03T00:18:06Z",
+            "published": "2024-02-03T00:18:06Z",
+            "affected": [
+                {
+                    "package": {
+                        "ecosystem": "crates.io",
+                        "name": "serde",
+                    },
+                    "ranges": [
+                        {
+                            "type": "ECOSYSTEM",
+                            "events": [
+                                {"introduced": "0"},
+                                {"fixed": "1.0.0"},
+                            ],
+                        }
+                    ],
+                }
+            ],
+        }
+        imported_data = parse_advisory_data(
+            mock_response,
+            supported_ecosystems=["cargo"],
+            advisory_url="https://github.com/advisories/GHSA-test-crates-io",
+        )
+        self.assertEqual(len(imported_data.affected_packages), 1)
+        self.assertEqual(str(imported_data.affected_packages[0].package), "pkg:cargo/serde")
+