ingest withdrawn status of advisories from GitHub

NuGet · Apr 23, 2021 · dea91d7 · dea91d7
1 parent f627d77
commit dea91d7
Show file tree

Hide file tree

Showing 3 changed files with 4 additions and 0 deletions.
diff --git a/src/GitHubVulnerabilities2Db/Collector/AdvisoryQueryBuilder.cs b/src/GitHubVulnerabilities2Db/Collector/AdvisoryQueryBuilder.cs
@@ -23,6 +23,7 @@ public string CreateSecurityAdvisoriesQuery(DateTimeOffset? updatedSince = null,
         databaseId
         permalink
         severity
+        withdrawnAt
         updatedAt
         " + CreateVulnerabilitiesConnectionQuery() + @"
       }

diff --git a/src/GitHubVulnerabilities2Db/Collector/AdvisoryQueryService.cs b/src/GitHubVulnerabilities2Db/Collector/AdvisoryQueryService.cs
@@ -77,7 +77,9 @@ private SecurityAdvisory MergeAdvisories(SecurityAdvisory advisory, SecurityAdvi
             nextAdvisory.Vulnerabilities.Edges = advisory.Vulnerabilities.Edges.Concat(
                 nextAdvisory.Vulnerabilities.Edges ?? Enumerable.Empty<Edge<SecurityVulnerability>>());
             // We are not querying the advisories feed at this time so we do not want to advance the advisory cursor past what it was originally.
+            // We also want to ensure a withdrawn advisory affects all vulnerabilities it comprises
             nextAdvisory.UpdatedAt = advisory.UpdatedAt;
+            nextAdvisory.WithdrawnAt = advisory.WithdrawnAt;
             return nextAdvisory;
         }
 

diff --git a/tests/GitHubVulnerabilities2Db.Facts/AdvisoryIngestorFacts.cs b/tests/GitHubVulnerabilities2Db.Facts/AdvisoryIngestorFacts.cs
@@ -52,6 +52,7 @@ public async Task IngestsAdvisoryWithoutVulnerability(bool withdrawn)
                         Assert.Equal(advisory.DatabaseId, vulnerability.GitHubDatabaseKey);
                         Assert.Equal(PackageVulnerabilitySeverity.Moderate, vulnerability.Severity);
                         Assert.Equal(advisory.Permalink, vulnerability.AdvisoryUrl);
+                        Assert.Equal(withdrawn, advisory.WithdrawnAt != null);
                     })
                     .Returns(Task.CompletedTask)
                     .Verifiable();